docs: publish drag regressions and small-diagram CPU measurements

Import unchanged from b8685416f56e53e30bd11ecf93a54cea10ac8458; Git blob f641989214. Required by oa-core/tests/attachment_workshop.rs.

PROJECT_GOAL.md

@@ -17,14 +17,14 @@ Apply these criteria to the scope requested by the user:
 - Consequential decisions have evidence and rationale. Major assumptions have been validated, explicitly accepted, or isolated without compromising required behavior.
 - The result builds, runs, and operates on the required platforms. Relevant tests and evaluators pass; integrations, edge cases, and failure states have been exercised against the actual result.
 - User-facing behavior and usability have been exercised directly, using representative data and workflows.
-- A fresh independent review covers requirements, domain/semantic consistency, usability, architecture, correctness, regressions, runtime behavior, documentation, and remaining risks. Valid material findings are addressed, blocking and high-impact issues resolved, and affected behavior reverified; no known blocker or high-severity defect remains.
+- A fresh independent review covers requirements, domain / semantic consistency, usability, architecture, correctness, regressions, runtime behavior, documentation, and remaining risks. Valid material findings are addressed, blocking and high-impact issues resolved, and affected behavior reverified; no known blocker or high-severity defect remains.
 - Deliverables are maintainable, appropriately extensible, documented, and published as required by `AGENTS.md`. Obsolete scaffolding is removed; documentation and shared state accurately describe the result. Another engineer or agent can reproduce the verification and continue the work.
 
 If required work or verification is blocked, record the specific gap and continue independent useful work without claiming completion.
 
 ## Final handoff
 
-Link the delivered result and summarize capabilities, discoveries, architecture and decisions, relevant rejected approaches, verification and independent review, remaining limitations, and exact build/run/deployment/verification instructions. Refer to authoritative records instead of repeating the project history.
+Link the delivered result and summarize capabilities, discoveries, architecture and decisions, relevant rejected approaches, verification and independent review, remaining limitations, and exact build / run / deployment / verification instructions. Refer to authoritative records instead of repeating the project history.
 
 ## USER-OWNED APPLICATION SPECIFICATION
 

crates/oa-core/examples/allocation_multiselect_native.rs

@@ -0,0 +1,768 @@
+//! Deterministic native fixture and literal complete-Project Allocation oracle.
+//! No desktop planner, inferred output delta, or GUI input is used by this oracle.
+use oa_core::{source_project::*, *};
+use std::{collections::BTreeMap, fs, io::Write, path::Path};
+type Result<T> = std::result::Result<T, Box<dyn std::error::Error>>;
+const MODES: [&str; 6] = [
+    "unchanged",
+    "oa-assigned",
+    "sa-assigned",
+    "oa-arranged",
+    "sa-arranged",
+    "oa-performers",
+];
+
+fn id(alias: &str) -> Id {
+    if alias == "oa_assign" {
+        return Id::from_u128(0x292609230001);
+    }
+    Id::new_v5(
+        &Id::from_u128(0xc1192026_0923_5000_8000_000000002931),
+        alias.as_bytes(),
+    )
+}
+fn xy(x: f32, y: f32) -> Position {
+    Position { x, y }
+}
+fn named(scope: &str, suffix: &str) -> String {
+    format!("{scope}_{suffix}")
+}
+fn need(ok: bool, message: impl Into<String>) -> Result<()> {
+    if ok {
+        Ok(())
+    } else {
+        Err(message.into().into())
+    }
+}
+fn element(p: &mut Project, alias: &str, name: &str, kind: Kind, layer: Layer) {
+    p.elements.insert(
+        id(alias),
+        Element {
+            id: id(alias),
+            alias: alias.into(),
+            name: name.into(),
+            description: format!("Preserve engineering record {alias}."),
+            parent: None,
+            body: ElementBody::new(kind, layer).unwrap(),
+        },
+    );
+}
+fn diagram(p: &mut Project, alias: &str, name: &str, layer: Layer, projection: ProjectionKind) {
+    p.diagrams.insert(
+        id(alias),
+        Diagram {
+            id: id(alias),
+            alias: alias.into(),
+            name: name.into(),
+            description: "Native group fixture; preserve unrelated records exactly.".into(),
+            layer,
+            projection,
+            layout: None,
+            view_options: Default::default(),
+            nodes: Default::default(),
+            routes: vec![],
+        },
+    );
+}
+fn place(p: &mut Project, scope: &str, suffix: &str, position: Position) {
+    let alias = named(scope, &format!("node_{suffix}"));
+    p.diagrams.get_mut(&id(scope)).unwrap().nodes.insert(
+        id(&alias),
+        NodePlacement {
+            id: id(&alias),
+            alias,
+            element: id(&named(scope, suffix)),
+            position,
+            size: Size {
+                width: 224.,
+                height: 94.,
+            },
+            collapsed: false,
+            port_anchors: vec![],
+        },
+    );
+}
+fn relation(
+    p: &mut Project,
+    scope: &str,
+    suffix: &str,
+    kind: RelationKind,
+    from: &str,
+    to: &str,
+) -> Result<()> {
+    let alias = named(scope, suffix);
+    let old = p.relate(
+        kind,
+        &format!("{scope} {suffix}"),
+        id(&named(scope, from)),
+        id(&named(scope, to)),
+    );
+    reidentify(p, old, id(&alias))?;
+    let r = p.relations.get_mut(&id(&alias)).unwrap();
+    r.alias = alias.clone();
+    r.description = format!("Reviewed identity and provenance {alias} must survive.");
+    // The actual constructor creates proper SA function contracts. Normalize
+    // every generated identity/alias; no random UUID can leak into the fixture.
+    let ports = match r.body {
+        RelationBody::FunctionalExchange {
+            source_port,
+            target_port,
+            ..
+        } => Some([source_port, target_port]),
+        _ => None,
+    };
+    if let Some(ports) = ports {
+        for (old_port, suffix) in ports.into_iter().zip(["output", "input"]) {
+            let alias = format!("{alias}_{suffix}");
+            reidentify(p, old_port, id(&alias))?;
+            let port = p.elements.get_mut(&id(&alias)).unwrap();
+            port.alias = alias.clone();
+            port.name = format!("{scope} {suffix}");
+            port.description = format!("Preserved typed endpoint {alias}.");
+        }
+    }
+    Ok(())
+}
+fn route(scope: &str, pins: [Position; 2]) -> EdgeRoute {
+    EdgeRoute {
+        edge: id(&named(scope, "exchange")),
+        waypoints: pins.to_vec(),
+        source_attachment: None,
+        target_attachment: None,
+        label: Some(EdgeLabel {
+            fraction: 0.45,
+            offset: xy(7., -19.),
+        }),
+    }
+}
+fn fixture() -> Result<Project> {
+    let mut p = Project::empty();
+    p.id = id("project");
+    p.alias = "allocation_multiselect_native".into();
+    p.name = "Allocation group native".into();
+    p.description = "Four independent compact OA/SA assignment and Arrange trials; ordinary performers use fresh OA assign baseline.".into();
+    for (layer, prefix, work, performer) in [
+        (Layer::Oa, "oa", Kind::Activity, Kind::Entity),
+        (Layer::Sa, "sa", Kind::Function, Kind::SystemActor),
+    ] {
+        for arrange in [false, true] {
+            let scope = format!("{prefix}_{}", if arrange { "arrange" } else { "assign" });
+            let number = match (prefix, arrange) {
+                ("oa", false) => "01",
+                ("sa", false) => "02",
+                ("oa", true) => "03",
+                _ => "04",
+            };
+            diagram(
+                &mut p,
+                &scope,
+                &format!(
+                    "{number} {} {}",
+                    prefix.to_uppercase(),
+                    if arrange { "arrange" } else { "assign" }
+                ),
+                layer,
+                ProjectionKind::Allocation,
+            );
+            let records: Vec<_> = if arrange {
+                vec![
+                    ("p", "P - team", performer, xy(40., 40.)),
+                    ("u", "U - contained work", work, xy(80., 140.)),
+                    ("v", "V - independent work", work, xy(440., 140.)),
+                ]
+            } else {
+                vec![
+                    ("a", "A - origin team", performer, xy(43., 47.)),
+                    // Leave room for SA Y's automatic top port stub below
+                    // B's 64-unit header plus 12-unit routing clearance.
+                    ("b", "B - other team", performer, xy(43., 337.)),
+                    ("c", "C - destination", performer, xy(500., 40.)),
+                    ("x", "X - receive", work, xy(80., 140.)),
+                    ("y", "Y - assess", work, xy(80., 440.)),
+                ]
+            };
+            for (suffix, label, kind, pos) in records {
+                // SA admits one System for the entire project, not one per view.
+                let kind = if layer == Layer::Sa && !arrange && suffix == "a" {
+                    Kind::System
+                } else {
+                    kind
+                };
+                element(&mut p, &named(&scope, suffix), label, kind, layer);
+                place(&mut p, &scope, suffix, pos);
+            }
+            let (from, to, pins) = if arrange {
+                relation(&mut p, &scope, "pu", RelationKind::Allocation, "p", "u")?;
+                ("u", "v", [xy(360., 180.), xy(360., 230.)])
+            } else {
+                p.diagrams
+                    .get_mut(&id(&scope))
+                    .unwrap()
+                    .nodes
+                    .get_mut(&id(&named(&scope, "node_c")))
+                    .unwrap()
+                    .size = Size {
+                    width: 360.,
+                    height: 600.,
+                };
+                relation(&mut p, &scope, "ax", RelationKind::Allocation, "a", "x")?;
+                relation(&mut p, &scope, "by", RelationKind::Allocation, "b", "y")?;
+                ("x", "y", [xy(340., 260.), xy(340., 400.)])
+            };
+            relation(
+                &mut p,
+                &scope,
+                "exchange",
+                if layer == Layer::Oa {
+                    RelationKind::Interaction
+                } else {
+                    RelationKind::FunctionalExchange
+                },
+                from,
+                to,
+            )?;
+            p.diagrams
+                .get_mut(&id(&scope))
+                .unwrap()
+                .routes
+                .push(route(&scope, pins));
+        }
+    }
+    diagram(
+        &mut p,
+        "other_view",
+        "05 Other saved view - preserve",
+        Layer::Oa,
+        ProjectionKind::Overview,
+    );
+    for (suffix, pos) in [("x", xy(40., 60.)), ("y", xy(410., 180.))] {
+        let alias = named("other_view", suffix);
+        p.diagrams.get_mut(&id("other_view")).unwrap().nodes.insert(
+            id(&alias),
+            NodePlacement {
+                id: id(&alias),
+                alias,
+                element: id(&named("oa_assign", suffix)),
+                position: pos,
+                size: Size {
+                    width: 224.,
+                    height: 94.,
+                },
+                collapsed: false,
+                port_anchors: vec![],
+            },
+        );
+    }
+    validate_candidate(&p)?;
+    Ok(p)
+}
+fn node_mut<'a>(p: &'a mut Project, scope: &str, suffix: &str) -> &'a mut NodePlacement {
+    p.diagrams
+        .get_mut(&id(scope))
+        .unwrap()
+        .nodes
+        .get_mut(&id(&named(scope, &format!("node_{suffix}"))))
+        .unwrap()
+}
+fn expected(before: &Project, mode: &str) -> Result<Project> {
+    let mut p = before.clone();
+    match mode {
+        "unchanged" => {}
+        "oa-assigned" | "sa-assigned" => {
+            let scope = if mode == "oa-assigned" {
+                "oa_assign"
+            } else {
+                "sa_assign"
+            };
+            for (rel, work) in [("ax", "x"), ("by", "y")] {
+                p.relations.get_mut(&id(&named(scope, rel))).unwrap().body =
+                    RelationBody::Allocation {
+                        source: id(&named(scope, "c")),
+                        target: id(&named(scope, work)),
+                    };
+            }
+            node_mut(&mut p, scope, "x").position = xy(560., 140.);
+            node_mut(&mut p, scope, "y").position = xy(560., 440.);
+            p.diagrams.get_mut(&id(scope)).unwrap().routes[0].waypoints =
+                vec![xy(820., 260.), xy(820., 400.)];
+        }
+        "oa-arranged" | "sa-arranged" => {
+            let scope = if mode == "oa-arranged" {
+                "oa_arrange"
+            } else {
+                "sa_arrange"
+            };
+            for (suffix, pos) in [
+                ("p", xy(40., 280.)),
+                ("u", xy(80., 380.)),
+                ("v", xy(440., 380.)),
+            ] {
+                node_mut(&mut p, scope, suffix).position = pos;
+            }
+            p.diagrams.get_mut(&id(scope)).unwrap().routes[0].waypoints =
+                vec![xy(360., 420.), xy(360., 470.)];
+        }
+        "oa-performers" => {
+            for (suffix, pos) in [
+                ("a", xy(120., 90.)),
+                ("b", xy(120., 380.)),
+                ("x", xy(157., 183.)),
+                ("y", xy(157., 483.)),
+            ] {
+                node_mut(&mut p, "oa_assign", suffix).position = pos;
+            }
+            p.diagrams.get_mut(&id("oa_assign")).unwrap().routes[0].waypoints =
+                vec![xy(417., 303.), xy(417., 443.)];
+        }
+        _ => return Err(format!("Unknown mode {mode}; expected {MODES:?}").into()),
+    }
+    Ok(p)
+}
+fn ancestor(view: &projection::ProjectedView, parent: Id, child: Id) -> bool {
+    let mut next = view
+        .nodes
+        .iter()
+        .find(|n| n.id == child)
+        .and_then(|n| n.visual_parent);
+    for _ in 0..view.nodes.len() {
+        let Some(current) = next else {
+            return false;
+        };
+        if current == parent {
+            return true;
+        }
+        next = view
+            .nodes
+            .iter()
+            .find(|n| n.id == current)
+            .and_then(|n| n.visual_parent);
+    }
+    false
+}
+/// Fixture-usability preflight only: never calculates expected mutations.
+fn preflight(p: &Project) -> Result<serde_json::Value> {
+    validate_candidate(p)?;
+    let mut scenes = Vec::new();
+    for scope in ["oa_assign", "sa_assign", "oa_arrange", "sa_arrange"] {
+        let d = &p.diagrams[&id(scope)];
+        let view = projection::project_view(p, d.id);
+        need(
+            view.nodes.len() == d.nodes.len(),
+            format!("{scope}: hidden/missing fixture placement"),
+        )?;
+        for n in &view.nodes {
+            need(
+                n.position == d.nodes[&n.id].position,
+                format!("{scope}: unexpectedly shifted projected origin {}", n.id),
+            )?;
+            need(
+                n.position.x >= 0.
+                    && n.position.y >= 0.
+                    && n.position.x + n.size.width <= 900.
+                    && n.position.y + n.size.height <= 750.,
+                format!("{scope}: fixture exceeds declared compact world envelope: {n:?}"),
+            )?;
+            if p.elements[&n.element].kind().is_work() {
+                let height = if d.layer == Layer::Sa { 132. } else { 94. };
+                need(
+                    n.size
+                        == Size {
+                            width: 224.,
+                            height,
+                        },
+                    format!("{scope}: unexpected work/port extent {n:?}"),
+                )?;
+            }
+        }
+        for (i, a) in view.nodes.iter().enumerate() {
+            for b in &view.nodes[i + 1..] {
+                if ancestor(&view, a.id, b.id) || ancestor(&view, b.id, a.id) {
+                    continue;
+                }
+                let width = (a.position.x + a.size.width).min(b.position.x + b.size.width)
+                    - a.position.x.max(b.position.x);
+                let height = (a.position.y + a.size.height).min(b.position.y + b.size.height)
+                    - a.position.y.max(b.position.y);
+                need(
+                    width <= 0. || height <= 0.,
+                    format!("{scope}: unrelated projected overlap {} {}", a.id, b.id),
+                )?;
+            }
+        }
+        let routed = routing::route_diagram(p, d, &view);
+        let edge = id(&named(scope, "exchange"));
+        let r = routed
+            .edges
+            .get(&edge)
+            .ok_or("Authored exchange route is missing")?;
+        need(
+            !r.custom_suspended && r.pins == d.routes[0].waypoints,
+            format!("{scope}: authored pins are not active"),
+        )?;
+        need(
+            r.warnings.is_empty(),
+            format!(
+                "{scope}: route warnings require fixture review: {:?}; ports={:?}; points={:?}; nodes={:?}",
+                r.warnings, view.ports, r.points, view.nodes
+            ),
+        )?;
+        need(
+            view.ports.len() == if d.layer == Layer::Sa { 2 } else { 0 },
+            format!("{scope}: unexpected visible typed ports"),
+        )?;
+        scenes.push(serde_json::json!({"diagram":scope,"nodes":view.nodes,"ports":view.ports,"active_pins":r.pins,"route_warnings":r.warnings.iter().map(ToString::to_string).collect::<Vec<_>>()}));
+    }
+    Ok(serde_json::json!(scenes))
+}
+fn load(path: &Path) -> Result<Project> {
+    if path
+        .extension()
+        .is_some_and(|ext| ext.eq_ignore_ascii_case("arcadia"))
+    {
+        let disk = source_files::load_project(path, ProjectLimits::default())?;
+        need(
+            !disk
+                .diagnostics
+                .iter()
+                .any(|d| d.diagnostic.severity == validation::Severity::Error),
+            format!("Source discovery errors: {:?}", disk.diagnostics),
+        )?;
+        let compiled = compile_bundle(&disk.reachable_bundle(), ProjectLimits::default())
+            .map_err(|e| format!("Source compile: {e:?}"))?;
+        Ok(compiled.decoded.project)
+    } else {
+        Ok(persistence::load(path)?)
+    }
+}
+fn equal(expected: &Project, actual: &Project) -> Result<()> {
+    if expected == actual {
+        return Ok(());
+    }
+    let e = serde_json::to_value(expected)?;
+    let a = serde_json::to_value(actual)?;
+    let fields: Vec<_> = e
+        .as_object()
+        .unwrap()
+        .keys()
+        .filter(|key| e[*key] != a[*key])
+        .cloned()
+        .collect();
+    Err(format!("Whole Project mismatch in {fields:?}; no partial PASS").into())
+}
+fn roundtrip(p: &Project) -> Result<SourceBundle> {
+    validate_candidate(p)?;
+    equal(p, &persistence::decode(&serde_json::to_vec(p)?)?)?;
+    let mut bundle = format_bundle(p);
+    for (path, text) in &mut bundle.files {
+        *text = format!("// Native preservation sentinel: {path}\n{text}");
+    }
+    let parsed = compile_bundle(&bundle, ProjectLimits::default())
+        .map_err(|e| format!("Source roundtrip: {e:?}"))?;
+    equal(p, &parsed.decoded.project)?;
+    Ok(bundle)
+}
+fn write_new(path: &Path, bytes: &[u8]) -> Result<()> {
+    fs::create_dir_all(path.parent().ok_or("Missing parent directory")?)?;
+    fs::OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .open(path)?
+        .write_all(bytes)?;
+    Ok(())
+}
+fn generate(out: &Path) -> Result<()> {
+    need(!out.exists(), "Output exists; choose a fresh directory")?;
+    let p = fixture()?;
+    let bundle = roundtrip(&p)?;
+    let mut geometry = BTreeMap::new();
+    // All literal candidates must satisfy the same compact-fixture prerequisites
+    // before any bytes are published for a native run.
+    for mode in MODES {
+        let candidate = expected(&p, mode)?;
+        roundtrip(&candidate)?;
+        geometry.insert(mode, preflight(&candidate)?);
+    }
+    let mut ids = BTreeMap::from([(p.alias.clone(), p.id)]);
+    ids.extend(p.elements.values().map(|v| (v.alias.clone(), v.id)));
+    ids.extend(p.relations.values().map(|v| (v.alias.clone(), v.id)));
+    ids.extend(p.diagrams.values().map(|v| (v.alias.clone(), v.id)));
+    ids.extend(
+        p.diagrams
+            .values()
+            .flat_map(|d| d.nodes.values().map(|v| (v.alias.clone(), v.id))),
+    );
+    write_new(&out.join("baseline.json"), &serde_json::to_vec_pretty(&p)?)?;
+    for (path, text) in &bundle.files {
+        write_new(&out.join("source").join(path), text.as_bytes())?;
+    }
+    let paths: BTreeMap<_, _> = ids
+        .iter()
+        .map(|(alias, id)| {
+            let needle = id.to_string();
+            let files: Vec<_> = bundle
+                .files
+                .iter()
+                .filter(|(_, text)| text.contains(&needle))
+                .map(|(path, _)| path.clone())
+                .collect();
+            (alias.clone(), files)
+        })
+        .collect();
+    write_new(
+        &out.join("manifest.json"),
+        &serde_json::to_vec_pretty(&serde_json::json!({
+            "fixture":"allocation-multiselect-native-20260923","source_entry":bundle.entry,"ids":ids,
+            "source_files":bundle.files.keys().collect::<Vec<_>>(),"id_text_occurrence_files":paths,
+            "modes":MODES,"geometry_preflight":geometry,
+            "literal_deltas":{"oa-assigned":[480,0],"sa-assigned":[480,0],"oa-arranged":[0,240],"sa-arranged":[0,240],"oa-performers":[77,43]},
+            "selection":{"assigned":["X","Y"],"arranged":["P","V"],"ordinary_performers":["A","B"]},
+            "ordinary_anchor_target":[120,90],
+            "evaluation":"Literal complete Project oracle, never inferred from saved geometry; baseline pinned to deterministic original",
+            "limits":"Geometry preflight is not GUI/planner admission. Source comments/history bytes, focus, exact selection, pointer delivery and one Undo/Redo require separate observation/checks. Each mode is one operation from baseline."
+        }))?,
+    )?;
+    equal(&p, &load(&out.join("baseline.json"))?)?;
+    equal(&p, &load(&out.join("source").join(&bundle.entry))?)?;
+    println!("PASS generated and reloaded fixture: {}", out.display());
+    Ok(())
+}
+fn check(mode: &str, baseline: &Path, saved: &Path) -> Result<()> {
+    let before = load(baseline)?;
+    equal(&fixture()?, &before).map_err(|e| format!("Baseline is not immutable original: {e}"))?;
+    let actual = load(saved)?;
+    validate_candidate(&actual)?;
+    equal(&expected(&before, mode)?, &actual)?;
+    roundtrip(&actual)?;
+    println!(
+        "{}",
+        serde_json::to_string_pretty(&serde_json::json!({
+            "result":"PASS","mode":mode,"baseline":baseline,"saved":saved,
+            "comparison":"complete Project equality; literal fixed record edits",
+            "limits":"No pointer, selection, source-byte preservation, focus, Undo/Redo, or native acceptance claim"
+        }))?
+    );
+    Ok(())
+}
+fn main() -> Result<()> {
+    let args: Vec<_> = std::env::args().skip(1).collect();
+    match args.as_slice() {
+        [command,out] if command=="generate" => generate(Path::new(out)),
+        [command,mode,baseline,saved] if command=="check" => check(mode,Path::new(baseline),Path::new(saved)),
+        _=>Err(format!("Usage: allocation_multiselect_native generate DIRECTORY | check MODE BASELINE SAVED; modes={MODES:?}").into()),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    fn through_json(mode: &str, before: &Project, actual: &Project) -> Result<()> {
+        validate_candidate(before).expect("baseline valid");
+        validate_candidate(actual).expect("falsifier must remain core-valid");
+        let dir = tempfile::tempdir()?;
+        let baseline = dir.path().join("baseline.json");
+        let saved = dir.path().join("saved.json");
+        persistence::save(&baseline, before)?;
+        persistence::save(&saved, actual)?;
+        check(mode, &baseline, &saved)
+    }
+    fn mismatch(mode: &str, before: &Project, actual: &Project) {
+        let error = through_json(mode, before, actual).unwrap_err().to_string();
+        assert!(
+            error.contains("Whole Project mismatch"),
+            "wrong failure cause: {error}"
+        );
+    }
+    #[test]
+    fn deterministic_create_only_generation_and_all_literal_modes() {
+        let p = fixture().unwrap();
+        assert_eq!(p, fixture().unwrap());
+        let dir = tempfile::tempdir().unwrap();
+        let out = dir.path().join("fixture");
+        generate(&out).unwrap();
+        let before = fs::read(out.join("baseline.json")).unwrap();
+        assert!(generate(&out).is_err());
+        assert_eq!(before, fs::read(out.join("baseline.json")).unwrap());
+        for mode in MODES {
+            let candidate = expected(&p, mode).unwrap();
+            preflight(&candidate).unwrap();
+            through_json(mode, &p, &candidate).unwrap();
+            if mode != "unchanged" {
+                mismatch(mode, &p, &p);
+            }
+        }
+        assert!(expected(&p, "invented").is_err());
+        let changed = expected(&p, "oa-assigned").unwrap();
+        assert!(
+            through_json("unchanged", &changed, &changed)
+                .unwrap_err()
+                .to_string()
+                .contains("immutable original")
+        );
+    }
+    #[test]
+    fn actual_core_assignment_batch_matches_literal_oracle_and_one_step_history() {
+        let before = fixture().unwrap();
+        for (mode, scope) in [("oa-assigned", "oa_assign"), ("sa-assigned", "sa_assign")] {
+            let mut commands = Vec::new();
+            for (alias, work) in [("ax", "x"), ("by", "y")] {
+                let relation = id(&named(scope, alias));
+                let mut value = before.relations[&relation].clone();
+                value.body = RelationBody::Allocation {
+                    source: id(&named(scope, "c")),
+                    target: id(&named(scope, work)),
+                };
+                commands.push(Command::EditRelation(relation, value));
+            }
+            for (suffix, position) in [("x", xy(560., 140.)), ("y", xy(560., 440.))] {
+                let original = id(&named(scope, &format!("node_{suffix}")));
+                let mut node = before.diagrams[&id(scope)].nodes[&original].clone();
+                node.position = position;
+                commands.push(Command::EditNode {
+                    diagram: id(scope),
+                    original,
+                    node,
+                });
+            }
+            let mut route = before.diagrams[&id(scope)].routes[0].clone();
+            route.waypoints = vec![xy(820., 260.), xy(820., 400.)];
+            commands.push(Command::SetEdgeRoute {
+                diagram: id(scope),
+                route,
+            });
+            let mut session = Session::new(before.clone());
+            session.execute(Command::Batch(commands)).unwrap();
+            through_json(mode, &before, session.project()).unwrap();
+            let after = session.project().clone();
+            session.undo();
+            assert_eq!(session.project(), &before);
+            assert!(!session.can_undo());
+            session.redo();
+            assert_eq!(session.project(), &after);
+            assert!(!session.can_redo());
+        }
+    }
+    #[test]
+    fn assignment_rejects_singleton_semantic_identity_and_route_drift() {
+        let before = fixture().unwrap();
+        for mode in ["oa-assigned", "sa-assigned"] {
+            let scope = if mode == "oa-assigned" {
+                "oa_assign"
+            } else {
+                "sa_assign"
+            };
+            let good = expected(&before, mode).unwrap();
+            let mut bad = good.clone();
+            node_mut(&mut bad, scope, "y").position = xy(80., 440.);
+            mismatch(mode, &before, &bad);
+            let mut bad = good.clone();
+            bad.relations.insert(
+                id(&named(scope, "by")),
+                before.relations[&id(&named(scope, "by"))].clone(),
+            );
+            mismatch(mode, &before, &bad);
+            let mut bad = good.clone();
+            reidentify(
+                &mut bad,
+                id(&named(scope, "ax")),
+                id("replacement_allocation"),
+            )
+            .unwrap();
+            mismatch(mode, &before, &bad);
+            let mut bad = good.clone();
+            bad.relations
+                .get_mut(&id(&named(scope, "ax")))
+                .unwrap()
+                .description
+                .push_str(" drift");
+            mismatch(mode, &before, &bad);
+            for pins in [
+                vec![xy(340., 260.), xy(340., 400.)],
+                vec![xy(1300., 260.), xy(1300., 400.)],
+            ] {
+                let mut bad = good.clone();
+                bad.diagrams.get_mut(&id(scope)).unwrap().routes[0].waypoints = pins;
+                mismatch(mode, &before, &bad);
+            }
+        }
+    }
+    #[test]
+    fn arrange_and_ordinary_closure_falsifiers_remain_core_valid() {
+        let before = fixture().unwrap();
+        for mode in ["oa-arranged", "sa-arranged"] {
+            let scope = if mode == "oa-arranged" {
+                "oa_arrange"
+            } else {
+                "sa_arrange"
+            };
+            let good = expected(&before, mode).unwrap();
+            for (suffix, pos) in [("u", xy(80., 140.)), ("v", xy(440., 140.))] {
+                let mut bad = good.clone();
+                node_mut(&mut bad, scope, suffix).position = pos;
+                mismatch(mode, &before, &bad);
+            }
+            let mut bad = good.clone();
+            bad.relations.remove(&id(&named(scope, "pu")));
+            mismatch(mode, &before, &bad);
+        }
+        let good = expected(&before, "oa-performers").unwrap();
+        let mut bad = good.clone();
+        node_mut(&mut bad, "oa_assign", "x").position = xy(80., 140.);
+        mismatch("oa-performers", &before, &bad);
+        let mut bad = good;
+        bad.relations.get_mut(&id("oa_assign_ax")).unwrap().body = RelationBody::Allocation {
+            source: id("oa_assign_c"),
+            target: id("oa_assign_x"),
+        };
+        mismatch("oa-performers", &before, &bad);
+    }
+    #[test]
+    fn whole_project_sentinels_and_real_saved_source_are_checked() {
+        let before = fixture().unwrap();
+        let dir = tempfile::tempdir().unwrap();
+        let baseline = dir.path().join("baseline.json");
+        persistence::save(&baseline, &before).unwrap();
+        for mode in MODES {
+            let good = expected(&before, mode).unwrap();
+            for corrupt in [false, true] {
+                let mut actual = good.clone();
+                if corrupt {
+                    actual
+                        .elements
+                        .get_mut(&id("sa_arrange_v"))
+                        .unwrap()
+                        .description
+                        .push_str(" drift");
+                }
+                let bundle = roundtrip(&actual).unwrap();
+                let folder = dir.path().join(format!("{mode}-{corrupt}"));
+                for (path, text) in &bundle.files {
+                    write_new(&folder.join(path), text.as_bytes()).unwrap();
+                }
+                let result = check(mode, &baseline, &folder.join(&bundle.entry));
+                if corrupt {
+                    assert!(
+                        result
+                            .unwrap_err()
+                            .to_string()
+                            .contains("Whole Project mismatch")
+                    );
+                } else {
+                    result.unwrap();
+                }
+            }
+            let mut bad = good;
+            bad.diagrams
+                .get_mut(&id("other_view"))
+                .unwrap()
+                .nodes
+                .get_mut(&id("other_view_x"))
+                .unwrap()
+                .position
+                .x += 10.;
+            mismatch(mode, &before, &bad);
+        }
+        let invalid = dir.path().join("invalid.arcadia");
+        write_new(&invalid, b"project {").unwrap();
+        assert!(load(&invalid).is_err());
+    }
+}

crates/oa-core/examples/multiselect_native.rs

@@ -41,6 +41,7 @@ fn diagram(p: &mut Project, alias: &str, name: &str, layer: Layer) {
             layer,
             projection: ProjectionKind::Overview,
             view_options: Default::default(),
+            layout: None,
             nodes: Default::default(),
             routes: vec![],
         },

crates/oa-core/examples/release_dense_views.rs

@@ -230,7 +230,7 @@ fn fixture() -> (Project, Id, Vec<Id>, Vec<Id>, Vec<Id>) {
             )
         })
         .collect();
-    p.diagrams.insert(diagram, Diagram { id: diagram, alias: "forty_exchange_view".into(), name: "Forty service exchanges · all concerns".into(), description: "Start with All. Compare first category, overlapping concerns, global coverage and chosen processes. No hand-routed edges.".into(), layer: Layer::Oa, projection: ProjectionKind::FunctionalDataflow, view_options: ViewOptions::default(), nodes, routes: vec![] });
+    p.diagrams.insert(diagram, Diagram { id: diagram, alias: "forty_exchange_view".into(), name: "Forty service exchanges · all concerns".into(), description: "Start with All. Compare first category, overlapping concerns, global coverage and chosen processes. No hand-routed edges.".into(), layer: Layer::Oa, projection: ProjectionKind::FunctionalDataflow, view_options: ViewOptions::default(), nodes, layout: None, routes: vec![] });
     (p, diagram, exchanges, categories, contexts)
 }
 

crates/oa-core/examples/state_multiselect_native.rs

@@ -41,6 +41,7 @@ fn diagram(p: &mut Project, alias: &str, name: &str, layer: Layer) {
             layer,
             projection: ProjectionKind::Overview,
             view_options: Default::default(),
+            layout: None,
             nodes: Default::default(),
             routes: vec![],
         },

crates/oa-core/src/demo.rs

@@ -81,6 +81,7 @@ fn diagram(
             projection,
             view_options: Default::default(),
             nodes: BTreeMap::new(),
+            layout: None,
             routes: vec![],
         },
     );

crates/oa-core/src/lib.rs

@@ -10,6 +10,7 @@ pub mod ports;
 pub mod projection;
 pub mod references;
 pub mod routing;
+pub mod scenario_layout;
 pub mod semantic;
 pub mod session;
 mod source_defaults;
@@ -21,6 +22,9 @@ pub mod validation;
 pub mod view_options;
 pub use model::*;
 pub use ports::*;
+pub use scenario_layout::{
+    DiagramLayout, ScenarioLanePosition, ScenarioLayout, ScenarioMessagePosition,
+};
 pub use semantic::*;
 pub use session::*;
 mod demo;

crates/oa-core/src/model.rs

@@ -1436,6 +1436,7 @@ pub enum ProjectionKind {
     FunctionalDataflow,
     Capabilities,
     StateMachine { machine: Id },
+    Scenario { scenario: Id },
 }
 impl ProjectionKind {
     pub fn state_machine(self) -> Option<Id> {
@@ -1445,8 +1446,30 @@ impl ProjectionKind {
         }
     }
 
+    /// The semantic owner of a saved Scenario representation.
+    pub fn scenario(self) -> Option<Id> {
+        match self {
+            Self::Scenario { scenario } => Some(scenario),
+            _ => None,
+        }
+    }
+
+    /// Explicitly classify architecture views; absence of a state machine is insufficient.
+    pub fn is_architecture(self) -> bool {
+        match self {
+            Self::Overview
+            | Self::Decomposition
+            | Self::Allocation
+            | Self::Traceability
+            | Self::FunctionalDataflow
+            | Self::Capabilities => true,
+            Self::StateMachine { .. } | Self::Scenario { .. } => false,
+        }
+    }
+
     pub fn includes(self, kind: Kind) -> bool {
         match self {
+            Self::Scenario { .. } => false,
             Self::StateMachine { .. } => {
                 matches!(kind, Kind::StateMachine | Kind::Region) || kind.is_state()
             }
@@ -1471,6 +1494,7 @@ impl std::fmt::Display for ProjectionKind {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         f.write_str(match self {
             Self::StateMachine { .. } => "State machine",
+            Self::Scenario { .. } => "Scenario",
             Self::Allocation => "Architecture · allocated work",
             Self::FunctionalDataflow => "Functional dataflow",
             Self::Capabilities => "Missions & capabilities",
@@ -1495,6 +1519,8 @@ pub struct Diagram {
     pub nodes: BTreeMap<Id, NodePlacement>,
     #[serde(default)]
     pub routes: Vec<EdgeRoute>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub layout: Option<crate::scenario_layout::DiagramLayout>,
 }
 /// Authored presentation for one existing relation or trace in one diagram.
 /// Computed endpoints and automatic routing elbows are never persisted here.
@@ -1955,6 +1981,7 @@ impl Project {
                 view_options: crate::view_options::ViewOptions::default(),
                 nodes: BTreeMap::new(),
                 routes: vec![],
+                layout: None,
             },
         );
         id

crates/oa-core/src/projection.rs

@@ -278,6 +278,11 @@ fn project_diagram_impl(
     mut availability: Option<&mut BTreeMap<Id, crate::view_options::EdgeAvailability>>,
     index: Option<&crate::view_options::ViewIndex>,
 ) -> ProjectedView {
+    // Saved Scenario layout is not an architecture/state projection. Its dedicated
+    // renderer is not wired yet; never interpret its payload through this fallback.
+    if d.projection.scenario().is_some() {
+        return ProjectedView::default();
+    }
     let parents = parents(p, d);
     let mut nodes = Vec::new();
     for n in d.nodes.values() {
@@ -394,6 +399,7 @@ fn project_diagram_impl(
             continue;
         }
         let included = match d.projection {
+            ProjectionKind::Scenario { .. } => false,
             ProjectionKind::StateMachine { machine } => matches!(&r.body,
                 RelationBody::StateTransition { transition_kind, .. }
                     if *transition_kind != TransitionKind::Internal

crates/oa-core/src/references.rs

@@ -203,7 +203,81 @@ pub fn visit_relation_refs(r: &mut Relation, mut visit: impl FnMut(&mut Id)) {
         _ => {}
     }
 }
-pub fn remap_references(p: &mut Project, old: Id, new: Id) {
+/// Every semantic/presentation reference in a diagram, excluding its own identities.
+pub fn diagram_references(d: &Diagram) -> Vec<Id> {
+    let mut copy = d.clone();
+    let mut refs = Vec::new();
+    visit_diagram_refs(&mut copy, |id| refs.push(*id));
+    refs
+}
+
+pub fn visit_diagram_refs(d: &mut Diagram, mut visit: impl FnMut(&mut Id)) {
+    d.view_options.visit_references(&mut visit);
+    match &mut d.projection {
+        ProjectionKind::StateMachine { machine } => visit(machine),
+        ProjectionKind::Scenario { scenario } => visit(scenario),
+        _ => {}
+    }
+    if let Some(layout) = &mut d.layout {
+        layout.visit_references(&mut visit);
+    }
+    for route in &mut d.routes {
+        visit(&mut route.edge);
+    }
+    for node in d.nodes.values_mut() {
+        for anchor in &mut node.port_anchors {
+            visit(&mut anchor.port);
+        }
+        visit(&mut node.element);
+    }
+}
+
+/// Preflight reference-key collisions before the caller changes object identities.
+/// Fresh targets are allowed. This is not whole-project admission: unrelated
+/// invalid records remain repairable within a transaction. Future typed reference
+/// domains must compose their own preflight here before any remap mutation.
+pub fn check_remap(p: &Project, old: Id, new: Id) -> Result<(), ModelError> {
+    if old == new {
+        return Ok(());
+    }
+    let remap = |id: Id| if id == old { new } else { id };
+    for diagram in p.diagrams.values() {
+        let Some(DiagramLayout::Scenario(layout)) = &diagram.layout else {
+            continue;
+        };
+        let mut lanes = std::collections::BTreeMap::new();
+        for lane in &layout.lanes {
+            let affected = lane.lifeline == old;
+            if let Some(previous_affected) = lanes.insert(remap(lane.lifeline), affected)
+                && (affected || previous_affected)
+            {
+                return Err(ModelError(
+                    "Identity remap would collide with a Scenario lane position.".into(),
+                ));
+            }
+        }
+        let mut messages = std::collections::BTreeMap::new();
+        for message in &layout.messages {
+            let mut address = message.address.clone();
+            let affected = address.occurrence == old || address.references.contains(&old);
+            address.occurrence = remap(address.occurrence);
+            for reference in &mut address.references {
+                *reference = remap(*reference);
+            }
+            if let Some(previous_affected) = messages.insert(address, affected)
+                && (affected || previous_affected)
+            {
+                return Err(ModelError(
+                    "Identity remap would collide with a Scenario message position.".into(),
+                ));
+            }
+        }
+    }
+    Ok(())
+}
+
+pub fn remap_references(p: &mut Project, old: Id, new: Id) -> Result<(), ModelError> {
+    check_remap(p, old, new)?;
     for e in p.elements.values_mut() {
         visit_element_refs(e, |id| {
             if *id == old {
@@ -219,31 +293,11 @@ pub fn remap_references(p: &mut Project, old: Id, new: Id) {
         });
     }
     for d in p.diagrams.values_mut() {
-        d.view_options.visit_references(|id| {
+        visit_diagram_refs(d, |id| {
             if *id == old {
                 *id = new;
             }
         });
-        if let ProjectionKind::StateMachine { machine } = &mut d.projection
-            && *machine == old
-        {
-            *machine = new;
-        }
-        for route in &mut d.routes {
-            if route.edge == old {
-                route.edge = new;
-            }
-        }
-        for n in d.nodes.values_mut() {
-            for anchor in &mut n.port_anchors {
-                if anchor.port == old {
-                    anchor.port = new;
-                }
-            }
-            if n.element == old {
-                n.element = new;
-            }
-        }
     }
     for a in p.artifact_links.values_mut() {
         if a.owner == old {
@@ -265,6 +319,7 @@ pub fn remap_references(p: &mut Project, old: Id, new: Id) {
             });
         }
     }
+    Ok(())
 }
 /// IDs removed by a cascade. Cross-layer traced counterparts are never included.
 pub fn deletion_impact(p: &Project, id: Id) -> BTreeSet<Id> {
@@ -339,7 +394,8 @@ fn deletion_impact_inner(p: &Project, id: Id, defer_exchange_allocations: bool)
         for d in p.diagrams.values() {
             if d.projection
                 .state_machine()
-                .is_some_and(|machine| removed.contains(&machine))
+                .or_else(|| d.projection.scenario())
+                .is_some_and(|owner| removed.contains(&owner))
             {
                 removed.insert(d.id);
             }
@@ -412,6 +468,7 @@ fn remove_objects(p: &mut Project, removed: BTreeSet<Id>) {
     p.artifact_links.retain(|id, _| !removed.contains(id));
     for d in p.diagrams.values_mut() {
         d.view_options.retain_references(|id| !removed.contains(id));
+        crate::scenario_layout::prune_deleted(d, &removed);
         d.nodes.retain(|id, _| !removed.contains(id));
         d.routes.retain(|route| !removed.contains(&route.edge));
         for node in d.nodes.values_mut() {
@@ -589,3 +646,7 @@ fn remove_objects(p: &mut Project, removed: BTreeSet<Id>) {
         }
     }
 }
+
+#[cfg(test)]
+#[path = "references/scenario_layout_tests.rs"]
+mod scenario_layout_tests;

crates/oa-core/src/references/scenario_layout_tests.rs

@@ -0,0 +1,388 @@
+use super::*;
+use std::collections::BTreeMap;
+
+struct Fixture {
+    project: Project,
+    owner: Id,
+    lanes: [Id; 2],
+    messages: [Id; 2],
+    views: [Id; 2],
+}
+
+fn address(occurrence: Id) -> OccurrenceEndpoint {
+    OccurrenceEndpoint {
+        references: vec![],
+        occurrence,
+    }
+}
+
+fn layout(project: &Project, view: Id) -> &ScenarioLayout {
+    let Some(DiagramLayout::Scenario(layout)) = &project.diagrams[&view].layout else {
+        panic!("expected authored Scenario positions")
+    };
+    layout
+}
+
+fn layout_mut(project: &mut Project, view: Id) -> &mut ScenarioLayout {
+    let Some(DiagramLayout::Scenario(layout)) =
+        &mut project.diagrams.get_mut(&view).unwrap().layout
+    else {
+        panic!("expected authored Scenario positions")
+    };
+    layout
+}
+
+fn admitted(project: &Project) {
+    let errors: Vec<_> = crate::validation::validate(project)
+        .into_iter()
+        .filter(|issue| issue.severity == crate::validation::Severity::Error)
+        .collect();
+    assert!(errors.is_empty(), "{errors:?}");
+}
+
+fn fixture() -> Fixture {
+    let mut project = Project::empty();
+    let owner = project
+        .add_element(Kind::Scenario, Layer::Oa, "Delivery", None)
+        .unwrap();
+    let lanes = ["Sender", "Receiver"].map(|name| {
+        project
+            .add_element(Kind::Lifeline, Layer::Oa, name, Some(owner))
+            .unwrap()
+    });
+    let messages = ["First message", "Second message"].map(|name| {
+        let id = project
+            .add_element(Kind::Occurrence, Layer::Oa, name, Some(owner))
+            .unwrap();
+        *project.elements.get_mut(&id).unwrap().shared_mut().unwrap() = SharedBody::Occurrence {
+            body: OccurrenceBody::Exchange {
+                exchange: None,
+                sender: Some(lanes[0]),
+                receiver: Some(lanes[1]),
+                message_kind: MessageKind::Asynchronous,
+                reply_to: None,
+                values: vec![],
+                operation: None,
+            },
+            precondition: String::new(),
+            postcondition: String::new(),
+        };
+        id
+    });
+    *project
+        .elements
+        .get_mut(&owner)
+        .unwrap()
+        .steps_mut()
+        .unwrap() = messages.to_vec();
+    let views = ["delivery_view", "review_view"].map(|alias| {
+        let id = Id::new_v4();
+        project.diagrams.insert(
+            id,
+            Diagram {
+                id,
+                alias: alias.into(),
+                name: alias.into(),
+                description: String::new(),
+                layer: Layer::Oa,
+                projection: ProjectionKind::Scenario { scenario: owner },
+                view_options: Default::default(),
+                nodes: BTreeMap::new(),
+                routes: vec![],
+                layout: Some(DiagramLayout::Scenario(ScenarioLayout {
+                    lanes: vec![
+                        ScenarioLanePosition {
+                            lifeline: lanes[0],
+                            x: 120.,
+                        },
+                        ScenarioLanePosition {
+                            lifeline: lanes[1],
+                            x: 420.,
+                        },
+                    ],
+                    messages: vec![
+                        ScenarioMessagePosition {
+                            address: address(messages[0]),
+                            send_y: 220.,
+                        },
+                        ScenarioMessagePosition {
+                            address: address(messages[1]),
+                            send_y: 360.,
+                        },
+                    ],
+                })),
+            },
+        );
+        id
+    });
+    admitted(&project);
+    Fixture {
+        project,
+        owner,
+        lanes,
+        messages,
+        views,
+    }
+}
+
+#[test]
+fn fresh_identity_swap_preserves_coordinates_and_semantic_sequence() {
+    let mut f = fixture();
+    let before = f.project.clone();
+    let temporary = Id::new_v4();
+    for ids in [f.lanes, f.messages] {
+        f.project = crate::execute_batch(
+            &f.project,
+            &[
+                Command::Reidentify(ids[0], temporary),
+                Command::Reidentify(ids[1], ids[0]),
+                Command::Reidentify(temporary, ids[1]),
+            ],
+        )
+        .unwrap();
+    }
+    admitted(&f.project);
+    assert_eq!(
+        f.project.elements[&f.owner].steps().unwrap(),
+        &vec![f.messages[1], f.messages[0]]
+    );
+    for view in f.views {
+        let rows = layout(&f.project, view);
+        assert_eq!(
+            rows.lanes,
+            vec![
+                ScenarioLanePosition {
+                    lifeline: f.lanes[1],
+                    x: 120.
+                },
+                ScenarioLanePosition {
+                    lifeline: f.lanes[0],
+                    x: 420.
+                }
+            ]
+        );
+        assert_eq!(
+            rows.messages,
+            vec![
+                ScenarioMessagePosition {
+                    address: address(f.messages[1]),
+                    send_y: 220.
+                },
+                ScenarioMessagePosition {
+                    address: address(f.messages[0]),
+                    send_y: 360.
+                }
+            ]
+        );
+    }
+    // Reverse the swaps: no values or identities other than those requested drift.
+    for ids in [f.lanes, f.messages] {
+        f.project = crate::execute_batch(
+            &f.project,
+            &[
+                Command::Reidentify(ids[0], temporary),
+                Command::Reidentify(ids[1], ids[0]),
+                Command::Reidentify(temporary, ids[1]),
+            ],
+        )
+        .unwrap();
+    }
+    assert_eq!(f.project, before);
+}
+
+#[test]
+fn colliding_lane_or_message_remap_rejects_before_any_reference_changes() {
+    for message in [false, true] {
+        let mut f = fixture();
+        let [old, new] = if message { f.messages } else { f.lanes };
+        let before = f.project.clone();
+        assert!(check_remap(&f.project, old, new).is_err());
+        assert!(remap_references(&mut f.project, old, new).is_err());
+        assert_eq!(f.project, before);
+    }
+}
+
+#[test]
+fn reidentify_preflight_precedes_object_map_mutation_for_fresh_colliding_target() {
+    let mut f = fixture();
+    let fresh = Id::new_v4();
+    // A repair candidate can already have a dangling coordinate key. It must not
+    // silently merge with the live lane, even though the destination ID is vacant.
+    layout_mut(&mut f.project, f.views[0]).lanes[1].lifeline = fresh;
+    let before = f.project.clone();
+    assert!(crate::session::reidentify(&mut f.project, f.lanes[0], fresh).is_err());
+    assert_eq!(f.project, before);
+}
+
+#[test]
+fn full_address_paths_are_walked_and_collision_checked_without_admitting_expansion() {
+    let mut f = fixture();
+    let [old, new] = [Id::new_v4(), Id::new_v4()];
+    let rows = layout_mut(&mut f.project, f.views[0]);
+    // Future/invalid expanded candidates still participate in reference safety.
+    rows.messages[0].address.references = vec![old];
+    rows.messages[1].address = OccurrenceEndpoint {
+        references: vec![new],
+        occurrence: f.messages[0],
+    };
+    let refs = diagram_references(&f.project.diagrams[&f.views[0]]);
+    assert!(refs.contains(&f.owner) && refs.contains(&old) && refs.contains(&new));
+    let before = f.project.clone();
+    assert!(remap_references(&mut f.project, old, new).is_err());
+    assert_eq!(f.project, before);
+    let fresh = Id::new_v4();
+    remap_references(&mut f.project, old, fresh).unwrap();
+    let rows = layout(&f.project, f.views[0]);
+    assert_eq!(rows.messages[0].address.references, vec![fresh]);
+    assert_eq!(rows.messages[0].address.occurrence, f.messages[0]);
+    assert_eq!(rows.messages[1].address.references, vec![new]);
+}
+
+#[test]
+fn owner_reidentify_and_delete_cover_all_saved_views_without_deleting_other_owners() {
+    let mut f = fixture();
+    let other_owner = f
+        .project
+        .add_element(Kind::Scenario, Layer::Oa, "Independent", None)
+        .unwrap();
+    let mut other_view = f.project.diagrams[&f.views[0]].clone();
+    other_view.id = Id::new_v4();
+    other_view.alias = "independent_view".into();
+    other_view.projection = ProjectionKind::Scenario {
+        scenario: other_owner,
+    };
+    other_view.layout = None;
+    f.project.diagrams.insert(other_view.id, other_view.clone());
+    admitted(&f.project);
+    let fresh_owner = Id::new_v4();
+    f.project = crate::prepare_command(&f.project, &Command::Reidentify(f.owner, fresh_owner))
+        .unwrap()
+        .project;
+    for view in f.views {
+        assert_eq!(
+            f.project.diagrams[&view].projection.scenario(),
+            Some(fresh_owner)
+        );
+    }
+    let impact = deletion_impact(&f.project, fresh_owner);
+    assert!(
+        f.views
+            .iter()
+            .chain(&f.lanes)
+            .chain(&f.messages)
+            .all(|id| impact.contains(id))
+    );
+    assert!(!impact.contains(&other_owner) && !impact.contains(&other_view.id));
+    delete_cascade(&mut f.project, fresh_owner);
+    assert_eq!(f.project.diagrams[&other_view.id], other_view);
+    assert!(
+        f.views
+            .iter()
+            .all(|id| !f.project.diagrams.contains_key(id))
+    );
+    admitted(&f.project);
+}
+
+#[test]
+fn deletion_then_recreation_never_resurrects_lane_or_message_coordinates() {
+    let mut f = fixture();
+    let lane = f.project.elements[&f.lanes[0]].clone();
+    let message = f.project.elements[&f.messages[0]].clone();
+    delete_cascade(&mut f.project, lane.id);
+    for view in f.views {
+        let rows = layout(&f.project, view);
+        assert_eq!(rows.lanes.len(), 1);
+        assert_eq!(rows.lanes[0].lifeline, f.lanes[1]);
+        // Missing endpoint assignment does not erase a still-live message's spacing.
+        assert_eq!(rows.messages.len(), 2);
+    }
+    let mut pending = BTreeSet::new();
+    delete_cascade_deferred(&mut f.project, message.id, &mut pending);
+    // Pruning happens during deletion, before later batch commands can recreate IDs.
+    assert!(
+        layout(&f.project, f.views[0])
+            .messages
+            .iter()
+            .all(|row| row.address.occurrence != message.id)
+    );
+    f.project.elements.insert(lane.id, lane);
+    f.project.elements.insert(message.id, message);
+    f.project
+        .elements
+        .get_mut(&f.owner)
+        .unwrap()
+        .steps_mut()
+        .unwrap()
+        .insert(0, f.messages[0]);
+    finish_deletions(&mut f.project, &pending);
+    for view in f.views {
+        let rows = layout(&f.project, view);
+        assert_eq!(rows.lanes.len(), 1);
+        assert_eq!(
+            rows.messages,
+            vec![ScenarioMessagePosition {
+                address: address(f.messages[1]),
+                send_y: 360.
+            }]
+        );
+    }
+    admitted(&f.project);
+}
+
+#[test]
+fn unrelated_invalid_records_do_not_block_scoped_remap_or_get_repaired_implicitly() {
+    let mut f = fixture();
+    let unrelated = Id::new_v4();
+    let rows = layout_mut(&mut f.project, f.views[1]);
+    let invalid = ScenarioLanePosition {
+        lifeline: unrelated,
+        x: MAX_COORDINATE * 2.,
+    };
+    rows.lanes.extend([invalid.clone(), invalid]);
+    let fresh = Id::new_v4();
+    let untouched = f.project.diagrams[&f.views[1]].clone();
+    let before = f.project.clone();
+    remap_references(&mut f.project, f.owner, f.owner).unwrap();
+    assert_eq!(f.project, before);
+    // The duplicate lane records do not involve the remapped message identity.
+    remap_references(&mut f.project, f.messages[0], fresh).unwrap();
+    assert_eq!(
+        layout(&f.project, f.views[1]).lanes,
+        layout_from(&untouched).lanes
+    );
+    assert_eq!(
+        layout(&f.project, f.views[1]).messages[0]
+            .address
+            .occurrence,
+        fresh
+    );
+    assert_eq!(layout(&f.project, f.views[1]).messages[0].send_y, 220.);
+}
+
+fn layout_from(diagram: &Diagram) -> &ScenarioLayout {
+    let Some(DiagramLayout::Scenario(layout)) = &diagram.layout else {
+        panic!("missing layout")
+    };
+    layout
+}
+
+#[test]
+fn deletion_prunes_an_explicit_address_path_without_pruning_other_message_rows() {
+    let mut f = fixture();
+    // Expanded addresses are not admitted in this slice, but deleting their
+    // explicit references must still make an intermediate repair candidate safe.
+    layout_mut(&mut f.project, f.views[0]).messages[0]
+        .address
+        .references = vec![f.lanes[0]];
+    delete_cascade(&mut f.project, f.lanes[0]);
+    assert_eq!(
+        layout(&f.project, f.views[0]).messages,
+        vec![ScenarioMessagePosition {
+            address: address(f.messages[1]),
+            send_y: 360.
+        }]
+    );
+    assert_eq!(layout(&f.project, f.views[1]).messages.len(), 2);
+    assert!(f.project.elements.contains_key(&f.messages[0]));
+    admitted(&f.project);
+}

crates/oa-core/src/scenario_layout.rs

@@ -0,0 +1,429 @@
+//! Authored Scenario presentation. Structural admission never changes event order.
+use crate::{
+    Diagram, Id, Kind, Layer, MAX_COORDINATE, ModelError, OccurrenceBody, OccurrenceEndpoint,
+    Project, SharedBody, validation,
+};
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeSet;
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub enum DiagramLayout {
+    Scenario(ScenarioLayout),
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default)]
+#[serde(deny_unknown_fields)]
+pub struct ScenarioLayout {
+    #[serde(default)]
+    pub lanes: Vec<ScenarioLanePosition>,
+    #[serde(default)]
+    pub messages: Vec<ScenarioMessagePosition>,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ScenarioLanePosition {
+    pub lifeline: Id,
+    pub x: f32,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ScenarioMessagePosition {
+    pub address: OccurrenceEndpoint,
+    /// Actual send endpoint, not the renderer's receive-oriented lifecycle row.
+    pub send_y: f32,
+}
+
+impl DiagramLayout {
+    /// Visit every explicit reference, including unsupported paths in a candidate.
+    /// The caller owns remap preflight and final atomic validation.
+    pub fn visit_references(&mut self, mut visit: impl FnMut(&mut Id)) {
+        match self {
+            Self::Scenario(layout) => {
+                for lane in &mut layout.lanes {
+                    visit(&mut lane.lifeline);
+                }
+                for message in &mut layout.messages {
+                    for reference in &mut message.address.references {
+                        visit(reference);
+                    }
+                    visit(&mut message.address.occurrence);
+                }
+            }
+        }
+    }
+}
+
+/// Proposed aggregate accounting contribution; the shared admission owner applies it.
+/// One payload plus one record per lane/message. No graph objects are introduced.
+pub fn record_count(diagram: &Diagram) -> usize {
+    match &diagram.layout {
+        None => 0,
+        Some(DiagramLayout::Scenario(layout)) => 1usize
+            .saturating_add(layout.lanes.len())
+            .saturating_add(layout.messages.len()),
+    }
+}
+
+fn coordinate(value: f32) -> bool {
+    value.is_finite() && value.abs() <= MAX_COORDINATE
+}
+
+fn owner(p: &Project, diagram: &Diagram) -> Result<Id, ModelError> {
+    let scenario = diagram
+        .projection
+        .scenario()
+        .ok_or_else(|| ModelError("Scenario layout requires a Scenario projection.".into()))?;
+    if !p
+        .elements
+        .get(&scenario)
+        .is_some_and(|element| element.kind() == Kind::Scenario && element.layer() == diagram.layer)
+    {
+        return Err(ModelError(
+            "Scenario projection requires an existing Scenario in the diagram layer.".into(),
+        ));
+    }
+    Ok(scenario)
+}
+
+fn lane_member(p: &Project, owner: Id, layer: Layer, lifeline: Id) -> bool {
+    p.elements.get(&lifeline).is_some_and(|element| {
+        element.kind() == Kind::Lifeline
+            && element.parent == Some(owner)
+            && element.layer() == layer
+    })
+}
+
+/// Only actual steps of this Scenario and its own Fragment/Branch sequences.
+/// ScenarioUse/SequenceReference are deliberately never expanded. Invalid graph
+/// cycles terminate, and malformed parent/step links do not manufacture membership.
+fn direct_messages(p: &Project, owner: Id, layer: Layer) -> BTreeSet<Id> {
+    let mut messages = BTreeSet::new();
+    let mut visited = BTreeSet::new();
+    let mut pending = vec![owner];
+    while let Some(scope) = pending.pop() {
+        if !visited.insert(scope) {
+            continue;
+        }
+        let Some(element) = p.elements.get(&scope) else {
+            continue;
+        };
+        for id in element.steps().into_iter().flatten() {
+            let Some(item) = p.elements.get(id) else {
+                continue;
+            };
+            if item.parent != Some(scope) || item.layer() != layer {
+                continue;
+            }
+            match item.shared() {
+                Some(SharedBody::Occurrence {
+                    body: OccurrenceBody::Exchange { .. },
+                    ..
+                }) => {
+                    messages.insert(*id);
+                }
+                Some(SharedBody::Occurrence {
+                    body: OccurrenceBody::Fragment { branches, .. },
+                    ..
+                }) => {
+                    for branch in branches {
+                        if p.elements.get(branch).is_some_and(|operand| {
+                            operand.parent == Some(*id)
+                                && operand.layer() == layer
+                                && matches!(
+                                    operand.shared(),
+                                    Some(SharedBody::Occurrence {
+                                        body: OccurrenceBody::Branch { .. },
+                                        ..
+                                    })
+                                )
+                        }) {
+                            pending.push(*branch);
+                        }
+                    }
+                }
+                _ => {}
+            }
+        }
+    }
+    messages
+}
+
+pub(crate) fn validate_diagram(p: &Project, diagram: &Diagram, out: &mut Vec<validation::Issue>) {
+    if diagram.projection.scenario().is_none() {
+        if diagram.layout.is_some() {
+            validation::error(
+                out,
+                diagram.id,
+                "scenario_layout_projection",
+                "layout",
+                "Only a Scenario projection accepts a Scenario layout, including an empty payload.",
+            );
+        }
+        return;
+    }
+    let scenario = match owner(p, diagram) {
+        Ok(owner) => owner,
+        Err(error) => {
+            validation::error(
+                out,
+                diagram.id,
+                "scenario_diagram_context",
+                "projection",
+                error.0,
+            );
+            return;
+        }
+    };
+    if !diagram.nodes.is_empty() || !diagram.routes.is_empty() {
+        validation::error(
+            out,
+            diagram.id,
+            "scenario_diagram_content",
+            "layout",
+            "Scenario views do not accept architecture node placements or edge routes.",
+        );
+    }
+    let Some(DiagramLayout::Scenario(layout)) = &diagram.layout else {
+        return;
+    };
+    let mut lanes = BTreeSet::new();
+    for lane in &layout.lanes {
+        if !lanes.insert(lane.lifeline) {
+            validation::error(
+                out,
+                diagram.id,
+                "duplicate_scenario_lane",
+                "layout",
+                "A Scenario layout has at most one position per lifeline.",
+            );
+        }
+        if !lane_member(p, scenario, diagram.layer, lane.lifeline) {
+            validation::error(
+                out,
+                diagram.id,
+                "scenario_layout_lifeline",
+                "layout",
+                "Lane positions reference a Lifeline directly owned by the projected Scenario.",
+            );
+        }
+        if !coordinate(lane.x) {
+            validation::error(
+                out,
+                diagram.id,
+                "scenario_layout_coordinate",
+                "layout",
+                "Scenario positions must be finite and within the shared coordinate bounds.",
+            );
+        }
+    }
+    let members = direct_messages(p, scenario, diagram.layer);
+    let mut addresses = BTreeSet::new();
+    for message in &layout.messages {
+        // Reject expanded paths without cloning or indexing their potentially large contents.
+        if !message.address.references.is_empty() {
+            validation::error(
+                out,
+                diagram.id,
+                "scenario_layout_address",
+                "layout",
+                "Expanded-reference message positions are not supported; references must be empty.",
+            );
+        } else if !addresses.insert(message.address.occurrence) {
+            validation::error(
+                out,
+                diagram.id,
+                "duplicate_scenario_message",
+                "layout",
+                "A Scenario layout has at most one position per message address.",
+            );
+        }
+        if !members.contains(&message.address.occurrence) {
+            validation::error(
+                out,
+                diagram.id,
+                "scenario_layout_message",
+                "layout",
+                "Message positions reference Exchange occurrences in the Scenario's own ordered sequence tree.",
+            );
+        }
+        if !coordinate(message.send_y) {
+            validation::error(
+                out,
+                diagram.id,
+                "scenario_layout_coordinate",
+                "layout",
+                "Scenario positions must be finite and within the shared coordinate bounds.",
+            );
+        }
+    }
+}
+
+fn editable(p: &Project, id: Id) -> Result<(&Diagram, Id), ModelError> {
+    let diagram = p
+        .diagrams
+        .get(&id)
+        .ok_or_else(|| ModelError("Scenario diagram does not exist.".into()))?;
+    let scenario = owner(p, diagram)?;
+    if !diagram.nodes.is_empty() || !diagram.routes.is_empty() {
+        return Err(ModelError(
+            "Scenario views do not accept architecture node placements or edge routes.".into(),
+        ));
+    }
+    Ok((diagram, scenario))
+}
+
+fn check_message(
+    p: &Project,
+    diagram: &Diagram,
+    owner: Id,
+    address: &OccurrenceEndpoint,
+) -> Result<(), ModelError> {
+    if !address.references.is_empty() {
+        return Err(ModelError(
+            "Expanded-reference message positions are not supported; references must be empty."
+                .into(),
+        ));
+    }
+    if !direct_messages(p, owner, diagram.layer).contains(&address.occurrence) {
+        return Err(ModelError("Message position requires an Exchange occurrence in the Scenario's own ordered sequence tree.".into()));
+    }
+    Ok(())
+}
+
+fn payload(diagram: &mut Diagram) -> &mut ScenarioLayout {
+    let DiagramLayout::Scenario(layout) = diagram
+        .layout
+        .get_or_insert_with(|| DiagramLayout::Scenario(ScenarioLayout::default()));
+    layout
+}
+
+/// Target-scoped preparation, not whole-project or whole-layout validation.
+/// Unrelated intermediate errors remain repairable by later commands in a batch.
+pub fn set_lane(
+    p: &Project,
+    diagram: Id,
+    position: ScenarioLanePosition,
+) -> Result<Diagram, ModelError> {
+    let (current, owner) = editable(p, diagram)?;
+    if !lane_member(p, owner, current.layer, position.lifeline) || !coordinate(position.x) {
+        return Err(ModelError(
+            "Lane position requires an owned Lifeline and a finite bounded x coordinate.".into(),
+        ));
+    }
+    let mut result = current.clone();
+    let layout = payload(&mut result);
+    if layout
+        .lanes
+        .iter()
+        .filter(|row| row.lifeline == position.lifeline)
+        .count()
+        > 1
+    {
+        return Err(ModelError(
+            "Cannot set an ambiguous duplicate lane position.".into(),
+        ));
+    }
+    if let Some(existing) = layout
+        .lanes
+        .iter_mut()
+        .find(|row| row.lifeline == position.lifeline)
+    {
+        if existing.x != position.x {
+            *existing = position;
+        }
+    } else {
+        layout.lanes.push(position);
+    }
+    Ok(result)
+}
+
+pub fn remove_lane(p: &Project, diagram: Id, lifeline: Id) -> Result<Diagram, ModelError> {
+    let (current, owner) = editable(p, diagram)?;
+    if !lane_member(p, owner, current.layer, lifeline) {
+        return Err(ModelError(
+            "Removing a lane position requires an owned Lifeline.".into(),
+        ));
+    }
+    let mut result = current.clone();
+    if let Some(DiagramLayout::Scenario(layout)) = &mut result.layout {
+        layout.lanes.retain(|row| row.lifeline != lifeline);
+    }
+    Ok(result)
+}
+
+pub fn set_message(
+    p: &Project,
+    diagram: Id,
+    position: ScenarioMessagePosition,
+) -> Result<Diagram, ModelError> {
+    let (current, owner) = editable(p, diagram)?;
+    check_message(p, current, owner, &position.address)?;
+    if !coordinate(position.send_y) {
+        return Err(ModelError(
+            "Message position requires a finite bounded send_y coordinate.".into(),
+        ));
+    }
+    let mut result = current.clone();
+    let layout = payload(&mut result);
+    if layout
+        .messages
+        .iter()
+        .filter(|row| row.address == position.address)
+        .count()
+        > 1
+    {
+        return Err(ModelError(
+            "Cannot set an ambiguous duplicate message position.".into(),
+        ));
+    }
+    if let Some(existing) = layout
+        .messages
+        .iter_mut()
+        .find(|row| row.address == position.address)
+    {
+        if existing.send_y != position.send_y {
+            *existing = position;
+        }
+    } else {
+        layout.messages.push(position);
+    }
+    Ok(result)
+}
+
+pub fn remove_message(
+    p: &Project,
+    diagram: Id,
+    address: &OccurrenceEndpoint,
+) -> Result<Diagram, ModelError> {
+    let (current, owner) = editable(p, diagram)?;
+    check_message(p, current, owner, address)?;
+    let mut result = current.clone();
+    if let Some(DiagramLayout::Scenario(layout)) = &mut result.layout {
+        layout.messages.retain(|row| &row.address != address);
+    }
+    Ok(result)
+}
+
+/// Prune only identities in the caller's actual deletion closure, never visibility
+/// or missing endpoint assignments. Owner-view cascade remains the caller's job.
+pub fn prune_deleted(diagram: &mut Diagram, deleted: &BTreeSet<Id>) {
+    if let Some(DiagramLayout::Scenario(layout)) = &mut diagram.layout {
+        layout
+            .lanes
+            .retain(|lane| !deleted.contains(&lane.lifeline));
+        layout.messages.retain(|message| {
+            !deleted.contains(&message.address.occurrence)
+                && !message
+                    .address
+                    .references
+                    .iter()
+                    .any(|id| deleted.contains(id))
+        });
+    }
+}
+
+#[cfg(test)]
+mod tests;

crates/oa-core/src/scenario_layout/tests.rs

@@ -0,0 +1,802 @@
+use super::*;
+use crate::{
+    Element, FragmentOperator, MessageKind, ProjectionKind, Relation, RelationBody, RelationKind,
+    ScenarioViewpoint,
+};
+use std::collections::BTreeMap;
+
+struct Fixture {
+    project: Project,
+    owner: Id,
+    performer: Id,
+    lane: Id,
+    repeated_lane: Id,
+    first: Id,
+    second: Id,
+    nested: Id,
+    fragment: Id,
+    branch: Id,
+    view: Id,
+    other_view: Id,
+    exchange: Id,
+}
+
+fn set_body(element: &mut Element, body: OccurrenceBody) {
+    *element.shared_mut().unwrap() = SharedBody::Occurrence {
+        body,
+        precondition: String::new(),
+        postcondition: String::new(),
+    };
+}
+fn address(occurrence: Id) -> OccurrenceEndpoint {
+    OccurrenceEndpoint {
+        references: vec![],
+        occurrence,
+    }
+}
+fn diagram(owner: Id, alias: &str) -> Diagram {
+    Diagram {
+        id: Id::new_v4(),
+        alias: alias.into(),
+        name: alias.into(),
+        description: String::new(),
+        layer: Layer::Oa,
+        projection: ProjectionKind::Scenario { scenario: owner },
+        view_options: Default::default(),
+        nodes: BTreeMap::new(),
+        routes: vec![],
+        layout: None,
+    }
+}
+fn assert_admitted(project: &Project) {
+    let errors: Vec<_> = validation::validate(project)
+        .into_iter()
+        .filter(|issue| issue.severity == validation::Severity::Error)
+        .collect();
+    assert!(errors.is_empty(), "{errors:?}");
+}
+fn has_code(project: &Project, code: &str) -> bool {
+    validation::validate(project)
+        .iter()
+        .any(|issue| issue.code == code)
+}
+fn layout(diagram: &Diagram) -> &ScenarioLayout {
+    let Some(DiagramLayout::Scenario(layout)) = &diagram.layout else {
+        panic!("expected saved payload")
+    };
+    layout
+}
+fn save(project: &mut Project, replacement: Diagram) {
+    project.diagrams.insert(replacement.id, replacement);
+}
+fn fixture() -> Fixture {
+    let mut project = Project::empty();
+    let owner = project
+        .add_element(Kind::Scenario, Layer::Oa, "Nominal", None)
+        .unwrap();
+    let Some(SharedBody::Scenario { viewpoint, .. }) =
+        project.elements.get_mut(&owner).unwrap().shared_mut()
+    else {
+        panic!("Scenario fixture body");
+    };
+    *viewpoint = ScenarioViewpoint::ParticipantInteraction;
+    let performer = project
+        .add_element(Kind::Entity, Layer::Oa, "Controller", None)
+        .unwrap();
+    let receiver = project
+        .add_element(Kind::Entity, Layer::Oa, "Provider", None)
+        .unwrap();
+    let lane = project
+        .add_element(Kind::Lifeline, Layer::Oa, "Controller lane", Some(owner))
+        .unwrap();
+    let repeated_lane = project
+        .add_element(
+            Kind::Lifeline,
+            Layer::Oa,
+            "Controller review lane",
+            Some(owner),
+        )
+        .unwrap();
+    let receiver_lane = project
+        .add_element(Kind::Lifeline, Layer::Oa, "Provider lane", Some(owner))
+        .unwrap();
+    for (id, represented) in [
+        (lane, performer),
+        (repeated_lane, performer),
+        (receiver_lane, receiver),
+    ] {
+        *project.elements.get_mut(&id).unwrap().shared_mut().unwrap() = SharedBody::Lifeline {
+            represented: Some(represented),
+        };
+    }
+    let exchange = Id::new_v4();
+    project.relations.insert(
+        exchange,
+        Relation {
+            id: exchange,
+            alias: "delivery_channel".into(),
+            name: "Delivery".into(),
+            description: String::new(),
+            body: RelationBody::new(RelationKind::CommunicationMean, performer, receiver),
+        },
+    );
+    let first = project
+        .add_element(Kind::Occurrence, Layer::Oa, "First delivery", Some(owner))
+        .unwrap();
+    let second = project
+        .add_element(Kind::Occurrence, Layer::Oa, "Second delivery", Some(owner))
+        .unwrap();
+    for (id, sender) in [(first, lane), (second, repeated_lane)] {
+        set_body(
+            project.elements.get_mut(&id).unwrap(),
+            OccurrenceBody::Exchange {
+                exchange: Some(exchange),
+                sender: Some(sender),
+                receiver: Some(receiver_lane),
+                message_kind: MessageKind::Asynchronous,
+                reply_to: None,
+                values: vec![],
+                operation: None,
+            },
+        );
+    }
+    let fragment = project
+        .add_element(
+            Kind::Occurrence,
+            Layer::Oa,
+            "Optional delivery",
+            Some(owner),
+        )
+        .unwrap();
+    set_body(
+        project.elements.get_mut(&fragment).unwrap(),
+        OccurrenceBody::Fragment {
+            operator: FragmentOperator::Optional,
+            branches: vec![],
+        },
+    );
+    let branch = project
+        .add_element(Kind::Occurrence, Layer::Oa, "Option body", Some(fragment))
+        .unwrap();
+    let nested = project
+        .add_element(
+            Kind::Occurrence,
+            Layer::Oa,
+            "Unfinished nested delivery",
+            Some(branch),
+        )
+        .unwrap();
+    set_body(
+        project.elements.get_mut(&nested).unwrap(),
+        OccurrenceBody::Exchange {
+            exchange: None,
+            sender: None,
+            receiver: None,
+            message_kind: MessageKind::Asynchronous,
+            reply_to: None,
+            values: vec![],
+            operation: None,
+        },
+    );
+    set_body(
+        project.elements.get_mut(&branch).unwrap(),
+        OccurrenceBody::Branch {
+            guard: "requested".into(),
+            occurrences: vec![nested],
+        },
+    );
+    set_body(
+        project.elements.get_mut(&fragment).unwrap(),
+        OccurrenceBody::Fragment {
+            operator: FragmentOperator::Optional,
+            branches: vec![branch],
+        },
+    );
+    *project
+        .elements
+        .get_mut(&owner)
+        .unwrap()
+        .steps_mut()
+        .unwrap() = vec![first, second, fragment];
+    let view_record = diagram(owner, "nominal_view");
+    let other_record = diagram(owner, "review_view");
+    let view = view_record.id;
+    let other_view = other_record.id;
+    save(&mut project, view_record);
+    save(&mut project, other_record);
+    assert_admitted(&project);
+    Fixture {
+        project,
+        owner,
+        performer,
+        lane,
+        repeated_lane,
+        first,
+        second,
+        nested,
+        fragment,
+        branch,
+        view,
+        other_view,
+        exchange,
+    }
+}
+
+#[test]
+fn two_views_and_repeated_semantic_definitions_keep_independent_overrides() {
+    let mut f = fixture();
+    let semantics = (f.project.elements.clone(), f.project.relations.clone());
+    for (view, line, x) in [
+        (f.view, f.lane, 420.),
+        (f.view, f.repeated_lane, 680.),
+        (f.other_view, f.lane, 900.),
+    ] {
+        let result =
+            set_lane(&f.project, view, ScenarioLanePosition { lifeline: line, x }).unwrap();
+        save(&mut f.project, result);
+    }
+    for (view, id, y) in [
+        (f.view, f.first, 200.),
+        (f.view, f.second, 350.),
+        (f.other_view, f.first, 260.),
+    ] {
+        let result = set_message(
+            &f.project,
+            view,
+            ScenarioMessagePosition {
+                address: address(id),
+                send_y: y,
+            },
+        )
+        .unwrap();
+        save(&mut f.project, result);
+    }
+    assert_eq!(
+        layout(&f.project.diagrams[&f.view]).lanes,
+        vec![
+            ScenarioLanePosition {
+                lifeline: f.lane,
+                x: 420.
+            },
+            ScenarioLanePosition {
+                lifeline: f.repeated_lane,
+                x: 680.
+            },
+        ]
+    );
+    assert_eq!(
+        layout(&f.project.diagrams[&f.view])
+            .messages
+            .iter()
+            .map(|r| (r.address.occurrence, r.send_y))
+            .collect::<Vec<_>>(),
+        vec![(f.first, 200.), (f.second, 350.)]
+    );
+    assert_eq!(
+        layout(&f.project.diagrams[&f.other_view]).messages[0].send_y,
+        260.
+    );
+    assert_eq!(layout(&f.project.diagrams[&f.other_view]).lanes[0].x, 900.);
+    assert_eq!(
+        (f.project.elements.clone(), f.project.relations.clone()),
+        semantics
+    );
+    assert_admitted(&f.project);
+}
+
+#[test]
+fn own_nested_unfinished_message_is_admitted_but_expansion_is_not() {
+    let mut f = fixture();
+    let result = set_message(
+        &f.project,
+        f.view,
+        ScenarioMessagePosition {
+            address: address(f.nested),
+            send_y: -80.,
+        },
+    )
+    .unwrap();
+    save(&mut f.project, result);
+    assert_admitted(&f.project);
+    let before = f.project.clone();
+    let expanded = OccurrenceEndpoint {
+        references: vec![f.fragment],
+        occurrence: f.nested,
+    };
+    assert!(
+        set_message(
+            &f.project,
+            f.view,
+            ScenarioMessagePosition {
+                address: expanded.clone(),
+                send_y: 400.
+            }
+        )
+        .is_err()
+    );
+    assert!(remove_message(&f.project, f.view, &expanded).is_err());
+    assert_eq!(f.project, before);
+    payload(f.project.diagrams.get_mut(&f.view).unwrap()).messages[0].address = expanded;
+    assert!(has_code(&f.project, "scenario_layout_address"));
+}
+
+#[test]
+fn only_ordered_message_appearances_and_owned_lifelines_are_targets() {
+    let mut f = fixture();
+    assert!(
+        set_lane(
+            &f.project,
+            f.view,
+            ScenarioLanePosition {
+                lifeline: f.performer,
+                x: 10.
+            }
+        )
+        .is_err()
+    );
+    for id in [f.exchange, f.fragment, f.branch, f.owner, Id::new_v4()] {
+        assert!(
+            set_message(
+                &f.project,
+                f.view,
+                ScenarioMessagePosition {
+                    address: address(id),
+                    send_y: 100.
+                }
+            )
+            .is_err()
+        );
+    }
+    let foreign = f
+        .project
+        .add_element(Kind::Scenario, Layer::Oa, "Foreign", None)
+        .unwrap();
+    let foreign_lane = f
+        .project
+        .add_element(Kind::Lifeline, Layer::Oa, "Foreign lane", Some(foreign))
+        .unwrap();
+    assert!(remove_lane(&f.project, f.view, foreign_lane).is_err());
+    f.project.elements.get_mut(&f.first).unwrap().parent = Some(foreign);
+    assert!(
+        set_message(
+            &f.project,
+            f.view,
+            ScenarioMessagePosition {
+                address: address(f.first),
+                send_y: 100.
+            }
+        )
+        .is_err()
+    );
+    f.project.elements.get_mut(&f.first).unwrap().parent = Some(f.owner);
+    f.project
+        .elements
+        .get_mut(&f.owner)
+        .unwrap()
+        .steps_mut()
+        .unwrap()
+        .retain(|id| *id != f.first);
+    assert!(
+        set_message(
+            &f.project,
+            f.view,
+            ScenarioMessagePosition {
+                address: address(f.first),
+                send_y: 100.
+            }
+        )
+        .is_err()
+    );
+}
+
+#[test]
+fn duplicate_positions_reject_even_when_values_match() {
+    let mut f = fixture();
+    let lane = ScenarioLanePosition {
+        lifeline: f.lane,
+        x: 10.,
+    };
+    let message = ScenarioMessagePosition {
+        address: address(f.first),
+        send_y: 100.,
+    };
+    let entries = payload(f.project.diagrams.get_mut(&f.view).unwrap());
+    entries.lanes = vec![lane.clone(), lane.clone()];
+    entries.messages = vec![message.clone(), message.clone()];
+    assert!(has_code(&f.project, "duplicate_scenario_lane"));
+    assert!(has_code(&f.project, "duplicate_scenario_message"));
+    assert!(set_lane(&f.project, f.view, lane).is_err());
+    assert!(set_message(&f.project, f.view, message).is_err());
+    // Explicit removal can repair all duplicates of the targeted identity.
+    let result = remove_lane(&f.project, f.view, f.lane).unwrap();
+    save(&mut f.project, result);
+    let result = remove_message(&f.project, f.view, &address(f.first)).unwrap();
+    save(&mut f.project, result);
+    assert_admitted(&f.project);
+}
+
+#[test]
+fn sparse_absence_empty_payload_and_signed_zero_are_preserved() {
+    let mut f = fixture();
+    let absent = f.project.diagrams[&f.view].clone();
+    assert_eq!(remove_lane(&f.project, f.view, f.lane).unwrap(), absent);
+    assert_eq!(
+        remove_message(&f.project, f.view, &address(f.first)).unwrap(),
+        absent
+    );
+    assert!(
+        serde_json::to_value(&absent)
+            .unwrap()
+            .get("layout")
+            .is_none()
+    );
+    let result = set_lane(
+        &f.project,
+        f.view,
+        ScenarioLanePosition {
+            lifeline: f.lane,
+            x: -0.,
+        },
+    )
+    .unwrap();
+    save(&mut f.project, result);
+    let result = set_message(
+        &f.project,
+        f.view,
+        ScenarioMessagePosition {
+            address: address(f.first),
+            send_y: -0.,
+        },
+    )
+    .unwrap();
+    save(&mut f.project, result);
+    let result = set_lane(
+        &f.project,
+        f.view,
+        ScenarioLanePosition {
+            lifeline: f.lane,
+            x: 0.,
+        },
+    )
+    .unwrap();
+    assert_eq!(layout(&result).lanes[0].x.to_bits(), (-0.0_f32).to_bits());
+    let result = set_message(
+        &f.project,
+        f.view,
+        ScenarioMessagePosition {
+            address: address(f.first),
+            send_y: 0.,
+        },
+    )
+    .unwrap();
+    assert_eq!(
+        layout(&result).messages[0].send_y.to_bits(),
+        (-0.0_f32).to_bits()
+    );
+    assert_eq!(
+        serde_json::to_string(&result).unwrap(),
+        serde_json::to_string(&f.project.diagrams[&f.view]).unwrap()
+    );
+    let result = remove_lane(&f.project, f.view, f.lane).unwrap();
+    save(&mut f.project, result);
+    let result = remove_message(&f.project, f.view, &address(f.first)).unwrap();
+    assert_eq!(
+        result.layout,
+        Some(DiagramLayout::Scenario(ScenarioLayout::default()))
+    );
+    assert_ne!(result, absent);
+}
+
+#[test]
+fn bounds_are_structural_and_rejected_helpers_do_not_mutate_project() {
+    let mut f = fixture();
+    for value in [-MAX_COORDINATE, MAX_COORDINATE, -7., 0.] {
+        let result = set_lane(
+            &f.project,
+            f.view,
+            ScenarioLanePosition {
+                lifeline: f.lane,
+                x: value,
+            },
+        )
+        .unwrap();
+        save(&mut f.project, result);
+        let result = set_message(
+            &f.project,
+            f.view,
+            ScenarioMessagePosition {
+                address: address(f.first),
+                send_y: value,
+            },
+        )
+        .unwrap();
+        save(&mut f.project, result);
+        assert_admitted(&f.project);
+    }
+    let before = serde_json::to_string(&f.project).unwrap();
+    for value in [
+        f32::NAN,
+        f32::INFINITY,
+        f32::NEG_INFINITY,
+        MAX_COORDINATE + 1.,
+    ] {
+        assert!(
+            set_lane(
+                &f.project,
+                f.view,
+                ScenarioLanePosition {
+                    lifeline: f.lane,
+                    x: value
+                }
+            )
+            .is_err()
+        );
+        assert!(
+            set_message(
+                &f.project,
+                f.view,
+                ScenarioMessagePosition {
+                    address: address(f.first),
+                    send_y: value
+                }
+            )
+            .is_err()
+        );
+    }
+    assert_eq!(serde_json::to_string(&f.project).unwrap(), before);
+    payload(f.project.diagrams.get_mut(&f.view).unwrap()).messages[0].send_y = f32::NAN;
+    assert!(has_code(&f.project, "scenario_layout_coordinate"));
+}
+
+#[test]
+fn helpers_do_not_validate_unrelated_transient_records_in_repair_batches() {
+    let mut f = fixture();
+    payload(f.project.diagrams.get_mut(&f.view).unwrap())
+        .messages
+        .push(ScenarioMessagePosition {
+            address: address(f.second),
+            send_y: f32::INFINITY,
+        });
+    let result = set_lane(
+        &f.project,
+        f.view,
+        ScenarioLanePosition {
+            lifeline: f.lane,
+            x: 420.,
+        },
+    )
+    .unwrap();
+    save(&mut f.project, result);
+    assert!(has_code(&f.project, "scenario_layout_coordinate"));
+    let result = set_message(
+        &f.project,
+        f.view,
+        ScenarioMessagePosition {
+            address: address(f.second),
+            send_y: 300.,
+        },
+    )
+    .unwrap();
+    save(&mut f.project, result);
+    assert_admitted(&f.project);
+}
+
+#[test]
+fn projection_context_and_architecture_payloads_are_explicitly_separate() {
+    let mut f = fixture();
+    let scenario = f.project.diagrams[&f.view].projection;
+    assert_eq!(scenario.scenario(), Some(f.owner));
+    assert!(!scenario.is_architecture());
+    assert!(!scenario.includes(Kind::Lifeline));
+    assert!(ProjectionKind::Overview.is_architecture());
+    assert!(!ProjectionKind::StateMachine { machine: f.owner }.is_architecture());
+    f.project.diagrams.get_mut(&f.view).unwrap().layer = Layer::Sa;
+    assert!(has_code(&f.project, "scenario_diagram_context"));
+    assert!(remove_lane(&f.project, f.view, f.lane).is_err());
+    f.project.diagrams.get_mut(&f.view).unwrap().layer = Layer::Oa;
+    f.project
+        .diagrams
+        .get_mut(&f.view)
+        .unwrap()
+        .routes
+        .push(crate::EdgeRoute {
+            edge: f.exchange,
+            source_attachment: None,
+            target_attachment: None,
+            waypoints: vec![],
+            label: None,
+        });
+    assert!(has_code(&f.project, "scenario_diagram_content"));
+    f.project.diagrams.get_mut(&f.view).unwrap().routes.clear();
+    payload(f.project.diagrams.get_mut(&f.view).unwrap());
+    f.project.diagrams.get_mut(&f.view).unwrap().projection = ProjectionKind::Overview;
+    assert!(has_code(&f.project, "scenario_layout_projection"));
+    assert!(
+        set_lane(
+            &f.project,
+            f.view,
+            ScenarioLanePosition {
+                lifeline: f.lane,
+                x: 10.
+            }
+        )
+        .is_err()
+    );
+}
+
+#[test]
+fn typed_json_records_round_trip_and_reject_unknown_or_missing_fields() {
+    let mut f = fixture();
+    let result = set_message(
+        &f.project,
+        f.view,
+        ScenarioMessagePosition {
+            address: address(f.first),
+            send_y: 200.,
+        },
+    )
+    .unwrap();
+    save(&mut f.project, result);
+    let encoded = serde_json::to_value(&f.project.diagrams[&f.view]).unwrap();
+    assert_eq!(
+        serde_json::from_value::<Diagram>(encoded.clone()).unwrap(),
+        f.project.diagrams[&f.view]
+    );
+    assert_eq!(
+        encoded["layout"]["Scenario"]["messages"][0]["address"]["occurrence"],
+        serde_json::json!(f.first)
+    );
+    let mut unknown = encoded.clone();
+    unknown["layout"]["Scenario"]["messages"][0]["extra"] = serde_json::json!(1);
+    assert!(serde_json::from_value::<Diagram>(unknown).is_err());
+    let mut missing = encoded;
+    missing["layout"]["Scenario"]["messages"][0]["address"]
+        .as_object_mut()
+        .unwrap()
+        .remove("references");
+    assert!(serde_json::from_value::<Diagram>(missing).is_err());
+}
+
+#[test]
+fn deleting_only_actual_ids_preserves_latent_message_positions_and_other_views() {
+    let mut f = fixture();
+    let result = set_lane(
+        &f.project,
+        f.view,
+        ScenarioLanePosition {
+            lifeline: f.lane,
+            x: 420.,
+        },
+    )
+    .unwrap();
+    save(&mut f.project, result);
+    let result = set_message(
+        &f.project,
+        f.view,
+        ScenarioMessagePosition {
+            address: address(f.first),
+            send_y: 200.,
+        },
+    )
+    .unwrap();
+    save(&mut f.project, result);
+    let mut copied = f.project.diagrams[&f.view].clone();
+    copied.id = f.other_view;
+    copied.alias = "review_view".into();
+    copied.name = "Review view".into();
+    save(&mut f.project, copied.clone());
+    assert_admitted(&f.project);
+    assert_eq!(layout(&copied).messages[0].address.occurrence, f.first);
+    let mut candidate = f.project.diagrams[&f.view].clone();
+    prune_deleted(&mut candidate, &BTreeSet::from([f.lane, f.exchange]));
+    assert!(layout(&candidate).lanes.is_empty());
+    assert_eq!(layout(&candidate).messages.len(), 1);
+    prune_deleted(&mut candidate, &BTreeSet::from([f.first]));
+    assert!(layout(&candidate).messages.is_empty());
+    assert!(candidate.layout.is_some());
+    assert_eq!(f.project.diagrams[&f.other_view], copied);
+}
+
+#[test]
+fn reference_visitor_and_record_count_cover_explicit_rows() {
+    let f = fixture();
+    let mut d = f.project.diagrams[&f.view].clone();
+    assert_eq!(record_count(&d), 0);
+    let rows = payload(&mut d);
+    rows.lanes.push(ScenarioLanePosition {
+        lifeline: f.lane,
+        x: 50.,
+    });
+    rows.messages.push(ScenarioMessagePosition {
+        address: address(f.first),
+        send_y: 100.,
+    });
+    assert_eq!(record_count(&d), 3);
+    let replacement = Id::new_v4();
+    d.layout.as_mut().unwrap().visit_references(|id| {
+        if *id == f.first {
+            *id = replacement;
+        }
+    });
+    assert_eq!(layout(&d).messages[0].address.occurrence, replacement);
+    assert_eq!(layout(&d).messages[0].send_y, 100.);
+    assert_eq!(layout(&d).lanes[0].lifeline, f.lane);
+}
+
+#[test]
+fn a_real_scenario_use_never_imports_its_called_message_as_a_direct_target() {
+    let mut f = fixture();
+    let called = f
+        .project
+        .add_element(Kind::Scenario, Layer::Oa, "Called sequence", None)
+        .unwrap();
+    let Some(SharedBody::Scenario { viewpoint, .. }) =
+        f.project.elements.get_mut(&called).unwrap().shared_mut()
+    else {
+        panic!("Called Scenario fixture body");
+    };
+    *viewpoint = ScenarioViewpoint::ParticipantInteraction;
+    let called_message = f
+        .project
+        .add_element(Kind::Occurrence, Layer::Oa, "Called delivery", Some(called))
+        .unwrap();
+    set_body(
+        f.project.elements.get_mut(&called_message).unwrap(),
+        OccurrenceBody::Exchange {
+            exchange: None,
+            sender: None,
+            receiver: None,
+            message_kind: MessageKind::Asynchronous,
+            reply_to: None,
+            values: vec![],
+            operation: None,
+        },
+    );
+    *f.project
+        .elements
+        .get_mut(&called)
+        .unwrap()
+        .steps_mut()
+        .unwrap() = vec![called_message];
+    let usage = f
+        .project
+        .add_element(Kind::Occurrence, Layer::Oa, "Call sequence", Some(f.owner))
+        .unwrap();
+    set_body(
+        f.project.elements.get_mut(&usage).unwrap(),
+        OccurrenceBody::ScenarioUse {
+            scenario: Some(called),
+            bindings: vec![],
+        },
+    );
+    f.project
+        .elements
+        .get_mut(&f.owner)
+        .unwrap()
+        .steps_mut()
+        .unwrap()
+        .push(usage);
+    assert_admitted(&f.project);
+    for target in [
+        address(called_message),
+        address(usage),
+        OccurrenceEndpoint {
+            references: vec![usage],
+            occurrence: called_message,
+        },
+    ] {
+        assert!(
+            set_message(
+                &f.project,
+                f.view,
+                ScenarioMessagePosition {
+                    address: target,
+                    send_y: 200.
+                }
+            )
+            .is_err()
+        );
+    }
+}
+
+mod source_lifecycle;

crates/oa-core/src/scenario_layout/tests/source_lifecycle.rs

@@ -0,0 +1,302 @@
+//! Source/command lifecycle checks for the candidate payload. Public version
+//! assignment remains the coordinated codec integration gate.
+use super::*;
+use crate::{Command, Session, language, prepare_command, source_project::*};
+
+fn authored(f: &Fixture) -> CompiledSourceProject {
+    let mut bundle = format_bundle(&f.project);
+    let initial = compile_bundle(&bundle, ProjectLimits::default()).unwrap();
+    let location = &initial.index.declarations[&f.view];
+    let source = bundle.files.get_mut(&location.path).unwrap();
+    let text = format!(
+        r#"diagram nominal_view "Nominal review" id "{}" {{
+ projection {{ Scenario {{ scenario @{}; }}; }};
+ layout {{ Scenario {{
+  lanes [
+   // Controller spacing rationale.
+   {{ lifeline @ // first lane identity
+      {}; x 4.20e2; }},
+   // Repeated performer has its own lane.
+   {{ lifeline @{}; x 680; }}
+  ];
+  messages [
+   // First delivery timing rationale.
+   {{ address {{ references []; occurrence @{}; }}; send_y 2.00e2; }},
+   // Second delivery timing rationale.
+   {{ address {{ references []; occurrence @{}; }}; send_y 350; }}
+  ];
+ }}; }};
+}}
+"#,
+        f.view,
+        f.project.elements[&f.owner].alias,
+        f.project.elements[&f.lane].alias,
+        f.project.elements[&f.repeated_lane].alias,
+        f.project.elements[&f.first].alias,
+        f.project.elements[&f.second].alias
+    );
+    source.replace_range(location.span.start..location.span.end, &text);
+    compile_bundle(&bundle, ProjectLimits::default()).unwrap()
+}
+
+#[test]
+fn source_rows_follow_identity_order_and_keep_comments_numeric_spelling_and_file_ownership() {
+    let f = fixture();
+    let original = authored(&f);
+    let mut changed = original.decoded.project.clone();
+    let rows = payload(changed.diagrams.get_mut(&f.view).unwrap());
+    rows.lanes.swap(0, 1);
+    rows.messages.swap(0, 1);
+    rows.messages[0].send_y = 390.;
+    changed.elements.get_mut(&f.lane).unwrap().alias = "renamed_controller_lane".into();
+    let updated = update_bundle(&original, &changed, ProjectLimits::default()).unwrap();
+    assert_eq!(updated.decoded.project, changed);
+    let path = &original.index.declarations[&f.view].path;
+    assert_eq!(&updated.index.declarations[&f.view].path, path);
+    let text = &updated.bundle.files[path];
+    assert!(
+        text.find("// Repeated performer").unwrap() < text.find("// Controller spacing").unwrap(),
+        "{text}"
+    );
+    assert!(
+        text.find("// Second delivery").unwrap() < text.find("// First delivery").unwrap(),
+        "{text}"
+    );
+    assert!(
+        text.contains(
+            "lifeline @ // first lane identity\n      renamed_controller_lane; x 4.20e2;"
+        ),
+        "{text}"
+    );
+    assert!(text.contains("send_y 2.00e2"), "{text}");
+    assert!(text.contains("send_y 390"), "{text}");
+    for (other, bytes) in &original.bundle.files {
+        if other != path && !bytes.contains(&f.project.elements[&f.lane].alias) {
+            assert_eq!(&updated.bundle.files[other], bytes);
+        }
+    }
+    assert_eq!(
+        compile_bundle(&updated.bundle, ProjectLimits::default())
+            .unwrap()
+            .decoded
+            .project,
+        changed
+    );
+}
+
+#[test]
+fn source_identity_swap_keeps_each_coordinate_comment_with_its_original_object() {
+    let f = fixture();
+    let original = authored(&f);
+    let temporary = Id::new_v4();
+    let command = Command::Batch(vec![
+        Command::Reidentify(f.first, temporary),
+        Command::Reidentify(f.second, f.first),
+        Command::Reidentify(temporary, f.second),
+    ]);
+    let prepared = prepare_command(&original.decoded.project, &command).unwrap();
+    let mut changed = prepared.project;
+    payload(changed.diagrams.get_mut(&f.view).unwrap())
+        .messages
+        .swap(0, 1);
+    let updated = update_bundle_with_identity_map(
+        &original,
+        &changed,
+        &prepared.identity_map,
+        ProjectLimits::default(),
+    )
+    .unwrap();
+    assert_eq!(updated.decoded.project, changed);
+    let path = &original.index.declarations[&f.view].path;
+    let text = &updated.bundle.files[path];
+    assert!(
+        text.find("// Second delivery").unwrap() < text.find("// First delivery").unwrap(),
+        "{text}"
+    );
+    let first_comment = text.find("// First delivery").unwrap();
+    assert!(text[first_comment..].contains(&format!(
+        "occurrence @{}",
+        changed.elements[&f.second].alias
+    )));
+    assert!(text[first_comment..].contains("send_y 2.00e2"));
+}
+
+#[test]
+fn coordinate_batch_is_one_undo_and_numeric_noop_keeps_source_exact() {
+    let f = fixture();
+    let original = authored(&f);
+    let mut session = Session::new(original.decoded.project.clone());
+    session
+        .execute(Command::Batch(vec![
+            Command::SetScenarioLanePosition {
+                diagram: f.view,
+                position: ScenarioLanePosition {
+                    lifeline: f.lane,
+                    x: 510.,
+                },
+            },
+            Command::SetScenarioMessagePosition {
+                diagram: f.view,
+                position: ScenarioMessagePosition {
+                    address: address(f.second),
+                    send_y: 430.,
+                },
+            },
+        ]))
+        .unwrap();
+    let changed = session.project().clone();
+    assert_eq!(session.revision(), 1);
+    assert_eq!(changed.elements, original.decoded.project.elements);
+    assert_eq!(changed.relations, original.decoded.project.relations);
+    let updated = update_bundle(&original, &changed, ProjectLimits::default()).unwrap();
+    session.undo();
+    assert_eq!(session.project(), &original.decoded.project);
+    assert!(!session.can_undo());
+    session.redo();
+    assert_eq!(session.project(), &changed);
+    session
+        .execute(Command::SetScenarioMessagePosition {
+            diagram: f.view,
+            position: ScenarioMessagePosition {
+                address: address(f.second),
+                send_y: 430.,
+            },
+        })
+        .unwrap();
+    assert_eq!(session.revision(), 3);
+    let noop = update_bundle(&updated, session.project(), ProjectLimits::default()).unwrap();
+    assert_eq!(noop.bundle, updated.bundle);
+}
+
+#[test]
+fn absent_and_empty_payload_round_trip_distinctly_and_remove_does_not_materialize_absence() {
+    let f = fixture();
+    let before = language::format(&f.project);
+    let mut session = Session::new(f.project.clone());
+    session
+        .execute(Command::RemoveScenarioLanePosition {
+            diagram: f.view,
+            lifeline: f.lane,
+        })
+        .unwrap();
+    assert_eq!(session.project(), &f.project);
+    assert!(!session.can_undo());
+    assert_eq!(language::format(session.project()), before);
+    let mut present = f.project.clone();
+    present.diagrams.get_mut(&f.view).unwrap().layout =
+        Some(DiagramLayout::Scenario(ScenarioLayout::default()));
+    let text = language::format(&present);
+    assert_ne!(text, before);
+    assert_eq!(language::parse(&text).unwrap(), present);
+    assert_eq!(language::parse(&before).unwrap(), f.project);
+}
+
+#[test]
+fn invalid_layout_source_rejects_without_changing_last_compiled_workspace() {
+    let f = fixture();
+    let original = authored(&f);
+    let before = original.bundle.clone();
+    let path = original.index.declarations[&f.view].path.clone();
+    for replacement in ["x 1e30", "x not_a_number"] {
+        let mut candidate = before.clone();
+        let source = candidate.files.get_mut(&path).unwrap();
+        *source = source.replace("x 4.20e2", replacement);
+        assert!(compile_bundle(&candidate, ProjectLimits::default()).is_err());
+        assert_eq!(original.bundle, before);
+    }
+    let mut candidate = before.clone();
+    let source = candidate.files.get_mut(&path).unwrap();
+    *source = source.replace(
+        &format!("occurrence @{}", f.project.elements[&f.first].alias),
+        &format!("occurrence @{}", f.project.elements[&f.performer].alias),
+    );
+    assert!(compile_bundle(&candidate, ProjectLimits::default()).is_err());
+    assert_eq!(original.bundle, before);
+}
+
+#[test]
+fn explicit_none_survives_other_edits_while_real_payload_clear_removes_values() {
+    let f = fixture();
+    let mut bundle = format_bundle(&f.project);
+    let compiled = compile_bundle(&bundle, ProjectLimits::default()).unwrap();
+    let location = &compiled.index.declarations[&f.view];
+    let path = location.path.clone();
+    bundle.files.get_mut(&path).unwrap().insert_str(
+        location.span.end - 1,
+        "\n layout // explicitly automatic\n none;\n",
+    );
+    let original = compile_bundle(&bundle, ProjectLimits::default()).unwrap();
+    let mut described = original.decoded.project.clone();
+    described.diagrams.get_mut(&f.view).unwrap().description =
+        "Review spacing independently".into();
+    let updated = update_bundle(&original, &described, ProjectLimits::default()).unwrap();
+    assert!(updated.bundle.files[&path].contains("layout // explicitly automatic\n none;"));
+    assert_eq!(updated.decoded.project, described);
+    let mut empty = described.clone();
+    empty.diagrams.get_mut(&f.view).unwrap().layout =
+        Some(DiagramLayout::Scenario(ScenarioLayout::default()));
+    let present = update_bundle(&updated, &empty, ProjectLimits::default()).unwrap();
+    assert_eq!(present.decoded.project, empty);
+    assert!(present.bundle.files[&path].contains("// explicitly automatic"));
+    let cleared = update_bundle(&present, &described, ProjectLimits::default()).unwrap();
+    assert_eq!(cleared.decoded.project, described);
+    assert!(!cleared.bundle.files[&path].contains("layout"));
+    assert!(cleared.bundle.files[&path].contains("// explicitly automatic"));
+}
+
+#[test]
+fn compact_defaults_and_scenario_row_identity_compose_through_rename_and_clear() {
+    let f = fixture();
+    let initial = authored(&f);
+    let mut bundle = initial.bundle.clone();
+    let location = &initial.index.declarations[&f.performer];
+    bundle.files.get_mut(&location.path).unwrap().insert_str(
+        location.span.end - 1,
+        "\n description // explicitly default prose\n \"\";\n",
+    );
+    let original = compile_bundle(&bundle, ProjectLimits::default()).unwrap();
+    let mut expected = original.decoded.project.clone();
+    let performer = expected.elements.get_mut(&f.performer).unwrap();
+    performer.name = "Reviewed controller".into();
+    performer.alias = "reviewed_controller".into();
+    expected.elements.get_mut(&f.lane).unwrap().alias = "reviewed_lane".into();
+    let rows = payload(expected.diagrams.get_mut(&f.view).unwrap());
+    rows.lanes.swap(0, 1);
+    rows.messages.swap(0, 1);
+    rows.messages[0].send_y = 390.;
+    let updated = update_bundle(&original, &expected, ProjectLimits::default()).unwrap();
+    assert_eq!(updated.decoded.project, expected);
+    let element = &updated.index.declarations[&f.performer];
+    let text = &updated.bundle.files[&element.path][element.span.start..element.span.end];
+    assert!(
+        text.contains("description // explicitly default prose\n \"\";"),
+        "{text}"
+    );
+    assert!(
+        !text.contains("categories"),
+        "an omitted default must stay omitted: {text}"
+    );
+    let diagram = &updated.index.declarations[&f.view];
+    let text = &updated.bundle.files[&diagram.path][diagram.span.start..diagram.span.end];
+    assert!(
+        text.find("// Repeated performer").unwrap() < text.find("// Controller spacing").unwrap()
+    );
+    assert!(text.contains("reviewed_lane; x 4.20e2;"), "{text}");
+    assert!(text.find("// Second delivery").unwrap() < text.find("// First delivery").unwrap());
+    assert!(text.contains("send_y 2.00e2"), "{text}");
+    assert!(!text.contains("view_options"), "{text}");
+    expected.diagrams.get_mut(&f.view).unwrap().layout = None;
+    let cleared = update_bundle(&updated, &expected, ProjectLimits::default()).unwrap();
+    assert_eq!(cleared.decoded.project, expected);
+    let declaration = &cleared.index.declarations[&f.view];
+    let text =
+        &cleared.bundle.files[&declaration.path][declaration.span.start..declaration.span.end];
+    assert!(!text.contains("layout"), "{text}");
+    assert!(text.contains("// Controller spacing rationale."), "{text}");
+    assert_eq!(
+        update_bundle(&cleared, &expected, ProjectLimits::default())
+            .unwrap()
+            .bundle,
+        cleared.bundle,
+    );
+}

crates/oa-core/src/session.rs

@@ -23,6 +23,22 @@ pub enum Command {
     EditRelation(Id, Relation),
     CreateDiagram(Diagram),
     EditDiagram(Id, Diagram),
+    SetScenarioLanePosition {
+        diagram: Id,
+        position: ScenarioLanePosition,
+    },
+    RemoveScenarioLanePosition {
+        diagram: Id,
+        lifeline: Id,
+    },
+    SetScenarioMessagePosition {
+        diagram: Id,
+        position: ScenarioMessagePosition,
+    },
+    RemoveScenarioMessagePosition {
+        diagram: Id,
+        address: OccurrenceEndpoint,
+    },
     CreateArtifact(ArtifactLink),
     EditArtifact(Id, ArtifactLink),
     CreateTrace(Trace),
@@ -488,6 +504,26 @@ fn apply_command(
             reidentify_tracked(p, *old, value.id, provenance)?;
             Some(value.id)
         }
+        Command::SetScenarioLanePosition { diagram, position } => {
+            let replacement = crate::scenario_layout::set_lane(p, *diagram, position.clone())?;
+            p.diagrams.insert(*diagram, replacement);
+            Some(*diagram)
+        }
+        Command::RemoveScenarioLanePosition { diagram, lifeline } => {
+            let replacement = crate::scenario_layout::remove_lane(p, *diagram, *lifeline)?;
+            p.diagrams.insert(*diagram, replacement);
+            Some(*diagram)
+        }
+        Command::SetScenarioMessagePosition { diagram, position } => {
+            let replacement = crate::scenario_layout::set_message(p, *diagram, position.clone())?;
+            p.diagrams.insert(*diagram, replacement);
+            Some(*diagram)
+        }
+        Command::RemoveScenarioMessagePosition { diagram, address } => {
+            let replacement = crate::scenario_layout::remove_message(p, *diagram, address)?;
+            p.diagrams.insert(*diagram, replacement);
+            Some(*diagram)
+        }
         Command::CreateArtifact(value) => {
             vacant(p, value.id)?;
             p.artifact_links.insert(value.id, value.clone());
@@ -878,6 +914,7 @@ pub fn reidentify(p: &mut Project, old: Id, new: Id) -> Result<(), ModelError> {
         return Ok(());
     }
     vacant(p, new)?;
+    crate::references::check_remap(p, old, new)?;
     if p.id == old {
         p.id = new;
     } else if let Some(mut v) = p.elements.remove(&old) {
@@ -904,12 +941,17 @@ pub fn reidentify(p: &mut Project, old: Id, new: Id) -> Result<(), ModelError> {
             }
         }
     }
-    crate::references::remap_references(p, old, new);
+    crate::references::remap_references(p, old, new)?;
     Ok(())
 }
 fn layout(p: &mut Project, diagram: Id) -> Result<(), ModelError> {
     use std::collections::{BTreeMap, BTreeSet};
     let d = p.diagrams.get(&diagram).ok_or_else(missing)?;
+    if d.projection.scenario().is_some() {
+        return Err(ModelError(
+            "Scenario layout requires the Scenario geometry operation.".into(),
+        ));
+    }
     let parents = crate::projection::parents(p, d);
     let mut children: BTreeMap<Option<Id>, Vec<Id>> = BTreeMap::new();
     for (id, parent) in &parents {

crates/oa-core/src/source_defaults.rs

@@ -52,7 +52,13 @@ pub(crate) fn parser_fields(context: Context) -> Map<String, Value> {
                 _ => &["source", "target"],
             }
         }
-        Context::Diagram => &[],
+        Context::Diagram => {
+            // Admit the optional payload without restoring a synthetic null in
+            // CompleteForEdit: absence there distinguishes a real layout clear
+            // from an unrelated edit beside an authored explicit `layout none`.
+            fields.insert("layout".into(), Value::Null);
+            &[]
+        }
         Context::Node => &["element"],
         Context::Artifact => &["owner"],
         Context::Trace => &["oa", "sa"],

crates/oa-core/src/source_project.rs

@@ -972,7 +972,18 @@ pub fn update_bundle_with_identity_map(
             };
             let local = edits.entry(path.clone()).or_default();
             update.header(&actual.header, &previous.header, &next.header, local);
-            update.value(&actual.fields, Some(&previous.fields), &next.fields, local);
+            let context = if old.diagrams.contains_key(&id) {
+                EditContext::Diagram
+            } else {
+                EditContext::Other
+            };
+            update.value(
+                &actual.fields,
+                Some(&previous.fields),
+                &next.fields,
+                context,
+                local,
+            );
         }
     }
     if old.id != project.id || old.alias != project.alias || old.name != project.name {
@@ -1224,6 +1235,29 @@ impl<'a> InsertionSyntax<'a> {
     }
 }
 
+// Schema context is explicit: similarly named fields in arbitrary records must
+// never acquire Scenario row identity or move their authored trivia.
+#[derive(Clone, Copy)]
+enum EditContext {
+    Other,
+    Diagram,
+    Layout,
+    Scenario,
+    Lanes,
+    Messages,
+}
+impl EditContext {
+    fn field(self, name: &str) -> Self {
+        match (self, name) {
+            (Self::Diagram, "layout") => Self::Layout,
+            (Self::Layout, "Scenario") => Self::Scenario,
+            (Self::Scenario, "lanes") => Self::Lanes,
+            (Self::Scenario, "messages") => Self::Messages,
+            _ => Self::Other,
+        }
+    }
+}
+
 struct SyntaxUpdate<'a> {
     source: &'a str,
     before: &'a str,
@@ -1301,6 +1335,7 @@ impl SyntaxUpdate<'_> {
         actual: &language::EditValue,
         before: Option<&language::EditValue>,
         after: &language::EditValue,
+        context: EditContext,
         edits: &mut LocalEdits,
     ) {
         use language::EditKind;
@@ -1316,7 +1351,7 @@ impl SyntaxUpdate<'_> {
                         None
                     }
                 });
-                self.record(actual.span, fields, previous, next, edits);
+                self.record(actual.span, fields, previous, next, context, edits);
             }
             (EditKind::List(items), EditKind::List(next)) => {
                 let previous = before.and_then(|old| {
@@ -1326,7 +1361,7 @@ impl SyntaxUpdate<'_> {
                         None
                     }
                 });
-                self.list(actual.span, items, previous, next, edits);
+                self.list(actual.span, items, previous, next, context, edits);
             }
             (EditKind::Reference(_), EditKind::Reference(alias)) => {
                 let token = significant(&self.source[actual.span.start..actual.span.end])
@@ -1379,6 +1414,7 @@ impl SyntaxUpdate<'_> {
         actual: &BTreeMap<String, language::EditField>,
         before: Option<&BTreeMap<String, language::EditField>>,
         after: &BTreeMap<String, language::EditField>,
+        context: EditContext,
         edits: &mut LocalEdits,
     ) {
         // A typed constructor tag change retains shared fields and their trivia.
@@ -1402,7 +1438,13 @@ impl SyntaxUpdate<'_> {
                     },
                     new_key.clone(),
                 ));
-                self.value(&field.value, Some(&old.value), &new.value, edits);
+                self.value(
+                    &field.value,
+                    Some(&old.value),
+                    &new.value,
+                    context.field(new_key),
+                    edits,
+                );
                 return;
             }
         }
@@ -1414,9 +1456,16 @@ impl SyntaxUpdate<'_> {
                         .and_then(|fields| fields.get(key))
                         .map(|field| &field.value),
                     &next.value,
+                    context.field(key),
                     edits,
                 );
-            } else {
+            } else if !(matches!(context, EditContext::Diagram)
+                && key == "layout"
+                && before.is_some_and(|fields| !fields.contains_key(key)))
+            {
+                // Canonical None omits layout. Preserve an authored explicit
+                // none while another field changes; a real Some->None clear
+                // still removes the former payload and retains its trivia.
                 erase_syntax(self.source, field.span, edits);
             }
         }
@@ -1470,6 +1519,7 @@ impl SyntaxUpdate<'_> {
         actual: &[language::EditValue],
         before: Option<&[language::EditValue]>,
         after: &[language::EditValue],
+        context: EditContext,
         edits: &mut LocalEdits,
     ) {
         let previous = before.unwrap_or(&[]);
@@ -1482,6 +1532,7 @@ impl SyntaxUpdate<'_> {
                     self.old_aliases,
                     self.legacy_value_paths,
                     None,
+                    context,
                 )
             })
             .collect();
@@ -1494,6 +1545,7 @@ impl SyntaxUpdate<'_> {
                     self.new_aliases,
                     self.legacy_value_paths,
                     self.identity_origins,
+                    context,
                 )
             })
             .collect();
@@ -1522,7 +1574,7 @@ impl SyntaxUpdate<'_> {
                 .all(|(i, source)| *source == Some(i))
         {
             for (i, (current, next)) in actual.iter().zip(after).enumerate() {
-                self.value(current, previous.get(i), next, edits);
+                self.value(current, previous.get(i), next, EditContext::Other, edits);
             }
             return;
         }
@@ -1555,7 +1607,13 @@ impl SyntaxUpdate<'_> {
                 let chunk = chunks[index];
                 text.push_str(&self.source[chunk.start..current.span.start]);
                 let mut local = Vec::new();
-                self.value(current, previous.get(index), next, &mut local);
+                self.value(
+                    current,
+                    previous.get(index),
+                    next,
+                    EditContext::Other,
+                    &mut local,
+                );
                 text.push_str(&changed_text(self.source, current.span, local));
                 suffix = &self.source[current.span.end..chunk.end];
             } else {
@@ -1594,14 +1652,58 @@ impl SyntaxUpdate<'_> {
     }
 }
 
+fn scenario_item_key(
+    value: &language::EditValue,
+    aliases: &BTreeMap<String, String>,
+    context: EditContext,
+) -> Option<String> {
+    use language::EditKind;
+    let EditKind::Record(fields) = &value.kind else {
+        return None;
+    };
+    let reference = |value: &language::EditValue| {
+        if let EditKind::Reference(alias) = &value.kind {
+            aliases.get(alias).cloned()
+        } else {
+            None
+        }
+    };
+    match context {
+        EditContext::Lanes => {
+            reference(&fields.get("lifeline")?.value).map(|id| format!("scenario-lane:{id}"))
+        }
+        EditContext::Messages => {
+            let EditKind::Record(address) = &fields.get("address")?.value.kind else {
+                return None;
+            };
+            let occurrence = reference(&address.get("occurrence")?.value)?;
+            let path: Vec<_> = match address.get("references") {
+                None => Vec::new(),
+                Some(field) => {
+                    let EditKind::List(path) = &field.value.kind else {
+                        return None;
+                    };
+                    path.iter().map(reference).collect::<Option<Vec<_>>>()?
+                }
+            };
+            Some(format!("scenario-message:{}:{occurrence}", path.join("/")))
+        }
+        _ => None,
+    }
+}
+
 fn item_key(
     value: &language::EditValue,
     source: &str,
     aliases: &BTreeMap<String, String>,
     legacy_value_paths: bool,
     origins: Option<&BTreeMap<Id, Id>>,
+    context: EditContext,
 ) -> Option<String> {
     use language::EditKind;
+    if matches!(context, EditContext::Lanes | EditContext::Messages) {
+        return scenario_item_key(value, aliases, context);
+    }
     if matches!(value.kind, EditKind::Record(_))
         && let Some(key) = language::semantic_row_key(
             &source[value.span.start..value.span.end],

crates/oa-core/src/source_project/source_migration.rs

@@ -72,6 +72,11 @@ pub(super) fn upgrade(
                 &actual.fields,
                 Some(&actual.fields),
                 &next.fields,
+                if project.diagrams.contains_key(&id) {
+                    EditContext::Diagram
+                } else {
+                    EditContext::Other
+                },
                 edits.entry(path.clone()).or_default(),
             );
         }

crates/oa-core/src/transitions.rs

@@ -750,7 +750,7 @@ pub fn plan_transition(
                 );
                 continue;
             }
-            if !compatible_existing(project, *source, target, request.direction) {
+            if !counterpart_compatible(project, *source, target, request.direction) {
                 conflict(
                     &mut plan,
                     Some(*source),
@@ -1317,12 +1317,22 @@ fn compatible_kinds(source: Kind, target: Kind, direction: TransitionDirection)
     }
     inferred_kind(source, direction) == Some(target)
 }
-fn compatible_existing(
+/// Whether existing records have compatible layers, categories and kinds for
+/// an ordinary transition. This is candidate eligibility, not approval of a
+/// complete plan: properties, dependencies and structural conflicts still need
+/// the normal preview and apply validation. Manual traces are not restricted
+/// by this predicate.
+pub fn counterpart_compatible(
     p: &Project,
     source: Id,
     target: Id,
     direction: TransitionDirection,
 ) -> bool {
+    if p.layer_of(source) != Some(direction.source_layer())
+        || p.layer_of(target) != Some(direction.target_layer())
+    {
+        return false;
+    }
     match (p.elements.get(&source), p.elements.get(&target)) {
         (Some(a), Some(b)) => compatible_kinds(a.kind(), b.kind(), direction),
         _ => match (p.relations.get(&source), p.relations.get(&target)) {

crates/oa-core/src/validation.rs

@@ -619,6 +619,7 @@ pub fn validate(p: &Project) -> Vec<Issue> {
         }
         text(&mut out, d.id, "name", &d.name);
         text(&mut out, d.id, "description", &d.description);
+        crate::scenario_layout::validate_diagram(p, d, &mut out);
         let option_issues = if d.projection == ProjectionKind::Traceability {
             crate::view_options::validate_options_cross_layer(p, &d.view_options)
         } else {

crates/oa-core/tests/default_omission_preservation.rs

@@ -231,6 +231,7 @@ fn node_project() -> Project {
                 },
             )]),
             routes: vec![],
+            layout: None,
         },
     );
     expected

crates/oa-core/tests/release_routing.rs

@@ -41,6 +41,7 @@ fn fixture() -> Fixture {
             projection: ProjectionKind::Overview,
             view_options: Default::default(),
             nodes: BTreeMap::new(),
+            layout: None,
             routes: vec![],
         },
     );

crates/oa-core/tests/source7_contract.rs

@@ -261,7 +261,7 @@ fn source7_context_lifecycle_source_history_and_closed_admission() {
     assert_eq!(session.project(), &after);
     let fresh = Id::new_v4();
     let mut reidentified = after.clone();
-    references::remap_references(&mut reidentified, f.r1, fresh);
+    references::remap_references(&mut reidentified, f.r1, fresh).unwrap();
     let mut e = reidentified.elements.remove(&f.r1).unwrap();
     e.id = fresh;
     reidentified.elements.insert(fresh, e);

crates/oa-core/tests/state_diagrams.rs

@@ -20,6 +20,7 @@ fn view(p: &mut Project, machine: Id, alias: &str) -> Id {
             projection: ProjectionKind::StateMachine { machine },
             view_options: Default::default(),
             nodes: BTreeMap::new(),
+            layout: None,
             routes: vec![],
         },
     );

crates/oa-core/tests/transition_counterpart_compatibility.rs

@@ -0,0 +1,353 @@
+//! Existing counterpart eligibility is a layer/category/kind decision, not
+//! validation or acceptance of an entire transition plan. The catalog fixtures
+//! below intentionally contain partial records (unowned states, etc.). The
+//! final regression separately starts from a structurally valid real project.
+use oa_core::{transitions::*, *};
+use std::collections::{BTreeMap, BTreeSet};
+
+fn element(p: &mut Project, layer: Layer, kind: Kind) -> Id {
+    let id = Id::new_v4();
+    let body = if kind == Kind::Port {
+        // Legacy ports can exist in preserved OA models. This does not offer
+        // new typed SA implementation ports for creation in portless OA.
+        ElementBody::shared_in(
+            layer,
+            SharedBody::Port {
+                contract: PortContract::Legacy,
+                legacy: None,
+            },
+        )
+    } else {
+        ElementBody::new(kind, layer).unwrap()
+    };
+    p.elements.insert(
+        id,
+        Element {
+            id,
+            alias: format!("candidate_{}", id.simple()),
+            name: "Identical candidate label".into(),
+            description: String::new(),
+            parent: None,
+            body,
+        },
+    );
+    id
+}
+
+#[test]
+fn existing_element_candidates_obey_explicit_engineering_families_in_both_directions() {
+    // Contract: language.rst §5 trace families and the explicit capability /
+    // mission alternative. State constructors remain eligible for explicit
+    // review across the state family; selecting a candidate does not accept a
+    // constructor change or make invalid ownership legal.
+    let mut allowed: BTreeSet<(Kind, Kind)> = [
+        (Kind::Activity, Kind::Function),
+        (Kind::Entity, Kind::System),
+        (Kind::Entity, Kind::SystemActor),
+        (Kind::Actor, Kind::System),
+        (Kind::Actor, Kind::SystemActor),
+        (Kind::Capability, Kind::SystemCapability),
+        (Kind::OperationalMission, Kind::Mission),
+        (Kind::Capability, Kind::Mission),
+        (Kind::Process, Kind::FunctionalChain),
+    ]
+    .into_iter()
+    .collect();
+    for kind in [
+        Kind::ExchangeItem,
+        Kind::ExchangeCategory,
+        Kind::DataType,
+        Kind::DataField,
+        Kind::Interface,
+        Kind::Port,
+        Kind::Scenario,
+        Kind::Lifeline,
+        Kind::Occurrence,
+        Kind::StateMachine,
+        Kind::Region,
+        Kind::Event,
+        Kind::Constraint,
+    ] {
+        allowed.insert((kind, kind));
+    }
+    let vertices = [
+        Kind::State,
+        Kind::Mode,
+        Kind::Initial,
+        Kind::Final,
+        Kind::Choice,
+        Kind::Junction,
+        Kind::Fork,
+        Kind::Join,
+        Kind::ShallowHistory,
+        Kind::DeepHistory,
+        Kind::EntryPoint,
+        Kind::ExitPoint,
+        Kind::Terminate,
+    ];
+    for oa in vertices {
+        for sa in vertices {
+            allowed.insert((oa, sa));
+        }
+    }
+    let mut p = Project::empty();
+    let oa: BTreeMap<_, _> = Kind::ALL
+        .into_iter()
+        .filter(|kind| kind.supports(Layer::Oa))
+        .map(|kind| (kind, element(&mut p, Layer::Oa, kind)))
+        .collect();
+    let sa: BTreeMap<_, _> = Kind::ALL
+        .into_iter()
+        .filter(|kind| kind.supports(Layer::Sa))
+        .map(|kind| (kind, element(&mut p, Layer::Sa, kind)))
+        .collect();
+    let original = p.clone();
+    for (&oa_kind, &oa_id) in &oa {
+        for (&sa_kind, &sa_id) in &sa {
+            let expected = allowed.contains(&(oa_kind, sa_kind));
+            assert_eq!(
+                counterpart_compatible(&p, oa_id, sa_id, TransitionDirection::OaToSa),
+                expected,
+                "OA {oa_kind:?} → SA {sa_kind:?}"
+            );
+            assert_eq!(
+                counterpart_compatible(&p, sa_id, oa_id, TransitionDirection::SaToOa),
+                expected,
+                "SA {sa_kind:?} → OA {oa_kind:?}"
+            );
+        }
+    }
+    assert_eq!(
+        p, original,
+        "Eligibility must not establish correspondence or edit records"
+    );
+}
+
+fn relation(p: &mut Project, kind: RelationKind, anchor: Id) -> Id {
+    let id = Id::new_v4();
+    // Only the semantic layer and relation category participate in candidate
+    // eligibility. Endpoint compatibility belongs to full plan validation.
+    p.relations.insert(
+        id,
+        Relation {
+            id,
+            alias: format!("relation_{}", id.simple()),
+            name: "Identical relation label".into(),
+            description: String::new(),
+            body: RelationBody::new(kind, anchor, anchor),
+        },
+    );
+    id
+}
+
+#[test]
+fn existing_relation_candidates_distinguish_work_boundary_and_shared_relations() {
+    // Work and boundary exchanges are different families. The boundary /
+    // boundary pair permits preserved legacy OA boundary records; ordinary
+    // portless OA communication means map to SA boundary exchanges.
+    let mut allowed = vec![
+        (RelationKind::Interaction, RelationKind::FunctionalExchange),
+        (
+            RelationKind::CommunicationMean,
+            RelationKind::BoundaryExchange,
+        ),
+        (
+            RelationKind::BoundaryExchange,
+            RelationKind::BoundaryExchange,
+        ),
+    ];
+    let shared = [
+        RelationKind::Allocation,
+        RelationKind::InterfaceItemAllocation,
+        RelationKind::DataAssociation,
+        RelationKind::ExchangeAllocation,
+        RelationKind::CapabilityInvolvement,
+        RelationKind::CapabilityInclude,
+        RelationKind::CapabilityExtend,
+        RelationKind::CapabilityGeneralization,
+        RelationKind::MissionInvolvement,
+        RelationKind::MissionCapability,
+        RelationKind::SequenceLink,
+        RelationKind::ContextualLink,
+        RelationKind::ChainInvolvement,
+        RelationKind::InterfaceProvision,
+        RelationKind::InterfaceRequirement,
+        RelationKind::StateTransition,
+        RelationKind::Availability,
+        RelationKind::StateAction,
+    ];
+    for kind in shared {
+        allowed.push((kind, kind));
+    }
+    let mut p = Project::empty();
+    let oa_anchor = element(&mut p, Layer::Oa, Kind::Activity);
+    let sa_anchor = element(&mut p, Layer::Sa, Kind::Function);
+    let oa: Vec<_> = shared
+        .into_iter()
+        .chain([
+            RelationKind::Interaction,
+            RelationKind::CommunicationMean,
+            RelationKind::BoundaryExchange,
+            RelationKind::RoleRealization,
+            RelationKind::RoleAssignment,
+        ])
+        .map(|kind| (kind, relation(&mut p, kind, oa_anchor)))
+        .collect();
+    let sa: Vec<_> = shared
+        .into_iter()
+        .chain([
+            RelationKind::FunctionalExchange,
+            RelationKind::BoundaryExchange,
+            RelationKind::PortAllocation,
+        ])
+        .map(|kind| (kind, relation(&mut p, kind, sa_anchor)))
+        .collect();
+    for &(oa_kind, oa_id) in &oa {
+        for &(sa_kind, sa_id) in &sa {
+            let expected = allowed.contains(&(oa_kind, sa_kind));
+            assert_eq!(
+                counterpart_compatible(&p, oa_id, sa_id, TransitionDirection::OaToSa),
+                expected,
+                "OA {oa_kind:?} → SA {sa_kind:?}"
+            );
+            assert_eq!(
+                counterpart_compatible(&p, sa_id, oa_id, TransitionDirection::SaToOa),
+                expected,
+                "SA {sa_kind:?} → OA {oa_kind:?}"
+            );
+        }
+    }
+}
+
+#[test]
+fn candidate_eligibility_rejects_wrong_layers_categories_and_missing_identities() {
+    let mut p = Project::empty();
+    let oa = element(&mut p, Layer::Oa, Kind::Activity);
+    let sa = element(&mut p, Layer::Sa, Kind::Function);
+    let oa_exchange = relation(&mut p, RelationKind::Interaction, oa);
+    let sa_exchange = relation(&mut p, RelationKind::FunctionalExchange, sa);
+    let diagram = p.ensure_diagram(Layer::Sa);
+    let node = p.place(diagram, sa, Position { x: 1., y: 2. });
+    for (direction, source, target, source_relation, target_relation) in [
+        (
+            TransitionDirection::OaToSa,
+            oa,
+            sa,
+            oa_exchange,
+            sa_exchange,
+        ),
+        (
+            TransitionDirection::SaToOa,
+            sa,
+            oa,
+            sa_exchange,
+            oa_exchange,
+        ),
+    ] {
+        assert!(counterpart_compatible(&p, source, target, direction));
+        assert!(counterpart_compatible(
+            &p,
+            source_relation,
+            target_relation,
+            direction
+        ));
+        for (a, b) in [
+            (target, source),
+            (source, source),
+            (target, target),
+            (target_relation, source_relation),
+            (source_relation, source_relation),
+            (source, target_relation),
+            (source_relation, target),
+        ] {
+            assert!(!counterpart_compatible(&p, a, b, direction));
+        }
+        for absent_or_nonsemantic in [Id::nil(), Id::new_v4(), p.id, diagram, node] {
+            assert!(!counterpart_compatible(
+                &p,
+                source,
+                absent_or_nonsemantic,
+                direction
+            ));
+            assert!(!counterpart_compatible(
+                &p,
+                absent_or_nonsemantic,
+                target,
+                direction
+            ));
+        }
+    }
+    p.elements.remove(&sa);
+    assert!(!counterpart_compatible(
+        &p,
+        oa,
+        sa,
+        TransitionDirection::OaToSa
+    ));
+    assert!(!counterpart_compatible(
+        &p,
+        sa,
+        oa,
+        TransitionDirection::SaToOa
+    ));
+    // The retained relation header cannot borrow a layer from a deleted owner.
+    assert!(!counterpart_compatible(
+        &p,
+        oa_exchange,
+        sa_exchange,
+        TransitionDirection::OaToSa
+    ));
+}
+
+#[test]
+fn activity_picker_rejects_real_sa_port_and_agrees_with_explicit_plan_refusal() {
+    let p = Project::demo();
+    let original = p.clone();
+    assert!(validation::validate(&p).is_empty());
+    let source = p
+        .elements
+        .values()
+        .find(|e| e.kind() == Kind::Activity)
+        .unwrap()
+        .id;
+    let port = p
+        .elements
+        .values()
+        .find(|e| e.layer() == Layer::Sa && e.kind() == Kind::Port)
+        .unwrap()
+        .id;
+    let function = p
+        .elements
+        .values()
+        .find(|e| e.kind() == Kind::Function)
+        .unwrap()
+        .id;
+    assert!(counterpart_compatible(
+        &p,
+        source,
+        function,
+        TransitionDirection::OaToSa
+    ));
+    assert!(!counterpart_compatible(
+        &p,
+        source,
+        port,
+        TransitionDirection::OaToSa
+    ));
+    let mut request = TransitionRequest::new(TransitionDirection::OaToSa, vec![source]);
+    request.mappings.push(TransitionMapping {
+        source,
+        target: Some(port),
+        target_kind: None,
+    });
+    let plan = plan_transition(&p, &request).unwrap();
+    assert!(
+        plan.conflicts
+            .iter()
+            .any(|conflict| conflict.source == Some(source)
+                && conflict.target == Some(port)
+                && conflict.field.is_none())
+    );
+    assert!(apply_transition(&p, &plan).is_err());
+    assert_eq!(p, original);
+}

crates/oa-core/tests/transition_lifecycle.rs

@@ -0,0 +1,638 @@
+//! Endpoint lifecycle acceptance for the ordinary, prose-reviewed transition API.
+//! OA is portless; the SA half contains typed ports. Deletion expectations below
+//! are fixture-owned identity lists, never results of the deletion implementation.
+use oa_core::{
+    language, persistence,
+    source_project::{ProjectLimits, SourceBundle, compile_bundle},
+    transitions::*,
+    validation::{self, Severity},
+    *,
+};
+use std::collections::BTreeMap;
+
+struct Side {
+    root: Id,
+    elements: Vec<Id>,
+    exchange: Id,
+    diagram: Id,
+    nodes: Vec<Id>,
+    artifacts: Vec<Id>,
+}
+
+struct Fixture {
+    project: Project,
+    source: Side,
+    target: Side,
+    trace: Id,
+    trace_artifact: Id,
+}
+
+fn artifact(p: &mut Project, owner: Id, label: &str) -> Id {
+    let id = Id::new_v4();
+    p.artifact_links.insert(
+        id,
+        ArtifactLink {
+            id,
+            alias: p.fresh_alias(label, "evidence", id),
+            name: label.into(),
+            description: "Independently authored rationale".into(),
+            owner,
+            relation: ArtifactRelation::References,
+            uri: "git:engineering/design.md".into(),
+            revision: Some("review-17".into()),
+            fragment: Some("retained-decision".into()),
+        },
+    );
+    id
+}
+
+fn side(p: &mut Project, layer: Layer) -> Side {
+    let (kind, prefix, relation) = match layer {
+        Layer::Oa => (Kind::Activity, "Operational", RelationKind::Interaction),
+        Layer::Sa => (
+            Kind::Function,
+            "Technical",
+            RelationKind::FunctionalExchange,
+        ),
+    };
+    let root = p
+        .add_element(kind, layer, &format!("{prefix} design"), None)
+        .unwrap();
+    p.elements.get_mut(&root).unwrap().description =
+        format!("{prefix} independently reviewed intent");
+    let send = p
+        .add_element(kind, layer, &format!("{prefix} send"), Some(root))
+        .unwrap();
+    let receive = p
+        .add_element(kind, layer, &format!("{prefix} receive"), Some(root))
+        .unwrap();
+    p.elements.get_mut(&send).unwrap().description =
+        "Preserve the detailed sending responsibility".into();
+    p.elements.get_mut(&receive).unwrap().description =
+        "Preserve the detailed receiving responsibility".into();
+    // A shared, separately owned definition survives deletion of its users.
+    let item = p
+        .add_element(
+            Kind::ExchangeItem,
+            layer,
+            &format!("{prefix} information"),
+            None,
+        )
+        .unwrap();
+    *p.elements.get_mut(&item).unwrap().shared_mut().unwrap() = SharedBody::ExchangeItem {
+        kind: ExchangeItemKind::Information,
+        mechanism: ExchangeMechanism::Flow,
+        supertype: None,
+    };
+    p.add_element(
+        Kind::DataField,
+        layer,
+        &format!("{prefix} payload"),
+        Some(item),
+    )
+    .unwrap();
+    let exchange = p.relate(relation, &format!("{prefix} delivery"), send, receive);
+    let mut elements = vec![root, send, receive];
+    match &mut p.relations.get_mut(&exchange).unwrap().body {
+        RelationBody::Interaction { items, .. } => *items = vec![item],
+        RelationBody::FunctionalExchange {
+            items,
+            source_port,
+            target_port,
+            ..
+        } => {
+            *items = vec![item];
+            let (output, input) = (*source_port, *target_port);
+            *p.elements.get_mut(&output).unwrap().shared_mut().unwrap() = SharedBody::Port {
+                contract: PortContract::FunctionOutput {
+                    outgoing_items: vec![item],
+                },
+                legacy: None,
+            };
+            *p.elements.get_mut(&input).unwrap().shared_mut().unwrap() = SharedBody::Port {
+                contract: PortContract::FunctionInput {
+                    incoming_items: vec![item],
+                },
+                legacy: None,
+            };
+            elements.extend([output, input]);
+        }
+        _ => unreachable!(),
+    }
+    p.relations.get_mut(&exchange).unwrap().description =
+        "Retain direction, item contract and relation identity".into();
+    let diagram = p.ensure_diagram(layer);
+    p.diagrams.get_mut(&diagram).unwrap().projection = ProjectionKind::Decomposition;
+    let nodes = [root, send, receive]
+        .into_iter()
+        .enumerate()
+        .map(|(index, element)| {
+            p.place(
+                diagram,
+                element,
+                Position {
+                    x: 43.25 + index as f32 * 271.,
+                    y: 97.5 + index as f32 * 83.,
+                },
+            )
+        })
+        .collect::<Vec<_>>();
+    let root_node = p
+        .diagrams
+        .get_mut(&diagram)
+        .unwrap()
+        .nodes
+        .get_mut(&nodes[0])
+        .unwrap();
+    root_node.size = Size {
+        width: 611.,
+        height: 319.,
+    };
+    root_node.collapsed = true;
+    p.diagrams
+        .get_mut(&diagram)
+        .unwrap()
+        .routes
+        .push(EdgeRoute {
+            edge: exchange,
+            // Both directions must preserve authored endpoint preferences,
+            // including dormant preferences on the SA semantic-port edge.
+            source_attachment: Some(EdgeAttachment {
+                side: PortAnchorSide::Bottom,
+                offset: 0.2,
+            }),
+            target_attachment: Some(EdgeAttachment {
+                side: PortAnchorSide::Top,
+                offset: 0.8,
+            }),
+            waypoints: vec![Position {
+                x: 337.5,
+                y: 423.25,
+            }],
+            label: Some(EdgeLabel {
+                fraction: 0.7,
+                offset: Position { x: 11., y: -17. },
+            }),
+        });
+    let artifacts = [root, send, exchange, nodes[0]]
+        .into_iter()
+        .enumerate()
+        .map(|(index, owner)| artifact(p, owner, &format!("{prefix} evidence {index}")))
+        .collect();
+    artifact(p, item, &format!("{prefix} shared item evidence"));
+    Side {
+        root,
+        elements,
+        exchange,
+        diagram,
+        nodes,
+        artifacts,
+    }
+}
+
+fn accepted(p: &Project) {
+    let issues = validation::validate(p);
+    // This fixture deliberately isolates decomposition and correspondence from
+    // performer allocation and process/chain/scenario inclusion. Each surviving
+    // leaf (including a newly transitioned root) must have exactly those two
+    // incomplete-work warnings; each surviving local exchange lacks a behavior
+    // context. Check exact record IDs and fields, including duplicate warnings.
+    // The system of interest and item contracts are complete fixture facts.
+    assert!(
+        issues
+            .iter()
+            .all(|issue| issue.severity == Severity::Warning),
+        "{issues:?}"
+    );
+    let mut expected = Vec::new();
+    for element in p.elements.values().filter(|element| {
+        matches!(element.kind(), Kind::Activity | Kind::Function)
+            && !p
+                .elements
+                .values()
+                .any(|child| child.parent == Some(element.id) && child.kind() == element.kind())
+    }) {
+        expected.push(("unallocated_leaf", Some(element.id), Some("allocation")));
+        expected.push(("work_without_behavior_context", Some(element.id), None));
+    }
+    for relation in p.relations.values().filter(|relation| {
+        matches!(
+            relation.kind(),
+            RelationKind::Interaction | RelationKind::FunctionalExchange
+        )
+    }) {
+        expected.push(("exchange_without_behavior_context", Some(relation.id), None));
+    }
+    let mut actual = issues
+        .iter()
+        .map(|issue| (issue.code.as_str(), issue.element, issue.field.as_deref()))
+        .collect::<Vec<_>>();
+    expected.sort();
+    actual.sort();
+    assert_eq!(
+        actual, expected,
+        "Unexpected fixture diagnostics: {issues:?}"
+    );
+}
+
+fn round_trip(p: &Project) -> String {
+    accepted(p);
+    let json = serde_json::to_vec_pretty(p).unwrap();
+    assert_eq!(persistence::decode(&json).unwrap(), *p);
+    let source = language::format(p);
+    let compiled = compile_bundle(
+        &SourceBundle {
+            entry: "project.arcadia".into(),
+            files: BTreeMap::from([("project.arcadia".into(), source.clone())]),
+        },
+        ProjectLimits::default(),
+    )
+    .unwrap();
+    assert_eq!(compiled.decoded.project, *p);
+    assert_eq!(language::format(&compiled.decoded.project), source);
+    source
+}
+
+fn explicit(direction: TransitionDirection, source: Id, target: Id) -> TransitionRequest {
+    let mut request = TransitionRequest::new(direction, vec![source]);
+    request.mappings.push(TransitionMapping {
+        source,
+        target: Some(target),
+        target_kind: None,
+    });
+    request
+}
+
+fn fixture(direction: TransitionDirection) -> Fixture {
+    let mut project = Project::empty();
+    project.name = "Endpoint lifecycle conservation".into();
+    project
+        .add_element(Kind::System, Layer::Sa, "System of interest", None)
+        .unwrap();
+    let oa = side(&mut project, Layer::Oa);
+    let sa = side(&mut project, Layer::Sa);
+    let (source, target) = match direction {
+        TransitionDirection::OaToSa => (oa, sa),
+        TransitionDirection::SaToOa => (sa, oa),
+    };
+    accepted(&project);
+    let before = project.clone();
+    let mut request = explicit(direction, source.root, target.root);
+    for field in [TransitionField::Name, TransitionField::Description] {
+        request.resolutions.push(FieldResolution {
+            source: source.root,
+            field,
+            decision: FieldDecision::KeepTarget,
+        });
+    }
+    let plan = plan_transition(&project, &request).unwrap();
+    assert!(plan.conflicts.is_empty(), "{:?}", plan.conflicts);
+    project = apply_transition(&project, &plan).unwrap();
+    let trace = assert_only_new_trace(&before, &project, direction, source.root, target.root);
+    let mut without_trace = project.clone();
+    without_trace.traces.remove(&trace);
+    assert_eq!(
+        without_trace, before,
+        "Initial review must only add correspondence"
+    );
+    let trace_artifact = artifact(&mut project, trace, "Correspondence rationale");
+    round_trip(&project);
+    Fixture {
+        project,
+        source,
+        target,
+        trace,
+        trace_artifact,
+    }
+}
+
+fn assert_only_new_trace(
+    before: &Project,
+    after: &Project,
+    direction: TransitionDirection,
+    source: Id,
+    target: Id,
+) -> Id {
+    let added = after
+        .traces
+        .values()
+        .filter(|trace| !before.traces.contains_key(&trace.id))
+        .collect::<Vec<_>>();
+    assert_eq!(added.len(), 1);
+    assert_eq!(after.traces.len(), before.traces.len() + 1);
+    let trace = added[0];
+    let (oa, sa) = match direction {
+        TransitionDirection::OaToSa => (source, target),
+        TransitionDirection::SaToOa => (target, source),
+    };
+    assert_eq!(
+        (trace.oa, trace.sa, trace.kind),
+        (oa, sa, TraceKind::Refinement)
+    );
+    assert_eq!(
+        trace.baseline,
+        Some(TraceBaseline {
+            oa: after.properties(oa).unwrap(),
+            sa: after.properties(sa).unwrap(),
+            semantic: None,
+        })
+    );
+    assert_eq!(trace_drift(after, trace), Drift::Unchanged);
+    trace.id
+}
+
+fn expected_deletion(fixture: &Fixture, side: &Side) -> Project {
+    let mut expected = fixture.project.clone();
+    for id in &side.elements {
+        assert!(expected.elements.remove(id).is_some());
+    }
+    assert!(expected.relations.remove(&side.exchange).is_some());
+    assert!(expected.traces.remove(&fixture.trace).is_some());
+    for id in side.artifacts.iter().chain([&fixture.trace_artifact]) {
+        assert!(expected.artifact_links.remove(id).is_some());
+    }
+    let diagram = expected.diagrams.get_mut(&side.diagram).unwrap();
+    for id in &side.nodes {
+        assert!(diagram.nodes.remove(id).is_some());
+    }
+    // This fixture authored exactly one route, for its removed local exchange.
+    assert_eq!(diagram.routes.len(), 1);
+    assert_eq!(diagram.routes[0].edge, side.exchange);
+    diagram.routes.clear();
+    expected
+}
+
+fn unchanged_retry(p: &Project, direction: TransitionDirection, source: Id, target: Id) {
+    let request = TransitionRequest::new(direction, vec![source]);
+    let plan = plan_transition(p, &request).unwrap();
+    assert!(plan.conflicts.is_empty(), "{:?}", plan.conflicts);
+    assert_eq!(plan.changes.len(), 1);
+    assert_eq!(
+        (
+            plan.changes[0].source,
+            plan.changes[0].target,
+            plan.changes[0].action
+        ),
+        (source, target, TransitionAction::Reuse)
+    );
+    assert!(plan.changes[0].fields.is_empty());
+    assert!(plan.commands.is_empty(), "{:?}", plan.commands);
+    let mut session = Session::new(p.clone());
+    let revision = session.revision();
+    session
+        .execute(Command::Replace(apply_transition(p, &plan).unwrap()))
+        .unwrap();
+    assert_eq!(session.project(), p);
+    assert_eq!(session.revision(), revision);
+    assert!(!session.can_undo());
+}
+
+fn source_deletion(direction: TransitionDirection) {
+    let fixture = fixture(direction);
+    let original_source = round_trip(&fixture.project);
+    let expected = expected_deletion(&fixture, &fixture.source);
+    let mut session = Session::new(fixture.project.clone());
+    session
+        .execute(Command::Delete(fixture.source.root))
+        .unwrap();
+    // Whole-project equality covers every retained target child, typed SA port,
+    // exchange, placement, route, artifact, shared item and unchanged identity.
+    assert_eq!(session.project(), &expected);
+    let deleted_source = round_trip(session.project());
+    session.undo();
+    assert_eq!(session.project(), &fixture.project);
+    assert_eq!(round_trip(session.project()), original_source);
+    assert!(!session.can_undo(), "Deletion is one history transaction");
+    session.redo();
+    assert_eq!(session.project(), &expected);
+    assert_eq!(round_trip(session.project()), deleted_source);
+}
+
+fn implicit_creation(
+    p: &Project,
+    direction: TransitionDirection,
+    source: Id,
+    forbidden_target: Id,
+) -> (Project, Id) {
+    let request = TransitionRequest::new(direction, vec![source]);
+    let plan = plan_transition(p, &request).unwrap();
+    assert!(plan.conflicts.is_empty(), "{:?}", plan.conflicts);
+    assert_eq!(plan.changes.len(), 1);
+    let change = &plan.changes[0];
+    assert_eq!(change.source, source);
+    assert_eq!(change.action, TransitionAction::Create);
+    let target = change.target;
+    assert_ne!(target, forbidden_target);
+    assert!(!p.contains(target));
+    let after = apply_transition(p, &plan).unwrap();
+    let trace = assert_only_new_trace(p, &after, direction, source, target);
+    let created = &after.elements[&target];
+    assert_eq!(created.id, target, "Apply preserves the preview identity");
+    assert_eq!(created.name, p.elements[&source].name);
+    assert_eq!(created.description, p.elements[&source].description);
+    assert_eq!(created.parent, None);
+    assert_eq!(
+        created.body,
+        match direction {
+            TransitionDirection::OaToSa => ElementBody::Sa(SaBody::Function),
+            TransitionDirection::SaToOa => ElementBody::Oa(OaBody::Activity),
+        }
+    );
+    assert!(!created.alias.is_empty());
+    assert!(
+        !p.identities()
+            .iter()
+            .any(|(_, alias)| *alias == created.alias)
+    );
+    // Remove only the independently expected two additions. Any incidental
+    // mutation, clone of target children or extra correspondence fails here.
+    let mut retained = after.clone();
+    retained.elements.remove(&target);
+    retained.traces.remove(&trace);
+    assert_eq!(retained, *p);
+    round_trip(&after);
+    // Replaying a creation plan after acceptance violates its snapshot, while
+    // a fresh unchanged request reuses the accepted counterpart.
+    assert!(
+        apply_transition(&after, &plan)
+            .unwrap_err()
+            .0
+            .contains("stale")
+    );
+    unchanged_retry(&after, direction, source, target);
+    (after, target)
+}
+
+fn target_deletion(direction: TransitionDirection) {
+    let fixture = fixture(direction);
+    let request = TransitionRequest::new(direction, vec![fixture.source.root]);
+    let old_plan = plan_transition(&fixture.project, &request).unwrap();
+    assert!(old_plan.conflicts.is_empty());
+    let expected = expected_deletion(&fixture, &fixture.target);
+    let mut session = Session::new(fixture.project.clone());
+    session
+        .execute(Command::Delete(fixture.target.root))
+        .unwrap();
+    assert_eq!(session.project(), &expected);
+    round_trip(session.project());
+    let revision = session.revision();
+    assert!(
+        apply_transition(session.project(), &old_plan)
+            .unwrap_err()
+            .0
+            .contains("stale")
+    );
+    let explicit_plan = plan_transition(
+        session.project(),
+        &explicit(direction, fixture.source.root, fixture.target.root),
+    )
+    .unwrap();
+    assert!(
+        explicit_plan
+            .conflicts
+            .iter()
+            .any(|conflict| conflict.source == Some(fixture.source.root)
+                && conflict.target == Some(fixture.target.root)
+                && conflict.field.is_none())
+    );
+    assert!(apply_transition(session.project(), &explicit_plan).is_err());
+    assert_eq!(session.project(), &expected);
+    assert_eq!(session.revision(), revision);
+    let (created, _) = implicit_creation(
+        session.project(),
+        direction,
+        fixture.source.root,
+        fixture.target.root,
+    );
+    session.execute(Command::Replace(created.clone())).unwrap();
+    session.undo();
+    assert_eq!(session.project(), &expected);
+    session.undo();
+    assert_eq!(session.project(), &fixture.project);
+    assert!(!session.can_undo());
+    session.redo();
+    session.redo();
+    assert_eq!(session.project(), &created);
+    round_trip(session.project());
+}
+
+fn source_recreation(direction: TransitionDirection) {
+    let fixture = fixture(direction);
+    let mut replacement = fixture.project.elements[&fixture.source.root].clone();
+    replacement.id = Id::new_v4();
+    let source = replacement.id;
+    // Same alias, name and prose, different UUID: name matching must never
+    // silently relink the retained engineering design.
+    assert_ne!(source, fixture.source.root);
+    let deleted = execute_batch(&fixture.project, &[Command::Delete(fixture.source.root)]).unwrap();
+    assert_eq!(deleted, expected_deletion(&fixture, &fixture.source));
+    let recreated =
+        execute_batch(&deleted, &[Command::CreateElement(replacement.clone())]).unwrap();
+    let mut expected = deleted.clone();
+    expected.elements.insert(source, replacement);
+    assert_eq!(recreated, expected);
+    round_trip(&recreated);
+    let (implicit, new_target) =
+        implicit_creation(&recreated, direction, source, fixture.target.root);
+    assert!(implicit.elements.contains_key(&fixture.target.root));
+    assert_ne!(new_target, fixture.target.root);
+
+    // The explicit branch starts from exactly the same recreated project.
+    let mut request = explicit(direction, source, fixture.target.root);
+    let unreviewed = plan_transition(&recreated, &request).unwrap();
+    for field in [TransitionField::Name, TransitionField::Description] {
+        assert!(
+            unreviewed
+                .conflicts
+                .iter()
+                .any(|conflict| conflict.source == Some(source)
+                    && conflict.target == Some(fixture.target.root)
+                    && conflict.field == Some(field))
+        );
+    }
+    assert!(apply_transition(&recreated, &unreviewed).is_err());
+    request.resolutions = vec![
+        FieldResolution {
+            source,
+            field: TransitionField::Name,
+            decision: FieldDecision::TakeSource,
+        },
+        FieldResolution {
+            source,
+            field: TransitionField::Description,
+            decision: FieldDecision::KeepTarget,
+        },
+    ];
+    let plan = plan_transition(&recreated, &request).unwrap();
+    assert!(plan.conflicts.is_empty(), "{:?}", plan.conflicts);
+    assert_eq!(plan.changes.len(), 1);
+    assert_eq!(
+        (plan.changes[0].target, plan.changes[0].action),
+        (fixture.target.root, TransitionAction::Update)
+    );
+    assert_eq!(
+        plan.changes[0].fields,
+        vec![FieldChange {
+            field: TransitionField::Name,
+            before: recreated.elements[&fixture.target.root].name.clone(),
+            after: recreated.elements[&source].name.clone(),
+        }]
+    );
+    let relinked = apply_transition(&recreated, &plan).unwrap();
+    let new_trace = assert_only_new_trace(
+        &recreated,
+        &relinked,
+        direction,
+        source,
+        fixture.target.root,
+    );
+    assert_ne!(
+        new_trace, fixture.trace,
+        "Deleted correspondence is not silently resurrected"
+    );
+    let mut expected = recreated.clone();
+    expected
+        .elements
+        .get_mut(&fixture.target.root)
+        .unwrap()
+        .name = recreated.elements[&source].name.clone();
+    let mut without_trace = relinked.clone();
+    without_trace.traces.remove(&new_trace);
+    assert_eq!(
+        without_trace, expected,
+        "Only the reviewed target name may change; rich target design survives"
+    );
+    round_trip(&relinked);
+    unchanged_retry(&relinked, direction, source, fixture.target.root);
+    let original_source = round_trip(&recreated);
+    let mut session = Session::new(recreated.clone());
+    session.execute(Command::Replace(relinked)).unwrap();
+    session.undo();
+    assert_eq!(session.project(), &recreated);
+    assert_eq!(round_trip(session.project()), original_source);
+}
+
+#[test]
+fn oa_source_deletion_preserves_rich_sa_design_and_exact_undo() {
+    source_deletion(TransitionDirection::OaToSa);
+}
+#[test]
+fn sa_source_deletion_preserves_rich_portless_oa_design_and_exact_undo() {
+    source_deletion(TransitionDirection::SaToOa);
+}
+#[test]
+fn deleted_sa_target_refuses_old_plans_and_implicit_retry_creates_once() {
+    target_deletion(TransitionDirection::OaToSa);
+}
+#[test]
+fn deleted_oa_target_refuses_old_plans_and_implicit_retry_creates_once() {
+    target_deletion(TransitionDirection::SaToOa);
+}
+#[test]
+fn recreated_oa_identity_requires_explicit_relink_to_retained_sa_design() {
+    source_recreation(TransitionDirection::OaToSa);
+}
+#[test]
+fn recreated_sa_identity_requires_explicit_relink_to_retained_oa_design() {
+    source_recreation(TransitionDirection::SaToOa);
+}

crates/oa-desktop/examples/allocation_policy_probe.rs

@@ -0,0 +1,14 @@
+//! Focused test harness for the production Allocation planner and Document.
+//! This does not exercise App input, painting, or native gestures.
+
+#[cfg(test)]
+#[allow(dead_code)] // App-facing entry points are intentionally absent here.
+#[path = "../src/allocation_drag.rs"]
+mod allocation_drag;
+
+#[cfg(test)]
+#[allow(dead_code, unused_imports)] // App-facing API and reexports are absent here.
+#[path = "../src/document.rs"]
+mod document;
+
+fn main() {}

crates/oa-desktop/src/allocation_drag.rs

@@ -13,6 +13,19 @@ use oa_core::{
 };
 use std::collections::{BTreeMap, BTreeSet};
 
+// The pure planner is verified before its App gesture adapter is connected.
+#[allow(dead_code)]
+#[path = "allocation_drag/arrange.rs"]
+pub mod arrange;
+
+#[path = "allocation_drag/geometry.rs"]
+mod geometry;
+
+// The combined semantic planner is verified before connecting its App adapter.
+#[allow(dead_code)]
+#[path = "allocation_drag/assignment.rs"]
+pub mod assignment;
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum Destination {
     LayoutOnly,
@@ -76,6 +89,11 @@ pub enum Refusal {
 
 pub fn capture(p: &Project, diagram: Id, work: Id, placement: Id) -> Result<Scope, Refusal> {
     validate_candidate(p).map_err(|e| Refusal::InvalidCandidate(e.to_string()))?;
+    capture_validated(p, diagram, work, placement)
+}
+
+/// Collect work facts after the caller's single complete Project validation.
+fn capture_validated(p: &Project, diagram: Id, work: Id, placement: Id) -> Result<Scope, Refusal> {
     let d = p.diagrams.get(&diagram).ok_or(Refusal::StaleScope)?;
     let root = p.elements.get(&work).ok_or(Refusal::StaleScope)?;
     if !root.kind().is_work()
@@ -192,7 +210,6 @@ impl SemanticPlan {
     pub fn project(&self) -> &Project {
         &self.candidate
     }
-    #[cfg(test)]
     pub fn index(&self) -> &ViewIndex {
         &self.index
     }
@@ -232,8 +249,93 @@ pub fn plan_semantics(
     let same_performer =
         matches!(destination, Destination::Performer(id) if scope.uniform == Uniform::Assigned(id));
     let mut expected = p.clone();
-    let mut commands = Vec::new();
-    let mut deleted = BTreeSet::new();
+    let mut edits = IntendedEdits::default();
+    append_semantic_edits(
+        p,
+        scope,
+        destination,
+        allocation_ids,
+        &mut expected,
+        &mut edits,
+    )?;
+    // A route cannot survive the intentional deletion of its own edge, even in
+    // another diagram. No other saved-view cleanup is authorized by this drag.
+    for diagram in expected.diagrams.values_mut() {
+        diagram.routes.retain(|r| !edits.deleted.contains(&r.edge));
+    }
+    let actual = prepare_command(p, &Command::Batch(edits.commands.clone()))
+        .map_err(|e| Refusal::InvalidCandidate(e.to_string()))?
+        .project;
+    exact_project(&expected, &actual)?;
+    let retained_roles = scope
+        .leaves
+        .values()
+        .any(|l| !l.role_assignments.is_empty());
+    let label = match destination {
+        Destination::LayoutOnly => "Arrange only".into(),
+        Destination::Performer(id) if same_performer => format!("Arrange within {}", p.named(id)),
+        Destination::Performer(id) => format!(
+            "Assign {} leaf {} to {}{}",
+            scope.leaves.len(),
+            match (scope.diagram.layer, scope.leaves.len()) {
+                (Layer::Oa, 1) => "activity",
+                (Layer::Oa, _) => "activities",
+                (Layer::Sa, 1) => "function",
+                (Layer::Sa, _) => "functions",
+            },
+            p.named(id),
+            if retained_roles {
+                " — explicit assignment; role responsibility retained"
+            } else {
+                ""
+            }
+        ),
+        Destination::OutsidePerformers if edits.commands.is_empty() => {
+            "Arrange unassigned work — decomposition retained".into()
+        }
+        Destination::OutsidePerformers => "Remove assignment — decomposition retained".into(),
+    };
+    let warnings = validation::validate(&actual)
+        .into_iter()
+        .filter(|i| i.severity == Severity::Warning)
+        .collect();
+    let index = ViewIndex::new(&actual);
+    Ok(SemanticPlan {
+        scope: scope.clone(),
+        destination,
+        label,
+        warnings,
+        accepted: p.clone(),
+        candidate: actual,
+        index,
+        commands: edits.commands,
+        before_visible,
+        before_expanded,
+    })
+}
+
+#[derive(Default)]
+struct IntendedEdits {
+    commands: Vec<Command>,
+    deleted: BTreeSet<Id>,
+    changed: BTreeSet<Id>,
+}
+
+/// Read each root's accepted responsibility while accumulating one intended
+/// Project, reserving relation identities and aliases across every root.
+fn append_semantic_edits(
+    p: &Project,
+    scope: &Scope,
+    destination: Destination,
+    allocation_ids: &BTreeMap<Id, Id>,
+    expected: &mut Project,
+    edits: &mut IntendedEdits,
+) -> Result<(), Refusal> {
+    let same_performer =
+        matches!(destination, Destination::Performer(id) if scope.uniform == Uniform::Assigned(id));
+    let commands = &mut edits.commands;
+    let deleted = &mut edits.deleted;
+    let changed = &mut edits.changed;
     if destination != Destination::LayoutOnly && !same_performer {
         for (work, leaf) in &scope.leaves {
             match destination {
@@ -246,6 +348,7 @@ pub fn plan_semantics(
                                 target: *work,
                             };
                             expected.relations.insert(edited.id, edited.clone());
+                            changed.insert(*work);
                             commands.push(Command::EditRelation(edited.id, edited));
                         }
                     } else {
@@ -269,6 +372,7 @@ pub fn plan_semantics(
                             },
                         };
                         expected.relations.insert(id, relation.clone());
+                        changed.insert(*work);
                         commands.push(Command::CreateRelation(relation));
                     }
                 }
@@ -327,6 +431,7 @@ pub fn plan_semantics(
                     if let Some(existing) = &leaf.direct {
                         expected.relations.remove(&existing.id);
                         deleted.insert(existing.id);
+                        changed.insert(*work);
                         commands.push(Command::Delete(existing.id));
                     }
                 }
@@ -334,60 +439,7 @@ pub fn plan_semantics(
             }
         }
     }
-    // A route cannot survive the intentional deletion of its own edge, even in
-    // another diagram. No other saved-view cleanup is authorized by this drag.
-    for diagram in expected.diagrams.values_mut() {
-        diagram.routes.retain(|r| !deleted.contains(&r.edge));
-    }
-    let actual = prepare_command(p, &Command::Batch(commands.clone()))
-        .map_err(|e| Refusal::InvalidCandidate(e.to_string()))?
-        .project;
-    exact_project(&expected, &actual)?;
-    let retained_roles = scope
-        .leaves
-        .values()
-        .any(|l| !l.role_assignments.is_empty());
-    let label = match destination {
-        Destination::LayoutOnly => "Arrange only".into(),
-        Destination::Performer(id) if same_performer => format!("Arrange within {}", p.named(id)),
-        Destination::Performer(id) => format!(
-            "Assign {} leaf {} to {}{}",
-            scope.leaves.len(),
-            match (scope.diagram.layer, scope.leaves.len()) {
-                (Layer::Oa, 1) => "activity",
-                (Layer::Oa, _) => "activities",
-                (Layer::Sa, 1) => "function",
-                (Layer::Sa, _) => "functions",
-            },
-            p.named(id),
-            if retained_roles {
-                " — explicit assignment; role responsibility retained"
-            } else {
-                ""
-            }
-        ),
-        Destination::OutsidePerformers if commands.is_empty() => {
-            "Arrange unassigned work — decomposition retained".into()
-        }
-        Destination::OutsidePerformers => "Remove assignment — decomposition retained".into(),
-    };
-    let warnings = validation::validate(&actual)
-        .into_iter()
-        .filter(|i| i.severity == Severity::Warning)
-        .collect();
-    let index = ViewIndex::new(&actual);
-    Ok(SemanticPlan {
-        scope: scope.clone(),
-        destination,
-        label,
-        warnings,
-        accepted: p.clone(),
-        candidate: actual,
-        index,
-        commands,
-        before_visible,
-        before_expanded,
-    })
+    Ok(())
 }
 
 /// World-space rectangle in the gesture's frozen transform. The UI resolver
@@ -432,6 +484,57 @@ pub struct PresentationContext {
     pub target: Option<TargetPresentation>,
 }
 
+impl PresentationContext {
+    fn header_visible(self, header: Rect, outgoing: bool) -> bool {
+        if !outgoing {
+            return self.viewport.contains(header);
+        }
+        // Leaving a performer must not require fitting the entire work card
+        // inside the camera. Retain a 24px grab region so the result stays
+        // directly reachable; geometry/model admission is independent.
+        let width = (header.position.x + header.size.width)
+            .min(self.viewport.position.x + self.viewport.size.width)
+            - header.position.x.max(self.viewport.position.x);
+        let height = (header.position.y + header.size.height)
+            .min(self.viewport.position.y + self.viewport.size.height)
+            - header.position.y.max(self.viewport.position.y);
+        width * self.zoom >= 24. && height * self.zoom >= 24.
+    }
+}
+
+#[test]
+fn outgoing_header_retains_a_grab_region_without_requiring_full_camera_containment() {
+    let context = PresentationContext {
+        viewport: Rect {
+            position: Position { x: 0., y: 0. },
+            size: Size {
+                width: 800.,
+                height: 400.,
+            },
+        },
+        zoom: 0.75,
+        target: None,
+    };
+    let mut header = Rect {
+        position: Position { x: -100., y: 30. },
+        size: Size {
+            width: 224.,
+            height: 62.,
+        },
+    };
+    assert!(context.header_visible(header, true));
+    assert!(!context.header_visible(header, false));
+    header.position.x = -192.; // exactly 32 world pixels = 24 logical pixels
+    assert!(context.header_visible(header, true));
+    header.position.x -= 1.;
+    assert!(!context.header_visible(header, true));
+    header.position.x = 0.;
+    header.position.y = 368.;
+    assert!(context.header_visible(header, true));
+    header.position.y += 1.;
+    assert!(!context.header_visible(header, true));
+}
+
 #[derive(Debug)]
 pub struct PlacementPlan {
     pub diagram: Diagram,
@@ -443,8 +546,8 @@ pub struct PlacementPlan {
     commands: Vec<Command>,
 }
 
-/// `requested` is the original selected placement position plus pointer motion
-/// in the frozen transform (therefore preserving the press offset). Snap only
+/// `requested` preserves the frozen pointer offset unless the caller proposes
+/// bounded outward clearance for an outgoing drop. Snap only
 /// this root; apply the resulting identical delta to captured Q and its routes.
 /// No whole Project clone, validator or semantic ViewIndex rebuild occurs here.
 pub fn place(
@@ -462,60 +565,18 @@ pub fn place(
             "Make room or adjust the view, then drag again.".into(),
         ));
     }
-    let root = &plan.scope.placements[&plan.scope.placement];
-    let delta = Position {
-        x: (requested.x / 10.).round() * 10. - root.position.x,
-        y: (requested.y / 10.).round() * 10. - root.position.y,
-    };
-    let mut diagram = plan.candidate.diagrams[&plan.scope.diagram.id].clone();
-    let mut commands = Vec::new();
-    let mut deltas = BTreeMap::new();
-    for (id, original) in &plan.scope.placements {
-        let node = diagram.nodes.get_mut(id).ok_or(Refusal::StaleScope)?;
-        node.position = Position {
-            x: original.position.x + delta.x,
-            y: original.position.y + delta.y,
-        };
-        if !(Rect {
-            position: node.position,
-            size: node.size,
-        })
-        .valid()
-        {
-            return Err(Refusal::InvalidCandidate(
-                "Moved coordinates exceed the model bounds.".into(),
-            ));
-        }
-        deltas.insert(*id, delta);
-        if node != original {
-            commands.push(Command::EditNode {
-                diagram: diagram.id,
-                original: *id,
-                node: node.clone(),
-            });
-        }
-    }
-    // Resolve endpoints using the captured accepted semantics, not a newly
-    // regrouped descendant walk. Own-edge deletions were removed above already.
-    for route in projection::translated_routes(&plan.accepted, &plan.scope.diagram, &deltas) {
-        if let Some(existing) = diagram.routes.iter_mut().find(|r| r.edge == route.edge) {
-            if route.waypoints.iter().any(|p| {
-                !p.x.is_finite()
-                    || !p.y.is_finite()
-                    || p.x.abs() > MAX_COORDINATE
-                    || p.y.abs() > MAX_COORDINATE
-            }) {
-                return Err(Refusal::InvalidCandidate(
-                    "Moved route exceeds the model bounds.".into(),
-                ));
-            }
-            *existing = route.clone();
-            commands.push(Command::SetEdgeRoute {
-                diagram: diagram.id,
-                route,
-            });
-        }
-    }
+    let geometry::Translation {
+        mut diagram,
+        mut commands,
+        delta,
+    } = geometry::translate(
+        &plan.accepted,
+        &plan.scope.diagram,
+        &plan.candidate.diagrams[&plan.scope.diagram.id],
+        &plan.scope.placements,
+        plan.scope.placement,
+        requested,
+    )?;
     let mut unfolded = None;
     if let Destination::Performer(performer) = plan.destination {
         let target = presentation.target.ok_or_else(|| {
@@ -566,7 +627,7 @@ pub fn place(
             height: selected.size.height.min(62.),
         },
     };
-    if !presentation.viewport.contains(header) {
+    if !presentation.header_visible(header, plan.destination == Destination::OutsidePerformers) {
         return Err(Refusal::LayoutRequired(
             "Make room or adjust the view, then drag again.".into(),
         ));
@@ -833,4 +894,5 @@ fn exact_project(expected: &Project, actual: &Project) -> Result<(), Refusal> {
 }
 
 #[cfg(test)]
+#[path = "allocation_drag/tests.rs"]
 mod tests;

crates/oa-desktop/src/allocation_drag/arrange.rs

@@ -0,0 +1,232 @@
+//! Explicit, semantics-preserving arrangement of one or more Allocation cards.
+//!
+//! The App must admit the entire original typed selection before converting it
+//! to placement/element identities. These values do not grant input authority.
+use super::*;
+
+#[derive(Debug)]
+pub struct Plan {
+    accepted: Project,
+    diagram: Id,
+    selected: BTreeMap<Id, Id>,
+    anchor: Id,
+    placements: BTreeMap<Id, NodePlacement>,
+    expanded_ids: BTreeSet<Id>,
+    index: ViewIndex,
+    before_visible: ProjectedView,
+    before_expanded: ProjectedView,
+}
+
+impl Plan {
+    pub fn project(&self) -> &Project {
+        &self.accepted
+    }
+
+    pub fn index(&self) -> &ViewIndex {
+        &self.index
+    }
+
+    pub fn affected(&self) -> &BTreeMap<Id, NodePlacement> {
+        &self.placements
+    }
+
+    pub fn selected(&self) -> &BTreeMap<Id, Id> {
+        &self.selected
+    }
+
+    pub fn anchor(&self) -> Id {
+        self.anchor
+    }
+
+    pub fn diagram(&self) -> &Diagram {
+        &self.accepted.diagrams[&self.diagram]
+    }
+}
+
+/// Capture every original placement identity before normalizing semantic roots.
+/// Document/revision/selection-generation and clean-owner guards belong to App.
+pub fn capture(
+    p: &Project,
+    diagram: Id,
+    selected: &BTreeMap<Id, Id>,
+    anchor: Id,
+) -> Result<Plan, Refusal> {
+    validate_candidate(p).map_err(|e| Refusal::InvalidCandidate(e.to_string()))?;
+    let d = p.diagrams.get(&diagram).ok_or(Refusal::StaleScope)?;
+    if d.projection != ProjectionKind::Allocation
+        || selected.is_empty()
+        || !selected.contains_key(&anchor)
+    {
+        return Err(Refusal::Ineligible(
+            "Arrange requires selected placements and a selected anchor in an Allocation view."
+                .into(),
+        ));
+    }
+    let index = ViewIndex::new(p);
+    let before_visible = projection::project_diagram_with_index(p, d, &index);
+    let visible: BTreeMap<_, _> = before_visible
+        .nodes
+        .iter()
+        .map(|n| (n.id, n.element))
+        .collect();
+    let mut work = BTreeMap::new();
+    let mut performers = Vec::new();
+    for (placement, element) in selected {
+        let node = d.nodes.get(placement).ok_or(Refusal::StaleScope)?;
+        let record = p.elements.get(element).ok_or(Refusal::StaleScope)?;
+        if node.element != *element || visible.get(placement) != Some(element) {
+            return Err(Refusal::StaleScope);
+        }
+        if record.layer() != d.layer || !(record.kind().is_work() || record.kind().is_performer()) {
+            return Err(Refusal::Ineligible(
+                "Arrange requires only activities, functions or performers in this layer.".into(),
+            ));
+        }
+        if record.kind().is_work() {
+            work.insert(*element, *placement);
+        } else {
+            performers.push(*placement);
+        }
+    }
+
+    let mut placements = BTreeMap::new();
+    for (element, placement) in &work {
+        let root = &p.elements[element];
+        let mut ancestor = root.parent;
+        let mut covered = false;
+        let mut seen = BTreeSet::new();
+        while let Some(id) = ancestor {
+            if !seen.insert(id) {
+                return Err(Refusal::StaleScope);
+            }
+            let parent = p.elements.get(&id).ok_or(Refusal::StaleScope)?;
+            if parent.kind() != root.kind() {
+                break;
+            }
+            if work.contains_key(&id) {
+                covered = true;
+                break;
+            }
+            ancestor = parent.parent;
+        }
+        if !covered {
+            placements.extend(capture_validated(p, diagram, *element, *placement)?.placements);
+        }
+    }
+    for performer in performers {
+        for id in
+            std::iter::once(performer).chain(projection::descendant_nodes(p, diagram, performer))
+        {
+            placements.insert(id, d.nodes.get(&id).ok_or(Refusal::StaleScope)?.clone());
+        }
+    }
+
+    // Arrange preserves ancestry, so accepted diagnostic identities also apply
+    // to every translated candidate.
+    let expanded_ids = geometry::expansion_ids(p, d, &index, &placements)?;
+    let before_expanded = geometry::expanded_view(p, d, &index, &expanded_ids);
+    Ok(Plan {
+        accepted: p.clone(),
+        diagram,
+        selected: selected.clone(),
+        anchor,
+        placements,
+        expanded_ids,
+        index,
+        before_visible,
+        before_expanded,
+    })
+}
+
+/// Snap the captured anchor once; preview the complete union without cloning or
+/// validating a Project, rebuilding its semantic index, or expanding scope.
+pub fn place(
+    plan: &Plan,
+    requested: Position,
+    presentation: PresentationContext,
+) -> Result<PlacementPlan, Refusal> {
+    if presentation.target.is_some() {
+        return Err(Refusal::Ineligible(
+            "Arrange only has no performer destination.".into(),
+        ));
+    }
+    if !requested.x.is_finite()
+        || !requested.y.is_finite()
+        || !presentation.viewport.valid()
+        || !presentation.zoom.is_finite()
+        || presentation.zoom <= 0.
+    {
+        return Err(Refusal::LayoutRequired(
+            "Make room or adjust the view, then drag again.".into(),
+        ));
+    }
+    let geometry::Translation {
+        diagram,
+        commands,
+        delta,
+    } = geometry::translate(
+        &plan.accepted,
+        plan.diagram(),
+        plan.diagram(),
+        &plan.placements,
+        plan.anchor,
+        requested,
+    )?;
+    let view = projection::project_diagram_with_index(&plan.accepted, &diagram, &plan.index);
+    let expanded =
+        geometry::expanded_view(&plan.accepted, &diagram, &plan.index, &plan.expanded_ids);
+    // Preserve Arrange's refusal precedence: projected bounds, then rigidity,
+    // then overlap growth. The shared scene check combines bounds and overlaps.
+    let scenes = match geometry::check_scenes(
+        &plan.before_visible,
+        &plan.before_expanded,
+        &view,
+        &expanded,
+    ) {
+        Err(error @ Refusal::InvalidCandidate(_)) => return Err(error),
+        result => result,
+    };
+    geometry::check_rigid(&plan.before_expanded, &expanded, &plan.placements, delta)?;
+    scenes?;
+    geometry::check_headers(&view, &plan.selected, presentation, false)?;
+    Ok(PlacementPlan {
+        diagram,
+        view,
+        delta,
+        unfolded: None,
+        requested,
+        presentation,
+        commands,
+    })
+}
+
+/// Recompute the candidate and compare the complete expected Project before the
+/// caller performs one source-admitted transaction. None means no history entry.
+pub fn finish(
+    plan: &Plan,
+    live: &Project,
+    placement: &PlacementPlan,
+) -> Result<Option<Command>, Refusal> {
+    if live != &plan.accepted {
+        return Err(Refusal::StaleScope);
+    }
+    let checked = place(plan, placement.requested, placement.presentation)?;
+    if checked.diagram != placement.diagram
+        || checked.view != placement.view
+        || checked.delta != placement.delta
+        || checked.unfolded != placement.unfolded
+        || checked.commands != placement.commands
+    {
+        return Err(Refusal::StaleScope);
+    }
+    let mut expected = plan.accepted.clone();
+    expected
+        .diagrams
+        .insert(checked.diagram.id, checked.diagram);
+    let command = Command::Batch(checked.commands);
+    let actual = prepare_command(live, &command)
+        .map_err(|e| Refusal::InvalidCandidate(e.to_string()))?
+        .project;
+    exact_project(&expected, &actual)?;
+    Ok((actual != *live).then_some(command))
+}

crates/oa-desktop/src/allocation_drag/arrange_tests.rs

@@ -0,0 +1,443 @@
+use super::*;
+
+struct Distributed {
+    f: Fixture,
+    a: Id,
+    b: Id,
+    x: Id,
+    y: Id,
+    internal: Id,
+}
+
+fn distributed(layer: Layer, folded: bool) -> Distributed {
+    let mut f = fixture(layer);
+    let kind = f.p.elements[&f.w].kind();
+    let x = f.p.add_element(kind, layer, "X", Some(f.w)).unwrap();
+    let y = f.p.add_element(kind, layer, "Y", Some(f.w)).unwrap();
+    let outside = f.p.add_element(kind, layer, "Outside", None).unwrap();
+    let xn = f.p.place(f.d, x, xy(140., 200.));
+    let yn = f.p.place(f.d, y, xy(940., 200.));
+    f.p.place(f.d, outside, xy(1800., 800.));
+    f.p.relate(RelationKind::Allocation, "A owns X", f.a, x);
+    f.p.relate(RelationKind::Allocation, "B owns Y", f.b, y);
+    let exchange = match layer {
+        Layer::Oa => RelationKind::Interaction,
+        Layer::Sa => RelationKind::FunctionalExchange,
+    };
+    let internal = f.p.relate(exchange, "X to Y", x, y);
+    let external = f.p.relate(exchange, "Y to Outside", y, outside);
+    let d = f.p.diagrams.get_mut(&f.d).unwrap();
+    let a = d.nodes.values().find(|n| n.element == f.a).unwrap().id;
+    let b = d.nodes.values().find(|n| n.element == f.b).unwrap().id;
+    d.nodes.get_mut(&a).unwrap().collapsed = folded;
+    d.nodes.get_mut(&f.n).unwrap().position = xy(100., 800.);
+    d.routes = vec![route(internal), route(external)];
+    validate_candidate(&f.p).unwrap();
+    Distributed {
+        f,
+        a,
+        b,
+        x: xn,
+        y: yn,
+        internal,
+    }
+}
+
+fn identities(m: &Distributed, ids: &[Id]) -> BTreeMap<Id, Id> {
+    ids.iter()
+        .map(|id| (*id, m.f.p.diagrams[&m.f.d].nodes[id].element))
+        .collect()
+}
+
+fn expected(m: &Distributed, include_a: bool) -> Project {
+    let mut p = m.f.p.clone();
+    let d = p.diagrams.get_mut(&m.f.d).unwrap();
+    for (id, position) in [
+        (m.f.n, xy(500., 800.)),
+        (m.x, xy(540., 200.)),
+        (m.y, xy(1340., 200.)),
+    ] {
+        d.nodes.get_mut(&id).unwrap().position = position;
+    }
+    if include_a {
+        d.nodes.get_mut(&m.a).unwrap().position = xy(500., 100.);
+    }
+    d.routes
+        .iter_mut()
+        .find(|r| r.edge == m.internal)
+        .unwrap()
+        .waypoints = vec![xy(820., 400.), xy(820., 550.)];
+    p
+}
+
+#[test]
+fn explicit_arrange_distributed_oa_sa_exact_scope_routes_source_history_and_anchor() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        for folded in [false, true] {
+            for include_a in [false, true] {
+                let m = distributed(layer, folded);
+                let members = if include_a {
+                    vec![m.f.n, m.a]
+                } else {
+                    vec![m.f.n]
+                };
+                let selected = identities(&m, &members);
+                for anchor in selected.keys().copied() {
+                    let plan = arrange::capture(&m.f.p, m.f.d, &selected, anchor).unwrap();
+                    assert_eq!(plan.selected(), &selected);
+                    let mut affected = BTreeSet::from([m.f.n, m.x, m.y]);
+                    if include_a {
+                        affected.insert(m.a);
+                    }
+                    assert_eq!(
+                        plan.affected().keys().copied().collect::<BTreeSet<_>>(),
+                        affected
+                    );
+                    let requested = if anchor == m.a {
+                        xy(503., 102.)
+                    } else {
+                        xy(503., 802.)
+                    };
+                    let placed =
+                        arrange::place(&plan, requested, presentation(&m.f.p, m.f.d, None))
+                            .unwrap();
+                    assert_eq!(placed.delta, xy(400., 0.));
+                    assert_eq!(placed.unfolded, None);
+                    let command = arrange::finish(&plan, &m.f.p, &placed).unwrap().unwrap();
+                    assert_eq!(roundtrip(&m.f.p, command), expected(&m, include_a));
+                    // Explicit Arrange does not widen ordinary distributed assignment.
+                    assert!(matches!(
+                        plan_semantics(
+                            &m.f.p,
+                            &scope(&m.f),
+                            Destination::Performer(m.f.a),
+                            &BTreeMap::new()
+                        ),
+                        Err(Refusal::MixedLayoutRequired)
+                    ));
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn explicit_arrange_performer_closure_does_not_acquire_incidental_semantic_root() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let m = distributed(layer, true);
+        let selected = identities(&m, &[m.a]);
+        let plan = arrange::capture(&m.f.p, m.f.d, &selected, m.a).unwrap();
+        assert_eq!(
+            plan.affected().keys().copied().collect::<BTreeSet<_>>(),
+            BTreeSet::from([m.a, m.x])
+        );
+        let placed =
+            arrange::place(&plan, xy(500., 100.), presentation(&m.f.p, m.f.d, None)).unwrap();
+        let mut expected = m.f.p.clone();
+        let d = expected.diagrams.get_mut(&m.f.d).unwrap();
+        d.nodes.get_mut(&m.a).unwrap().position = xy(500., 100.);
+        d.nodes.get_mut(&m.x).unwrap().position = xy(540., 200.);
+        // X-to-Y is now one-ended; all saved pins remain byte-for-byte unchanged.
+        assert_eq!(
+            roundtrip(
+                &m.f.p,
+                arrange::finish(&plan, &m.f.p, &placed).unwrap().unwrap()
+            ),
+            expected
+        );
+    }
+}
+
+#[test]
+fn explicit_arrange_validates_all_original_members_before_normalizing() {
+    let mut m = distributed(Layer::Oa, false);
+    let selected = identities(&m, &[m.f.n, m.x]);
+    let plan = arrange::capture(&m.f.p, m.f.d, &selected, m.x).unwrap();
+    assert_eq!(plan.selected(), &selected);
+    assert_eq!(plan.affected().len(), 3);
+    let placed = arrange::place(&plan, xy(540., 200.), presentation(&m.f.p, m.f.d, None)).unwrap();
+    assert_eq!(
+        roundtrip(
+            &m.f.p,
+            arrange::finish(&plan, &m.f.p, &placed).unwrap().unwrap()
+        ),
+        expected(&m, false)
+    );
+    let mut stale = selected.clone();
+    stale.insert(m.x, m.f.w);
+    assert!(arrange::capture(&m.f.p, m.f.d, &stale, m.f.n).is_err());
+    m.f.p
+        .diagrams
+        .get_mut(&m.f.d)
+        .unwrap()
+        .nodes
+        .get_mut(&m.a)
+        .unwrap()
+        .collapsed = true;
+    assert!(
+        arrange::capture(&m.f.p, m.f.d, &selected, m.f.n).is_err(),
+        "covered selected X is hidden and cannot disappear in normalization"
+    );
+    assert!(arrange::capture(&m.f.p, m.f.d, &BTreeMap::new(), m.f.n).is_err());
+    assert!(arrange::capture(&m.f.p, m.f.d, &identities(&m, &[m.f.n]), m.a).is_err());
+    assert!(arrange::capture(&m.f.p, m.f.second, &identities(&m, &[m.f.n]), m.f.n).is_err());
+    let foreign = Id::new_v4();
+    assert!(
+        arrange::capture(
+            &m.f.p,
+            m.f.d,
+            &BTreeMap::from([(m.f.n, m.f.w), (foreign, m.f.w)]),
+            m.f.n
+        )
+        .is_err()
+    );
+    m.f.p.diagrams.get_mut(&m.f.d).unwrap().projection = ProjectionKind::Overview;
+    assert!(arrange::capture(&m.f.p, m.f.d, &identities(&m, &[m.f.n]), m.f.n).is_err());
+}
+
+#[test]
+fn explicit_arrange_simultaneous_roots_may_enter_each_others_vacated_bounds() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = fixture(layer);
+        let kind = f.p.elements[&f.w].kind();
+        let y = f.p.add_element(kind, layer, "Second root", None).unwrap();
+        let yn = f.p.place(f.d, y, xy(400., 500.));
+        let relation = f.p.relate(
+            if layer == Layer::Oa {
+                RelationKind::Interaction
+            } else {
+                RelationKind::FunctionalExchange
+            },
+            "Between roots",
+            f.w,
+            y,
+        );
+        f.p.diagrams.get_mut(&f.d).unwrap().routes = vec![route(relation)];
+        let context = presentation(&f.p, f.d, None);
+        let single = arrange::capture(&f.p, f.d, &BTreeMap::from([(f.n, f.w)]), f.n).unwrap();
+        assert!(
+            arrange::place(&single, xy(400., 500.), context).is_err(),
+            "singleton would collide with stationary Y"
+        );
+        let plan =
+            arrange::capture(&f.p, f.d, &BTreeMap::from([(f.n, f.w), (yn, y)]), f.n).unwrap();
+        let placed = arrange::place(&plan, xy(400., 500.), context).unwrap();
+        let mut expected = f.p.clone();
+        let d = expected.diagrams.get_mut(&f.d).unwrap();
+        d.nodes.get_mut(&f.n).unwrap().position = xy(400., 500.);
+        d.nodes.get_mut(&yn).unwrap().position = xy(700., 500.);
+        d.routes[0].waypoints = vec![xy(720., 400.), xy(720., 550.)];
+        assert_eq!(
+            roundtrip(
+                &f.p,
+                arrange::finish(&plan, &f.p, &placed).unwrap().unwrap()
+            ),
+            expected
+        );
+    }
+}
+
+#[test]
+fn explicit_arrange_preserves_roles_and_does_not_invent_unplaced_descendants() {
+    let mut f = fixture(Layer::Oa);
+    let a = f.a;
+    role(&mut f, Some(a));
+    f.p.diagrams
+        .get_mut(&f.d)
+        .unwrap()
+        .nodes
+        .get_mut(&f.n)
+        .unwrap()
+        .position = xy(150., 200.);
+    let plan = arrange::capture(&f.p, f.d, &BTreeMap::from([(f.n, f.w)]), f.n).unwrap();
+    let placed = arrange::place(&plan, xy(160., 210.), presentation(&f.p, f.d, None)).unwrap();
+    let mut role_expected = f.p.clone();
+    role_expected
+        .diagrams
+        .get_mut(&f.d)
+        .unwrap()
+        .nodes
+        .get_mut(&f.n)
+        .unwrap()
+        .position = xy(160., 210.);
+    assert_eq!(
+        roundtrip(
+            &f.p,
+            arrange::finish(&plan, &f.p, &placed).unwrap().unwrap()
+        ),
+        role_expected
+    );
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut m = distributed(layer, true);
+        let kind = m.f.p.elements[&m.f.w].kind();
+        m.f.p
+            .add_element(kind, layer, "Unplaced leaf", Some(m.f.w))
+            .unwrap();
+        let plan = arrange::capture(&m.f.p, m.f.d, &identities(&m, &[m.f.n]), m.f.n).unwrap();
+        assert_eq!(plan.affected().len(), 3);
+        let placed =
+            arrange::place(&plan, xy(500., 800.), presentation(&m.f.p, m.f.d, None)).unwrap();
+        assert_eq!(
+            roundtrip(
+                &m.f.p,
+                arrange::finish(&plan, &m.f.p, &placed).unwrap().unwrap()
+            ),
+            expected(&m, false)
+        );
+    }
+}
+
+#[test]
+fn explicit_arrange_detects_hidden_moved_child_and_stationary_enclosure_growth() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        for hidden in [false, true] {
+            let mut m = distributed(layer, hidden);
+            let kind = m.f.p.elements[&m.f.w].kind();
+            let z = m.f.p.add_element(kind, layer, "Obstacle", None).unwrap();
+            let zn = m.f.p.place(
+                m.f.d,
+                z,
+                if hidden {
+                    xy(550., 230.)
+                } else {
+                    xy(1200., 100.)
+                },
+            );
+            // The independent candidate differs only by literal admitted edits.
+            // Establish which geometric case the real planner must reject.
+            let candidate = expected(&m, true);
+            let before = projection::project_view(&m.f.p, m.f.d);
+            let after = projection::project_view(&candidate, m.f.d);
+            let find =
+                |view: &ProjectedView, id| view.nodes.iter().find(|n| n.id == id).unwrap().clone();
+            if hidden {
+                assert!(!overlaps(&before, &after));
+                assert!(!after.nodes.iter().any(|n| n.id == m.x));
+                let mut diagnostic = candidate.diagrams[&m.f.d].clone();
+                diagnostic.nodes.get_mut(&m.a).unwrap().collapsed = false;
+                let expanded = projection::project_diagram(&candidate, &diagnostic);
+                assert_eq!(
+                    overlap(&find(&expanded, m.x), &find(&expanded, zn)),
+                    if layer == Layer::Oa { 13696. } else { 20116. }
+                );
+            } else {
+                assert_eq!(overlap(&find(&before, m.b), &find(&before, zn)), 0.);
+                assert_eq!(overlap(&find(&after, m.b), &find(&after, zn)), 21056.);
+                for id in [m.a, m.f.n, m.x, m.y] {
+                    assert_eq!(overlap(&find(&after, id), &find(&after, zn)), 0.);
+                }
+                assert_eq!(
+                    candidate.diagrams[&m.f.d].nodes[&m.b],
+                    m.f.p.diagrams[&m.f.d].nodes[&m.b]
+                );
+            }
+            let plan =
+                arrange::capture(&m.f.p, m.f.d, &identities(&m, &[m.a, m.f.n]), m.f.n).unwrap();
+            assert!(matches!(
+                arrange::place(&plan, xy(500., 800.), presentation(&m.f.p, m.f.d, None)),
+                Err(Refusal::LayoutRequired(_))
+            ));
+        }
+    }
+}
+
+#[test]
+fn explicit_arrange_preserves_existing_overlap_but_refuses_its_growth() {
+    let mut f = fixture(Layer::Oa);
+    let y =
+        f.p.add_element(Kind::Activity, Layer::Oa, "Existing overlap", None)
+            .unwrap();
+    let yn = f.p.place(f.d, y, xy(250., 500.));
+    let context = presentation(&f.p, f.d, None);
+    let single = arrange::capture(&f.p, f.d, &BTreeMap::from([(f.n, f.w)]), f.n).unwrap();
+    assert!(arrange::place(&single, xy(110., 500.), context).is_err());
+    let plan = arrange::capture(&f.p, f.d, &BTreeMap::from([(f.n, f.w), (yn, y)]), f.n).unwrap();
+    let placed = arrange::place(&plan, xy(400., 500.), context).unwrap();
+    let mut expected = f.p.clone();
+    let d = expected.diagrams.get_mut(&f.d).unwrap();
+    d.nodes.get_mut(&f.n).unwrap().position = xy(400., 500.);
+    d.nodes.get_mut(&yn).unwrap().position = xy(550., 500.);
+    assert_eq!(
+        roundtrip(
+            &f.p,
+            arrange::finish(&plan, &f.p, &placed).unwrap().unwrap()
+        ),
+        expected
+    );
+}
+
+#[test]
+fn explicit_arrange_preserves_unrelated_folded_interior_diagnostic_boundary() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut m = distributed(layer, true);
+        let performer = if layer == Layer::Oa {
+            Kind::Actor
+        } else {
+            Kind::SystemActor
+        };
+        let d = m.f.p.add_element(performer, layer, "D", None).unwrap();
+        let z =
+            m.f.p
+                .add_element(m.f.p.elements[&m.f.w].kind(), layer, "Hidden Z", None)
+                .unwrap();
+        m.f.p.relate(RelationKind::Allocation, "D owns Z", d, z);
+        let dn = m.f.p.place(m.f.d, d, xy(2500., 100.));
+        m.f.p.place(m.f.d, z, xy(550., 230.));
+        m.f.p
+            .diagrams
+            .get_mut(&m.f.d)
+            .unwrap()
+            .nodes
+            .get_mut(&dn)
+            .unwrap()
+            .collapsed = true;
+        let plan = arrange::capture(&m.f.p, m.f.d, &identities(&m, &[m.a, m.f.n]), m.f.n).unwrap();
+        let placed =
+            arrange::place(&plan, xy(500., 800.), presentation(&m.f.p, m.f.d, None)).unwrap();
+        assert_eq!(
+            roundtrip(
+                &m.f.p,
+                arrange::finish(&plan, &m.f.p, &placed).unwrap().unwrap()
+            ),
+            expected(&m, true)
+        );
+    }
+}
+
+#[test]
+fn explicit_arrange_noop_stale_tamper_target_and_all_selected_headers() {
+    let m = distributed(Layer::Sa, false);
+    let selected = identities(&m, &[m.a, m.f.n]);
+    let plan = arrange::capture(&m.f.p, m.f.d, &selected, m.f.n).unwrap();
+    let context = presentation(&m.f.p, m.f.d, None);
+    let noop = arrange::place(&plan, xy(103., 802.), context).unwrap();
+    assert!(arrange::finish(&plan, &m.f.p, &noop).unwrap().is_none());
+    let mut placed = arrange::place(&plan, xy(500., 800.), context).unwrap();
+    let mut stale = m.f.p.clone();
+    stale.name.push_str(" changed");
+    assert!(matches!(
+        arrange::finish(&plan, &stale, &placed),
+        Err(Refusal::StaleScope)
+    ));
+    placed.diagram.nodes.get_mut(&m.b).unwrap().position.x += 1.;
+    assert!(matches!(
+        arrange::finish(&plan, &m.f.p, &placed),
+        Err(Refusal::StaleScope)
+    ));
+    assert!(
+        arrange::place(
+            &plan,
+            xy(500., 800.),
+            presentation(&m.f.p, m.f.d, Some(m.f.b))
+        )
+        .is_err()
+    );
+    let mut clipped = context;
+    clipped.viewport.position = xy(400., 700.);
+    assert!(
+        arrange::place(&plan, xy(500., 800.), clipped).is_err(),
+        "anchor C visible, other selected A header clipped"
+    );
+    assert!(arrange::place(&plan, xy(f32::NAN, 800.), context).is_err());
+    assert!(arrange::place(&plan, xy(MAX_COORDINATE, 800.), context).is_err());
+}

crates/oa-desktop/src/allocation_drag/assignment.rs

@@ -0,0 +1,449 @@
+//! Ordinary work-only group assignment, with one combined semantic/geometry plan.
+//! App retains authority over the complete typed selection and gesture lifetime.
+use super::*;
+use std::sync::Arc;
+
+#[derive(Debug)]
+struct Captured {
+    accepted: Project,
+    diagram: Id,
+    selected: BTreeMap<Id, Id>,
+    anchor: Id,
+    roots: Vec<super::Scope>,
+    placements: BTreeMap<Id, NodePlacement>,
+    leaves: BTreeMap<Id, Leaf>,
+    index: ViewIndex,
+    before_visible: ProjectedView,
+    before_expanded: ProjectedView,
+}
+
+/// Destination plans share one immutable accepted capture.
+#[derive(Debug, Clone)]
+pub struct Scope(Arc<Captured>);
+
+impl Scope {
+    pub fn project(&self) -> &Project {
+        &self.0.accepted
+    }
+
+    pub fn index(&self) -> &ViewIndex {
+        &self.0.index
+    }
+
+    pub fn diagram(&self) -> &Diagram {
+        &self.0.accepted.diagrams[&self.0.diagram]
+    }
+
+    pub fn selected(&self) -> &BTreeMap<Id, Id> {
+        &self.0.selected
+    }
+
+    pub fn affected(&self) -> &BTreeMap<Id, NodePlacement> {
+        &self.0.placements
+    }
+
+    pub fn anchor(&self) -> Id {
+        self.0.anchor
+    }
+
+    pub fn leaves(&self) -> &BTreeMap<Id, Leaf> {
+        &self.0.leaves
+    }
+}
+
+/// App must reject non-placement members before constructing this complete map.
+/// Every original identity is checked before redundant work roots are removed.
+pub fn capture(
+    p: &Project,
+    diagram: Id,
+    selected: &BTreeMap<Id, Id>,
+    anchor: Id,
+) -> Result<Scope, Refusal> {
+    validate_candidate(p).map_err(|e| Refusal::InvalidCandidate(e.to_string()))?;
+    let d = p.diagrams.get(&diagram).ok_or(Refusal::StaleScope)?;
+    if d.projection != ProjectionKind::Allocation
+        || selected.is_empty()
+        || !selected.contains_key(&anchor)
+    {
+        return Err(Refusal::Ineligible(
+            "Assignment requires selected work placements and a selected anchor in an Allocation view."
+                .into(),
+        ));
+    }
+    let index = ViewIndex::new(p);
+    let before_visible = projection::project_diagram_with_index(p, d, &index);
+    let visible: BTreeMap<_, _> = before_visible
+        .nodes
+        .iter()
+        .map(|node| (node.id, node.element))
+        .collect();
+    let mut work = BTreeMap::new();
+    for (placement, element) in selected {
+        let node = d.nodes.get(placement).ok_or(Refusal::StaleScope)?;
+        let record = p.elements.get(element).ok_or(Refusal::StaleScope)?;
+        if node.element != *element || visible.get(placement) != Some(element) {
+            return Err(Refusal::StaleScope);
+        }
+        if !record.kind().is_work() || record.layer() != d.layer {
+            return Err(Refusal::Ineligible(
+                "Assignment requires only activities or functions in this layer. Use Arrange only for a supported mixed selection."
+                    .into(),
+            ));
+        }
+        work.insert(*element, *placement);
+    }
+
+    let mut roots = Vec::new();
+    let mut placements = BTreeMap::new();
+    let mut leaves = BTreeMap::new();
+    for (element, placement) in &work {
+        let record = &p.elements[element];
+        let mut ancestor = record.parent;
+        let mut seen = BTreeSet::new();
+        let mut covered = false;
+        while let Some(id) = ancestor {
+            if !seen.insert(id) {
+                return Err(Refusal::StaleScope);
+            }
+            let parent = p.elements.get(&id).ok_or(Refusal::StaleScope)?;
+            if parent.kind() != record.kind() {
+                break;
+            }
+            if work.contains_key(&id) {
+                covered = true;
+                break;
+            }
+            ancestor = parent.parent;
+        }
+        if covered {
+            continue;
+        }
+        let root = capture_validated(p, diagram, *element, *placement)?;
+        if root.work_records.len() > 1 && root.uniform == Uniform::MixedOrUnresolved {
+            return Err(Refusal::MixedLayoutRequired);
+        }
+        for (id, leaf) in &root.leaves {
+            if leaves.insert(*id, leaf.clone()).is_some() {
+                return Err(Refusal::StaleScope);
+            }
+        }
+        placements.extend(root.placements.clone());
+        roots.push(root);
+    }
+    let expansion = geometry::expansion_ids(p, d, &index, &placements)?;
+    let before_expanded = geometry::expanded_view(p, d, &index, &expansion);
+    if roots
+        .iter()
+        .any(|root| root.work_records.len() > 1 && !coherent(root, &before_expanded))
+    {
+        return Err(Refusal::MixedLayoutRequired);
+    }
+    Ok(Scope(Arc::new(Captured {
+        accepted: p.clone(),
+        diagram,
+        selected: selected.clone(),
+        anchor,
+        roots,
+        placements,
+        leaves,
+        index,
+        before_visible,
+        before_expanded,
+    })))
+}
+
+#[derive(Debug)]
+pub struct SemanticPlan {
+    scope: Scope,
+    destination: Destination,
+    candidate: Project,
+    index: ViewIndex,
+    commands: Vec<Command>,
+    changed: BTreeSet<Id>,
+    expanded_ids: BTreeSet<Id>,
+    label: String,
+    warnings: Vec<Issue>,
+}
+
+impl SemanticPlan {
+    pub fn scope(&self) -> &Scope {
+        &self.scope
+    }
+
+    pub fn project(&self) -> &Project {
+        &self.candidate
+    }
+
+    pub fn index(&self) -> &ViewIndex {
+        &self.index
+    }
+
+    pub fn destination(&self) -> Destination {
+        self.destination
+    }
+
+    pub fn label(&self) -> &str {
+        &self.label
+    }
+
+    pub fn warnings(&self) -> &[Issue] {
+        &self.warnings
+    }
+
+    pub fn changed_count(&self) -> usize {
+        self.changed.len()
+    }
+
+    /// Already effective at the performer, or already unassigned for Outside.
+    pub fn already_correct_count(&self) -> usize {
+        self.scope.leaves().len() - self.changed.len()
+    }
+}
+
+/// Build one destination candidate. Per-root decisions read accepted facts;
+/// aliases and new identities are reserved in the combined expected Project.
+pub fn plan_semantics(
+    scope: &Scope,
+    destination: Destination,
+    allocation_ids: &BTreeMap<Id, Id>,
+) -> Result<SemanticPlan, Refusal> {
+    let accepted = scope.project();
+    match destination {
+        Destination::LayoutOnly => {
+            return Err(Refusal::Ineligible(
+                "Use the explicit Arrange only planner for presentation-only movement.".into(),
+            ));
+        }
+        Destination::Performer(id) => {
+            if !accepted.elements.get(&id).is_some_and(|element| {
+                element.kind().is_performer() && element.layer() == scope.diagram().layer
+            }) {
+                return Err(Refusal::Ineligible(
+                    "Choose a performer in this layer.".into(),
+                ));
+            }
+        }
+        Destination::OutsidePerformers => {}
+    }
+    let mut expected = accepted.clone();
+    let mut edits = IntendedEdits::default();
+    for root in &scope.0.roots {
+        append_semantic_edits(
+            accepted,
+            root,
+            destination,
+            allocation_ids,
+            &mut expected,
+            &mut edits,
+        )?;
+    }
+    for diagram in expected.diagrams.values_mut() {
+        diagram
+            .routes
+            .retain(|route| !edits.deleted.contains(&route.edge));
+    }
+    let candidate = prepare_command(accepted, &Command::Batch(edits.commands.clone()))
+        .map_err(|e| Refusal::InvalidCandidate(e.to_string()))?
+        .project;
+    exact_project(&expected, &candidate)?;
+    let warnings = validation::validate(&candidate)
+        .into_iter()
+        .filter(|issue| issue.severity == Severity::Warning)
+        .collect();
+    let index = ViewIndex::new(&candidate);
+    // Assignment may change visual ancestry: never reuse accepted expansion IDs.
+    let expanded_ids = geometry::expansion_ids(
+        &candidate,
+        &candidate.diagrams[&scope.0.diagram],
+        &index,
+        scope.affected(),
+    )?;
+    let total = scope.leaves().len();
+    let changed = edits.changed.len();
+    let already_correct = total - changed;
+    let noun = match (scope.diagram().layer, total) {
+        (Layer::Oa, 1) => "activity",
+        (Layer::Oa, _) => "activities",
+        (Layer::Sa, 1) => "function",
+        (Layer::Sa, _) => "functions",
+    };
+    let retained_roles = scope
+        .leaves()
+        .values()
+        .any(|leaf| !leaf.role_assignments.is_empty());
+    let label = match destination {
+        Destination::Performer(id) if changed == 0 => {
+            format!(
+                "Arrange within {} — all {total} leaf {noun} already assigned",
+                accepted.named(id)
+            )
+        }
+        Destination::Performer(id) => format!(
+            "Assign {changed} of {total} leaf {noun} to {}{}{}",
+            accepted.named(id),
+            if already_correct > 0 {
+                format!(" · {already_correct} already assigned")
+            } else {
+                String::new()
+            },
+            if retained_roles {
+                " — role responsibility retained"
+            } else {
+                ""
+            },
+        ),
+        Destination::OutsidePerformers if changed == 0 => {
+            "Arrange unassigned work — decomposition retained".into()
+        }
+        Destination::OutsidePerformers => format!(
+            "Remove assignments from {changed} of {total} leaf {noun} — decomposition retained"
+        ),
+        Destination::LayoutOnly => unreachable!(),
+    };
+    Ok(SemanticPlan {
+        scope: scope.clone(),
+        destination,
+        candidate,
+        index,
+        commands: edits.commands,
+        changed: edits.changed,
+        expanded_ids,
+        label,
+        warnings,
+    })
+}
+
+/// Translate the entire captured Q once, then evaluate the combined candidate.
+/// This path does not clone/validate a Project or rebuild semantic indexes.
+pub fn place(
+    plan: &SemanticPlan,
+    requested: Position,
+    presentation: PresentationContext,
+) -> Result<PlacementPlan, Refusal> {
+    if !requested.x.is_finite()
+        || !requested.y.is_finite()
+        || !presentation.viewport.valid()
+        || !presentation.zoom.is_finite()
+        || presentation.zoom <= 0.
+    {
+        return Err(Refusal::LayoutRequired(
+            "Make room or adjust the view, then drag again.".into(),
+        ));
+    }
+    let scope = &plan.scope;
+    let geometry::Translation {
+        mut diagram,
+        mut commands,
+        delta,
+    } = geometry::translate(
+        scope.project(),
+        scope.diagram(),
+        &plan.candidate.diagrams[&scope.0.diagram],
+        scope.affected(),
+        scope.anchor(),
+        requested,
+    )?;
+    let mut unfolded = None;
+    if let Destination::Performer(performer) = plan.destination {
+        let target = presentation.target.ok_or_else(|| {
+            Refusal::LayoutRequired("A visible accepted performer target is required.".into())
+        })?;
+        if !scope
+            .0
+            .before_visible
+            .nodes
+            .iter()
+            .any(|node| node.id == target.placement && node.element == performer)
+        {
+            return Err(Refusal::LayoutRequired(
+                "Make room or adjust the view, then drag again.".into(),
+            ));
+        }
+        let target_node = diagram
+            .nodes
+            .get_mut(&target.placement)
+            .ok_or(Refusal::StaleScope)?;
+        if target_node.element != performer {
+            return Err(Refusal::StaleScope);
+        }
+        if !plan.changed.is_empty() && target_node.collapsed {
+            target_node.collapsed = false;
+            unfolded = Some(target_node.id);
+            commands.push(Command::EditNode {
+                diagram: diagram.id,
+                original: target_node.id,
+                node: target_node.clone(),
+            });
+        }
+    } else if presentation.target.is_some() {
+        return Err(Refusal::Ineligible(
+            "An outside destination has no performer target.".into(),
+        ));
+    }
+    let view = projection::project_diagram_with_index(&plan.candidate, &diagram, &plan.index);
+    let expanded =
+        geometry::expanded_view(&plan.candidate, &diagram, &plan.index, &plan.expanded_ids);
+    if scope
+        .0
+        .roots
+        .iter()
+        .any(|root| root.work_records.len() > 1 && !coherent(root, &expanded))
+    {
+        return Err(Refusal::MixedLayoutRequired);
+    }
+    geometry::check_scenes(
+        &scope.0.before_visible,
+        &scope.0.before_expanded,
+        &view,
+        &expanded,
+    )?;
+    geometry::check_rigid(&scope.0.before_expanded, &expanded, scope.affected(), delta)?;
+    geometry::check_headers(
+        &view,
+        scope.selected(),
+        presentation,
+        plan.destination == Destination::OutsidePerformers,
+    )?;
+    Ok(PlacementPlan {
+        diagram,
+        view,
+        delta,
+        unfolded,
+        requested,
+        presentation,
+        commands,
+    })
+}
+
+/// Recheck immutable facts and recompute geometry before one final source batch.
+/// Zero delta remains a transaction when assignment semantics changed.
+pub fn finish(
+    plan: &SemanticPlan,
+    live: &Project,
+    placement: &PlacementPlan,
+) -> Result<Option<Command>, Refusal> {
+    if live != plan.scope.project() {
+        return Err(Refusal::StaleScope);
+    }
+    let checked = place(plan, placement.requested, placement.presentation)?;
+    if checked.diagram != placement.diagram
+        || checked.view != placement.view
+        || checked.delta != placement.delta
+        || checked.unfolded != placement.unfolded
+        || checked.commands != placement.commands
+    {
+        return Err(Refusal::StaleScope);
+    }
+    let mut expected = plan.candidate.clone();
+    expected
+        .diagrams
+        .insert(checked.diagram.id, checked.diagram);
+    let mut commands = plan.commands.clone();
+    commands.extend(checked.commands);
+    let command = Command::Batch(commands);
+    let actual = prepare_command(live, &command)
+        .map_err(|e| Refusal::InvalidCandidate(e.to_string()))?
+        .project;
+    exact_project(&expected, &actual)?;
+    Ok((actual != *live).then_some(command))
+}

crates/oa-desktop/src/allocation_drag/assignment_boundary_tests.rs

@@ -0,0 +1,497 @@
+use super::*;
+
+struct Composite {
+    f: Fixture,
+    child: Id,
+    child_node: Id,
+    unplaced: Id,
+}
+
+fn composite(layer: Layer) -> Composite {
+    let mut f = fixture(layer);
+    let kind = f.p.elements[&f.w].kind();
+    let child =
+        f.p.add_element(kind, layer, "Placed child", Some(f.w))
+            .unwrap();
+    let unplaced =
+        f.p.add_element(kind, layer, "Unplaced leaf", Some(f.w))
+            .unwrap();
+    let child_node = f.p.place(f.d, child, xy(140., 600.));
+    validate_candidate(&f.p).unwrap();
+    Composite {
+        f,
+        child,
+        child_node,
+        unplaced,
+    }
+}
+
+fn expected_allocation(id: Id, alias: &str, name: &str, performer: Id, work: Id) -> Relation {
+    Relation {
+        id,
+        alias: alias.into(),
+        name: name.into(),
+        description: String::new(),
+        body: RelationBody::Allocation {
+            source: performer,
+            target: work,
+        },
+    }
+}
+
+#[test]
+fn group_assignment_checks_original_identity_and_visibility_before_normalization() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let c = composite(layer);
+        let valid = BTreeMap::from([(c.f.n, c.f.w), (c.child_node, c.child)]);
+        let admitted = assignment::capture(&c.f.p, c.f.d, &valid, c.f.n).unwrap();
+        assert_eq!(admitted.selected(), &valid);
+        let foreign = c.f.p.diagrams[&c.f.second]
+            .nodes
+            .values()
+            .find(|node| node.element == c.f.w)
+            .unwrap()
+            .id;
+        // Each extra member is semantically covered by the valid selected parent.
+        // Normalizing first would incorrectly hide its invalid original identity.
+        for invalid in [
+            BTreeMap::from([(c.f.n, c.f.w), (c.child_node, c.unplaced)]),
+            BTreeMap::from([(c.f.n, c.f.w), (Id::new_v4(), c.child)]),
+            BTreeMap::from([(c.f.n, c.f.w), (foreign, c.f.w)]),
+        ] {
+            assert!(matches!(
+                assignment::capture(&c.f.p, c.f.d, &invalid, c.f.n),
+                Err(Refusal::StaleScope)
+            ));
+        }
+        let mut folded = c.f.p.clone();
+        folded
+            .diagrams
+            .get_mut(&c.f.d)
+            .unwrap()
+            .nodes
+            .get_mut(&c.f.n)
+            .unwrap()
+            .collapsed = true;
+        validate_candidate(&folded).unwrap();
+        assert!(
+            !projection::project_view(&folded, c.f.d)
+                .nodes
+                .iter()
+                .any(|node| node.id == c.child_node)
+        );
+        // Hidden descendants remain in Q when only the visible parent is selected.
+        let parent_only =
+            assignment::capture(&folded, c.f.d, &BTreeMap::from([(c.f.n, c.f.w)]), c.f.n).unwrap();
+        assert!(parent_only.affected().contains_key(&c.child_node));
+        assert!(matches!(
+            assignment::capture(&folded, c.f.d, &valid, c.f.n),
+            Err(Refusal::StaleScope)
+        ));
+    }
+}
+
+#[test]
+fn group_assignment_normalizes_parent_child_and_assigns_unplaced_leaf_once() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let c = composite(layer);
+        let selected = BTreeMap::from([(c.f.n, c.f.w), (c.child_node, c.child)]);
+        let scope = assignment::capture(&c.f.p, c.f.d, &selected, c.f.n).unwrap();
+        assert_eq!(scope.selected(), &selected);
+        assert_eq!(
+            scope.affected().keys().copied().collect::<BTreeSet<_>>(),
+            BTreeSet::from([c.f.n, c.child_node])
+        );
+        assert_eq!(
+            scope.leaves().keys().copied().collect::<BTreeSet<_>>(),
+            BTreeSet::from([c.child, c.unplaced])
+        );
+        let child_allocation = Id::new_v4();
+        let unplaced_allocation = Id::new_v4();
+        let ids = BTreeMap::from([
+            (c.child, child_allocation),
+            (c.unplaced, unplaced_allocation),
+        ]);
+        let plan = assignment::plan_semantics(&scope, Destination::Performer(c.f.a), &ids).unwrap();
+        assert_eq!(plan.changed_count(), 2);
+        let mut expected = c.f.p.clone();
+        expected.relations.insert(
+            child_allocation,
+            expected_allocation(
+                child_allocation,
+                "a_performs_placed_child",
+                "A performs Placed child",
+                c.f.a,
+                c.child,
+            ),
+        );
+        expected.relations.insert(
+            unplaced_allocation,
+            expected_allocation(
+                unplaced_allocation,
+                "a_performs_unplaced_leaf",
+                "A performs Unplaced leaf",
+                c.f.a,
+                c.unplaced,
+            ),
+        );
+        assert_eq!(plan.project(), &expected);
+        let placed = assignment::place(
+            &plan,
+            xy(140., 200.),
+            presentation(&c.f.p, c.f.d, Some(c.f.a)),
+        )
+        .unwrap();
+        let mut clipped = presentation(&c.f.p, c.f.d, Some(c.f.a));
+        clipped.viewport.size.height = 450.; // bottom350: parent header fits; selected child ends362.
+        for (id, should_fit) in [(c.f.n, true), (c.child_node, false)] {
+            let node = placed.view.nodes.iter().find(|node| node.id == id).unwrap();
+            let header = Rect {
+                position: node.position,
+                size: Size {
+                    width: node.size.width,
+                    height: 62.,
+                },
+            };
+            assert_eq!(clipped.viewport.contains(header), should_fit);
+        }
+        assert!(
+            matches!(
+                assignment::place(&plan, xy(140., 200.), clipped),
+                Err(Refusal::LayoutRequired(_))
+            ),
+            "normalized-away selected child still requires its header"
+        );
+        let d = expected.diagrams.get_mut(&c.f.d).unwrap();
+        d.nodes.get_mut(&c.f.n).unwrap().position = xy(140., 200.);
+        d.nodes.get_mut(&c.child_node).unwrap().position = xy(180., 300.);
+        assert_eq!(placed.delta, xy(40., -300.));
+        assert_eq!(
+            roundtrip(
+                &c.f.p,
+                assignment::finish(&plan, &c.f.p, &placed).unwrap().unwrap()
+            ),
+            expected
+        );
+        assert_eq!(
+            expected.diagrams[&c.f.d].nodes.len(),
+            c.f.p.diagrams[&c.f.d].nodes.len()
+        );
+        assert!(
+            !expected.diagrams[&c.f.d]
+                .nodes
+                .values()
+                .any(|node| node.element == c.unplaced)
+        );
+        assert!(
+            !expected
+                .relations
+                .values()
+                .any(|relation| relation.kind() == RelationKind::Allocation
+                    && relation.target() == c.f.w)
+        );
+    }
+}
+
+#[test]
+fn group_assignment_distributed_parent_refuses_but_its_independent_leaves_can_reassign() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut c = composite(layer);
+        let second_node = c.f.p.place(c.f.d, c.unplaced, xy(940., 200.));
+        let performer =
+            c.f.p
+                .add_element(
+                    if layer == Layer::Oa {
+                        Kind::Actor
+                    } else {
+                        Kind::SystemActor
+                    },
+                    layer,
+                    "C",
+                    None,
+                )
+                .unwrap();
+        c.f.p.place(c.f.d, performer, xy(1700., 100.));
+        let d = c.f.p.diagrams.get_mut(&c.f.d).unwrap();
+        d.nodes.get_mut(&c.f.n).unwrap().position = xy(1700., 800.);
+        d.nodes.get_mut(&c.child_node).unwrap().position = xy(140., 200.);
+        let ax =
+            c.f.p
+                .relate(RelationKind::Allocation, "A child", c.f.a, c.child);
+        let by =
+            c.f.p
+                .relate(RelationKind::Allocation, "B child", c.f.b, c.unplaced);
+        validate_candidate(&c.f.p).unwrap();
+        let visible = projection::project_view(&c.f.p, c.f.d);
+        for id in [c.f.n, c.child_node, second_node] {
+            assert!(visible.nodes.iter().any(|node| node.id == id));
+        }
+        assert_eq!(scope(&c.f).uniform, Uniform::MixedOrUnresolved);
+        assert!(matches!(
+            assignment::capture(&c.f.p, c.f.d, &BTreeMap::from([(c.f.n, c.f.w)]), c.f.n,),
+            Err(Refusal::MixedLayoutRequired)
+        ));
+        let selected = BTreeMap::from([(c.child_node, c.child), (second_node, c.unplaced)]);
+        let captured = assignment::capture(&c.f.p, c.f.d, &selected, c.child_node).unwrap();
+        let plan = assignment::plan_semantics(
+            &captured,
+            Destination::Performer(performer),
+            &BTreeMap::new(),
+        )
+        .unwrap();
+        let mut expected = c.f.p.clone();
+        expected.relations.get_mut(&ax).unwrap().body = RelationBody::Allocation {
+            source: performer,
+            target: c.child,
+        };
+        expected.relations.get_mut(&by).unwrap().body = RelationBody::Allocation {
+            source: performer,
+            target: c.unplaced,
+        };
+        assert_eq!(plan.project(), &expected);
+        // One delta moves both leaves. The unselected semantic parent remains
+        // authored at (1700,800), while its derived enclosure may change.
+        let placed = assignment::place(
+            &plan,
+            xy(1740., 120.),
+            presentation(&c.f.p, c.f.d, Some(performer)),
+        )
+        .unwrap();
+        let d = expected.diagrams.get_mut(&c.f.d).unwrap();
+        d.nodes.get_mut(&c.child_node).unwrap().position = xy(1740., 120.);
+        d.nodes.get_mut(&second_node).unwrap().position = xy(2540., 120.);
+        assert_eq!(
+            roundtrip(
+                &c.f.p,
+                assignment::finish(&plan, &c.f.p, &placed).unwrap().unwrap()
+            ),
+            expected
+        );
+    }
+}
+
+fn separate_unassigned(layer: Layer) -> (Fixture, Id, Id) {
+    let mut f = fixture(layer);
+    let companion =
+        f.p.add_element(f.p.elements[&f.w].kind(), layer, "Companion", None)
+            .unwrap();
+    let companion_node = f.p.place(f.d, companion, xy(100., 1000.));
+    validate_candidate(&f.p).unwrap();
+    (f, companion, companion_node)
+}
+
+#[test]
+fn group_assignment_finish_rejects_stale_project_and_each_tampered_result() {
+    let (f, companion, companion_node) = separate_unassigned(Layer::Oa);
+    let selected = BTreeMap::from([(f.n, f.w), (companion_node, companion)]);
+    let captured = assignment::capture(&f.p, f.d, &selected, f.n).unwrap();
+    let plan =
+        assignment::plan_semantics(&captured, Destination::OutsidePerformers, &BTreeMap::new())
+            .unwrap();
+    let context = presentation(&f.p, f.d, None);
+    let valid = assignment::place(&plan, xy(500., 500.), context).unwrap();
+    let mut expected = f.p.clone();
+    expected
+        .diagrams
+        .get_mut(&f.d)
+        .unwrap()
+        .nodes
+        .get_mut(&f.n)
+        .unwrap()
+        .position = xy(500., 500.);
+    expected
+        .diagrams
+        .get_mut(&f.d)
+        .unwrap()
+        .nodes
+        .get_mut(&companion_node)
+        .unwrap()
+        .position = xy(500., 1000.);
+    assert_eq!(
+        roundtrip(
+            &f.p,
+            assignment::finish(&plan, &f.p, &valid).unwrap().unwrap()
+        ),
+        expected
+    );
+    let mut stale = f.p.clone();
+    stale.elements.get_mut(&f.b).unwrap().description = "Changed unrelated accepted record".into();
+    validate_candidate(&stale).unwrap();
+    assert!(matches!(
+        assignment::finish(&plan, &stale, &valid),
+        Err(Refusal::StaleScope)
+    ));
+    for field in 0..6 {
+        let mut altered = assignment::place(&plan, xy(500., 500.), context).unwrap();
+        match field {
+            0 => altered.diagram.nodes.get_mut(&f.n).unwrap().position.x += 20.,
+            1 => {
+                altered
+                    .view
+                    .nodes
+                    .iter_mut()
+                    .find(|node| node.id == f.n)
+                    .unwrap()
+                    .position
+                    .x += 20.
+            }
+            2 => altered.delta.x += 20.,
+            3 => altered.unfolded = Some(f.n),
+            4 => altered.commands.clear(),
+            5 => altered.requested.x += 10.,
+            _ => unreachable!(),
+        }
+        assert!(
+            matches!(
+                assignment::finish(&plan, &f.p, &altered),
+                Err(Refusal::StaleScope)
+            ),
+            "tampered result field {field}"
+        );
+    }
+}
+
+#[test]
+fn group_assignment_requires_non_anchor_selected_header_inside_viewport() {
+    let (f, companion, companion_node) = separate_unassigned(Layer::Oa);
+    let captured = assignment::capture(
+        &f.p,
+        f.d,
+        &BTreeMap::from([(f.n, f.w), (companion_node, companion)]),
+        f.n,
+    )
+    .unwrap();
+    let plan =
+        assignment::plan_semantics(&captured, Destination::OutsidePerformers, &BTreeMap::new())
+            .unwrap();
+    let wide = presentation(&f.p, f.d, None);
+    let placed = assignment::place(&plan, xy(500., 500.), wide).unwrap();
+    let mut narrow = wide;
+    narrow.viewport.size.height = 800.; // world bottom700: anchor header fits, companion does not.
+    let header = |id| {
+        let node = placed.view.nodes.iter().find(|node| node.id == id).unwrap();
+        Rect {
+            position: node.position,
+            size: Size {
+                width: node.size.width,
+                height: 62.,
+            },
+        }
+    };
+    assert!(narrow.viewport.contains(header(f.n)));
+    assert!(!narrow.viewport.contains(header(companion_node)));
+    // Only the viewport differs from the already admitted identical geometry.
+    assert!(matches!(
+        assignment::place(&plan, xy(500., 500.), narrow),
+        Err(Refusal::LayoutRequired(_))
+    ));
+}
+
+#[test]
+fn group_assignment_unresolved_oa_role_leaf_accepts_explicit_target_but_not_outside() {
+    for ambiguous in [false, true] {
+        let (mut f, companion, companion_node) = separate_unassigned(Layer::Oa);
+        let (role_id, role_assignment) = role(&mut f, None);
+        if ambiguous {
+            f.p.relate(
+                RelationKind::RoleRealization,
+                "A realizes responsibility",
+                f.a,
+                role_id,
+            );
+            f.p.relate(
+                RelationKind::RoleRealization,
+                "B realizes responsibility",
+                f.b,
+                role_id,
+            );
+        }
+        validate_candidate(&f.p).unwrap();
+        assert_eq!(validation::effective_performer(&f.p, f.w), None);
+        let captured = assignment::capture(
+            &f.p,
+            f.d,
+            &BTreeMap::from([(f.n, f.w), (companion_node, companion)]),
+            f.n,
+        )
+        .unwrap();
+        let Refusal::RoleExitRequired {
+            work,
+            roles,
+            performers,
+            ..
+        } = assignment::plan_semantics(&captured, Destination::OutsidePerformers, &BTreeMap::new())
+            .unwrap_err()
+        else {
+            panic!("unresolved role must produce its specific outward refusal");
+        };
+        assert_eq!(work, f.w);
+        assert_eq!(roles, vec![role_id]);
+        assert_eq!(
+            performers.into_iter().collect::<BTreeSet<_>>(),
+            if ambiguous {
+                BTreeSet::from([f.a, f.b])
+            } else {
+                BTreeSet::new()
+            }
+        );
+        let work_allocation = Id::new_v4();
+        let companion_allocation = Id::new_v4();
+        let ids = BTreeMap::from([(f.w, work_allocation), (companion, companion_allocation)]);
+        let plan =
+            assignment::plan_semantics(&captured, Destination::Performer(f.b), &ids).unwrap();
+        assert_eq!(plan.changed_count(), 2);
+        assert!(plan.label().contains("role responsibility retained"));
+        let mut expected = f.p.clone();
+        expected.relations.insert(
+            work_allocation,
+            expected_allocation(
+                work_allocation,
+                "b_performs_work",
+                "B performs Work",
+                f.b,
+                f.w,
+            ),
+        );
+        expected.relations.insert(
+            companion_allocation,
+            expected_allocation(
+                companion_allocation,
+                "b_performs_companion",
+                "B performs Companion",
+                f.b,
+                companion,
+            ),
+        );
+        assert_eq!(plan.project(), &expected);
+        assert_eq!(
+            plan.project().relations[&role_assignment],
+            f.p.relations[&role_assignment]
+        );
+        let placed =
+            assignment::place(&plan, xy(940., 200.), presentation(&f.p, f.d, Some(f.b))).unwrap();
+        expected
+            .diagrams
+            .get_mut(&f.d)
+            .unwrap()
+            .nodes
+            .get_mut(&f.n)
+            .unwrap()
+            .position = xy(940., 200.);
+        expected
+            .diagrams
+            .get_mut(&f.d)
+            .unwrap()
+            .nodes
+            .get_mut(&companion_node)
+            .unwrap()
+            .position = xy(940., 700.);
+        assert_eq!(
+            roundtrip(
+                &f.p,
+                assignment::finish(&plan, &f.p, &placed).unwrap().unwrap()
+            ),
+            expected
+        );
+    }
+}

crates/oa-desktop/src/allocation_drag/assignment_tests.rs

@@ -0,0 +1,606 @@
+use super::*;
+
+struct Roots {
+    f: Fixture,
+    c: Id,
+    cn: Id,
+    y: Id,
+    yn: Id,
+    z: Id,
+    zn: Id,
+    ax: Id,
+    by: Id,
+}
+
+fn roots(layer: Layer) -> Roots {
+    let mut f = fixture(layer);
+    let kind = f.p.elements[&f.w].kind();
+    let c =
+        f.p.add_element(
+            if layer == Layer::Oa {
+                Kind::Actor
+            } else {
+                Kind::SystemActor
+            },
+            layer,
+            "C",
+            None,
+        )
+        .unwrap();
+    let y = f.p.add_element(kind, layer, "Y", None).unwrap();
+    let z = f.p.add_element(kind, layer, "Z", None).unwrap();
+    let cn = f.p.place(f.d, c, xy(1500., 100.));
+    let yn = f.p.place(f.d, y, xy(140., 800.));
+    let zn = f.p.place(f.d, z, xy(1540., 1400.));
+    let d = f.p.diagrams.get_mut(&f.d).unwrap();
+    d.nodes.get_mut(&f.n).unwrap().position = xy(140., 200.);
+    d.nodes
+        .values_mut()
+        .find(|n| n.element == f.b)
+        .unwrap()
+        .position = xy(100., 700.);
+    let ax = f.p.relate(
+        RelationKind::Allocation,
+        "Original X responsibility",
+        f.a,
+        f.w,
+    );
+    let by = f.p.relate(
+        RelationKind::Allocation,
+        "Original Y responsibility",
+        f.b,
+        y,
+    );
+    f.p.relations.get_mut(&ax).unwrap().description = "Reviewed X identity must survive".into();
+    f.p.relations.get_mut(&by).unwrap().description = "Reviewed Y identity must survive".into();
+    if layer == Layer::Oa {
+        let r =
+            f.p.add_element(Kind::Role, layer, "Responsibility", None)
+                .unwrap();
+        f.p.relate(RelationKind::RoleAssignment, "Z role", r, z);
+        f.p.relate(RelationKind::RoleRealization, "C role", c, r);
+    } else {
+        f.p.relate(RelationKind::Allocation, "Z already assigned", c, z);
+    }
+    validate_candidate(&f.p).unwrap();
+    Roots {
+        f,
+        c,
+        cn,
+        y,
+        yn,
+        z,
+        zn,
+        ax,
+        by,
+    }
+}
+
+fn wide(p: &Project, d: Id, target: Option<Id>) -> PresentationContext {
+    let mut context = presentation(p, d, target);
+    context.viewport.size = Size {
+        width: 5000.,
+        height: 3000.,
+    };
+    context
+}
+
+fn selected(r: &Roots, with_z: bool) -> BTreeMap<Id, Id> {
+    let mut ids = BTreeMap::from([(r.f.n, r.f.w), (r.yn, r.y)]);
+    if with_z {
+        ids.insert(r.zn, r.z);
+    }
+    ids
+}
+
+fn retarget(p: &mut Project, relation: Id, target: Id) {
+    let r = p.relations.get_mut(&relation).unwrap();
+    r.body = RelationBody::Allocation {
+        source: target,
+        target: r.target(),
+    };
+}
+
+#[test]
+fn group_assignment_independent_performers_preserves_already_correct_provenance() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let r = roots(layer);
+        let selected = selected(&r, true);
+        let scope = assignment::capture(&r.f.p, r.f.d, &selected, r.f.n).unwrap();
+        let plan =
+            assignment::plan_semantics(&scope, Destination::Performer(r.c), &BTreeMap::new())
+                .unwrap();
+        assert_eq!(plan.changed_count(), 2);
+        assert_eq!(plan.already_correct_count(), 1);
+        let placed =
+            assignment::place(&plan, xy(1540., 200.), wide(&r.f.p, r.f.d, Some(r.c))).unwrap();
+        let mut expected = r.f.p.clone();
+        retarget(&mut expected, r.ax, r.c);
+        retarget(&mut expected, r.by, r.c);
+        let d = expected.diagrams.get_mut(&r.f.d).unwrap();
+        d.nodes.get_mut(&r.f.n).unwrap().position = xy(1540., 200.);
+        d.nodes.get_mut(&r.yn).unwrap().position = xy(1540., 800.);
+        d.nodes.get_mut(&r.zn).unwrap().position = xy(2940., 1400.);
+        assert_eq!(
+            roundtrip(
+                &r.f.p,
+                assignment::finish(&plan, &r.f.p, &placed).unwrap().unwrap()
+            ),
+            expected
+        );
+        if layer == Layer::Oa {
+            assert!(
+                !plan
+                    .project()
+                    .relations
+                    .values()
+                    .any(|relation| relation.kind() == RelationKind::Allocation
+                        && relation.target() == r.z)
+            );
+            assert!(matches!(
+                assignment::plan_semantics(
+                    &scope,
+                    Destination::OutsidePerformers,
+                    &BTreeMap::new()
+                ),
+                Err(Refusal::RoleExitRequired { .. })
+            ));
+        }
+        assert!(
+            assignment::plan_semantics(&scope, Destination::LayoutOnly, &BTreeMap::new()).is_err()
+        );
+    }
+}
+
+#[test]
+fn group_assignment_zero_delta_changes_semantics_once_and_then_is_noop() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = fixture(layer);
+        let d = f.p.diagrams.get_mut(&f.d).unwrap();
+        d.nodes
+            .values_mut()
+            .find(|n| n.element == f.a)
+            .unwrap()
+            .size = Size {
+            width: 600.,
+            height: 400.,
+        };
+        d.nodes.get_mut(&f.n).unwrap().position = xy(140., 200.);
+        let scope = assignment::capture(&f.p, f.d, &BTreeMap::from([(f.n, f.w)]), f.n).unwrap();
+        let id = Id::new_v4();
+        let plan = assignment::plan_semantics(
+            &scope,
+            Destination::Performer(f.a),
+            &BTreeMap::from([(f.w, id)]),
+        )
+        .unwrap();
+        let placed = assignment::place(&plan, xy(140., 200.), wide(&f.p, f.d, Some(f.a))).unwrap();
+        assert_eq!(placed.delta, xy(0., 0.));
+        let mut expected = f.p.clone();
+        expected.relations.insert(
+            id,
+            Relation {
+                id,
+                alias: "a_performs_work".into(),
+                name: "A performs Work".into(),
+                description: String::new(),
+                body: RelationBody::Allocation {
+                    source: f.a,
+                    target: f.w,
+                },
+            },
+        );
+        assert_eq!(
+            roundtrip(
+                &f.p,
+                assignment::finish(&plan, &f.p, &placed).unwrap().unwrap()
+            ),
+            expected
+        );
+        let scope =
+            assignment::capture(&expected, f.d, &BTreeMap::from([(f.n, f.w)]), f.n).unwrap();
+        let noop =
+            assignment::plan_semantics(&scope, Destination::Performer(f.a), &BTreeMap::new())
+                .unwrap();
+        let placed =
+            assignment::place(&noop, xy(140., 200.), wide(&expected, f.d, Some(f.a))).unwrap();
+        assert!(
+            assignment::finish(&noop, &expected, &placed)
+                .unwrap()
+                .is_none()
+        );
+    }
+}
+
+#[test]
+fn group_assignment_unfolds_only_changed_destination_and_refuses_newly_exposed_overlap() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        for obstacle in [false, true] {
+            let mut r = roots(layer);
+            let d = r.f.p.diagrams.get_mut(&r.f.d).unwrap();
+            d.nodes
+                .values_mut()
+                .find(|n| n.element == r.f.b)
+                .unwrap()
+                .position = xy(100., 400.);
+            d.nodes.get_mut(&r.yn).unwrap().position = xy(140., 500.);
+            d.nodes.get_mut(&r.zn).unwrap().position = xy(1540., 800.);
+            d.nodes.get_mut(&r.cn).unwrap().collapsed = true;
+            if obstacle {
+                let k =
+                    r.f.p
+                        .add_element(r.f.p.elements[&r.f.w].kind(), layer, "Hidden overlap", None)
+                        .unwrap();
+                r.f.p
+                    .relate(RelationKind::Allocation, "C also owns K", r.c, k);
+                r.f.p.place(r.f.d, k, xy(1540., 800.));
+            }
+            assert!(
+                !projection::project_view(&r.f.p, r.f.d)
+                    .nodes
+                    .iter()
+                    .any(|n| n.id == r.zn)
+            );
+            assert!(
+                assignment::capture(&r.f.p, r.f.d, &selected(&r, true), r.f.n).is_err(),
+                "hidden selected member is not normalized away"
+            );
+            let scope = assignment::capture(&r.f.p, r.f.d, &selected(&r, false), r.f.n).unwrap();
+            let plan =
+                assignment::plan_semantics(&scope, Destination::Performer(r.c), &BTreeMap::new())
+                    .unwrap();
+            let placed = assignment::place(&plan, xy(1540., 120.), wide(&r.f.p, r.f.d, Some(r.c)));
+            if obstacle {
+                assert!(matches!(placed, Err(Refusal::LayoutRequired(_))));
+                continue;
+            }
+            let placed = placed.unwrap();
+            assert_eq!(placed.unfolded, Some(r.cn));
+            let mut expected = r.f.p.clone();
+            retarget(&mut expected, r.ax, r.c);
+            retarget(&mut expected, r.by, r.c);
+            let d = expected.diagrams.get_mut(&r.f.d).unwrap();
+            d.nodes.get_mut(&r.cn).unwrap().collapsed = false;
+            d.nodes.get_mut(&r.f.n).unwrap().position = xy(1540., 120.);
+            d.nodes.get_mut(&r.yn).unwrap().position = xy(1540., 420.);
+            assert_eq!(
+                roundtrip(
+                    &r.f.p,
+                    assignment::finish(&plan, &r.f.p, &placed).unwrap().unwrap()
+                ),
+                expected
+            );
+        }
+    }
+}
+
+#[test]
+fn group_assignment_accumulates_stable_ids_and_aliases_without_partial_reuse() {
+    let mut f = fixture(Layer::Oa);
+    let y =
+        f.p.add_element(Kind::Activity, Layer::Oa, "Work", None)
+            .unwrap();
+    let yn = f.p.place(f.d, y, xy(400., 500.));
+    let selected = BTreeMap::from([(f.n, f.w), (yn, y)]);
+    let scope = assignment::capture(&f.p, f.d, &selected, f.n).unwrap();
+    let ids = BTreeMap::from([(f.w, Id::new_v4()), (y, Id::new_v4())]);
+    let first = assignment::plan_semantics(&scope, Destination::Performer(f.a), &ids).unwrap();
+    let other = assignment::plan_semantics(&scope, Destination::Performer(f.b), &ids).unwrap();
+    let repeated = assignment::plan_semantics(&scope, Destination::Performer(f.a), &ids).unwrap();
+    assert_eq!(first.project(), repeated.project());
+    assert_eq!(first.changed_count(), 2);
+    let mut expected = f.p.clone();
+    let aliases: BTreeSet<_> = ids
+        .values()
+        .map(|id| first.project().relations[id].alias.clone())
+        .collect();
+    assert_eq!(aliases.len(), 2);
+    assert!(aliases.contains("a_performs_work"));
+    for (ordinal, (work, id)) in ids.iter().enumerate() {
+        let relation = &first.project().relations[id];
+        let expected_relation = Relation {
+            id: *id,
+            alias: if ordinal == 0 {
+                "a_performs_work".into()
+            } else {
+                format!("a_performs_work_{}", &id.simple().to_string()[..8])
+            },
+            name: "A performs Work".into(),
+            description: String::new(),
+            body: RelationBody::Allocation {
+                source: f.a,
+                target: *work,
+            },
+        };
+        assert_eq!(relation, &expected_relation);
+        assert_eq!(
+            other.project().relations[id].body,
+            RelationBody::Allocation {
+                source: f.b,
+                target: *work
+            }
+        );
+        expected.relations.insert(*id, expected_relation);
+    }
+    assert_eq!(first.project(), &expected);
+    let duplicate = Id::new_v4();
+    for bad in [
+        BTreeMap::from([(f.w, duplicate), (y, duplicate)]),
+        BTreeMap::from([(f.w, Id::nil()), (y, ids[&y])]),
+        BTreeMap::from([(f.w, f.a), (y, ids[&y])]),
+    ] {
+        assert!(assignment::plan_semantics(&scope, Destination::Performer(f.a), &bad).is_err());
+    }
+}
+
+#[test]
+fn group_assignment_source_failure_preserves_existing_history_and_retry_ids() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = fixture(layer);
+        let y =
+            f.p.add_element(f.p.elements[&f.w].kind(), layer, "Y", None)
+                .unwrap();
+        let yn = f.p.place(f.d, y, xy(400., 800.));
+        let mut bundle = format_bundle(&f.p);
+        bundle
+            .files
+            .get_mut(&bundle.entry.clone())
+            .unwrap()
+            .insert_str(
+                0,
+                "// Keep reviewed source through a refused group assignment.\n",
+            );
+        let mut limits = ProjectLimits::default();
+        limits.model.max_source_bytes = bundle.files.values().map(String::len).sum::<usize>() + 128;
+        let mut document = Document::from_bundle(bundle, limits).unwrap();
+        document
+            .execute(Command::Describe(f.w, "Reviewed".into()))
+            .unwrap();
+        document
+            .execute(Command::Rename(y, "Future Y".into()))
+            .unwrap();
+        let redo_project = document.project().clone();
+        let redo_source = document.bundle().clone();
+        assert!(document.undo());
+        assert!(document.can_undo() && document.can_redo());
+        let accepted = document.project().clone();
+        let source = document.bundle().clone();
+        let revision = document.revision();
+        let ids = BTreeMap::from([(f.w, Id::new_v4()), (y, Id::new_v4())]);
+        let scope =
+            assignment::capture(&accepted, f.d, &BTreeMap::from([(f.n, f.w), (yn, y)]), f.n)
+                .unwrap();
+        let plan = assignment::plan_semantics(&scope, Destination::Performer(f.a), &ids).unwrap();
+        let placed =
+            assignment::place(&plan, xy(150., 200.), wide(&accepted, f.d, Some(f.a))).unwrap();
+        let command = assignment::finish(&plan, &accepted, &placed)
+            .unwrap()
+            .unwrap();
+        assert!(matches!(
+            document.execute(command.clone()),
+            Err(crate::document::DocumentError::Source(_))
+        ));
+        assert_eq!(document.project(), &accepted);
+        assert_eq!(document.bundle(), &source);
+        assert_eq!(document.revision(), revision);
+        assert!(document.can_undo() && document.can_redo());
+        assert!(document.redo());
+        assert_eq!(document.project(), &redo_project);
+        assert_eq!(document.bundle(), &redo_source);
+        assert!(document.undo());
+        assert_eq!(document.project(), &accepted);
+        assert_eq!(document.bundle(), &source);
+        let mut expected = accepted.clone();
+        for (work, name, alias) in [
+            (f.w, "A performs Work", "a_performs_work"),
+            (y, "A performs Y", "a_performs_y"),
+        ] {
+            expected.relations.insert(
+                ids[&work],
+                Relation {
+                    id: ids[&work],
+                    alias: alias.into(),
+                    name: name.into(),
+                    description: String::new(),
+                    body: RelationBody::Allocation {
+                        source: f.a,
+                        target: work,
+                    },
+                },
+            );
+        }
+        let d = expected.diagrams.get_mut(&f.d).unwrap();
+        d.nodes.get_mut(&f.n).unwrap().position = xy(150., 200.);
+        d.nodes.get_mut(&yn).unwrap().position = xy(450., 500.);
+        assert_eq!(roundtrip(&accepted, command), expected);
+    }
+}
+
+#[test]
+fn group_assignment_collateral_surviving_constraint_refuses_whole_semantic_candidate() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut r = roots(layer);
+        let k =
+            r.f.p
+                .add_element(Kind::Constraint, layer, "Keep reviewed assignment", None)
+                .unwrap();
+        *r.f.p.elements.get_mut(&k).unwrap().shared_mut().unwrap() = SharedBody::Constraint {
+            expression: "reviewed assignment".into(),
+            constrained: vec![r.ax, r.f.w],
+        };
+        let core = prepare_command(&r.f.p, &Command::Delete(r.ax))
+            .unwrap()
+            .project;
+        validate_candidate(&core).unwrap();
+        assert!(core.elements.contains_key(&k));
+        assert_ne!(core.elements[&k], r.f.p.elements[&k]);
+        let scope = assignment::capture(&r.f.p, r.f.d, &selected(&r, false), r.f.n).unwrap();
+        let Err(Refusal::CollateralChangeRequired(changed)) =
+            assignment::plan_semantics(&scope, Destination::OutsidePerformers, &BTreeMap::new())
+        else {
+            panic!("surviving constraint edit must refuse the entire plan");
+        };
+        assert!(changed.iter().any(|record| record.id == k));
+    }
+}
+
+#[test]
+fn group_assignment_uses_vacated_space_and_one_complete_route_owner_map() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = fixture(layer);
+        let kind = f.p.elements[&f.w].kind();
+        let y = f.p.add_element(kind, layer, "Y", None).unwrap();
+        let outside = f.p.add_element(kind, layer, "Outside", None).unwrap();
+        let yn = f.p.place(f.d, y, xy(400., 500.));
+        f.p.place(f.d, outside, xy(1600., 500.));
+        let d = f.p.diagrams.get_mut(&f.d).unwrap();
+        let a = d.nodes.values_mut().find(|n| n.element == f.a).unwrap();
+        a.position = xy(350., 350.);
+        a.size = Size {
+            width: 1000.,
+            height: 600.,
+        };
+        let edge_kind = if layer == Layer::Oa {
+            RelationKind::Interaction
+        } else {
+            RelationKind::FunctionalExchange
+        };
+        let internal = f.p.relate(edge_kind, "Internal", f.w, y);
+        let external = f.p.relate(edge_kind, "External", y, outside);
+        let mut internal_route = route(internal);
+        internal_route.waypoints = vec![xy(370., 550.), xy(370., 650.)];
+        internal_route.source_attachment = Some(EdgeAttachment {
+            side: PortAnchorSide::Bottom,
+            offset: 0.3,
+        });
+        internal_route.target_attachment = Some(EdgeAttachment {
+            side: PortAnchorSide::Top,
+            offset: 0.7,
+        });
+        let mut external_route = internal_route.clone();
+        external_route.edge = external;
+        external_route.waypoints = vec![xy(1200., 550.), xy(1300., 650.)];
+        for diagram in [f.d, f.second] {
+            f.p.diagrams.get_mut(&diagram).unwrap().routes =
+                vec![internal_route.clone(), external_route.clone()];
+        }
+        if let RelationBody::FunctionalExchange { source_port, .. } = f.p.relations[&internal].body
+        {
+            f.p.diagrams
+                .get_mut(&f.d)
+                .unwrap()
+                .nodes
+                .get_mut(&f.n)
+                .unwrap()
+                .port_anchors
+                .push(PortAnchor {
+                    port: source_port,
+                    side: PortAnchorSide::Bottom,
+                    offset: 0.4,
+                });
+        }
+        validate_candidate(&f.p).unwrap();
+        let ids = BTreeMap::from([(f.w, Id::new_v4()), (y, Id::new_v4())]);
+        // The singleton candidate really occupies stationary Y's card. The
+        // combined candidate must not inherit that sequential-planning veto.
+        let mut singleton = f.p.clone();
+        singleton
+            .diagrams
+            .get_mut(&f.d)
+            .unwrap()
+            .nodes
+            .get_mut(&f.n)
+            .unwrap()
+            .position = xy(400., 500.);
+        let projected = projection::project_view(&singleton, f.d);
+        let x_card = projected.nodes.iter().find(|n| n.id == f.n).unwrap();
+        let y_card = projected.nodes.iter().find(|n| n.id == yn).unwrap();
+        assert_eq!(
+            overlap(x_card, y_card),
+            if layer == Layer::Oa { 21056. } else { 29568. }
+        );
+        let single = assignment::capture(&f.p, f.d, &BTreeMap::from([(f.n, f.w)]), f.n).unwrap();
+        let single =
+            assignment::plan_semantics(&single, Destination::Performer(f.a), &ids).unwrap();
+        assert!(matches!(
+            assignment::place(&single, xy(400., 500.), wide(&f.p, f.d, Some(f.a))),
+            Err(Refusal::LayoutRequired(_))
+        ));
+        let scope =
+            assignment::capture(&f.p, f.d, &BTreeMap::from([(f.n, f.w), (yn, y)]), f.n).unwrap();
+        let plan = assignment::plan_semantics(&scope, Destination::Performer(f.a), &ids).unwrap();
+        let placed = assignment::place(&plan, xy(400., 500.), wide(&f.p, f.d, Some(f.a))).unwrap();
+        let mut expected = f.p.clone();
+        for (work, name, alias) in [
+            (f.w, "A performs Work", "a_performs_work"),
+            (y, "A performs Y", "a_performs_y"),
+        ] {
+            expected.relations.insert(
+                ids[&work],
+                Relation {
+                    id: ids[&work],
+                    alias: alias.into(),
+                    name: name.into(),
+                    description: String::new(),
+                    body: RelationBody::Allocation {
+                        source: f.a,
+                        target: work,
+                    },
+                },
+            );
+        }
+        let d = expected.diagrams.get_mut(&f.d).unwrap();
+        d.nodes.get_mut(&f.n).unwrap().position = xy(400., 500.);
+        d.nodes.get_mut(&yn).unwrap().position = xy(700., 500.);
+        d.routes[0].waypoints = vec![xy(670., 550.), xy(670., 650.)];
+        assert_eq!(placed.diagram.routes[1], external_route);
+        assert_eq!(
+            roundtrip(
+                &f.p,
+                assignment::finish(&plan, &f.p, &placed).unwrap().unwrap()
+            ),
+            expected
+        );
+    }
+}
+
+#[test]
+fn group_assignment_deletes_only_own_routes_across_views_and_keeps_internal_flow() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut r = roots(layer);
+        let kind = if layer == Layer::Oa {
+            RelationKind::Interaction
+        } else {
+            RelationKind::FunctionalExchange
+        };
+        let internal = r.f.p.relate(kind, "Keep internal flow", r.f.w, r.y);
+        for diagram in [r.f.d, r.f.second] {
+            r.f.p.diagrams.get_mut(&diagram).unwrap().routes =
+                vec![route(r.ax), route(internal), route(r.by)];
+        }
+        validate_candidate(&r.f.p).unwrap();
+        let scope = assignment::capture(&r.f.p, r.f.d, &selected(&r, false), r.f.n).unwrap();
+        let plan =
+            assignment::plan_semantics(&scope, Destination::OutsidePerformers, &BTreeMap::new())
+                .unwrap();
+        assert_eq!(plan.changed_count(), 2);
+        let placed = assignment::place(&plan, xy(640., 200.), wide(&r.f.p, r.f.d, None)).unwrap();
+        let mut expected = r.f.p.clone();
+        expected.relations.remove(&r.ax);
+        expected.relations.remove(&r.by);
+        for diagram in [r.f.d, r.f.second] {
+            expected.diagrams.get_mut(&diagram).unwrap().routes = vec![route(internal)];
+        }
+        let d = expected.diagrams.get_mut(&r.f.d).unwrap();
+        d.nodes.get_mut(&r.f.n).unwrap().position = xy(640., 200.);
+        d.nodes.get_mut(&r.yn).unwrap().position = xy(640., 800.);
+        d.routes[0].waypoints = vec![xy(920., 400.), xy(920., 550.)];
+        assert_eq!(
+            roundtrip(
+                &r.f.p,
+                assignment::finish(&plan, &r.f.p, &placed).unwrap().unwrap()
+            ),
+            expected
+        );
+    }
+}

crates/oa-desktop/src/allocation_drag/geometry.rs

@@ -0,0 +1,196 @@
+//! Geometry operations over an explicitly captured placement set.
+use super::*;
+
+pub(super) struct Translation {
+    pub diagram: Diagram,
+    pub commands: Vec<Command>,
+    pub delta: Position,
+}
+
+/// Translate exactly `placements` using one snapped anchor delta. `base` must
+/// come from an exact, validated semantic candidate; absent routes are permitted
+/// only because that candidate has already admitted their semantic deletion.
+pub(super) fn translate(
+    accepted: &Project,
+    original: &Diagram,
+    base: &Diagram,
+    placements: &BTreeMap<Id, NodePlacement>,
+    anchor: Id,
+    requested: Position,
+) -> Result<Translation, Refusal> {
+    let anchor = placements.get(&anchor).ok_or(Refusal::StaleScope)?;
+    let delta = Position {
+        x: (requested.x / 10.).round() * 10. - anchor.position.x,
+        y: (requested.y / 10.).round() * 10. - anchor.position.y,
+    };
+    let mut diagram = base.clone();
+    let mut commands = Vec::new();
+    let mut deltas = BTreeMap::new();
+    for (id, captured) in placements {
+        let node = diagram.nodes.get_mut(id).ok_or(Refusal::StaleScope)?;
+        node.position = Position {
+            x: captured.position.x + delta.x,
+            y: captured.position.y + delta.y,
+        };
+        if !(Rect {
+            position: node.position,
+            size: node.size,
+        })
+        .valid()
+        {
+            return Err(Refusal::InvalidCandidate(
+                "Moved coordinates exceed the model bounds.".into(),
+            ));
+        }
+        deltas.insert(*id, delta);
+        if node != captured {
+            commands.push(Command::EditNode {
+                diagram: diagram.id,
+                original: *id,
+                node: node.clone(),
+            });
+        }
+    }
+    // Resolve actual endpoint owners once against accepted semantics and the
+    // complete delta map. Never reinsert a semantically deleted saved route.
+    for route in projection::translated_routes(accepted, original, &deltas) {
+        if let Some(stored) = diagram.routes.iter_mut().find(|r| r.edge == route.edge) {
+            if route.waypoints.iter().any(|point| {
+                !point.x.is_finite()
+                    || !point.y.is_finite()
+                    || point.x.abs() > MAX_COORDINATE
+                    || point.y.abs() > MAX_COORDINATE
+            }) {
+                return Err(Refusal::InvalidCandidate(
+                    "Moved route exceeds the model bounds.".into(),
+                ));
+            }
+            *stored = route.clone();
+            commands.push(Command::SetEdgeRoute {
+                diagram: diagram.id,
+                route,
+            });
+        }
+    }
+    Ok(Translation {
+        diagram,
+        commands,
+        delta,
+    })
+}
+
+/// Recover hidden ancestry for identity lookup only. The all-unfolded scene is
+/// never used for collision admission; only affected nodes and their ancestors
+/// enter the required diagnostic expansion.
+pub(super) fn expansion_ids(
+    p: &Project,
+    d: &Diagram,
+    index: &ViewIndex,
+    placements: &BTreeMap<Id, NodePlacement>,
+) -> Result<BTreeSet<Id>, Refusal> {
+    let mut all_unfolded = d.clone();
+    for node in all_unfolded.nodes.values_mut() {
+        node.collapsed = false;
+    }
+    let all_view = projection::project_diagram_with_index(p, &all_unfolded, index);
+    let ancestry = ancestors(&all_view);
+    let mut ids: BTreeSet<_> = placements.keys().copied().collect();
+    for id in placements.keys() {
+        ids.extend(ancestry.get(id).ok_or(Refusal::StaleScope)?.iter().copied());
+    }
+    Ok(ids)
+}
+
+pub(super) fn expanded_view(
+    p: &Project,
+    d: &Diagram,
+    index: &ViewIndex,
+    ids: &BTreeSet<Id>,
+) -> ProjectedView {
+    let mut expanded = d.clone();
+    for id in ids {
+        if let Some(node) = expanded.nodes.get_mut(id) {
+            node.collapsed = false;
+        }
+    }
+    projection::project_diagram_with_index(p, &expanded, index)
+}
+
+pub(super) fn check_scenes(
+    before_visible: &ProjectedView,
+    before_expanded: &ProjectedView,
+    visible: &ProjectedView,
+    expanded: &ProjectedView,
+) -> Result<(), Refusal> {
+    if visible.nodes.iter().chain(&expanded.nodes).any(|node| {
+        !(Rect {
+            position: node.position,
+            size: node.size,
+        })
+        .valid()
+    }) {
+        return Err(Refusal::InvalidCandidate(
+            "The projected enclosure exceeds the model bounds.".into(),
+        ));
+    }
+    if overlaps(before_visible, visible) || overlaps(before_expanded, expanded) {
+        return Err(Refusal::LayoutRequired(
+            "Make room before arranging: the candidate would introduce or enlarge overlapping cards."
+                .into(),
+        ));
+    }
+    Ok(())
+}
+
+pub(super) fn check_rigid(
+    before: &ProjectedView,
+    after: &ProjectedView,
+    placements: &BTreeMap<Id, NodePlacement>,
+    delta: Position,
+) -> Result<(), Refusal> {
+    let before: BTreeMap<_, _> = before.nodes.iter().map(|n| (n.id, n)).collect();
+    let after: BTreeMap<_, _> = after.nodes.iter().map(|n| (n.id, n)).collect();
+    for id in placements.keys() {
+        let old = before.get(id).ok_or(Refusal::StaleScope)?;
+        let new = after.get(id).ok_or(Refusal::StaleScope)?;
+        if (new.position.x - old.position.x - delta.x).abs() > 0.01
+            || (new.position.y - old.position.y - delta.y).abs() > 0.01
+            || (new.size.width - old.size.width).abs() > 0.01
+            || (new.size.height - old.size.height).abs() > 0.01
+        {
+            return Err(Refusal::LayoutRequired(
+                "This selection requires an explicit layout; its footprint cannot be translated unchanged."
+                    .into(),
+            ));
+        }
+    }
+    Ok(())
+}
+
+pub(super) fn check_headers(
+    view: &ProjectedView,
+    selected: &BTreeMap<Id, Id>,
+    presentation: PresentationContext,
+    outgoing: bool,
+) -> Result<(), Refusal> {
+    for (id, element) in selected {
+        let node = view
+            .nodes
+            .iter()
+            .find(|node| node.id == *id && node.element == *element)
+            .ok_or_else(|| Refusal::LayoutRequired("A selected header would be hidden.".into()))?;
+        let header = Rect {
+            position: node.position,
+            size: Size {
+                width: node.size.width,
+                height: node.size.height.min(62.),
+            },
+        };
+        if !presentation.header_visible(header, outgoing) {
+            return Err(Refusal::LayoutRequired(
+                "Make room or adjust the view, then drag again.".into(),
+            ));
+        }
+    }
+    Ok(())
+}

crates/oa-desktop/src/allocation_drag/group_arrange_experiment.rs

@@ -0,0 +1,450 @@
+//! Reviewed policy experiment using the production projection and translator.
+//! No production admission or atomic-refusal behavior is tested here.
+use super::*;
+
+struct Mixed {
+    f: Fixture,
+    an: Id,
+    xn: Id,
+    yn: Id,
+    internal: Id,
+    include_performer: bool,
+}
+
+fn mixed(layer: Layer, collapsed: bool, obstacle: bool, include_performer: bool) -> Mixed {
+    let mut f = fixture(layer);
+    let work = f.p.elements[&f.w].kind();
+    let exchange = match layer {
+        Layer::Oa => RelationKind::Interaction,
+        Layer::Sa => RelationKind::FunctionalExchange,
+    };
+    let x = f.p.add_element(work, layer, "X", Some(f.w)).unwrap();
+    let y = f.p.add_element(work, layer, "Y", Some(f.w)).unwrap();
+    let outside = f.p.add_element(work, layer, "Outside", None).unwrap();
+    let xn = f.p.place(f.d, x, xy(140., 200.));
+    let yn = f.p.place(f.d, y, xy(940., 200.));
+    f.p.place(f.d, outside, xy(1800., 800.));
+    f.p.relate(RelationKind::Allocation, "A owns X", f.a, x);
+    f.p.relate(RelationKind::Allocation, "B owns Y", f.b, y);
+    // FunctionalExchange's actual builder creates valid function input/output
+    // ports; do not manufacture Interaction records between SA Functions.
+    let internal = f.p.relate(exchange, "X to Y", x, y);
+    let external = f.p.relate(exchange, "Y to Outside", y, outside);
+    let an = f.p.diagrams[&f.d]
+        .nodes
+        .values()
+        .find(|n| n.element == f.a)
+        .unwrap()
+        .id;
+    let d = f.p.diagrams.get_mut(&f.d).unwrap();
+    d.nodes.get_mut(&f.n).unwrap().position = xy(100., 800.);
+    d.nodes.get_mut(&an).unwrap().collapsed = collapsed;
+    d.routes = vec![route(internal), route(external)];
+    if obstacle {
+        let id =
+            f.p.add_element(work, layer, "Stationary obstacle", None)
+                .unwrap();
+        f.p.place(f.d, id, xy(550., 230.));
+    }
+    validate_candidate(&f.p).unwrap();
+    let captured = scope(&f);
+    assert_eq!(captured.uniform, Uniform::MixedOrUnresolved);
+    assert_eq!(
+        captured.placements.keys().copied().collect::<BTreeSet<_>>(),
+        BTreeSet::from([f.n, xn, yn])
+    );
+    // Explicit control: the real current API still refuses Arrange for this root.
+    assert!(matches!(
+        plan_semantics(&f.p, &captured, Destination::LayoutOnly, &BTreeMap::new()),
+        Err(Refusal::MixedLayoutRequired)
+    ));
+    assert!(matches!(
+        plan_semantics(
+            &f.p,
+            &captured,
+            Destination::Performer(f.a),
+            &BTreeMap::new()
+        ),
+        Err(Refusal::MixedLayoutRequired)
+    ));
+    Mixed {
+        f,
+        an,
+        xn,
+        yn,
+        internal,
+        include_performer,
+    }
+}
+
+fn affected(m: &Mixed) -> BTreeSet<Id> {
+    let mut ids: BTreeSet<_> = scope(&m.f).placements.keys().copied().collect();
+    let mut expected = BTreeSet::from([m.f.n, m.xn, m.yn]);
+    if m.include_performer {
+        ids.insert(m.an);
+        ids.extend(projection::descendant_nodes(&m.f.p, m.f.d, m.an));
+        expected.insert(m.an);
+    }
+    assert_eq!(ids, expected);
+    ids
+}
+
+// Diagnostic expansion changes only a temporary Diagram. Include affected
+// descendants and ancestors even when the normal projection hides them.
+// Unrelated folded interiors are intentionally OUTSIDE this diagnostic domain.
+fn diagnostic(p: &Project, diagram: Id, ids: &BTreeSet<Id>) -> ProjectedView {
+    let mut d = p.diagrams[&diagram].clone();
+    for (id, node) in &mut d.nodes {
+        if ids.contains(id)
+            || projection::descendant_nodes(p, diagram, *id)
+                .iter()
+                .any(|n| ids.contains(n))
+        {
+            node.collapsed = false;
+        }
+    }
+    projection::project_diagram(p, &d)
+}
+
+fn rigid(before: &ProjectedView, after: &ProjectedView, ids: &BTreeSet<Id>) {
+    for id in ids {
+        let old = before.nodes.iter().find(|n| n.id == *id).unwrap();
+        let new = after.nodes.iter().find(|n| n.id == *id).unwrap();
+        assert_eq!(new.position, xy(old.position.x + 400., old.position.y));
+        assert_eq!(new.size, old.size, "no reflow of an affected footprint");
+    }
+}
+
+// The only experimental bypass: use the pure general geometry command instead
+// of plan_semantics(LayoutOnly), whose mixed-root pre-veto is asserted above.
+// This is not a fabricated Scope or a call to singleton check_geometry with a
+// falsely enlarged Scope. The combined scene uses the real overlap predicate.
+fn candidate(m: &Mixed) -> (Command, Project) {
+    let ids = affected(m);
+    let command =
+        oa_core::diagram_edit::translate_placements(&m.f.p, m.f.d, &ids, xy(400., 0.)).unwrap();
+    let actual = prepare_command(&m.f.p, &command).unwrap().project;
+    validate_candidate(&actual).unwrap();
+    // Independent literal expected Project: no planner or route helper oracle.
+    let mut expected = m.f.p.clone();
+    let d = expected.diagrams.get_mut(&m.f.d).unwrap();
+    for (id, position) in [
+        (m.f.n, xy(500., 800.)),
+        (m.xn, xy(540., 200.)),
+        (m.yn, xy(1340., 200.)),
+    ] {
+        d.nodes.get_mut(&id).unwrap().position = position;
+    }
+    if m.include_performer {
+        d.nodes.get_mut(&m.an).unwrap().position = xy(500., 100.);
+    }
+    let internal = d.routes.iter_mut().find(|r| r.edge == m.internal).unwrap();
+    internal.waypoints = vec![xy(820., 400.), xy(820., 550.)];
+    assert_eq!(
+        actual, expected,
+        "complete records, including folds, routes, other view and relations"
+    );
+    (command, actual)
+}
+
+#[test]
+fn mixed_arrange_experiment_distributed_root_and_performer_can_translate_rigidly() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let enclosure_height = match layer {
+            Layer::Oa => 218.,
+            Layer::Sa => 256.,
+        };
+        for include_performer in [false, true] {
+            for collapsed in [false, true] {
+                let m = mixed(layer, collapsed, false, include_performer);
+                let accepted = m.f.p.clone();
+                let (command, actual) = candidate(&m);
+                let ids = affected(&m);
+                let before = projection::project_view(&accepted, m.f.d);
+                let after = projection::project_view(&actual, m.f.d);
+                let before_expanded = diagnostic(&accepted, m.f.d, &ids);
+                let after_expanded = diagnostic(&actual, m.f.d, &ids);
+                assert!(
+                    !overlaps(&before, &after),
+                    "visible scene must admit the combined move"
+                );
+                assert!(
+                    !overlaps(&before_expanded, &after_expanded),
+                    "expanded scene must admit the combined move"
+                );
+                rigid(&before_expanded, &after_expanded, &ids);
+                for node in after.nodes.iter().chain(&after_expanded.nodes) {
+                    assert!(
+                        (Rect {
+                            position: node.position,
+                            size: node.size
+                        })
+                        .valid()
+                    );
+                }
+                // Explicit selected headers remain visible. Native clipping/readability
+                // and complete group gesture admission are intentionally not claimed.
+                assert!(after.nodes.iter().any(|n| n.id == m.f.n));
+                if include_performer {
+                    assert!(after.nodes.iter().any(|n| n.id == m.an));
+                } else {
+                    assert_eq!(
+                        actual.diagrams[&m.f.d].nodes[&m.an],
+                        accepted.diagrams[&m.f.d].nodes[&m.an]
+                    );
+                    assert_eq!(node(&before_expanded, m.an).position, xy(100., 100.));
+                    assert_eq!(
+                        node(&before_expanded, m.an).size,
+                        Size {
+                            width: 288.,
+                            height: enclosure_height
+                        }
+                    );
+                    assert_eq!(node(&after_expanded, m.an).position, xy(100., 100.));
+                    assert_eq!(
+                        node(&after_expanded, m.an).size,
+                        Size {
+                            width: 688.,
+                            height: enclosure_height
+                        }
+                    );
+                }
+                assert_eq!(roundtrip(&accepted, command), actual);
+                assert_eq!(m.f.p, accepted);
+            }
+        }
+    }
+}
+
+#[test]
+fn mixed_arrange_experiment_detects_moved_folded_child_collision() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let expected_overlap = match layer {
+            Layer::Oa => 13696.,
+            Layer::Sa => 20116.,
+        };
+        let m = mixed(layer, true, true, true);
+        let accepted = m.f.p.clone();
+        let (_, actual) = candidate(&m);
+        let ids = affected(&m);
+        let before = projection::project_view(&accepted, m.f.d);
+        let after = projection::project_view(&actual, m.f.d);
+        assert!(!before.nodes.iter().any(|n| n.id == m.xn));
+        assert!(!after.nodes.iter().any(|n| n.id == m.xn));
+        assert!(
+            !overlaps(&before, &after),
+            "must distinguish hidden collision from ordinary visible refusal"
+        );
+        let before_expanded = diagnostic(&accepted, m.f.d, &ids);
+        let after_expanded = diagnostic(&actual, m.f.d, &ids);
+        rigid(&before_expanded, &after_expanded, &ids);
+        let obstacle = before_expanded
+            .nodes
+            .iter()
+            .find(|n| n.position == xy(550., 230.))
+            .unwrap()
+            .id;
+        assert_eq!(
+            overlap(
+                node(&before_expanded, m.xn),
+                node(&before_expanded, obstacle)
+            ),
+            0.
+        );
+        assert_eq!(
+            overlap(node(&after_expanded, m.xn), node(&after_expanded, obstacle)),
+            expected_overlap
+        );
+        assert!(
+            overlaps(&before_expanded, &after_expanded),
+            "combined diagnostic scene must refuse"
+        );
+        // Detection only: there is no production group admission/commit API here.
+        assert_eq!(m.f.p, accepted);
+    }
+}
+
+fn node(view: &ProjectedView, id: Id) -> &ProjectedNode {
+    view.nodes.iter().find(|n| n.id == id).unwrap()
+}
+
+#[test]
+fn mixed_arrange_experiment_detects_stationary_enclosure_growth_collision() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let enclosure_height = match layer {
+            Layer::Oa => 218.,
+            Layer::Sa => 256.,
+        };
+        let mut m = mixed(layer, false, false, true);
+        let kind = m.f.p.elements[&m.f.w].kind();
+        let z =
+            m.f.p
+                .add_element(kind, layer, "Stationary Z", None)
+                .unwrap();
+        let zn = m.f.p.place(m.f.d, z, xy(1200., 100.));
+        validate_candidate(&m.f.p).unwrap();
+        let accepted = m.f.p.clone();
+        let (_, actual) = candidate(&m);
+        let bn = accepted.diagrams[&m.f.d]
+            .nodes
+            .values()
+            .find(|n| n.element == m.f.b)
+            .unwrap()
+            .id;
+        let before = projection::project_view(&accepted, m.f.d);
+        let after = projection::project_view(&actual, m.f.d);
+        assert_eq!(node(&before, bn).position, xy(900., 100.));
+        assert_eq!(
+            node(&before, bn).size,
+            Size {
+                width: 288.,
+                height: enclosure_height
+            }
+        );
+        assert_eq!(node(&after, bn).position, xy(900., 100.));
+        assert_eq!(
+            node(&after, bn).size,
+            Size {
+                width: 688.,
+                height: enclosure_height
+            }
+        );
+        assert_eq!(node(&after, zn).position, xy(1200., 100.));
+        assert_eq!(
+            node(&after, zn).size,
+            Size {
+                width: 224.,
+                height: 94.
+            }
+        );
+        assert_eq!(overlap(node(&before, bn), node(&before, zn)), 0.);
+        assert_eq!(overlap(node(&after, bn), node(&after, zn)), 21056.);
+        assert_eq!(node(&after, m.yn).position, xy(1340., 200.));
+        assert_eq!(
+            node(&after, m.yn).position.y
+                - (node(&after, zn).position.y + node(&after, zn).size.height),
+            6.
+        );
+        for id in affected(&m) {
+            assert_eq!(overlap(node(&before, id), node(&before, zn)), 0.);
+            assert_eq!(overlap(node(&after, id), node(&after, zn)), 0.);
+        }
+        assert_eq!(
+            actual.diagrams[&m.f.d].nodes[&bn],
+            accepted.diagrams[&m.f.d].nodes[&bn]
+        );
+        assert_eq!(
+            actual.diagrams[&m.f.d].nodes[&zn],
+            accepted.diagrams[&m.f.d].nodes[&zn]
+        );
+        assert!(
+            overlaps(&before, &after),
+            "complete scene must detect stationary enclosure growth"
+        );
+        let ids = affected(&m);
+        assert!(overlaps(
+            &diagnostic(&accepted, m.f.d, &ids),
+            &diagnostic(&actual, m.f.d, &ids)
+        ));
+        assert_eq!(m.f.p, accepted);
+    }
+}
+
+#[test]
+fn mixed_arrange_experiment_unrelated_folded_interiors_are_outside_diagnostic_domain() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        // Independent source-derived literals: SA's auto-created function ports
+        // raise projected X/Y height to 76 + 28 * (1 + 1), while Z is port-free.
+        let (work_height, expected_overlap) = match layer {
+            Layer::Oa => (94., 13696.),
+            Layer::Sa => (132., 20116.),
+        };
+        let mut m = mixed(layer, true, false, true);
+        let performer = match layer {
+            Layer::Oa => Kind::Actor,
+            Layer::Sa => Kind::SystemActor,
+        };
+        let kind = m.f.p.elements[&m.f.w].kind();
+        let d =
+            m.f.p
+                .add_element(performer, layer, "Unrelated D", None)
+                .unwrap();
+        let z =
+            m.f.p
+                .add_element(kind, layer, "Unrelated hidden Z", None)
+                .unwrap();
+        m.f.p.relate(RelationKind::Allocation, "D owns Z", d, z);
+        let dn = m.f.p.place(m.f.d, d, xy(2500., 100.));
+        let zn = m.f.p.place(m.f.d, z, xy(550., 230.));
+        m.f.p
+            .diagrams
+            .get_mut(&m.f.d)
+            .unwrap()
+            .nodes
+            .get_mut(&dn)
+            .unwrap()
+            .collapsed = true;
+        validate_candidate(&m.f.p).unwrap();
+        let accepted = m.f.p.clone();
+        let (_, actual) = candidate(&m);
+        let ids = affected(&m);
+        let before = diagnostic(&accepted, m.f.d, &ids);
+        let after = diagnostic(&actual, m.f.d, &ids);
+        assert!(!before.nodes.iter().any(|n| n.id == zn));
+        assert!(!after.nodes.iter().any(|n| n.id == zn));
+        assert!(
+            !overlaps(&before, &after),
+            "chosen diagnostic domain excludes unrelated folded contents"
+        );
+        assert!(!overlaps(
+            &projection::project_view(&accepted, m.f.d),
+            &projection::project_view(&actual, m.f.d)
+        ));
+        let all_unfolded = |p: &Project| {
+            let mut diagram = p.diagrams[&m.f.d].clone();
+            for n in diagram.nodes.values_mut() {
+                n.collapsed = false;
+            }
+            projection::project_diagram(p, &diagram)
+        };
+        let broad_before = all_unfolded(&accepted);
+        let broad_after = all_unfolded(&actual);
+        assert_eq!(node(&broad_before, m.xn).position, xy(140., 200.));
+        assert_eq!(node(&broad_after, m.xn).position, xy(540., 200.));
+        assert_eq!(
+            node(&broad_after, m.xn).size,
+            Size {
+                width: 224.,
+                height: work_height
+            }
+        );
+        assert_eq!(node(&broad_before, zn).position, xy(550., 230.));
+        assert_eq!(node(&broad_after, zn).position, xy(550., 230.));
+        assert_eq!(
+            node(&broad_after, zn).size,
+            Size {
+                width: 224.,
+                height: 94.
+            }
+        );
+        assert_eq!(
+            overlap(node(&broad_before, m.xn), node(&broad_before, zn)),
+            0.
+        );
+        assert_eq!(
+            overlap(node(&broad_after, m.xn), node(&broad_after, zn)),
+            expected_overlap
+        );
+        // Other newly exposed enclosure pairs may also overlap. X/Z is a
+        // concrete discriminator, not a claim that it is the only cause.
+        assert!(overlaps(&broad_before, &broad_after));
+        for id in [dn, zn] {
+            assert_eq!(
+                actual.diagrams[&m.f.d].nodes[&id],
+                accepted.diagrams[&m.f.d].nodes[&id]
+            );
+        }
+        assert!(actual.diagrams[&m.f.d].nodes[&dn].collapsed);
+        assert_eq!(m.f.p, accepted);
+    }
+}

crates/oa-desktop/src/allocation_drag/tests.rs

@@ -2,6 +2,18 @@ use super::*;
 use crate::document::Document;
 use oa_core::source_project::{ProjectLimits, compile_bundle, format_bundle};
 
+#[path = "group_arrange_experiment.rs"]
+mod group_arrange_experiment;
+
+#[path = "arrange_tests.rs"]
+mod arrange_tests;
+
+#[path = "assignment_tests.rs"]
+mod assignment_tests;
+
+#[path = "assignment_boundary_tests.rs"]
+mod assignment_boundary_tests;
+
 struct Fixture {
     p: Project,
     d: Id,

crates/oa-desktop/src/app/allocation_drag.rs

@@ -1,12 +1,23 @@
 //! Allocation work-body input admission. Gesture authority lives here, while
 //! the canvas retains ordered native pointer positions and frozen hit geometry.
 use super::{App, Message, Page};
-use crate::{allocation_drag as plan, route_edit::Context};
+use crate::{
+    allocation_drag as plan,
+    diagram_selection::Snapshot,
+    diagram_usage::{Surface, Target as SelectionTarget},
+    route_edit::Context,
+};
 use iced::{Point, Rectangle, Task, Vector};
 use oa_core::{projection::ProjectedView, routing::RoutedView, *};
-use std::{collections::BTreeMap, sync::Arc};
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    sync::Arc,
+};
 
-pub const FINISH_EDIT: &str = "Finish or cancel the current edit before selecting or moving work.";
+mod clearance;
+
+pub const FINISH_EDIT: &str =
+    "Finish or cancel the current edit before selecting or moving elements.";
 
 #[derive(Debug, Clone, Copy, PartialEq)]
 pub struct Stamp {
@@ -47,6 +58,7 @@ pub struct Target {
 #[derive(Debug, Clone)]
 pub struct Frozen {
     pub targets: Vec<Target>,
+    pub moving: Vec<Rectangle>,
     cards: Vec<Rectangle>,
     controls: Vec<Rectangle>,
     edges: Vec<(Point, Point)>,
@@ -65,26 +77,29 @@ pub fn contains(r: Rectangle, p: Point) -> bool {
 impl Frozen {
     pub fn capture(
         project: &Project,
-        scope: &plan::Scope,
+        diagram: &Diagram,
+        affected: &BTreeMap<Id, NodePlacement>,
         view: &ProjectedView,
         routed: &RoutedView,
         zoom: f32,
     ) -> Self {
         let mut targets = Vec::new();
         let mut cards = Vec::new();
+        let mut moving = Vec::new();
         for n in &view.nodes {
-            if scope.placements.contains_key(&n.id) {
-                continue;
-            }
             let region = Rectangle::new(
                 Point::new(n.position.x, n.position.y),
                 iced::Size::new(n.size.width, n.size.height),
             );
+            if affected.contains_key(&n.id) {
+                moving.push(region);
+                continue;
+            }
             let Some(e) = project.elements.get(&n.element) else {
                 cards.push(region);
                 continue;
             };
-            if e.kind().is_performer() && e.layer() == scope.diagram.layer {
+            if e.kind().is_performer() && e.layer() == diagram.layer {
                 let mut ancestors = Vec::new();
                 let mut parent = e.parent;
                 while let Some(id) = parent {
@@ -95,7 +110,7 @@ impl Frozen {
                     parent = project.elements.get(&id).and_then(|e| e.parent);
                 }
                 let name = project.named(e.id).to_owned();
-                let collapsed = scope.diagram.nodes[&n.id].collapsed;
+                let collapsed = diagram.nodes[&n.id].collapsed;
                 targets.push(Target {
                     element: e.id,
                     placement: n.id,
@@ -118,7 +133,7 @@ impl Frozen {
         let mut controls: Vec<_> = view
             .ports
             .iter()
-            .filter(|port| !scope.placements.contains_key(&port.owner))
+            .filter(|port| !affected.contains_key(&port.owner))
             .map(|port| {
                 Rectangle::new(
                     Point::new(port.position.x - radius, port.position.y - radius),
@@ -162,6 +177,7 @@ impl Frozen {
         }
         Self {
             targets,
+            moving,
             cards,
             controls,
             edges,
@@ -224,17 +240,23 @@ impl Frozen {
     }
 }
 
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Mode {
+    Assign,
+    Arrange,
+}
+
 #[derive(Debug, Clone)]
-pub struct Press {
+pub(crate) struct Press {
     pub stamp: Stamp,
     pub token: Id,
     pub start: Point,
-    pub scope: plan::Scope,
-    pub frozen: Frozen,
-    pub arrange: bool,
+    pub selection: Snapshot,
+    pub target: SelectionTarget,
+    pub mode: Mode,
 }
 #[derive(Debug, Clone)]
-pub enum Event {
+pub(crate) enum Event {
     Press(Arc<Press>),
     Preview(Stamp, Id, Option<Point>),
     Release(Stamp, Id, Option<Point>),
@@ -244,28 +266,272 @@ pub enum Event {
     Unfocused,
     KeyboardBoundary,
 }
+pub struct PreviewPlacement {
+    pub diagram: Diagram,
+    pub view: ProjectedView,
+    pub delta: Position,
+}
+
 pub struct Preview {
     pub token: Id,
-    pub semantic: Arc<plan::SemanticPlan>,
-    pub placement: plan::PlacementPlan,
+    pub candidate: Candidate,
+    pub placement: PreviewPlacement,
     pub routed: Arc<RoutedView>,
 }
+impl Preview {
+    pub fn project(&self) -> &Project {
+        self.candidate.project()
+    }
+    #[cfg(test)]
+    pub fn index(&self) -> &view_options::ViewIndex {
+        self.candidate.index()
+    }
+}
+
+enum Prepared {
+    Singleton(Box<plan::Scope>),
+    Assignment(plan::assignment::Scope),
+    Arrange(Arc<plan::arrange::Plan>),
+    Performers(Arc<PerformerPlan>),
+    Refused(String),
+}
+
+#[derive(Clone)]
+pub enum Candidate {
+    Singleton(Arc<plan::SemanticPlan>),
+    Assignment(Arc<plan::assignment::SemanticPlan>),
+    Arrange(Arc<plan::arrange::Plan>),
+    Performers(Arc<PerformerPlan>),
+}
+
+enum Placed {
+    Planned(plan::PlacementPlan),
+    Performers {
+        preview: PreviewPlacement,
+        command: Box<Command>,
+        requested: Position,
+    },
+}
+
+impl Placed {
+    fn diagram(&self) -> &Diagram {
+        match self {
+            Self::Planned(p) => &p.diagram,
+            Self::Performers { preview, .. } => &preview.diagram,
+        }
+    }
+    fn view(&self) -> &ProjectedView {
+        match self {
+            Self::Planned(p) => &p.view,
+            Self::Performers { preview, .. } => &preview.view,
+        }
+    }
+    fn into_preview(self) -> PreviewPlacement {
+        match self {
+            Self::Planned(p) => PreviewPlacement {
+                diagram: p.diagram,
+                view: p.view,
+                delta: p.delta,
+            },
+            Self::Performers { preview, .. } => preview,
+        }
+    }
+}
+
+/// Ordinary performer movement preserves the established core translation policy.
+/// It shares input provenance, not the explicit Arrange geometry restrictions.
+pub struct PerformerPlan {
+    accepted: Project,
+    index: view_options::ViewIndex,
+    diagram: Id,
+    selected: BTreeSet<Id>,
+    anchor: Id,
+    affected: BTreeMap<Id, NodePlacement>,
+}
+impl PerformerPlan {
+    fn place(&self, requested: Position) -> Result<Placed, plan::Refusal> {
+        let original = &self.accepted.diagrams[&self.diagram];
+        let anchor = original.nodes[&self.anchor].position;
+        let delta = if requested == anchor {
+            Position { x: 0., y: 0. }
+        } else {
+            Position {
+                x: (requested.x / 10.).round() * 10. - anchor.x,
+                y: (requested.y / 10.).round() * 10. - anchor.y,
+            }
+        };
+        let command =
+            diagram_edit::translate_placements(&self.accepted, self.diagram, &self.selected, delta)
+                .map_err(|e| plan::Refusal::InvalidCandidate(e.to_string()))?;
+        let mut diagram = original.clone();
+        let Command::Batch(edits) = &command else {
+            unreachable!("translation is an atomic batch")
+        };
+        for edit in edits {
+            match edit {
+                Command::EditNode {
+                    diagram: id,
+                    original,
+                    node,
+                } if *id == self.diagram => {
+                    diagram.nodes.insert(*original, node.clone());
+                }
+                Command::SetEdgeRoute { diagram: id, route } if *id == self.diagram => {
+                    let stored = diagram
+                        .routes
+                        .iter_mut()
+                        .find(|r| r.edge == route.edge)
+                        .ok_or(plan::Refusal::StaleScope)?;
+                    *stored = route.clone();
+                }
+                _ => {
+                    return Err(plan::Refusal::InvalidCandidate(
+                        "Unexpected performer movement edit.".into(),
+                    ));
+                }
+            }
+        }
+        let view = projection::project_diagram_with_index(&self.accepted, &diagram, &self.index);
+        Ok(Placed::Performers {
+            preview: PreviewPlacement {
+                diagram,
+                view,
+                delta,
+            },
+            command: Box::new(command),
+            requested,
+        })
+    }
+}
+
+impl Candidate {
+    pub fn project(&self) -> &Project {
+        match self {
+            Self::Singleton(p) => p.project(),
+            Self::Assignment(p) => p.project(),
+            Self::Arrange(p) => p.project(),
+            Self::Performers(p) => &p.accepted,
+        }
+    }
+    pub fn index(&self) -> &view_options::ViewIndex {
+        match self {
+            Self::Singleton(p) => p.index(),
+            Self::Assignment(p) => p.index(),
+            Self::Arrange(p) => p.index(),
+            Self::Performers(p) => &p.index,
+        }
+    }
+    fn place(
+        &self,
+        requested: Position,
+        presentation: plan::PresentationContext,
+    ) -> Result<Placed, plan::Refusal> {
+        match self {
+            Self::Singleton(p) => plan::place(p, requested, presentation).map(Placed::Planned),
+            Self::Assignment(p) => {
+                plan::assignment::place(p, requested, presentation).map(Placed::Planned)
+            }
+            Self::Arrange(p) => {
+                plan::arrange::place(p, requested, presentation).map(Placed::Planned)
+            }
+            Self::Performers(p) => p.place(requested),
+        }
+    }
+    fn finish(&self, live: &Project, placed: &Placed) -> Result<Option<Command>, plan::Refusal> {
+        match (self, placed) {
+            (Self::Singleton(p), Placed::Planned(result)) => plan::finish(p, live, result),
+            (Self::Assignment(p), Placed::Planned(result)) => {
+                plan::assignment::finish(p, live, result)
+            }
+            (Self::Arrange(p), Placed::Planned(result)) => plan::arrange::finish(p, live, result),
+            (
+                Self::Performers(p),
+                Placed::Performers {
+                    preview,
+                    command,
+                    requested,
+                },
+            ) => {
+                if live != &p.accepted {
+                    return Err(plan::Refusal::StaleScope);
+                }
+                let checked = p.place(*requested)?;
+                let Placed::Performers {
+                    preview: checked,
+                    command: checked_command,
+                    ..
+                } = checked
+                else {
+                    unreachable!()
+                };
+                if checked.diagram != preview.diagram
+                    || checked.view != preview.view
+                    || checked.delta != preview.delta
+                    || &checked_command != command
+                {
+                    return Err(plan::Refusal::StaleScope);
+                }
+                let mut expected = p.accepted.clone();
+                expected.diagrams.insert(p.diagram, checked.diagram);
+                let actual = prepare_command(live, &checked_command)
+                    .map_err(|e| plan::Refusal::InvalidCandidate(e.to_string()))?
+                    .project;
+                if actual != expected {
+                    return Err(plan::Refusal::InvalidCandidate(
+                        "Performer movement would change unrelated records.".into(),
+                    ));
+                }
+                Ok((actual != *live).then_some(*checked_command))
+            }
+            _ => Err(plan::Refusal::StaleScope),
+        }
+    }
+    fn label(&self) -> String {
+        let (label, warnings) = match self {
+            Self::Singleton(p) => (p.label.clone(), p.warnings.len()),
+            Self::Assignment(p) => (p.label().to_owned(), p.warnings().len()),
+            Self::Arrange(p) => (
+                format!(
+                    "Arrange {} selected elements · {} affected placements",
+                    p.selected().len(),
+                    p.affected().len()
+                ),
+                0,
+            ),
+            Self::Performers(p) => (
+                format!("Move {} selected performer(s)", p.selected.len()),
+                0,
+            ),
+        };
+        if warnings == 0 {
+            label
+        } else {
+            format!("{label} · {warnings} model warning(s) retained")
+        }
+    }
+}
+
 struct Active {
     press: Arc<Press>,
+    selection: Snapshot,
+    crossed: bool,
+    prepared: Prepared,
+    frozen: Option<Arc<Frozen>>,
     inspection_targets: Vec<usize>,
     ids: BTreeMap<Id, Id>,
-    cache: Vec<(
-        plan::Destination,
-        Result<Arc<plan::SemanticPlan>, plan::Refusal>,
-    )>,
+    cache: Vec<(plan::Destination, Result<Candidate, plan::Refusal>)>,
 }
-pub struct Feedback {
+pub(crate) struct Feedback {
     pub press: Arc<Press>,
+    pub frozen: Option<Arc<Frozen>>,
+    ordinary_performers: bool,
     pub targets: Vec<usize>,
     /// Last captured target names for inspection only; never resolver input.
     pub inspection_targets: Vec<usize>,
     pub text: String,
     pub refused: bool,
+    /// Pointer-following outline only; it never authorizes a model change.
+    pub ghost_delta: Option<Vector>,
 }
 impl Feedback {
     pub fn inspection_identity(&self) -> String {
@@ -273,7 +539,13 @@ impl Feedback {
             let names = self
                 .inspection_targets
                 .iter()
-                .map(|index| self.press.frozen.targets[*index].name.as_str())
+                .filter_map(|index| {
+                    self.frozen
+                        .as_ref()?
+                        .targets
+                        .get(*index)
+                        .map(|t| t.name.as_str())
+                })
                 .collect::<Vec<_>>()
                 .join(" / ");
             format!(
@@ -293,7 +565,9 @@ impl Feedback {
     /// Captured accepted names, independent of clipped status/refusal prose.
     pub fn destination_identity(&self) -> String {
         match self.targets.as_slice() {
-            [] => if self.press.arrange {
+            [] => if self.ordinary_performers {
+                "Move performers"
+            } else if self.press.mode == Mode::Arrange {
                 "Arrange only"
             } else if self.refused {
                 "No eligible destination"
@@ -301,12 +575,22 @@ impl Feedback {
                 "Outside performers"
             }
             .into(),
-            [index] => self.press.frozen.targets[*index].name.clone(),
+            [index] => self
+                .frozen
+                .as_ref()
+                .and_then(|f| f.targets.get(*index))
+                .map(|t| t.name.clone())
+                .unwrap_or_else(|| "No eligible destination".into()),
             indices => format!(
                 "Ambiguous: {}",
                 indices
                     .iter()
-                    .map(|index| self.press.frozen.targets[*index].name.as_str())
+                    .filter_map(|index| self
+                        .frozen
+                        .as_ref()?
+                        .targets
+                        .get(*index)
+                        .map(|t| t.name.as_str()))
                     .collect::<Vec<_>>()
                     .join(" / ")
             ),
@@ -391,6 +675,18 @@ impl App {
             && self.canvas_size.is_none_or(|s| s == stamp.bounds.size())
             && stamp.bounds.width > 0.
             && stamp.bounds.height > 0.
+            && stamp.zoom > 0.
+            && [
+                stamp.bounds.x,
+                stamp.bounds.y,
+                stamp.bounds.width,
+                stamp.bounds.height,
+                stamp.pan.x,
+                stamp.pan.y,
+                stamp.zoom,
+            ]
+            .iter()
+            .all(|value| value.is_finite())
     }
     /// Called before general input dispatch. Even equal-valued actions (Fit,
     /// Undo/Redo, tool/modal round trips) retire old render-time capabilities.
@@ -427,20 +723,54 @@ impl App {
     pub(super) fn allocation_retire(&mut self) {
         self.allocation_drag.retire();
     }
-    fn select_work_clean(&mut self, press: &Press) -> bool {
-        if !self.allocation_stamp_valid(press.stamp) {
-            return false;
-        }
-        self.selected = press.scope.work;
-        self.selected_node = Some(press.scope.placement);
-        self.selected_bend = None;
-        self.refresh_draft();
-        true
+    fn allocation_selection_valid(&self, snapshot: &Snapshot) -> bool {
+        self.multiselect_context().is_some_and(|current| {
+            self.diagram_selection
+                .as_ref()
+                .is_some_and(|selection| selection.matches(snapshot, current))
+        })
     }
     pub(super) fn allocation_press_owns_current_view(&self, press: &Press) -> bool {
-        self.allocation_drag.active.is_none()
-            && self.allocation_stamp_valid(press.stamp)
-            && press.arrange == self.allocation_drag.arrange_next
+        if self.allocation_drag.active.is_some()
+            || !self.allocation_stamp_valid(press.stamp)
+            || (press.mode == Mode::Arrange) != self.allocation_drag.arrange_next
+            || !self.allocation_selection_valid(&press.selection)
+            || press.selection.context().scope.surface
+                != Surface::Saved(press.stamp.context.diagram)
+            || !press.start.x.is_finite()
+            || !press.start.y.is_finite()
+            || !contains(press.stamp.bounds, press.start)
+        {
+            return false;
+        }
+        let view = projection::project_view_with_index(
+            self.project(),
+            press.stamp.context.diagram,
+            self.document.view_index(),
+        );
+        super::multiselect::visible(
+            self.project(),
+            press.stamp.context.diagram,
+            &view,
+            &press.target,
+        )
+    }
+    /// Bare Allocation movement has no lifetime provenance. All actual Allocation
+    /// placement gestures now enter Press/Active, including ordinary performers.
+    pub(super) fn allocation_legacy_move(&self, message: &Message) -> bool {
+        let allocation = |diagram| {
+            self.project()
+                .diagrams
+                .get(&diagram)
+                .is_some_and(|d| d.projection == ProjectionKind::Allocation)
+        };
+        match message {
+            Message::MoveNode(..) => self.active_diagram.is_some_and(allocation),
+            Message::DiagramSelection(super::multiselect::Event::Move(snapshot, _)) => {
+                matches!(snapshot.context().scope.surface, Surface::Saved(diagram) if allocation(diagram))
+            }
+            _ => false,
+        }
     }
     pub(super) fn allocation_event_envelope(&self, event: &Event) -> bool {
         match event {
@@ -451,11 +781,64 @@ impl App {
                     .is_some_and(|active| active.press.token == *token)
             }
             Event::Refused(epoch, _) => *epoch == self.allocation_drag.epoch,
-            // Invalid Press packets deliberately report why the view or draft
-            // changed. Leave their existing validation and feedback intact.
             _ => true,
         }
     }
+    fn allocation_prepare(&self, press: &Press, selection: &Snapshot) -> Prepared {
+        let SelectionTarget::Placement(anchor) = &press.target else {
+            return Prepared::Refused("Move requires only placed work or performers; ports and connections cannot be moved with this selection.".into());
+        };
+        let anchor = *anchor;
+        let Some(ids) = super::multiselect::placements(selection) else {
+            return Prepared::Refused("Move requires only placed work or performers; remove ports, rows and connections from the selection.".into());
+        };
+        let project = self.project();
+        let diagram = press.stamp.context.diagram;
+        let d = &project.diagrams[&diagram];
+        let selected: BTreeMap<_, _> = ids.iter().map(|id| (*id, d.nodes[id].element)).collect();
+        let result = if press.mode == Mode::Arrange {
+            plan::arrange::capture(project, diagram, &selected, anchor)
+                .map(|p| Prepared::Arrange(Arc::new(p)))
+        } else if selected
+            .values()
+            .all(|id| project.elements[id].kind().is_work())
+        {
+            if selected.len() == 1 {
+                plan::capture(project, diagram, selected[&anchor], anchor)
+                    .map(|scope| Prepared::Singleton(Box::new(scope)))
+            } else {
+                plan::assignment::capture(project, diagram, &selected, anchor)
+                    .map(Prepared::Assignment)
+            }
+        } else if selected
+            .values()
+            .all(|id| project.elements[id].kind().is_performer())
+        {
+            validate_candidate(project)
+                .map_err(|e| plan::Refusal::InvalidCandidate(e.to_string()))
+                .map(|_| {
+                    let mut affected = BTreeMap::new();
+                    for id in &ids {
+                        for member in std::iter::once(*id)
+                            .chain(projection::descendant_nodes(project, diagram, *id))
+                        {
+                            affected.insert(member, d.nodes[&member].clone());
+                        }
+                    }
+                    Prepared::Performers(Arc::new(PerformerPlan {
+                        accepted: project.clone(),
+                        index: view_options::ViewIndex::new(project),
+                        diagram,
+                        selected: ids,
+                        anchor,
+                        affected,
+                    }))
+                })
+        } else {
+            Err(plan::Refusal::Ineligible("Assignment requires only work. Arm Arrange next drag to arrange a supported work/performer selection.".into()))
+        };
+        result.unwrap_or_else(|reason| Prepared::Refused(refusal(&reason)))
+    }
     pub(super) fn allocation_event(&mut self, event: Event) -> Task<Message> {
         if !self.allocation_event_envelope(&event) {
             return Task::none();
@@ -465,7 +848,8 @@ impl App {
                 self.allocation_drag.retire();
                 if self.allocation_drag_clean() {
                     self.allocation_drag.arrange_next = true;
-                    self.status = "Arrange next drag armed · moves work only · Esc cancels".into();
+                    self.status =
+                        "Arrange next drag armed · presentation only · Esc cancels".into();
                 } else {
                     self.status = FINISH_EDIT.into();
                 }
@@ -476,22 +860,13 @@ impl App {
                     self.allocation_drag.retire();
                 }
             }
-            Event::Cancel(token) => {
-                if self
-                    .allocation_drag
-                    .active
-                    .as_ref()
-                    .is_some_and(|a| a.press.token == token)
-                {
-                    self.allocation_drag.retire();
-                    self.status = "Work drag canceled".into();
-                }
+            Event::Cancel(_) => {
+                self.allocation_drag.retire();
+                self.status = "Drag canceled".into();
             }
-            Event::Refused(epoch, text) => {
-                if epoch == self.allocation_drag.epoch {
-                    self.allocation_drag.retire();
-                    self.status = text;
-                }
+            Event::Refused(_, text) => {
+                self.allocation_drag.retire();
+                self.status = text;
             }
             Event::Press(press) => {
                 if self.allocation_drag.active.is_some() {
@@ -505,32 +880,73 @@ impl App {
                     };
                     return Task::none();
                 }
-                let checked = plan::capture(
-                    self.project(),
-                    press.scope.diagram.id,
-                    press.scope.work,
-                    press.scope.placement,
-                );
-                if checked.as_ref() != Ok(&press.scope) || !self.select_work_clean(&press) {
-                    self.status = checked
-                        .err()
-                        .as_ref()
-                        .map(refusal)
-                        .unwrap_or_else(|| "The view changed. Start this drag again.".into());
-                    self.allocation_drag.retire();
+                // A selected-member press has no selection or inspector effect.
+                // An unselected press replaces selection atomically in this handler.
+                if !press.selection.targets().contains(&press.target) {
+                    self.multiselect_event(super::multiselect::Event::Choose(
+                        press.selection.context(),
+                        press.target.clone(),
+                        super::multiselect::Choice::Replace,
+                    ));
+                }
+                let Some(selection) = self.multiselect_snapshot() else {
+                    return Task::none();
+                };
+                if !selection.targets().contains(&press.target)
+                    || (!press.selection.targets().contains(&press.target)
+                        && selection.targets() != [press.target.clone()])
+                {
                     return Task::none();
                 }
-                let ids = press
-                    .scope
-                    .leaves
-                    .keys()
-                    .map(|id| (*id, Id::new_v4()))
-                    .collect();
+                let diagram = press.stamp.context.diagram;
+                let view = projection::project_view_with_index(
+                    self.project(),
+                    diagram,
+                    self.document.view_index(),
+                );
+                if !selection.targets().iter().all(|target| {
+                    super::multiselect::visible(self.project(), diagram, &view, target)
+                }) {
+                    self.allocation_drag.retire();
+                    self.status = "The view changed. Start this drag again.".into();
+                    return Task::none();
+                }
+                let prepared = self.allocation_prepare(&press, &selection);
+                let (affected, leaf_ids) = match &prepared {
+                    Prepared::Singleton(scope) => (
+                        Some(&scope.placements),
+                        scope.leaves.keys().copied().collect::<Vec<_>>(),
+                    ),
+                    Prepared::Assignment(scope) => (
+                        Some(scope.affected()),
+                        scope.leaves().keys().copied().collect(),
+                    ),
+                    Prepared::Arrange(plan) => (Some(plan.affected()), Vec::new()),
+                    Prepared::Performers(plan) => (Some(&plan.affected), Vec::new()),
+                    Prepared::Refused(_) => (None, Vec::new()),
+                };
+                let frozen = affected.map(|affected| {
+                    let d = &self.project().diagrams[&diagram];
+                    let routed = routing::route_diagram(self.project(), d, &view);
+                    Arc::new(Frozen::capture(
+                        self.project(),
+                        d,
+                        affected,
+                        &view,
+                        &routed,
+                        press.stamp.zoom,
+                    ))
+                });
+                let ids = leaf_ids.into_iter().map(|id| (id, Id::new_v4())).collect();
                 self.allocation_drag.arrange_next = false;
                 self.allocation_drag.preview = None;
                 self.allocation_drag.feedback = None;
                 self.allocation_drag.active = Some(Active {
                     press,
+                    selection,
+                    crossed: false,
+                    prepared,
+                    frozen,
                     inspection_targets: Vec::new(),
                     ids,
                     cache: Vec::new(),
@@ -552,15 +968,16 @@ impl App {
         pointer: Option<Point>,
         release: bool,
     ) {
-        if self
-            .allocation_drag
-            .active
-            .as_ref()
-            .is_none_or(|a| a.press.token != token)
-        {
-            return; // An old packet cannot cancel a newer gesture.
+        let Some(active) = self.allocation_drag.active.as_ref() else {
+            return;
+        };
+        if active.press.token != token {
+            return;
         }
-        if !self.allocation_stamp_valid(stamp) {
+        if !self.allocation_stamp_valid(stamp)
+            || !self.allocation_selection_valid(&active.selection)
+            || active.press.stamp != stamp
+        {
             self.allocation_drag.retire();
             self.status = if self.allocation_drag_clean() {
                 "The view changed. Start this drag again.".into()
@@ -569,17 +986,35 @@ impl App {
             };
             return;
         }
-        let Some(mut active) = self.allocation_drag.active.take() else {
-            return;
-        };
-        if active.press.token != token || active.press.stamp != stamp {
-            self.allocation_drag.active = Some(active);
+        let mut active = self.allocation_drag.active.take().unwrap();
+        let press = active.press.clone();
+        active.crossed |= pointer.is_some_and(|p| p.distance(press.start) > 3.);
+        let in_bounds = pointer
+            .is_some_and(|p| p.x.is_finite() && p.y.is_finite() && contains(stamp.bounds, p));
+        if !active.crossed && in_bounds {
+            if release {
+                self.multiselect_event(super::multiselect::Event::Collapse(
+                    active.selection,
+                    press.target.clone(),
+                ));
+                self.allocation_drag.retire();
+                self.status = "Element selected".into();
+            } else {
+                self.allocation_drag.active = Some(active);
+            }
             return;
         }
-        let press = active.press.clone();
-        let moved = pointer.is_some_and(|p| p.distance(press.start) > 3.);
-        let hit = press.frozen.resolve(stamp, pointer, press.arrange);
-        if moved {
+        let ordinary_performers = matches!(&active.prepared, Prepared::Performers(_));
+        let hit = if !in_bounds {
+            Hit::OutsideViewport
+        } else if ordinary_performers {
+            Hit::Destination(plan::Destination::LayoutOnly, None)
+        } else {
+            active.frozen.as_ref().map_or(Hit::Occluded, |f| {
+                f.resolve(stamp, pointer, press.mode == Mode::Arrange)
+            })
+        };
+        if active.crossed {
             match &hit {
                 Hit::Destination(_, Some(target)) => active.inspection_targets = vec![*target],
                 Hit::Ambiguous(targets) => active.inspection_targets = targets.clone(),
@@ -588,64 +1023,82 @@ impl App {
         }
         let mut targets = Vec::new();
         let mut preview = None;
-        let result: Result<String, String> = match hit {
-            Hit::OutsideViewport => Err(if release {
-                "Work drag canceled outside the canvas."
-            } else {
-                "Pointer outside canvas · return to choose a destination; releasing here cancels the drag."
-            }.into()),
-            _ if !moved => Ok("Work selected".into()),
+        let result: Result<String, String> = if matches!(hit, Hit::OutsideViewport) {
+            Err(if release { "Drag canceled outside the canvas." }
+                else { "Pointer outside canvas · return to choose a destination; releasing here cancels the drag." }.into())
+        } else if let Prepared::Refused(reason) = &active.prepared {
+            Err(reason.clone())
+        } else {
+            match hit {
+            Hit::OutsideViewport => unreachable!(),
             Hit::Occluded => Err("Aim at exposed performer space or empty canvas; this card, port, connection or control blocks the drop.".into()),
             Hit::Ambiguous(indices) => {
-                targets = indices;
-                Err("Two unrelated performers overlap here. Use an exposed region.".into())
+                targets = indices; Err("Two unrelated performers overlap here. Use an exposed region.".into())
             }
             Hit::Destination(destination, target) => {
                 targets.extend(target);
-                let semantic = if let Some((_, result)) = active.cache.iter().find(|(d, _)| *d == destination) {
-                    result.clone()
-                } else {
-                    let result = plan::plan_semantics(self.project(), &press.scope, destination, &active.ids).map(Arc::new);
-                    active.cache.push((destination, result.clone()));
-                    result
+                let candidate = if let Some((_, cached)) = active.cache.iter().find(|(d, _)| *d == destination) { cached.clone() }
+                else {
+                    let candidate = match &active.prepared {
+                        Prepared::Singleton(scope) => plan::plan_semantics(self.project(), scope, destination, &active.ids)
+                            .map(|p| Candidate::Singleton(Arc::new(p))),
+                        Prepared::Assignment(scope) => plan::assignment::plan_semantics(scope, destination, &active.ids)
+                            .map(|p| Candidate::Assignment(Arc::new(p))),
+                        Prepared::Arrange(plan) => Ok(Candidate::Arrange(plan.clone())),
+                        Prepared::Performers(plan) => Ok(Candidate::Performers(plan.clone())),
+                        Prepared::Refused(_) => unreachable!(),
+                    };
+                    active.cache.push((destination, candidate.clone())); candidate
                 };
-                semantic.map_err(|r| refusal(&r)).and_then(|semantic| {
-                    if stamp.zoom * 16. < 9. {
+                candidate.map_err(|r| refusal(&r)).and_then(|candidate| {
+                    if !ordinary_performers && stamp.zoom * 16. < 9. {
                         return Err("Make room or adjust the view, then drag again. Zoom in to read the work and destination.".into());
                     }
-                    let pointer = pointer.unwrap();
-                    let delta = pointer - press.start;
-                    let original = press.scope.placements[&press.scope.placement].position;
+                    let SelectionTarget::Placement(anchor) = &press.target else { unreachable!("supported placement") };
+                    let original = self.project().diagrams[&stamp.context.diagram].nodes[anchor].position;
+                    let delta = pointer.unwrap() - press.start;
                     let requested = Position { x: original.x + delta.x / stamp.zoom, y: original.y + delta.y / stamp.zoom };
                     let presentation = plan::PresentationContext {
                         viewport: stamp.viewport(), zoom: stamp.zoom,
-                        target: target.map(|i| {
-                            let t = &press.frozen.targets[i];
-                            plan::TargetPresentation { placement: t.placement }
-                        }),
-                    };
-                    let placement = plan::place(&semantic, requested, presentation).map_err(|r| refusal(&r))?;
-                    let label = if semantic.warnings.is_empty() { semantic.label.clone() } else {
-                        format!("{} · {} model warning(s) retained", semantic.label, semantic.warnings.len())
+                        target: target.map(|i| plan::TargetPresentation { placement: active.frozen.as_ref().unwrap().targets[i].placement }),
                     };
+                    let exact = candidate.place(requested, presentation);
+                    let placed = if destination == plan::Destination::OutsidePerformers
+                        && matches!(&exact, Err(plan::Refusal::LayoutRequired(_)))
+                    {
+                        let affected = match &active.prepared {
+                            Prepared::Singleton(scope) => Some(&scope.placements),
+                            Prepared::Assignment(scope) => Some(scope.affected()),
+                            _ => None,
+                        };
+                        affected.and_then(|affected| {
+                            clearance::requests(
+                                (self.project(), self.document.view_index()),
+                                (candidate.project(), candidate.index()), stamp.context.diagram,
+                                affected, *anchor, requested,
+                                (stamp.world(press.start), stamp.world(pointer.unwrap())),
+                            ).into_iter().find_map(|position| candidate.place(position, presentation).ok())
+                        }).map_or(exact, Ok)
+                    } else {
+                        exact
+                    }.map_err(|r| refusal(&r))?;
+                    let label = candidate.label();
                     if release {
-                        let command = plan::finish(&semantic, self.project(), &placement).map_err(|r| refusal(&r))?;
-                        if let Some(command) = command {
-                            // Bypass applying selectors and unrelated repair helpers. The
-                            // planner's exact Batch enters the authoritative source pipeline.
-                            self.document.execute(command).map_err(|e| format!("{} · retry this drag after correcting the source issue", e))?;
+                        if let Some(command) = candidate.finish(self.project(), &placed).map_err(|r| refusal(&r))? {
+                            self.document.execute(command)
+                                .map_err(|e| format!("{e} · retry this drag after correcting the source issue"))?;
+                            // sync refreshes the retained primary once; no anchor promotion.
                             self.sync();
-                            self.selected = press.scope.work;
-                            self.selected_node = Some(press.scope.placement);
-                            self.refresh_draft();
+                            self.reconcile_multiselect();
                         }
                     } else {
-                        let routed = Arc::new(routing::route_diagram(semantic.project(), &placement.diagram, &placement.view));
-                        preview = Some(Arc::new(Preview { token, semantic, placement, routed }));
+                        let routed = Arc::new(routing::route_diagram(candidate.project(), placed.diagram(), placed.view()));
+                        preview = Some(Arc::new(Preview { token, candidate, placement: placed.into_preview(), routed }));
                     }
                     Ok(label)
                 })
             }
+        }
         };
         let refused = result.is_err();
         let text = result.unwrap_or_else(|text| text);
@@ -654,14 +1107,26 @@ impl App {
             self.allocation_drag.retire();
         } else {
             let inspection_targets = active.inspection_targets.clone();
+            let frozen = active.frozen.clone();
+            // A rejected intermediate position is not a return gesture. Keep the
+            // last admitted scene and show current motion separately; release
+            // always recomputes admission and never commits this retained view.
+            if refused && in_bounds && preview.is_none() {
+                preview = self.allocation_drag.preview.take();
+            }
+            let ghost_delta = (refused && in_bounds)
+                .then(|| (pointer.unwrap() - press.start) * (1. / stamp.zoom));
             self.allocation_drag.active = Some(active);
             self.allocation_drag.preview = preview;
             self.allocation_drag.feedback = Some(Feedback {
                 press,
+                frozen,
+                ordinary_performers,
                 targets,
                 inspection_targets,
                 text,
                 refused,
+                ghost_delta,
             });
         }
     }

crates/oa-desktop/src/app/allocation_drag/clearance.rs

@@ -0,0 +1,595 @@
+//! Bounded outgoing clearance proposals. The ordinary placement and semantic
+//! validators still decide whether any proposal may be previewed or committed.
+use iced::Point;
+use oa_core::{Id, NodePlacement, Position, Project, projection, view_options::ViewIndex};
+use std::collections::{BTreeMap, BTreeSet};
+
+const GRID: f32 = 10.;
+const GAP: f32 = 10.;
+
+#[derive(Clone, Copy)]
+struct Bounds {
+    left: f32,
+    top: f32,
+    right: f32,
+    bottom: f32,
+}
+
+impl Bounds {
+    fn node(node: &projection::ProjectedNode) -> Option<Self> {
+        let result = Self {
+            left: node.position.x,
+            top: node.position.y,
+            right: node.position.x + node.size.width,
+            bottom: node.position.y + node.size.height,
+        };
+        ([result.left, result.top, result.right, result.bottom]
+            .iter()
+            .all(|value| value.is_finite())
+            && result.right > result.left
+            && result.bottom > result.top)
+            .then_some(result)
+    }
+
+    fn union(self, other: Self) -> Self {
+        Self {
+            left: self.left.min(other.left),
+            top: self.top.min(other.top),
+            right: self.right.max(other.right),
+            bottom: self.bottom.max(other.bottom),
+        }
+    }
+
+    fn overlaps(self, other: Self) -> bool {
+        self.left < other.right
+            && other.left < self.right
+            && self.top < other.bottom
+            && other.top < self.bottom
+    }
+}
+
+/// Called only after an OutsidePerformers candidate fails ordinary placement.
+/// Coordinates use the frozen world transform. The entire affected footprint
+/// receives one anchor translation; this never moves or packs other cards.
+pub(super) fn requests(
+    accepted: (&Project, &ViewIndex),
+    candidate: (&Project, &ViewIndex),
+    diagram: Id,
+    affected: &BTreeMap<Id, NodePlacement>,
+    anchor: Id,
+    requested: Position,
+    motion: (Point, Point),
+) -> Vec<Position> {
+    let (accepted, accepted_index) = accepted;
+    let (candidate, candidate_index) = candidate;
+    let (start, pointer) = motion;
+    if ![
+        requested.x,
+        requested.y,
+        start.x,
+        start.y,
+        pointer.x,
+        pointer.y,
+    ]
+    .iter()
+    .all(|value| value.is_finite())
+    {
+        return Vec::new();
+    }
+    let (Some(original), Some(base), Some(anchor)) = (
+        accepted.diagrams.get(&diagram),
+        candidate.diagrams.get(&diagram),
+        affected.get(&anchor),
+    ) else {
+        return Vec::new();
+    };
+    let snapped = Position {
+        x: (requested.x / GRID).round() * GRID,
+        y: (requested.y / GRID).round() * GRID,
+    };
+    let delta = Position {
+        x: snapped.x - anchor.position.x,
+        y: snapped.y - anchor.position.y,
+    };
+    let before = projection::project_diagram_with_index(accepted, original, accepted_index);
+    let before_nodes: BTreeMap<_, _> = before.nodes.iter().map(|node| (node.id, node)).collect();
+    let mut sources = BTreeSet::new();
+    for node in before
+        .nodes
+        .iter()
+        .filter(|node| affected.contains_key(&node.id))
+    {
+        let mut parent = node.visual_parent;
+        let mut seen = BTreeSet::new();
+        while let Some(id) = parent {
+            if !seen.insert(id) {
+                return Vec::new();
+            }
+            let Some(node) = before_nodes.get(&id) else {
+                break;
+            };
+            if !affected.contains_key(&id)
+                && accepted
+                    .elements
+                    .get(&node.element)
+                    .is_some_and(|element| element.kind().is_performer())
+            {
+                sources.insert(id);
+            }
+            parent = node.visual_parent;
+        }
+    }
+    if sources.is_empty() {
+        return Vec::new();
+    }
+    // Projection after responsibility removal supplies the former performer's
+    // remaining enclosure, including other allocated work. Projecting the moved
+    // block also includes the full visible descendant enclosure of every root.
+    let mut moved = base.clone();
+    for (id, captured) in affected {
+        let Some(node) = moved.nodes.get_mut(id) else {
+            return Vec::new();
+        };
+        node.position = Position {
+            x: captured.position.x + delta.x,
+            y: captured.position.y + delta.y,
+        };
+        if ![
+            node.position.x,
+            node.position.y,
+            node.size.width,
+            node.size.height,
+        ]
+        .iter()
+        .all(|value| value.is_finite())
+        {
+            return Vec::new();
+        }
+    }
+    let after = projection::project_diagram_with_index(candidate, &moved, candidate_index);
+    let mut footprint: Option<Bounds> = None;
+    for node in after
+        .nodes
+        .iter()
+        .filter(|node| affected.contains_key(&node.id))
+    {
+        let Some(bounds) = Bounds::node(node) else {
+            return Vec::new();
+        };
+        footprint = Some(footprint.map_or(bounds, |previous| previous.union(bounds)));
+    }
+    let Some(footprint) = footprint else {
+        return Vec::new();
+    };
+    let mut overlaps = Vec::new();
+    for node in after.nodes.iter().filter(|node| sources.contains(&node.id)) {
+        let (Some(old), Some(current)) = (Bounds::node(before_nodes[&node.id]), Bounds::node(node))
+        else {
+            return Vec::new();
+        };
+        if footprint.overlaps(current) {
+            overlaps.push((old, current));
+        }
+    }
+    if overlaps.is_empty() {
+        return Vec::new();
+    }
+
+    // Each entry is a half-plane actually crossed by the pointer. At a corner,
+    // prefer the boundary reached first on the press-to-pointer segment. The
+    // direction index is a stable tie-break, independent of placement UUIDs.
+    let mut crossings = [None::<f32>; 4];
+    for (old, _) in &overlaps {
+        for (direction, initial, final_, boundary, outward) in [
+            (
+                0,
+                start.x,
+                pointer.x,
+                old.left,
+                pointer.x < old.left && start.x >= old.left,
+            ),
+            (
+                1,
+                start.x,
+                pointer.x,
+                old.right,
+                pointer.x >= old.right && start.x < old.right,
+            ),
+            (
+                2,
+                start.y,
+                pointer.y,
+                old.top,
+                pointer.y < old.top && start.y >= old.top,
+            ),
+            (
+                3,
+                start.y,
+                pointer.y,
+                old.bottom,
+                pointer.y >= old.bottom && start.y < old.bottom,
+            ),
+        ] {
+            if outward {
+                let fraction = (boundary - initial) / (final_ - initial);
+                if fraction.is_finite() && (0. ..=1.).contains(&fraction) {
+                    crossings[direction] =
+                        Some(crossings[direction].map_or(fraction, |old| old.min(fraction)));
+                }
+            }
+        }
+    }
+    let mut directions: Vec<_> = crossings
+        .into_iter()
+        .enumerate()
+        .filter_map(|(direction, fraction)| fraction.map(|fraction| (direction, fraction)))
+        .collect();
+    directions.sort_by(|a, b| a.1.total_cmp(&b.1).then(a.0.cmp(&b.0)));
+    let mut result = Vec::new();
+    for (direction, _) in directions {
+        let mut corrected = snapped;
+        match direction {
+            0 => {
+                let edge = overlaps
+                    .iter()
+                    .map(|(_, current)| current.left)
+                    .fold(f32::INFINITY, f32::min);
+                corrected.x = ((snapped.x + edge - GAP - footprint.right) / GRID).floor() * GRID;
+            }
+            1 => {
+                let edge = overlaps
+                    .iter()
+                    .map(|(_, current)| current.right)
+                    .fold(f32::NEG_INFINITY, f32::max);
+                corrected.x = ((snapped.x + edge + GAP - footprint.left) / GRID).ceil() * GRID;
+            }
+            2 => {
+                let edge = overlaps
+                    .iter()
+                    .map(|(_, current)| current.top)
+                    .fold(f32::INFINITY, f32::min);
+                corrected.y = ((snapped.y + edge - GAP - footprint.bottom) / GRID).floor() * GRID;
+            }
+            3 => {
+                let edge = overlaps
+                    .iter()
+                    .map(|(_, current)| current.bottom)
+                    .fold(f32::NEG_INFINITY, f32::max);
+                corrected.y = ((snapped.y + edge + GAP - footprint.top) / GRID).ceil() * GRID;
+            }
+            _ => unreachable!(),
+        }
+        if corrected.x.is_finite() && corrected.y.is_finite() && !result.contains(&corrected) {
+            result.push(corrected);
+        }
+    }
+    result
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::allocation_drag as plan;
+    use oa_core::{Kind, Layer, ProjectionKind, RelationKind, Size};
+
+    struct Fixture {
+        project: Project,
+        diagram: Id,
+        performer: Id,
+        work: Id,
+        node: Id,
+    }
+
+    fn xy(x: f32, y: f32) -> Position {
+        Position { x, y }
+    }
+
+    fn fixture(layer: Layer) -> Fixture {
+        let mut project = Project::empty();
+        let (performer, work) = match layer {
+            Layer::Oa => (Kind::Entity, Kind::Activity),
+            Layer::Sa => (Kind::System, Kind::Function),
+        };
+        let performer = project
+            .add_element(performer, layer, "Performer", None)
+            .unwrap();
+        let work = project.add_element(work, layer, "Work", None).unwrap();
+        let diagram = project.ensure_diagram(layer);
+        project.diagrams.get_mut(&diagram).unwrap().projection = ProjectionKind::Allocation;
+        let performer = project.place(diagram, performer, xy(100., 100.));
+        project
+            .diagrams
+            .get_mut(&diagram)
+            .unwrap()
+            .nodes
+            .get_mut(&performer)
+            .unwrap()
+            .size = Size {
+            width: 400.,
+            height: 250.,
+        };
+        let node = project.place(diagram, work, xy(160., 180.));
+        let owner = project.diagrams[&diagram].nodes[&performer].element;
+        project.relate(RelationKind::Allocation, "Responsibility", owner, work);
+        Fixture {
+            project,
+            diagram,
+            performer,
+            work,
+            node,
+        }
+    }
+
+    fn semantic(f: &Fixture) -> (plan::Scope, plan::SemanticPlan) {
+        let scope = plan::capture(&f.project, f.diagram, f.work, f.node).unwrap();
+        let semantic = plan::plan_semantics(
+            &f.project,
+            &scope,
+            plan::Destination::OutsidePerformers,
+            &BTreeMap::new(),
+        )
+        .unwrap();
+        (scope, semantic)
+    }
+
+    fn presentation() -> plan::PresentationContext {
+        plan::PresentationContext {
+            viewport: plan::Rect {
+                position: xy(-2000., -2000.),
+                size: Size {
+                    width: 5000.,
+                    height: 5000.,
+                },
+            },
+            zoom: 1.,
+            target: None,
+        }
+    }
+
+    #[test]
+    fn each_outgoing_edge_clears_the_source_and_passes_ordinary_placement() {
+        for layer in [Layer::Oa, Layer::Sa] {
+            let f = fixture(layer);
+            let (scope, semantic) = semantic(&f);
+            for (start, pointer, requested, expected) in [
+                (
+                    Point::new(170., 210.),
+                    Point::new(99., 210.),
+                    xy(89., 180.),
+                    xy(-140., 180.),
+                ),
+                (
+                    Point::new(340., 210.),
+                    Point::new(501., 210.),
+                    xy(321., 180.),
+                    xy(510., 180.),
+                ),
+                (
+                    Point::new(200., 190.),
+                    Point::new(200., 99.),
+                    xy(160., 89.),
+                    xy(160., -10.),
+                ),
+                (
+                    Point::new(200., 260.),
+                    Point::new(200., 351.),
+                    xy(160., 271.),
+                    xy(160., 360.),
+                ),
+            ] {
+                assert!(matches!(
+                    plan::place(&semantic, requested, presentation()),
+                    Err(plan::Refusal::LayoutRequired(_))
+                ));
+                let proposed = requests(
+                    (&f.project, &ViewIndex::new(&f.project)),
+                    (semantic.project(), semantic.index()),
+                    f.diagram,
+                    &scope.placements,
+                    f.node,
+                    requested,
+                    (start, pointer),
+                );
+                assert_eq!(proposed, vec![expected]);
+                let placed = plan::place(&semantic, proposed[0], presentation()).unwrap();
+                assert!(
+                    plan::finish(&semantic, &f.project, &placed)
+                        .unwrap()
+                        .is_some()
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn source_shrink_uses_candidate_enclosure_not_frozen_target() {
+        let mut f = fixture(Layer::Oa);
+        f.project
+            .diagrams
+            .get_mut(&f.diagram)
+            .unwrap()
+            .nodes
+            .get_mut(&f.performer)
+            .unwrap()
+            .size = Size {
+            width: 224.,
+            height: 94.,
+        };
+        let (scope, semantic) = semantic(&f);
+        let proposed = requests(
+            (&f.project, &ViewIndex::new(&f.project)),
+            (semantic.project(), semantic.index()),
+            f.diagram,
+            &scope.placements,
+            f.node,
+            xy(229., 180.),
+            (Point::new(340., 210.), Point::new(409., 210.)),
+        );
+        assert_eq!(proposed, vec![xy(340., 180.)]);
+        plan::place(&semantic, proposed[0], presentation()).unwrap();
+    }
+
+    #[test]
+    fn corner_order_follows_boundary_crossing_and_is_deterministic() {
+        let f = fixture(Layer::Sa);
+        let (scope, semantic) = semantic(&f);
+        // Right crossed at 160/161 of the segment; bottom at 90/91.
+        let args = (
+            xy(321., 271.),
+            Point::new(340., 260.),
+            Point::new(501., 351.),
+        );
+        let proposed = requests(
+            (&f.project, &ViewIndex::new(&f.project)),
+            (semantic.project(), semantic.index()),
+            f.diagram,
+            &scope.placements,
+            f.node,
+            args.0,
+            (args.1, args.2),
+        );
+        assert_eq!(proposed, vec![xy(320., 360.), xy(510., 270.)]);
+        assert_eq!(
+            proposed,
+            requests(
+                (&f.project, &ViewIndex::new(&f.project)),
+                (semantic.project(), semantic.index()),
+                f.diagram,
+                &scope.placements,
+                f.node,
+                args.0,
+                (args.1, args.2)
+            )
+        );
+    }
+
+    #[test]
+    fn no_crossing_no_overlap_no_source_and_nonfinite_requests_are_empty() {
+        let f = fixture(Layer::Oa);
+        let (scope, semantic) = semantic(&f);
+        for (requested, pointer) in [
+            (xy(170., 180.), Point::new(210., 210.)),
+            (xy(700., 180.), Point::new(740., 210.)),
+            (xy(f32::NAN, 180.), Point::new(99., 210.)),
+            (xy(89., 180.), Point::new(f32::INFINITY, 210.)),
+        ] {
+            assert!(
+                requests(
+                    (&f.project, &ViewIndex::new(&f.project)),
+                    (semantic.project(), semantic.index()),
+                    f.diagram,
+                    &scope.placements,
+                    f.node,
+                    requested,
+                    (Point::new(200., 210.), pointer)
+                )
+                .is_empty()
+            );
+        }
+        assert!(
+            requests(
+                (semantic.project(), semantic.index()),
+                (semantic.project(), semantic.index()),
+                f.diagram,
+                &scope.placements,
+                f.node,
+                xy(89., 180.),
+                (Point::new(200., 210.), Point::new(99., 210.))
+            )
+            .is_empty()
+        );
+    }
+
+    #[test]
+    fn descendant_footprint_controls_clearance_without_mutating_projects() {
+        for layer in [Layer::Oa, Layer::Sa] {
+            let mut f = fixture(layer);
+            let kind = f.project.elements[&f.work].kind();
+            let child = f
+                .project
+                .add_element(kind, layer, "Child", Some(f.work))
+                .unwrap();
+            let child_node = f.project.place(f.diagram, child, xy(240., 270.));
+            // First-child allocation transfer is normally performed by commands;
+            // this fixture expresses the resulting leaf allocation directly.
+            f.project.relations.clear();
+            let owner = f.project.diagrams[&f.diagram].nodes[&f.performer].element;
+            f.project.relate(
+                RelationKind::Allocation,
+                "Leaf responsibility",
+                owner,
+                child,
+            );
+            let (scope, semantic) = semantic(&f);
+            assert!(scope.placements.contains_key(&child_node));
+            let before = f.project.clone();
+            let candidate = semantic.project().clone();
+            let proposed = requests(
+                (&f.project, &ViewIndex::new(&f.project)),
+                (&candidate, semantic.index()),
+                f.diagram,
+                &scope.placements,
+                f.node,
+                xy(89., 180.),
+                (Point::new(170., 210.), Point::new(99., 210.)),
+            );
+            assert_eq!(proposed, vec![xy(-240., 180.)]);
+            let placed = plan::place(&semantic, proposed[0], presentation()).unwrap();
+            let root = &placed.diagram.nodes[&f.node];
+            let child = &placed.diagram.nodes[&child_node];
+            assert_eq!(child.position.x - root.position.x, 80.);
+            assert_eq!(child.position.y - root.position.y, 90.);
+            assert_eq!(f.project, before);
+            assert_eq!(semantic.project(), &candidate);
+        }
+    }
+
+    #[test]
+    fn independent_selected_roots_keep_one_rigid_group_translation() {
+        for layer in [Layer::Oa, Layer::Sa] {
+            let mut f = fixture(layer);
+            let kind = f.project.elements[&f.work].kind();
+            let second = f
+                .project
+                .add_element(kind, layer, "Second work", None)
+                .unwrap();
+            let second_node = f.project.place(f.diagram, second, xy(240., 300.));
+            let owner = f.project.diagrams[&f.diagram].nodes[&f.performer].element;
+            f.project.relate(
+                RelationKind::Allocation,
+                "Second responsibility",
+                owner,
+                second,
+            );
+            let selected = BTreeMap::from([(f.node, f.work), (second_node, second)]);
+            let scope =
+                plan::assignment::capture(&f.project, f.diagram, &selected, f.node).unwrap();
+            let semantic = plan::assignment::plan_semantics(
+                &scope,
+                plan::Destination::OutsidePerformers,
+                &BTreeMap::new(),
+            )
+            .unwrap();
+            let proposed = requests(
+                (&f.project, &ViewIndex::new(&f.project)),
+                (semantic.project(), semantic.index()),
+                f.diagram,
+                scope.affected(),
+                f.node,
+                xy(89., 180.),
+                (Point::new(170., 210.), Point::new(99., 210.)),
+            );
+            assert_eq!(proposed, vec![xy(-220., 180.)]);
+            let placed = plan::assignment::place(&semantic, proposed[0], presentation()).unwrap();
+            let root = &placed.diagram.nodes[&f.node];
+            let second = &placed.diagram.nodes[&second_node];
+            assert_eq!(second.position.x - root.position.x, 80.);
+            assert_eq!(second.position.y - root.position.y, 120.);
+            assert!(
+                plan::assignment::finish(&semantic, &f.project, &placed)
+                    .unwrap()
+                    .is_some()
+            );
+        }
+    }
+}

crates/oa-desktop/src/app/allocation_drag_full_tree_tests.rs

@@ -4,6 +4,9 @@ use super::*;
 use crate::behavior::canvas_workspace::tests::{Mounted, key};
 use iced::{Event as Input, keyboard};
 
+#[path = "allocation_drag_tests/control_focus.rs"]
+mod control_focus;
+
 fn character(text: &str, modifiers: keyboard::Modifiers) -> Input {
     Input::Keyboard(keyboard::Event::KeyPressed {
         key: keyboard::Key::Character(text.into()),
@@ -27,6 +30,117 @@ async fn mount() -> (Fixture, Mounted) {
     mounted.settle(&mut f.app).await;
     (f, mounted)
 }
+
+#[tokio::test]
+async fn actual_tree_outgoing_boundary_motion_preview_release_and_cancel() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = outgoing_fixture(layer);
+        f.app.layer = layer;
+        f.app.window_size = iced::Size::new(1440., 900.);
+        let _ = f.app.update(Message::Select(f.work));
+        let mut mounted = Mounted::new(&mut f.app).await;
+        f.app.zoom = 0.75;
+        f.app.pan = Vector::new(20., 15.);
+        f.app.fit_to_view = false;
+        mounted.settle(&mut f.app).await;
+        let original = f.app.project().clone();
+        let source = f.app.document.bundle().clone();
+        let from = at(&mut mounted, &f, xy(660., 225.));
+        mounted
+            .batch(
+                &mut f.app,
+                &[
+                    Input::Mouse(mouse::Event::CursorMoved { position: from }),
+                    Input::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
+                ],
+                mouse::Cursor::Available(from),
+            )
+            .await;
+        // Separate input/update/layout turns expose the held boundary transition
+        // that a one-batch distant drop cannot exercise.
+        for x in [620., 560., 510., 499., 490.] {
+            let to = at(&mut mounted, &f, xy(x, 225.));
+            mounted
+                .batch(
+                    &mut f.app,
+                    &[Input::Mouse(mouse::Event::CursorMoved { position: to })],
+                    mouse::Cursor::Available(to),
+                )
+                .await;
+            assert_eq!(f.app.project(), &original);
+            assert_eq!(f.app.document.bundle(), &source);
+            assert!(
+                !f.app.allocation_drag.feedback.as_ref().unwrap().refused,
+                "{layer:?} x={x}: {}",
+                f.app.status
+            );
+            assert!(f.app.allocation_drag.preview.is_some());
+            let _ = mounted.pixels(&f.app);
+        }
+        let expected = f
+            .app
+            .allocation_drag
+            .preview
+            .as_ref()
+            .unwrap()
+            .placement
+            .diagram
+            .clone();
+        let to = at(&mut mounted, &f, xy(490., 225.));
+        mounted
+            .batch(
+                &mut f.app,
+                &[Input::Mouse(mouse::Event::ButtonReleased(
+                    mouse::Button::Left,
+                ))],
+                mouse::Cursor::Available(to),
+            )
+            .await;
+        assert_eq!(&f.app.project().diagrams[&f.diagram], &expected);
+        assert!(
+            !f.app
+                .project()
+                .relations
+                .values()
+                .any(|r| r.kind() == RelationKind::Allocation && r.target() == f.work)
+        );
+        let _ = f.app.update(Message::Undo);
+        mounted.settle(&mut f.app).await;
+        assert_eq!(f.app.document.bundle(), &source);
+        let from = at(&mut mounted, &f, xy(660., 225.));
+        let to = at(&mut mounted, &f, xy(490., 225.));
+        mounted
+            .batch(
+                &mut f.app,
+                &[
+                    Input::Mouse(mouse::Event::CursorMoved { position: from }),
+                    Input::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
+                    Input::Mouse(mouse::Event::CursorMoved { position: to }),
+                ],
+                mouse::Cursor::Available(to),
+            )
+            .await;
+        mounted
+            .batch(
+                &mut f.app,
+                &[key(keyboard::key::Named::Escape)],
+                mouse::Cursor::Available(to),
+            )
+            .await;
+        mounted
+            .batch(
+                &mut f.app,
+                &[Input::Mouse(mouse::Event::ButtonReleased(
+                    mouse::Button::Left,
+                ))],
+                mouse::Cursor::Available(to),
+            )
+            .await;
+        assert_eq!(f.app.document.bundle(), &source);
+        assert!(f.app.allocation_drag.preview.is_none());
+        assert!(!f.app.document.can_undo());
+    }
+}
 fn canvas_bounds(mounted: &mut Mounted, app: &App) -> Rectangle {
     mounted
         .geometry(app)
@@ -211,7 +325,7 @@ async fn actual_keyboard_arrange_shortcut_consumes_once_escape_cancels_and_dirty
     assert!(
         messages
             .iter()
-            .any(|m| matches!(m, Message::WorkDrag(Event::Press(p)) if p.arrange))
+            .any(|m| matches!(m, Message::WorkDrag(Event::Press(p)) if p.mode == Mode::Arrange))
     );
     assert!(!f.app.allocation_drag.arrange_next);
     assert_eq!(f.app.document.revision(), 1, "{}", f.app.status);
@@ -282,7 +396,7 @@ async fn actual_rendered_canvas_pixels_do_not_change_when_toolbar_feedback_text_
         .as_ref()
         .expect("active frozen destination");
     assert!(!feedback.refused, "{}", feedback.text);
-    let target = &feedback.press.frozen.targets[feedback.targets[0]];
+    let target = &feedback.frozen.as_ref().unwrap().targets[feedback.targets[0]];
     assert!(target.region.y * f.app.zoom + f.app.pan.y < 0.);
     assert_eq!(feedback.destination_identity(), "A");
     let canvas = canvas_bounds(&mut mounted, &f.app);
@@ -434,7 +548,7 @@ async fn actual_app_tree_exact_incoming_drag_keeps_destination_visible_and_canva
                 selected_header.x + selected_header.width <= canvas.x + canvas.width
                     && selected_header.y + selected_header.height <= canvas.y + canvas.height
             );
-            let mut expected = preview.semantic.project().clone();
+            let mut expected = preview.project().clone();
             expected
                 .diagrams
                 .insert(f.diagram, preview.placement.diagram.clone());
@@ -478,6 +592,7 @@ async fn actual_app_tree_exact_incoming_drag_keeps_destination_visible_and_canva
             if pan.y == -100. {
                 // A genuine clipping refusal in the same held gesture, then
                 // recovery at the original exact point: no camera rebasing.
+                let retained = f.app.allocation_drag.preview.clone().unwrap();
                 let clipped = at(&mut mounted, &f, xy(160., 110.));
                 mounted
                     .batch(
@@ -489,7 +604,19 @@ async fn actual_app_tree_exact_incoming_drag_keeps_destination_visible_and_canva
                     )
                     .await;
                 assert!(f.app.allocation_drag.feedback.as_ref().unwrap().refused);
-                assert!(f.app.allocation_drag.preview.is_none());
+                assert!(Arc::ptr_eq(
+                    f.app.allocation_drag.preview.as_ref().unwrap(),
+                    &retained
+                ));
+                assert!(
+                    f.app
+                        .allocation_drag
+                        .feedback
+                        .as_ref()
+                        .unwrap()
+                        .ghost_delta
+                        .is_some()
+                );
                 assert_eq!(canvas_bounds(&mut mounted, &f.app), canvas);
                 assert_eq!(destination_bounds(&mut mounted, &f.app), slot);
                 assert_eq!(f.app.project(), &before);
@@ -689,7 +816,7 @@ async fn actual_toolbar_hover_inspects_last_full_name_without_authorizing_an_out
             .await;
         assert!(f.app.allocation_drag.active.is_none());
         assert!(f.app.allocation_drag.feedback.is_none());
-        assert_eq!(f.app.status, "Work drag canceled outside the canvas.");
+        assert_eq!(f.app.status, "Drag canceled outside the canvas.");
         assert_eq!(f.app.document.bundle(), &before);
         assert!(!f.app.document.can_undo());
         // A fresh gesture cannot inherit the previous inspection name.

crates/oa-desktop/src/app/allocation_drag_tests.rs

@@ -8,6 +8,9 @@ use iced::{
 #[path = "allocation_drag_full_tree_tests.rs"]
 mod full_tree;
 
+#[path = "allocation_drag_tests/group.rs"]
+mod group;
+
 #[path = "allocation_drag_tests/navigation_union.rs"]
 mod navigation_union;
 
@@ -48,6 +51,7 @@ fn fixture(layer: Layer) -> Fixture {
     app.zoom = 1.;
     app.pan = Vector::ZERO;
     app.fit_to_view = false;
+    app.reconcile_multiselect();
     Fixture {
         app,
         a,
@@ -59,7 +63,7 @@ fn fixture(layer: Layer) -> Fixture {
 }
 fn canvas(app: &App) -> DiagramCanvas<'_> {
     DiagramCanvas {
-        selection: None,
+        selection: app.diagram_selection.as_ref(),
         allocation: Some(app.allocation_capability()),
         project: app.project(),
         view_index: Some(app.document.view_index()),
@@ -122,6 +126,18 @@ fn press(f: &Fixture) -> Arc<Press> {
         })
         .expect("actual clean work-body press")
 }
+fn admit_press(f: &mut Fixture) -> Arc<Press> {
+    let p = press(f);
+    let _ = f.app.update(Message::WorkDrag(Event::Press(p.clone())));
+    assert!(f.app.allocation_drag.active.is_some(), "{}", f.app.status);
+    p
+}
+fn singleton(candidate: &Candidate) -> &Arc<plan::SemanticPlan> {
+    let Candidate::Singleton(plan) = candidate else {
+        panic!("legacy singleton candidate")
+    };
+    plan
+}
 fn drag(f: &mut Fixture, to: Point) {
     let events = batch(&f.app, start(f), to);
     assert!(matches!(
@@ -359,7 +375,7 @@ fn arrange_is_one_gesture_and_snapped_noop_preserves_redo_and_source() {
     assert!(f.app.allocation_drag.arrange_next);
     let p = press(&f);
     let _ = f.app.update(Message::WorkDrag(Event::Press(p.clone())));
-    assert!(p.arrange);
+    assert_eq!(p.mode, Mode::Arrange);
     assert!(!f.app.allocation_drag.arrange_next);
     let _ = f.app.update(Message::WorkDrag(Event::Release(
         p.stamp,
@@ -370,7 +386,7 @@ fn arrange_is_one_gesture_and_snapped_noop_preserves_redo_and_source() {
     assert_eq!(f.app.document.revision(), revision);
     assert!(f.app.document.can_redo());
     assert!(f.app.project().relations.is_empty());
-    assert!(!press(&f).arrange);
+    assert_eq!(press(&f).mode, Mode::Assign);
 }
 
 #[test]
@@ -397,14 +413,15 @@ fn candidate_semantics_are_cached_per_destination_with_stable_ids_and_own_index(
     let _ = f
         .app
         .update(Message::WorkDrag(Event::Preview(p.stamp, p.token, Some(a))));
-    let first = f
-        .app
-        .allocation_drag
-        .preview
-        .as_ref()
-        .expect(&f.app.status)
-        .semantic
-        .clone();
+    let first = singleton(
+        &f.app
+            .allocation_drag
+            .preview
+            .as_ref()
+            .expect(&f.app.status)
+            .candidate,
+    )
+    .clone();
     let stable = first
         .project()
         .relations
@@ -419,20 +436,20 @@ fn candidate_semantics_are_cached_per_destination_with_stable_ids_and_own_index(
     )));
     assert!(Arc::ptr_eq(
         &first,
-        &f.app.allocation_drag.preview.as_ref().unwrap().semantic
+        singleton(&f.app.allocation_drag.preview.as_ref().unwrap().candidate)
     ));
     let _ = f
         .app
         .update(Message::WorkDrag(Event::Preview(p.stamp, p.token, Some(b))));
     let preview = f.app.allocation_drag.preview.as_ref().expect(&f.app.status);
-    assert!(!Arc::ptr_eq(&first, &preview.semantic));
-    assert_eq!(preview.semantic.project().relations[&stable].source(), f.b);
+    assert!(!Arc::ptr_eq(&first, singleton(&preview.candidate)));
+    assert_eq!(preview.project().relations[&stable].source(), f.b);
     assert_eq!(
         preview.placement.view,
         projection::project_diagram_with_index(
-            preview.semantic.project(),
+            preview.project(),
             &preview.placement.diagram,
-            preview.semantic.index()
+            preview.index()
         )
     );
     assert_ne!(
@@ -448,7 +465,7 @@ fn candidate_semantics_are_cached_per_destination_with_stable_ids_and_own_index(
         .update(Message::WorkDrag(Event::Preview(p.stamp, p.token, Some(a))));
     assert!(Arc::ptr_eq(
         &first,
-        &f.app.allocation_drag.preview.as_ref().unwrap().semantic
+        singleton(&f.app.allocation_drag.preview.as_ref().unwrap().candidate)
     ));
     assert_eq!(
         f.app.allocation_drag.active.as_ref().unwrap().cache.len(),
@@ -458,9 +475,19 @@ fn candidate_semantics_are_cached_per_destination_with_stable_ids_and_own_index(
 
 #[test]
 fn frozen_targets_use_half_open_semantic_priority_and_refuse_incomparable_overlap() {
-    let f = fixture(Layer::Oa);
-    let p = press(&f);
-    let mut frozen = p.frozen.clone();
+    let mut f = fixture(Layer::Oa);
+    let p = admit_press(&mut f);
+    let mut frozen = f
+        .app
+        .allocation_drag
+        .active
+        .as_ref()
+        .unwrap()
+        .frozen
+        .as_ref()
+        .unwrap()
+        .as_ref()
+        .clone();
     let ai = frozen
         .targets
         .iter()
@@ -540,6 +567,7 @@ fn release_uses_ordered_native_position_before_later_motion_in_same_batch() {
 fn replace(f: &mut Fixture, project: Project) {
     f.app.document = crate::document::Document::from_project(project, Default::default()).unwrap();
     f.app.sync();
+    f.app.reconcile_multiselect();
 }
 
 #[test]
@@ -588,7 +616,7 @@ fn same_snapped_position_on_opposite_shared_border_rebuilds_semantics_even_if_la
         .1
         .as_ref()
         .unwrap();
-    assert!(!Arc::ptr_eq(a, b));
+    assert!(!Arc::ptr_eq(singleton(a), singleton(b)));
     let stable = a
         .project()
         .relations
@@ -655,13 +683,24 @@ fn mounted_role_only_outgoing_refusal_retains_placement_and_same_performer_creat
         "{}",
         f.app.status
     );
-    let target = press(&f)
+    let admitted = admit_press(&mut f);
+    let target = f
+        .app
+        .allocation_drag
+        .active
+        .as_ref()
+        .unwrap()
         .frozen
+        .as_ref()
+        .unwrap()
         .targets
         .iter()
         .find(|t| t.element == f.a)
         .unwrap()
         .region;
+    let _ = f
+        .app
+        .update(Message::WorkDrag(Event::Cancel(admitted.token)));
     drag(&mut f, screen(xy(target.x + 45., target.y + 100.)));
     assert_eq!(f.app.document.revision(), 1, "{}", f.app.status);
     assert_eq!(f.app.project().relations, relations);
@@ -774,8 +813,18 @@ fn frozen_collapsed_target_uses_only_visible_header_and_port_edge_controls_occlu
         .unwrap()
         .collapsed = true;
     replace(&mut f, project);
-    let p = press(&f);
-    let mut frozen = p.frozen.clone();
+    let p = admit_press(&mut f);
+    let mut frozen = f
+        .app
+        .allocation_drag
+        .active
+        .as_ref()
+        .unwrap()
+        .frozen
+        .as_ref()
+        .unwrap()
+        .as_ref()
+        .clone();
     let t = frozen.targets.iter().find(|t| t.element == f.a).unwrap();
     let bottom = xy(t.region.x + 30., t.region.y + t.region.height);
     assert!(t.region.height <= 62.);
@@ -945,7 +994,7 @@ fn toolbar_destination_names_transformed_target_whose_header_is_clipped() {
         send(&mut f.app, events);
         let feedback = f.app.allocation_drag.feedback.as_ref().unwrap();
         assert!(!feedback.refused, "{}", feedback.text);
-        let target = &feedback.press.frozen.targets[feedback.targets[0]];
+        let target = &feedback.frozen.as_ref().unwrap().targets[feedback.targets[0]];
         assert!(screen(xy(target.region.x, target.region.y)).y < bounds().y);
         assert_eq!(feedback.destination_identity(), "A");
         assert!(f.app.allocation_drag.preview.is_some());
@@ -1004,7 +1053,7 @@ fn oa_sa_clipped_selected_header_refuses_preview_release_and_retries_without_par
             assert!(feedback.refused, "{}", feedback.text);
             assert!(feedback.text.contains("Make room or adjust the view"));
             assert_eq!(
-                feedback.press.frozen.targets[feedback.targets[0]].element,
+                feedback.frozen.as_ref().unwrap().targets[feedback.targets[0]].element,
                 f.a
             );
             assert_eq!(f.app.project(), &accepted);
@@ -1029,14 +1078,14 @@ fn oa_sa_clipped_selected_header_refuses_preview_release_and_retries_without_par
             send(&mut f.app, events);
             let active = f.app.allocation_drag.active.as_ref().unwrap();
             let p = active.press.clone();
-            let semantic = active.cache[0].1.as_ref().unwrap().clone();
+            let semantic = singleton(active.cache[0].1.as_ref().unwrap()).clone();
             let _ = f.app.update(Message::WorkDrag(Event::Preview(
                 p.stamp,
                 p.token,
                 Some(clear),
             )));
             let preview = f.app.allocation_drag.preview.as_ref().expect(&f.app.status);
-            assert!(Arc::ptr_eq(&semantic, &preview.semantic));
+            assert!(Arc::ptr_eq(&semantic, singleton(&preview.candidate)));
             assert_eq!(
                 preview.placement.diagram.nodes[&f.node].position,
                 xy(120., 160.)
@@ -1132,7 +1181,7 @@ fn oa_sa_toolbar_identity_accepts_exact_receiver_and_collapsed_header_drag() {
                 assert!(!feedback.refused, "{}", feedback.text);
                 assert_eq!(feedback.destination_identity(), name);
                 assert_eq!(
-                    feedback.press.frozen.targets[feedback.targets[0]].placement,
+                    feedback.frozen.as_ref().unwrap().targets[feedback.targets[0]].placement,
                     target_id
                 );
                 let preview = f.app.allocation_drag.preview.as_ref().expect(&f.app.status);
@@ -1144,12 +1193,12 @@ fn oa_sa_toolbar_identity_accepts_exact_receiver_and_collapsed_header_drag() {
                 assert_eq!(
                     preview.placement.view,
                     projection::project_diagram_with_index(
-                        preview.semantic.project(),
+                        preview.project(),
                         &preview.placement.diagram,
-                        preview.semantic.index()
+                        preview.index()
                     )
                 );
-                let mut expected = preview.semantic.project().clone();
+                let mut expected = preview.project().clone();
                 expected
                     .diagrams
                     .insert(f.diagram, preview.placement.diagram.clone());
@@ -1184,10 +1233,13 @@ fn destination_identity_does_not_describe_blocked_or_outside_viewport_as_unalloc
     let p = press(&f);
     let mut feedback = Feedback {
         press: p,
+        frozen: None,
+        ordinary_performers: false,
         targets: vec![],
         inspection_targets: vec![],
         text: "A card blocks this drop".into(),
         refused: true,
+        ghost_delta: None,
     };
     assert_eq!(feedback.destination_identity(), "No eligible destination");
     feedback.text = "Release inside the captured canvas".into();
@@ -1195,3 +1247,361 @@ fn destination_identity_does_not_describe_blocked_or_outside_viewport_as_unalloc
     feedback.refused = false;
     assert_eq!(feedback.destination_identity(), "Outside performers");
 }
+
+fn outgoing_fixture(layer: Layer) -> Fixture {
+    let mut f = fixture(layer);
+    drag(&mut f, screen(xy(160., 190.)));
+    let mut project = f.app.project().clone();
+    let d = project.diagrams.get_mut(&f.diagram).unwrap();
+    let performer = d.nodes.values_mut().find(|n| n.element == f.a).unwrap();
+    performer.position = xy(500., 100.);
+    performer.size = Size {
+        width: 300.,
+        height: 300.,
+    };
+    d.nodes.get_mut(&f.node).unwrap().position = xy(540., 190.);
+    replace(&mut f, project);
+    f
+}
+
+#[test]
+fn outgoing_boundary_drop_clears_source_without_changing_other_placements() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = outgoing_fixture(layer);
+        let before = f.app.project().clone();
+        let source = f.app.document.bundle().clone();
+        let from = screen(xy(660., 225.));
+        let to = screen(xy(490., 225.));
+        let mut events = batch(&f.app, from, to);
+        let release = events.pop().unwrap();
+        send(&mut f.app, events);
+        let feedback = f.app.allocation_drag.feedback.as_ref().unwrap();
+        assert!(!feedback.refused, "{}", feedback.text);
+        let preview = f.app.allocation_drag.preview.as_ref().unwrap();
+        let expected_diagram = preview.placement.diagram.clone();
+        let work = &expected_diagram.nodes[&f.node];
+        assert!(work.position.x + work.size.width <= 490.);
+        assert_eq!(work.position.y, 190.);
+        for (id, node) in &before.diagrams[&f.diagram].nodes {
+            if *id != f.node {
+                assert_eq!(&expected_diagram.nodes[id], node);
+            }
+        }
+        assert_eq!(f.app.project(), &before);
+        assert_eq!(f.app.document.bundle(), &source);
+        let _ = f.app.update(release);
+        assert_eq!(&f.app.project().diagrams[&f.diagram], &expected_diagram);
+        assert!(
+            !f.app
+                .project()
+                .relations
+                .values()
+                .any(|r| r.kind() == RelationKind::Allocation && r.target() == f.work)
+        );
+        let after = f.app.project().clone();
+        let saved = f.app.document.bundle().clone();
+        let _ = f.app.update(Message::Undo);
+        assert_eq!(f.app.project(), &before);
+        assert_eq!(f.app.document.bundle(), &source);
+        assert!(!f.app.document.can_undo());
+        let _ = f.app.update(Message::Redo);
+        assert_eq!(f.app.project(), &after);
+        assert_eq!(f.app.document.bundle(), &saved);
+    }
+}
+
+#[test]
+fn outgoing_clearance_collision_refuses_release_without_source_or_history_mutation() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = outgoing_fixture(layer);
+        let mut project = f.app.project().clone();
+        let obstacle = project
+            .add_element(
+                project.elements[&f.work].kind(),
+                layer,
+                "Unrelated work",
+                None,
+            )
+            .unwrap();
+        let obstacle_node = project.place(f.diagram, obstacle, xy(240., 190.));
+        replace(&mut f, project);
+        // A refused release must preserve an existing redo branch, too.
+        let _ = f.app.update(Message::Command(Command::Rename(
+            f.work,
+            "Temporary".into(),
+        )));
+        let _ = f.app.update(Message::Undo);
+        let before = f.app.project().clone();
+        let source = f.app.document.bundle().clone();
+        let snapshot = f.app.document.snapshot();
+        let revision = f.app.document.revision();
+        let from = screen(xy(660., 225.));
+        let to = screen(xy(490., 225.));
+        let mut events = batch(&f.app, from, to);
+        let release = events.pop().unwrap();
+        send(&mut f.app, events);
+
+        let active = f.app.allocation_drag.active.as_ref().unwrap();
+        let p = &active.press;
+        let frozen = active.frozen.as_ref().unwrap();
+        let owner = frozen.targets.iter().find(|t| t.element == f.a).unwrap();
+        assert_eq!(p.start, from);
+        assert!(contains(owner.region, p.stamp.world(from)));
+        assert!(p.stamp.world(to).x < owner.region.x);
+        assert_eq!(
+            frozen.resolve(p.stamp, Some(to), false),
+            Hit::Destination(plan::Destination::OutsidePerformers, None),
+            "The pointer must reach empty canvas, not be occluded by the obstacle"
+        );
+        let candidate = active
+            .cache
+            .iter()
+            .find(|(destination, _)| *destination == plan::Destination::OutsidePerformers)
+            .unwrap()
+            .1
+            .as_ref()
+            .unwrap();
+        let affected = match &active.prepared {
+            Prepared::Singleton(scope) => &scope.placements,
+            Prepared::Assignment(scope) => scope.affected(),
+            _ => panic!("expected assignment gesture"),
+        };
+        let requested = xy(370., 190.);
+        let presentation = plan::PresentationContext {
+            viewport: p.stamp.viewport(),
+            zoom: p.stamp.zoom,
+            target: None,
+        };
+        assert!(matches!(
+            candidate.place(requested, presentation),
+            Err(plan::Refusal::LayoutRequired(_))
+        ));
+        let proposed = clearance::requests(
+            (f.app.project(), f.app.document.view_index()),
+            (candidate.project(), candidate.index()),
+            f.diagram,
+            affected,
+            f.node,
+            requested,
+            (p.stamp.world(from), p.stamp.world(to)),
+        );
+        assert_eq!(
+            proposed.len(),
+            1,
+            "a genuine left crossing must propose clearance"
+        );
+        assert!(proposed[0].x < requested.x);
+        let work = &before.diagrams[&f.diagram].nodes[&f.node];
+        let obstacle = &before.diagrams[&f.diagram].nodes[&obstacle_node];
+        assert!(obstacle.position.x + obstacle.size.width < 490.);
+        assert!(proposed[0].x + work.size.width <= owner.region.x - 10.);
+        assert!(proposed[0].x < obstacle.position.x + obstacle.size.width);
+        assert!(obstacle.position.x < proposed[0].x + work.size.width);
+        assert_eq!(proposed[0].y, obstacle.position.y);
+        assert!(matches!(
+            candidate.place(proposed[0], presentation),
+            Err(plan::Refusal::LayoutRequired(message)) if message.contains("overlapping cards")
+        ));
+        let feedback = f.app.allocation_drag.feedback.as_ref().unwrap();
+        assert!(feedback.refused, "{}", feedback.text);
+        assert!(feedback.ghost_delta.is_some());
+        assert!(f.app.allocation_drag.preview.is_none());
+        assert_eq!(f.app.project(), &before);
+        assert_eq!(f.app.document.bundle(), &source);
+        assert!(Arc::ptr_eq(&snapshot, &f.app.document.snapshot()));
+        let _ = f.app.update(release);
+        assert!(
+            f.app.status.contains("overlapping cards"),
+            "{}",
+            f.app.status
+        );
+        assert!(f.app.allocation_drag.active.is_none());
+        assert!(f.app.allocation_drag.preview.is_none());
+        assert_eq!(f.app.project(), &before);
+        assert_eq!(f.app.document.bundle(), &source);
+        assert_eq!(f.app.document.revision(), revision);
+        assert!(Arc::ptr_eq(&snapshot, &f.app.document.snapshot()));
+        assert!(!f.app.document.can_undo());
+        assert!(f.app.document.can_redo());
+    }
+}
+
+#[test]
+fn outgoing_clearance_preserves_source_enclosure_and_allocated_sibling() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = outgoing_fixture(layer);
+        let mut project = f.app.project().clone();
+        let sibling = project
+            .add_element(
+                project.elements[&f.work].kind(),
+                layer,
+                "Remaining work",
+                None,
+            )
+            .unwrap();
+        let sibling_node = project.place(f.diagram, sibling, xy(540., 450.));
+        let allocation = project.relate(
+            RelationKind::Allocation,
+            "Keep responsibility",
+            f.a,
+            sibling,
+        );
+        replace(&mut f, project);
+        let before = f.app.project().clone();
+        let source = f.app.document.bundle().clone();
+        let view = projection::project_view(&before, f.diagram);
+        let owner = view.nodes.iter().find(|n| n.element == f.a).unwrap();
+        let bottom = owner.position.y + owner.size.height;
+        let stored_owner = &before.diagrams[&f.diagram].nodes[&owner.id];
+        assert!(
+            bottom > stored_owner.position.y + stored_owner.size.height,
+            "The retained sibling must enlarge the projected source enclosure"
+        );
+        let from = screen(xy(660., 225.));
+        let to = screen(xy(660., bottom + 1.));
+        let mut events = batch(&f.app, from, to);
+        let release = events.pop().unwrap();
+        send(&mut f.app, events);
+        let active = f.app.allocation_drag.active.as_ref().unwrap();
+        let p = &active.press;
+        let frozen = active.frozen.as_ref().unwrap();
+        let target = frozen.targets.iter().find(|t| t.element == f.a).unwrap();
+        assert_eq!(p.start, from);
+        assert!(contains(target.region, p.stamp.world(from)));
+        assert!(p.stamp.world(to).y >= target.region.y + target.region.height);
+        assert_eq!(
+            frozen.resolve(p.stamp, Some(to), false),
+            Hit::Destination(plan::Destination::OutsidePerformers, None)
+        );
+        let preview = f.app.allocation_drag.preview.as_ref().expect(&f.app.status);
+        assert!(!f.app.allocation_drag.feedback.as_ref().unwrap().refused);
+        let requested = xy(540., 190. + to.y - from.y);
+        assert!(matches!(
+            preview.candidate.place(
+                requested,
+                plan::PresentationContext {
+                    viewport: p.stamp.viewport(),
+                    zoom: p.stamp.zoom,
+                    target: None,
+                }
+            ),
+            Err(plan::Refusal::LayoutRequired(_))
+        ));
+        let moved = &preview.placement.diagram.nodes[&f.node];
+        assert_eq!(moved.position.x, 540.);
+        assert!(moved.position.y >= bottom + 10.);
+        assert!(moved.position.y > requested.y);
+        assert_eq!(
+            preview
+                .placement
+                .view
+                .nodes
+                .iter()
+                .find(|n| n.id == owner.id)
+                .unwrap(),
+            owner
+        );
+        let remaining = preview
+            .placement
+            .view
+            .nodes
+            .iter()
+            .find(|n| n.id == sibling_node)
+            .unwrap();
+        assert_eq!(remaining.visual_parent, Some(owner.id));
+        assert_eq!(
+            remaining.position,
+            before.diagrams[&f.diagram].nodes[&sibling_node].position
+        );
+        assert_eq!(
+            &preview.project().relations[&allocation],
+            &before.relations[&allocation]
+        );
+        for (id, node) in &before.diagrams[&f.diagram].nodes {
+            if *id != f.node {
+                assert_eq!(&preview.placement.diagram.nodes[id], node);
+            }
+        }
+        let mut expected = preview.project().clone();
+        expected
+            .diagrams
+            .insert(f.diagram, preview.placement.diagram.clone());
+        assert_eq!(f.app.project(), &before);
+        assert_eq!(f.app.document.bundle(), &source);
+        let _ = f.app.update(release);
+        assert_eq!(f.app.project(), &expected, "{}", f.app.status);
+        assert_eq!(f.app.document.revision(), 1);
+        assert_eq!(
+            validation::effective_performer(f.app.project(), f.work),
+            None
+        );
+        assert_eq!(
+            validation::effective_performer(f.app.project(), sibling),
+            Some(f.a)
+        );
+        assert_eq!(
+            &f.app.project().relations[&allocation],
+            &before.relations[&allocation]
+        );
+        let after = f.app.document.bundle().clone();
+        let _ = f.app.update(Message::Undo);
+        assert_eq!(f.app.project(), &before);
+        assert_eq!(f.app.document.bundle(), &source);
+        assert!(!f.app.document.can_undo());
+        let _ = f.app.update(Message::Redo);
+        assert_eq!(f.app.project(), &expected);
+        assert_eq!(f.app.document.bundle(), &after);
+    }
+}
+
+#[test]
+fn refused_motion_retains_last_scene_but_release_never_commits_it() {
+    let mut f = outgoing_fixture(Layer::Sa);
+    let mut project = f.app.project().clone();
+    let obstacle = project
+        .add_element(Kind::Function, Layer::Sa, "Unrelated work", None)
+        .unwrap();
+    project.place(f.diagram, obstacle, xy(1250., 120.));
+    replace(&mut f, project);
+    let original = f.app.project().clone();
+    let source = f.app.document.bundle().clone();
+    let p = admit_press(&mut f);
+    let clear = screen(xy(450., 225.));
+    let _ = f.app.update(Message::WorkDrag(Event::Preview(
+        p.stamp,
+        p.token,
+        Some(clear),
+    )));
+    let last = f.app.allocation_drag.preview.clone().expect(&f.app.status);
+    // Another work card blocks this location: the prior legal outgoing scene is display
+    // state only, and must not become a fallback command on release.
+    let blocked = screen(xy(1260., 130.));
+    let _ = f.app.update(Message::WorkDrag(Event::Preview(
+        p.stamp,
+        p.token,
+        Some(blocked),
+    )));
+    assert!(f.app.allocation_drag.feedback.as_ref().unwrap().refused);
+    assert!(
+        f.app
+            .allocation_drag
+            .feedback
+            .as_ref()
+            .unwrap()
+            .ghost_delta
+            .is_some()
+    );
+    assert!(Arc::ptr_eq(
+        f.app.allocation_drag.preview.as_ref().unwrap(),
+        &last
+    ));
+    let _ = f.app.update(Message::WorkDrag(Event::Release(
+        p.stamp,
+        p.token,
+        Some(blocked),
+    )));
+    assert_eq!(f.app.project(), &original);
+    assert_eq!(f.app.document.bundle(), &source);
+    assert!(!f.app.document.can_undo());
+    assert!(f.app.allocation_drag.preview.is_none());
+}

crates/oa-desktop/src/app/allocation_drag_tests/control_focus.rs

@@ -0,0 +1,111 @@
+use super::*;
+
+#[tokio::test]
+async fn dirty_selected_pin_outer_ring_keeps_real_name_focus_and_caret() {
+    let mut f = fixture(Layer::Oa);
+    let mut p = f.app.project().clone();
+    let peer = p
+        .add_element(Kind::Activity, Layer::Oa, "Peer", None)
+        .unwrap();
+    p.place(f.diagram, peer, xy(700., 500.));
+    let edge = p.relate(RelationKind::Interaction, "Flow", f.work, peer);
+    let pin = xy(450., 547.);
+    p.diagrams
+        .get_mut(&f.diagram)
+        .unwrap()
+        .routes
+        .push(EdgeRoute {
+            edge,
+            source_attachment: Some(EdgeAttachment {
+                side: PortAnchorSide::Right,
+                offset: 0.5,
+            }),
+            target_attachment: Some(EdgeAttachment {
+                side: PortAnchorSide::Left,
+                offset: 0.5,
+            }),
+            waypoints: vec![pin],
+            label: Some(EdgeLabel {
+                fraction: 0.8,
+                offset: xy(0., -60.),
+            }),
+        });
+    validate_candidate(&p).unwrap();
+    let view = projection::project_view(&p, f.diagram);
+    let routed = routing::route_diagram(&p, &p.diagrams[&f.diagram], &view);
+    assert_eq!(routed.edges[&edge].pins, vec![pin]);
+    assert!(!routed.edges[&edge].custom_suspended);
+    assert!(
+        routed.edges[&edge]
+            .points
+            .iter()
+            .all(|point| point.y == 547.)
+    );
+    f.app = App::with_project(p);
+    f.app.active_diagram = Some(f.diagram);
+    f.app.window_size = iced::Size::new(2000., 1400.);
+    let _ = f.app.update(Message::Select(edge));
+    f.app.reconcile_multiselect();
+    let mut mounted = Mounted::new(&mut f.app).await;
+    f.app.zoom = 1.;
+    f.app.pan = Vector::ZERO;
+    f.app.fit_to_view = false;
+    mounted.settle(&mut f.app).await;
+    let field = name_field(&mut mounted, &f.app);
+    mounted.click(&mut f.app, field.center()).await;
+    mounted
+        .batch(
+            &mut f.app,
+            &[key(keyboard::key::Named::Home)],
+            mouse::Cursor::Unavailable,
+        )
+        .await;
+    type_key(&mut mounted, &mut f.app, "X").await;
+    mounted
+        .batch(
+            &mut f.app,
+            &[key(keyboard::key::Named::ArrowLeft)],
+            mouse::Cursor::Unavailable,
+        )
+        .await;
+    assert_eq!(f.app.draft.as_ref().unwrap().inputs["/name"].raw, "XFlow");
+    assert!(f.app.draft_dirty());
+    let accepted = f.app.document.snapshot();
+    let source = f.app.document.bundle().clone();
+    let selection = f.app.multiselect_snapshot().unwrap();
+    let pan = f.app.pan;
+    // Exposed straight-run bend: outside the 7px line hit, within the 8px handle.
+    let point = at(&mut mounted, &f, xy(pin.x, pin.y + 7.5));
+    let messages = mounted.click(&mut f.app, point).await;
+    assert!(
+        messages
+            .iter()
+            .any(|m| matches!(m, Message::WorkDrag(Event::Refused(..))))
+    );
+    assert!(!messages.iter().any(|m| matches!(
+        m,
+        Message::Pan(_)
+            | Message::Select(_)
+            | Message::SelectNode(_)
+            | Message::MoveNode(..)
+            | Message::Route(_)
+            | Message::DiagramSelection(_)
+    )));
+    assert!(Arc::ptr_eq(&accepted, &f.app.document.snapshot()));
+    assert_eq!(f.app.document.bundle(), &source);
+    assert_eq!(f.app.multiselect_snapshot().unwrap(), selection);
+    assert_eq!(f.app.pan, pan);
+    assert!(
+        is_focused(&mut mounted, &f.app, field),
+        "dirty handle press must stop before outside-press unfocus"
+    );
+    let messages = type_key(&mut mounted, &mut f.app, "Y").await;
+    assert!(
+        messages
+            .iter()
+            .any(|m| matches!(m, Message::Field(path, _) if path == "/name"))
+    );
+    assert_eq!(f.app.draft.as_ref().unwrap().inputs["/name"].raw, "YXFlow");
+    assert_eq!(f.app.document.bundle(), &source);
+    assert!(!f.app.document.can_undo());
+}

crates/oa-desktop/src/app/allocation_drag_tests/group.rs

@@ -0,0 +1,904 @@
+use super::*;
+use crate::app::multiselect::{self, Choice};
+use crate::diagram_usage::Target as SelectionTarget;
+use iced::widget::text_editor;
+
+#[path = "group/connection_lifetime.rs"]
+mod connection_lifetime;
+#[path = "group/route_lifetime.rs"]
+mod route_lifetime;
+
+struct Group {
+    f: Fixture,
+    y: Id,
+    yn: Id,
+    c: Id,
+    cn: Id,
+    an: Id,
+    ax: Id,
+    by: Id,
+}
+
+fn group(layer: Layer) -> Group {
+    let mut f = fixture(layer);
+    let mut p = f.app.project().clone();
+    let y = p
+        .add_element(p.elements[&f.work].kind(), layer, "Y", None)
+        .unwrap();
+    let c = p
+        .add_element(
+            if layer == Layer::Oa {
+                Kind::Actor
+            } else {
+                Kind::SystemActor
+            },
+            layer,
+            "C",
+            None,
+        )
+        .unwrap();
+    let yn = p.place(f.diagram, y, xy(140., 600.));
+    let cn = p.place(f.diagram, c, xy(1500., 100.));
+    let d = p.diagrams.get_mut(&f.diagram).unwrap();
+    d.nodes.get_mut(&f.node).unwrap().position = xy(140., 200.);
+    d.nodes
+        .values_mut()
+        .find(|n| n.element == f.b)
+        .unwrap()
+        .position = xy(100., 500.);
+    d.nodes.get_mut(&cn).unwrap().size = Size {
+        width: 600.,
+        height: 900.,
+    };
+    let an = d.nodes.values().find(|n| n.element == f.a).unwrap().id;
+    let ax = p.relate(
+        RelationKind::Allocation,
+        "Reviewed X responsibility",
+        f.a,
+        f.work,
+    );
+    let by = p.relate(
+        RelationKind::Allocation,
+        "Reviewed Y responsibility",
+        f.b,
+        y,
+    );
+    p.relations.get_mut(&ax).unwrap().description = "Keep X provenance".into();
+    p.relations.get_mut(&by).unwrap().description = "Keep Y provenance".into();
+    validate_candidate(&p).unwrap();
+    f.app = App::with_project(p);
+    f.app.active_diagram = Some(f.diagram);
+    f.app.zoom = 1.;
+    f.app.pan = Vector::ZERO;
+    f.app.fit_to_view = false;
+    f.app.reconcile_multiselect();
+    Group {
+        f,
+        y,
+        yn,
+        c,
+        cn,
+        an,
+        ax,
+        by,
+    }
+}
+
+fn choose(app: &mut App, target: SelectionTarget, choice: Choice) {
+    let context = multiselect::context(app.route_context().unwrap());
+    let _ = app.update(Message::DiagramSelection(multiselect::Event::Choose(
+        context, target, choice,
+    )));
+}
+
+fn select(app: &mut App, ids: &[Id]) {
+    for (i, id) in ids.iter().enumerate() {
+        choose(
+            app,
+            SelectionTarget::Placement(*id),
+            if i == 0 { Choice::Replace } else { Choice::Add },
+        );
+    }
+    assert_eq!(
+        app.diagram_selection.as_ref().unwrap().targets(),
+        &ids.iter()
+            .copied()
+            .map(SelectionTarget::Placement)
+            .collect::<Vec<_>>()
+    );
+}
+
+fn selection(
+    app: &App,
+) -> (
+    Vec<SelectionTarget>,
+    Option<SelectionTarget>,
+    Id,
+    Option<Id>,
+) {
+    let s = app.diagram_selection.as_ref().unwrap();
+    (
+        s.targets().to_vec(),
+        s.primary().cloned(),
+        app.selected,
+        app.selected_node,
+    )
+}
+
+fn node_point(app: &App, node: Id) -> Point {
+    let view = projection::project_view(app.project(), app.active_diagram.unwrap());
+    let n = view.nodes.iter().find(|n| n.id == node).unwrap();
+    screen(xy(n.position.x + 40., n.position.y + 35.))
+}
+
+fn input(app: &mut App, state: &mut CanvasState, event: mouse::Event, at: Point) {
+    if let Some(message) = pointer(&canvas(app), state, event, at) {
+        let _ = app.update(message);
+    }
+}
+
+fn begin(app: &mut App, state: &mut CanvasState, from: Point) -> Arc<Press> {
+    input(
+        app,
+        state,
+        mouse::Event::CursorMoved { position: from },
+        from,
+    );
+    let message = pointer(
+        &canvas(app),
+        state,
+        mouse::Event::ButtonPressed(mouse::Button::Left),
+        from,
+    )
+    .unwrap();
+    let Message::WorkDrag(Event::Press(packet)) = &message else {
+        panic!("Allocation placement must enter its captured lifetime: {message:?}");
+    };
+    let packet = packet.clone();
+    let _ = app.update(message);
+    packet
+}
+
+fn move_pointer(app: &mut App, state: &mut CanvasState, to: Point) {
+    input(app, state, mouse::Event::CursorMoved { position: to }, to);
+}
+
+fn release(app: &mut App, state: &mut CanvasState, to: Point) {
+    input(
+        app,
+        state,
+        mouse::Event::ButtonReleased(mouse::Button::Left),
+        to,
+    );
+}
+
+fn exact_history(
+    app: &mut App,
+    before: &Project,
+    source: &oa_core::source_project::SourceBundle,
+    expected: &Project,
+) {
+    assert_eq!(app.project(), expected);
+    let after = app.document.bundle().clone();
+    let reopened =
+        crate::document::Document::from_bundle(after.clone(), Default::default()).unwrap();
+    assert_eq!(reopened.project(), expected);
+    let _ = app.update(Message::Undo);
+    assert_eq!(app.project(), before);
+    assert_eq!(app.document.bundle(), source);
+    assert!(
+        !app.document.can_undo(),
+        "one group drag is one history step"
+    );
+    let _ = app.update(Message::Redo);
+    assert_eq!(app.project(), expected);
+    assert_eq!(app.document.bundle(), &after);
+    assert!(!app.document.can_redo());
+}
+
+#[test]
+fn completed_text_apply_rejects_old_allocation_packets_without_retiring_a_new_drag() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut g = group(layer);
+        select(&mut g.f.app, &[g.f.node, g.yn]);
+        let before = g.f.app.document.snapshot();
+        assert!(!g.f.app.document.can_undo());
+        let from = node_point(&g.f.app, g.f.node);
+        let mut old_canvas = CanvasState::default();
+        let old = begin(&mut g.f.app, &mut old_canvas, from);
+        assert!(g.f.app.allocation_drag.active.is_some());
+        let location = g.f.app.document.compiled().index.declarations[&g.f.work].clone();
+        let original = &before.bundle.files[&location.path];
+        let quoted_name = format!("\"{}\"", g.f.app.project().elements[&g.f.work].name);
+        assert_eq!(original.matches(quoted_name.as_str()).count(), 1);
+        let edited = original.replace(quoted_name.as_str(), "\"Changed through Text\"");
+        let mut expected = before.decoded.project.clone();
+        expected.elements.get_mut(&g.f.work).unwrap().name = "Changed through Text".into();
+        let mut expected_bundle = before.bundle.clone();
+        expected_bundle
+            .files
+            .insert(location.path.clone(), edited.clone());
+
+        let _ = g.f.app.update(Message::Page(Page::Text));
+        assert!(g.f.app.allocation_drag.active.is_none());
+        let _ = g.f.app.update(Message::SourceFile(location.path));
+        let _ =
+            g.f.app
+                .update(Message::SourceEdit(text_editor::Action::SelectAll));
+        let _ =
+            g.f.app
+                .update(Message::SourceEdit(text_editor::Action::Edit(
+                    text_editor::Edit::Paste(Arc::new(edited.clone())),
+                )));
+        assert!(g.f.app.source_dirty());
+        assert_eq!(g.f.app.source_editor.text(), edited);
+        assert!(Arc::ptr_eq(&before, &g.f.app.document.snapshot()));
+        let _ = g.f.app.update(Message::ApplySource);
+        assert!(!g.f.app.source_dirty(), "{}", g.f.app.status);
+        assert_eq!(g.f.app.project(), &expected);
+        assert_eq!(g.f.app.document.bundle(), &expected_bundle);
+
+        let _ = g.f.app.update(Message::Page(Page::Diagram));
+        assert_eq!(g.f.app.active_diagram, Some(g.f.diagram));
+        select(&mut g.f.app, &[g.f.node, g.yn]);
+        let from = node_point(&g.f.app, g.f.node);
+        let to = from + Vector::new(1400., 0.);
+        let mut current_canvas = CanvasState::default();
+        let current = begin(&mut g.f.app, &mut current_canvas, from);
+        assert_ne!(current.token, old.token);
+        assert_ne!(current.stamp.context, old.stamp.context);
+        move_pointer(&mut g.f.app, &mut current_canvas, to);
+        let preview =
+            g.f.app
+                .allocation_drag
+                .preview
+                .as_ref()
+                .expect(&g.f.app.status)
+                .clone();
+        let Candidate::Assignment(plan) = &preview.candidate else {
+            panic!("the current gesture must be a real group assignment");
+        };
+        assert_eq!(plan.changed_count(), 2);
+        let accepted = g.f.app.document.snapshot();
+        let revision = g.f.app.document.revision();
+        let held = selection(&g.f.app);
+        let selected = g.f.app.multiselect_snapshot().unwrap();
+        let workspace = g.f.app.source_workspace.bundle();
+        let editor = g.f.app.source_editor.text();
+        let camera = (
+            g.f.app.zoom,
+            g.f.app.pan,
+            g.f.app.fit_to_view,
+            g.f.app.canvas_size,
+        );
+        let epochs = (
+            g.f.app.canvas_epoch,
+            g.f.app.camera_epoch,
+            g.f.app.allocation_drag.epoch,
+        );
+        let draft =
+            g.f.app
+                .draft
+                .as_ref()
+                .map(|d| serde_json::to_value(d.recovery_snapshot()).unwrap());
+        let form = g.f.app.behavior.recovery_snapshot();
+        let status = g.f.app.status.clone();
+        let pending_reveal = g.f.app.pending_diagram_reveal.clone();
+        let arrange = g.f.app.allocation_drag.arrange_next;
+        // An idle obsolete press intentionally reports a stale-view explanation.
+        // With a newer real gesture active, both old packets must be fully inert.
+        for event in [
+            Event::Press(old.clone()),
+            Event::Release(old.stamp, old.token, Some(to)),
+        ] {
+            let _ = g.f.app.update(Message::WorkDrag(event));
+            assert!(Arc::ptr_eq(&accepted, &g.f.app.document.snapshot()));
+            assert_eq!(g.f.app.project(), &expected);
+            assert_eq!(g.f.app.document.bundle(), &expected_bundle);
+            assert_eq!(g.f.app.document.revision(), revision);
+            assert_eq!(selection(&g.f.app), held);
+            assert_eq!(g.f.app.multiselect_snapshot(), Some(selected.clone()));
+            assert!(Arc::ptr_eq(
+                &g.f.app.allocation_drag.active.as_ref().unwrap().press,
+                &current
+            ));
+            assert!(Arc::ptr_eq(
+                g.f.app.allocation_drag.preview.as_ref().unwrap(),
+                &preview
+            ));
+            assert_eq!(g.f.app.source_workspace.bundle(), workspace);
+            assert_eq!(g.f.app.source_editor.text(), editor);
+            assert_eq!(
+                (
+                    g.f.app.zoom,
+                    g.f.app.pan,
+                    g.f.app.fit_to_view,
+                    g.f.app.canvas_size
+                ),
+                camera
+            );
+            assert_eq!(
+                (
+                    g.f.app.canvas_epoch,
+                    g.f.app.camera_epoch,
+                    g.f.app.allocation_drag.epoch
+                ),
+                epochs
+            );
+            assert_eq!(
+                g.f.app
+                    .draft
+                    .as_ref()
+                    .map(|d| serde_json::to_value(d.recovery_snapshot()).unwrap()),
+                draft
+            );
+            assert_eq!(g.f.app.behavior.recovery_snapshot(), form);
+            assert_eq!(g.f.app.pending_diagram_reveal, pending_reveal);
+            assert_eq!(g.f.app.allocation_drag.arrange_next, arrange);
+            assert_eq!(g.f.app.status, status);
+            assert!(!g.f.app.source_dirty());
+            assert!(g.f.app.document.can_undo());
+            assert!(!g.f.app.document.can_redo());
+        }
+        // The current gesture remains only a preview. History contains solely
+        // the accepted text rename, never either stale assignment packet.
+        let _ = g.f.app.update(Message::Undo);
+        assert_eq!(g.f.app.project(), &before.decoded.project);
+        assert_eq!(g.f.app.document.bundle(), &before.bundle);
+        assert!(!g.f.app.document.can_undo());
+        assert!(g.f.app.document.can_redo());
+        let _ = g.f.app.update(Message::Redo);
+        assert_eq!(g.f.app.project(), &expected);
+        assert_eq!(g.f.app.document.bundle(), &expected_bundle);
+        assert!(g.f.app.document.can_undo());
+        assert!(!g.f.app.document.can_redo());
+    }
+}
+
+#[test]
+fn group_assignment_split_rebuild_preserves_primary_and_commits_one_complete_candidate() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        for anchor_is_primary in [false, true] {
+            let mut g = group(layer);
+            select(&mut g.f.app, &[g.f.node, g.yn]);
+            let held = selection(&g.f.app);
+            let before = g.f.app.project().clone();
+            let source = g.f.app.document.bundle().clone();
+            let anchor = if anchor_is_primary { g.yn } else { g.f.node };
+            let from = node_point(&g.f.app, anchor);
+            let to = from + Vector::new(1400., 0.);
+            let mut state = CanvasState::default();
+            let packet = begin(&mut g.f.app, &mut state, from);
+            assert_eq!(packet.target, SelectionTarget::Placement(anchor));
+            assert_eq!(
+                selection(&g.f.app),
+                held,
+                "member press must not inspect/collapse"
+            );
+            assert_eq!(g.f.app.document.bundle(), &source);
+            move_pointer(&mut g.f.app, &mut state, to);
+            let preview =
+                g.f.app
+                    .allocation_drag
+                    .preview
+                    .as_ref()
+                    .expect(&g.f.app.status);
+            let Candidate::Assignment(plan) = &preview.candidate else {
+                panic!("group must use combined assignment");
+            };
+            assert_eq!(plan.changed_count(), 2);
+            assert_eq!(plan.already_correct_count(), 0);
+            assert_eq!(selection(&g.f.app), held);
+            assert_eq!(g.f.app.project(), &before, "preview is immutable");
+            release(&mut g.f.app, &mut state, to);
+            let mut expected = before.clone();
+            for (relation, work) in [(g.ax, g.f.work), (g.by, g.y)] {
+                expected.relations.get_mut(&relation).unwrap().body = RelationBody::Allocation {
+                    source: g.c,
+                    target: work,
+                };
+            }
+            let d = expected.diagrams.get_mut(&g.f.diagram).unwrap();
+            d.nodes.get_mut(&g.f.node).unwrap().position = xy(1540., 200.);
+            d.nodes.get_mut(&g.yn).unwrap().position = xy(1540., 600.);
+            assert_eq!(selection(&g.f.app), held);
+            exact_history(&mut g.f.app, &before, &source, &expected);
+        }
+    }
+}
+
+#[test]
+fn group_arrange_work_and_performer_anchors_preserve_every_responsibility() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        for performer_anchor in [false, true] {
+            let mut g = group(layer);
+            select(&mut g.f.app, &[g.an, g.yn]);
+            let held = selection(&g.f.app);
+            let before = g.f.app.project().clone();
+            let source = g.f.app.document.bundle().clone();
+            let _ = g.f.app.update(Message::WorkDrag(Event::ArrangeNext));
+            assert!(g.f.app.allocation_drag.arrange_next);
+            let from = node_point(&g.f.app, if performer_anchor { g.an } else { g.yn });
+            let to = from + Vector::new(400., 0.);
+            let mut state = CanvasState::default();
+            let packet = begin(&mut g.f.app, &mut state, from);
+            assert_eq!(packet.mode, Mode::Arrange);
+            assert!(!g.f.app.allocation_drag.arrange_next);
+            assert_eq!(selection(&g.f.app), held);
+            move_pointer(&mut g.f.app, &mut state, to);
+            assert!(
+                matches!(
+                    g.f.app
+                        .allocation_drag
+                        .preview
+                        .as_ref()
+                        .map(|p| &p.candidate),
+                    Some(Candidate::Arrange(_))
+                ),
+                "{}",
+                g.f.app.status
+            );
+            release(&mut g.f.app, &mut state, to);
+            let mut expected = before.clone();
+            let d = expected.diagrams.get_mut(&g.f.diagram).unwrap();
+            d.nodes.get_mut(&g.an).unwrap().position = xy(500., 100.);
+            d.nodes.get_mut(&g.f.node).unwrap().position = xy(540., 200.);
+            d.nodes.get_mut(&g.yn).unwrap().position = xy(540., 600.);
+            assert_eq!(selection(&g.f.app), held);
+            exact_history(&mut g.f.app, &before, &source, &expected);
+        }
+    }
+}
+
+#[test]
+fn unsupported_group_click_collapses_but_threshold_crossing_never_becomes_click() {
+    for performer_anchor in [false, true] {
+        for distance in [0., 3., 3.25] {
+            let mut g = group(Layer::Oa);
+            select(&mut g.f.app, &[g.an, g.f.node]);
+            let held = selection(&g.f.app);
+            let before = g.f.app.document.snapshot();
+            let anchor = if performer_anchor { g.an } else { g.f.node };
+            let from = node_point(&g.f.app, anchor);
+            let mut state = CanvasState::default();
+            begin(&mut g.f.app, &mut state, from);
+            assert_eq!(selection(&g.f.app), held);
+            move_pointer(&mut g.f.app, &mut state, from + Vector::new(distance, 0.));
+            if distance > 3. {
+                assert!(
+                    g.f.app
+                        .allocation_drag
+                        .feedback
+                        .as_ref()
+                        .is_some_and(|f| f.refused)
+                );
+                assert!(g.f.app.allocation_drag.preview.is_none());
+            }
+            move_pointer(&mut g.f.app, &mut state, from);
+            release(&mut g.f.app, &mut state, from);
+            assert!(g.f.app.allocation_drag.active.is_none());
+            assert!(Arc::ptr_eq(&before, &g.f.app.document.snapshot()));
+            if distance > 3. {
+                assert_eq!(
+                    selection(&g.f.app),
+                    held,
+                    "crossed-and-returned refusal must retain group"
+                );
+            } else {
+                let s = g.f.app.diagram_selection.as_ref().unwrap();
+                assert_eq!(s.targets(), &[SelectionTarget::Placement(anchor)]);
+                assert_eq!(s.primary(), Some(&SelectionTarget::Placement(anchor)));
+            }
+        }
+    }
+}
+
+#[test]
+fn allocation_bare_moves_cannot_bypass_armed_active_or_retired_lifetime() {
+    for (stage, singleton) in (0..3).flat_map(|stage| [(stage, false), (stage, true)]) {
+        let mut g = group(Layer::Oa);
+        let ids = if singleton {
+            vec![g.an]
+        } else {
+            vec![g.an, g.cn]
+        };
+        select(&mut g.f.app, &ids);
+        let snapshot = g.f.app.multiselect_snapshot().unwrap();
+        let held = selection(&g.f.app);
+        let before = g.f.app.document.snapshot();
+        let _ = g.f.app.update(Message::WorkDrag(Event::ArrangeNext));
+        let mut state = CanvasState::default();
+        let from = node_point(&g.f.app, g.an);
+        if stage > 0 {
+            let press = begin(&mut g.f.app, &mut state, from);
+            if stage == 2 {
+                let _ =
+                    g.f.app
+                        .update(Message::WorkDrag(Event::Cancel(press.token)));
+            }
+        }
+        let epoch = g.f.app.allocation_drag.epoch;
+        let armed = g.f.app.allocation_drag.arrange_next;
+        let token =
+            g.f.app
+                .allocation_drag
+                .active
+                .as_ref()
+                .map(|a| a.press.token);
+        let _ = g.f.app.update(Message::MoveNode(g.an, xy(500., 100.)));
+        let _ =
+            g.f.app
+                .update(Message::DiagramSelection(multiselect::Event::Move(
+                    snapshot,
+                    xy(400., 0.),
+                )));
+        assert!(Arc::ptr_eq(&before, &g.f.app.document.snapshot()));
+        assert_eq!(selection(&g.f.app), held);
+        assert_eq!(g.f.app.allocation_drag.epoch, epoch);
+        assert_eq!(g.f.app.allocation_drag.arrange_next, armed);
+        assert_eq!(
+            g.f.app
+                .allocation_drag
+                .active
+                .as_ref()
+                .map(|a| a.press.token),
+            token
+        );
+    }
+    // A fresh ordinary performer gesture still uses the existing layout policy.
+    // C's right edge leaves the viewport: explicit Arrange's header gate must not
+    // accidentally become a new restriction on ordinary performer movement.
+    let mut g = group(Layer::Oa);
+    select(&mut g.f.app, &[g.an, g.cn]);
+    let held = selection(&g.f.app);
+    let before = g.f.app.project().clone();
+    let source = g.f.app.document.bundle().clone();
+    let _ = g.f.app.update(Message::WorkDrag(Event::ArrangeNext));
+    let from = node_point(&g.f.app, g.an);
+    let mut state = CanvasState::default();
+    let old = begin(&mut g.f.app, &mut state, from);
+    let _ = g.f.app.update(Message::WorkDrag(Event::Cancel(old.token)));
+    let mut state = CanvasState::default();
+    let fresh = begin(&mut g.f.app, &mut state, from);
+    assert_eq!(fresh.mode, Mode::Assign);
+    let to = from + Vector::new(300., 0.);
+    move_pointer(&mut g.f.app, &mut state, to);
+    assert!(
+        matches!(
+            g.f.app
+                .allocation_drag
+                .preview
+                .as_ref()
+                .map(|p| &p.candidate),
+            Some(Candidate::Performers(_))
+        ),
+        "{}",
+        g.f.app.status
+    );
+    release(&mut g.f.app, &mut state, to);
+    let mut expected = before.clone();
+    let d = expected.diagrams.get_mut(&g.f.diagram).unwrap();
+    d.nodes.get_mut(&g.an).unwrap().position = xy(400., 100.);
+    d.nodes.get_mut(&g.f.node).unwrap().position = xy(440., 200.);
+    d.nodes.get_mut(&g.cn).unwrap().position = xy(1800., 100.);
+    assert_eq!(selection(&g.f.app), held);
+    exact_history(&mut g.f.app, &before, &source, &expected);
+}
+
+#[test]
+fn idle_group_press_rejects_selection_generation_aba_with_unchanged_other_stamps() {
+    for membership_aba in [false, true] {
+        let mut g = group(Layer::Oa);
+        select(&mut g.f.app, &[g.f.node, g.yn]);
+        let old = press(&g.f);
+        let before = g.f.app.document.snapshot();
+        let held = selection(&g.f.app);
+        let epoch = g.f.app.allocation_drag.epoch;
+        // Deliberately isolate selection generation from App message retirement.
+        // Final selection/primary/context/Document values are unchanged; this
+        // exercises the snapshot boundary, not an ordinary user-input sequence.
+        let s = g.f.app.diagram_selection.as_mut().unwrap();
+        if membership_aba {
+            assert!(s.remove(&SelectionTarget::Placement(g.yn)));
+            assert!(s.add(SelectionTarget::Placement(g.yn), |_| true));
+        } else {
+            assert!(s.set_primary(&SelectionTarget::Placement(g.f.node)));
+            assert!(s.set_primary(&SelectionTarget::Placement(g.yn)));
+        }
+        assert_eq!(selection(&g.f.app), held);
+        assert_eq!(g.f.app.allocation_drag.epoch, epoch);
+        assert_eq!(g.f.app.route_context(), Some(old.stamp.context));
+        let _ = g.f.app.update(Message::WorkDrag(Event::Press(old.clone())));
+        assert!(
+            g.f.app.allocation_drag.active.is_none(),
+            "generation-only stale selection must not acquire input"
+        );
+        let _ = g.f.app.update(Message::WorkDrag(Event::Release(
+            old.stamp,
+            old.token,
+            Some(start(&g.f)),
+        )));
+        assert!(Arc::ptr_eq(&before, &g.f.app.document.snapshot()));
+        assert_eq!(selection(&g.f.app), held);
+    }
+}
+
+#[test]
+fn group_selection_aba_and_old_press_cannot_retire_a_new_token() {
+    let mut g = group(Layer::Oa);
+    select(&mut g.f.app, &[g.f.node, g.yn]);
+    let old = press(&g.f);
+    choose(
+        &mut g.f.app,
+        SelectionTarget::Placement(g.f.node),
+        Choice::Inspect,
+    );
+    choose(
+        &mut g.f.app,
+        SelectionTarget::Placement(g.yn),
+        Choice::Inspect,
+    );
+    let before = g.f.app.document.snapshot();
+    let from = node_point(&g.f.app, g.f.node);
+    let mut state = CanvasState::default();
+    let fresh = begin(&mut g.f.app, &mut state, from);
+    let held = selection(&g.f.app);
+    let epoch = g.f.app.allocation_drag.epoch;
+    let _ = g.f.app.update(Message::WorkDrag(Event::Press(old.clone())));
+    let _ = g.f.app.update(Message::WorkDrag(Event::Release(
+        old.stamp,
+        old.token,
+        Some(from + Vector::new(1400., 0.)),
+    )));
+    assert_eq!(
+        g.f.app
+            .allocation_drag
+            .active
+            .as_ref()
+            .map(|a| a.press.token),
+        Some(fresh.token)
+    );
+    assert_eq!(g.f.app.allocation_drag.epoch, epoch);
+    assert_eq!(selection(&g.f.app), held);
+    assert!(Arc::ptr_eq(&before, &g.f.app.document.snapshot()));
+    release(&mut g.f.app, &mut state, from);
+}
+
+fn unassign(g: &mut Group, inside_c: bool) {
+    let mut project = g.f.app.project().clone();
+    project.relations.remove(&g.ax);
+    project.relations.remove(&g.by);
+    if inside_c {
+        let d = project.diagrams.get_mut(&g.f.diagram).unwrap();
+        // These unassigned cards overlap an unrelated empty performer at the
+        // same depth. Paint C first so the intended work press is visible and
+        // independent of random UUID ordering; no semantic containment exists.
+        let mut target = d.nodes.remove(&g.cn).unwrap();
+        g.cn = Id::from_u128(1);
+        target.id = g.cn;
+        assert!(d.nodes.insert(g.cn, target).is_none());
+        d.nodes.get_mut(&g.f.node).unwrap().position = xy(1540., 200.);
+        d.nodes.get_mut(&g.yn).unwrap().position = xy(1540., 600.);
+    }
+    g.f.app = App::with_project(project);
+    g.f.app.active_diagram = Some(g.f.diagram);
+    g.f.app.zoom = 1.;
+    g.f.app.pan = Vector::ZERO;
+    g.f.app.fit_to_view = false;
+    g.f.app.reconcile_multiselect();
+}
+
+fn c_allocations(expected: &mut Project, g: &Group, ids: &BTreeMap<Id, Id>) {
+    for (work, name, alias) in [
+        (g.f.work, "C performs Work", "c_performs_work"),
+        (g.y, "C performs Y", "c_performs_y"),
+    ] {
+        expected.relations.insert(
+            ids[&work],
+            Relation {
+                id: ids[&work],
+                alias: alias.into(),
+                name: name.into(),
+                description: String::new(),
+                body: RelationBody::Allocation {
+                    source: g.c,
+                    target: work,
+                },
+            },
+        );
+    }
+}
+
+#[test]
+fn group_out_and_back_assigns_at_zero_delta_then_true_noop_preserves_redo() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut g = group(layer);
+        unassign(&mut g, true);
+        select(&mut g.f.app, &[g.f.node, g.yn]);
+        let held = selection(&g.f.app);
+        let before = g.f.app.project().clone();
+        let source = g.f.app.document.bundle().clone();
+        let from = node_point(&g.f.app, g.f.node);
+        let mut state = CanvasState::default();
+        let press = begin(&mut g.f.app, &mut state, from);
+        assert_eq!(press.target, SelectionTarget::Placement(g.f.node));
+        assert_eq!(selection(&g.f.app), held);
+        move_pointer(&mut g.f.app, &mut state, from + Vector::new(4., 0.));
+        let preview =
+            g.f.app
+                .allocation_drag
+                .preview
+                .as_ref()
+                .expect(&g.f.app.status);
+        assert_eq!(preview.placement.delta, xy(0., 0.));
+        let Candidate::Assignment(candidate) = &preview.candidate else {
+            panic!("exact work group must preview assignment");
+        };
+        assert_eq!(candidate.destination(), plan::Destination::Performer(g.c));
+        assert_eq!(candidate.changed_count(), 2);
+        let ids: BTreeMap<_, _> = preview
+            .project()
+            .relations
+            .values()
+            .filter(|r| r.kind() == RelationKind::Allocation)
+            .map(|r| (r.target(), r.id))
+            .collect();
+        assert_eq!(ids.len(), 2);
+        move_pointer(&mut g.f.app, &mut state, from);
+        release(&mut g.f.app, &mut state, from);
+        let mut expected = before.clone();
+        c_allocations(&mut expected, &g, &ids);
+        assert_eq!(selection(&g.f.app), held);
+        exact_history(&mut g.f.app, &before, &source, &expected);
+        g.f.app
+            .document
+            .execute(Command::Describe(g.y, "Future rationale".into()))
+            .unwrap();
+        g.f.app.sync();
+        let future = g.f.app.document.bundle().clone();
+        let _ = g.f.app.update(Message::Undo);
+        assert!(g.f.app.document.can_undo() && g.f.app.document.can_redo());
+        let snapshot = g.f.app.document.snapshot();
+        let revision = g.f.app.document.revision();
+        let held = selection(&g.f.app);
+        let from = node_point(&g.f.app, g.f.node);
+        let mut state = CanvasState::default();
+        begin(&mut g.f.app, &mut state, from);
+        move_pointer(&mut g.f.app, &mut state, from + Vector::new(4., 0.));
+        move_pointer(&mut g.f.app, &mut state, from);
+        release(&mut g.f.app, &mut state, from);
+        assert!(
+            Arc::ptr_eq(&snapshot, &g.f.app.document.snapshot()),
+            "{}",
+            g.f.app.status
+        );
+        assert_eq!(g.f.app.document.revision(), revision);
+        assert_eq!(selection(&g.f.app), held);
+        assert!(g.f.app.document.can_undo() && g.f.app.document.can_redo());
+        let _ = g.f.app.update(Message::Redo);
+        assert_eq!(g.f.app.document.bundle(), &future);
+    }
+}
+
+#[test]
+fn group_source_refusal_retains_primary_source_and_both_history_paths() {
+    let mut g = group(Layer::Oa);
+    unassign(&mut g, false);
+    let source = g.f.app.document.bundle().clone();
+    let mut limits = oa_core::source_project::ProjectLimits::default();
+    limits.model.max_source_bytes = source.files.values().map(String::len).sum::<usize>() + 128;
+    g.f.app.document = crate::document::Document::from_bundle(source, limits).unwrap();
+    g.f.app
+        .document
+        .execute(Command::Describe(g.f.work, "Reviewed".into()))
+        .unwrap();
+    g.f.app
+        .document
+        .execute(Command::Rename(g.y, "Future Y".into()))
+        .unwrap();
+    let future = g.f.app.document.bundle().clone();
+    assert!(g.f.app.document.undo());
+    g.f.app.sync();
+    g.f.app.reconcile_multiselect();
+    select(&mut g.f.app, &[g.f.node, g.yn]);
+    let held = selection(&g.f.app);
+    let before = g.f.app.document.snapshot();
+    let source = g.f.app.document.bundle().clone();
+    let revision = g.f.app.document.revision();
+    assert!(g.f.app.document.can_undo() && g.f.app.document.can_redo());
+    let from = node_point(&g.f.app, g.f.node);
+    let to = from + Vector::new(1400., 0.);
+    let mut state = CanvasState::default();
+    begin(&mut g.f.app, &mut state, from);
+    move_pointer(&mut g.f.app, &mut state, to);
+    assert!(
+        g.f.app.allocation_drag.preview.is_some(),
+        "geometry and semantics pass before source refusal: {}",
+        g.f.app.status
+    );
+    release(&mut g.f.app, &mut state, to);
+    assert!(g.f.app.status.contains("retry"), "{}", g.f.app.status);
+    assert!(g.f.app.allocation_drag.active.is_none());
+    assert!(Arc::ptr_eq(&before, &g.f.app.document.snapshot()));
+    assert_eq!(g.f.app.document.bundle(), &source);
+    assert_eq!(g.f.app.document.revision(), revision);
+    assert_eq!(selection(&g.f.app), held);
+    assert!(g.f.app.document.can_undo() && g.f.app.document.can_redo());
+    let _ = g.f.app.update(Message::Redo);
+    assert_eq!(g.f.app.document.bundle(), &future);
+    let _ = g.f.app.update(Message::Undo);
+    assert_eq!(g.f.app.document.bundle(), &source);
+}
+
+#[test]
+fn ordinary_off_grid_performer_out_and_back_is_noop_with_redo() {
+    for singleton in [false, true] {
+        let mut g = group(Layer::Oa);
+        let mut project = g.f.app.project().clone();
+        project
+            .diagrams
+            .get_mut(&g.f.diagram)
+            .unwrap()
+            .nodes
+            .get_mut(&g.an)
+            .unwrap()
+            .position = xy(103., 107.);
+        g.f.app = App::with_project(project);
+        g.f.app.active_diagram = Some(g.f.diagram);
+        g.f.app.zoom = 1.;
+        g.f.app.pan = Vector::ZERO;
+        g.f.app.fit_to_view = false;
+        g.f.app
+            .document
+            .execute(Command::Describe(g.f.work, "Reviewed".into()))
+            .unwrap();
+        g.f.app
+            .document
+            .execute(Command::Describe(g.y, "Future".into()))
+            .unwrap();
+        let future = g.f.app.document.bundle().clone();
+        assert!(g.f.app.document.undo());
+        g.f.app.sync();
+        g.f.app.reconcile_multiselect();
+        select(
+            &mut g.f.app,
+            &if singleton {
+                vec![g.an]
+            } else {
+                vec![g.an, g.cn]
+            },
+        );
+        let held = selection(&g.f.app);
+        let before = g.f.app.document.snapshot();
+        let source = g.f.app.document.bundle().clone();
+        let revision = g.f.app.document.revision();
+        let from = node_point(&g.f.app, g.an);
+        let mut state = CanvasState::default();
+        begin(&mut g.f.app, &mut state, from);
+        move_pointer(&mut g.f.app, &mut state, from + Vector::new(20., 0.));
+        assert!(
+            g.f.app.allocation_drag.preview.is_some(),
+            "{}",
+            g.f.app.status
+        );
+        move_pointer(&mut g.f.app, &mut state, from);
+        assert_eq!(
+            g.f.app
+                .allocation_drag
+                .preview
+                .as_ref()
+                .unwrap()
+                .placement
+                .delta,
+            xy(0., 0.)
+        );
+        release(&mut g.f.app, &mut state, from);
+        assert!(Arc::ptr_eq(&before, &g.f.app.document.snapshot()));
+        assert_eq!(g.f.app.document.bundle(), &source);
+        assert_eq!(g.f.app.document.revision(), revision);
+        assert_eq!(selection(&g.f.app), held);
+        assert!(g.f.app.document.can_undo() && g.f.app.document.can_redo());
+        let _ = g.f.app.update(Message::Redo);
+        assert_eq!(g.f.app.document.bundle(), &future);
+    }
+}

crates/oa-desktop/src/app/allocation_drag_tests/group/connection_lifetime.rs

@@ -0,0 +1,292 @@
+//! Delayed captured drawing packets must not retire a newer Allocation owner.
+use super::*;
+use crate::connection_edit::Event as ConnectionEvent;
+use crate::connection_tool::Tool;
+
+fn drawing_tool(layer: Layer) -> Tool {
+    match layer {
+        Layer::Oa => Tool::Interaction,
+        Layer::Sa => Tool::FunctionalExchange,
+    }
+}
+
+fn drawing_source(g: &mut Group, layer: Layer) -> crate::route_edit::Context {
+    let _ =
+        g.f.app
+            .update(Message::Connection(ConnectionEvent::Choose(Some(
+                drawing_tool(layer),
+            ))));
+    let context = g.f.app.route_context().unwrap();
+    let _ =
+        g.f.app
+            .update(Message::Connection(ConnectionEvent::Endpoint(
+                context, g.f.work,
+            )));
+    let session = g.f.app.connection.as_ref().unwrap();
+    assert_eq!(session.context, context);
+    assert_eq!(session.source, Some(g.f.work));
+    assert!(session.candidates.contains(&g.y));
+    assert_eq!(g.f.app.route_context(), Some(context));
+    context
+}
+
+fn assert_captured_noop(app: &mut App, captured: crate::route_edit::Context, target: Id) {
+    for event in [
+        ConnectionEvent::Endpoint(captured, target),
+        ConnectionEvent::Restart(captured),
+    ] {
+        assert_connection_noop(app, event);
+    }
+}
+
+fn assert_connection_noop(app: &mut App, event: ConnectionEvent) {
+    let document = app.document.snapshot();
+    let selected = selection(app);
+    let context = app.route_context();
+    let camera = (app.pan, app.zoom, app.canvas_epoch, app.camera_epoch);
+    let ownership = (app.allocation_drag.epoch, app.allocation_drag.arrange_next);
+    let active = app
+        .allocation_drag
+        .active
+        .as_ref()
+        .map(|a| (a.press.clone(), a.crossed, a.cache.len()));
+    let preview = app.allocation_drag.preview.as_ref().map(|p| {
+        (
+            p.token,
+            p.placement.diagram.clone(),
+            p.placement.delta,
+            p.project().clone(),
+            p.routed.clone(),
+        )
+    });
+    let feedback = app.allocation_drag.feedback.as_ref().map(|f| {
+        (
+            f.press.token,
+            f.text.clone(),
+            f.refused,
+            f.targets.clone(),
+            f.inspection_targets.clone(),
+        )
+    });
+    let connection = |app: &App| {
+        app.connection
+            .as_ref()
+            .map(|s| (s.context, s.tool, s.source, s.candidates.clone()))
+    };
+    let session = connection(app);
+    let interaction = app.source_symbols.interaction;
+    let status = app.status.clone();
+    let _ = app.update(Message::Connection(event));
+    assert_eq!(selection(app), selected);
+    assert_eq!(app.route_context(), context);
+    assert_eq!(
+        (app.pan, app.zoom, app.canvas_epoch, app.camera_epoch),
+        camera
+    );
+    assert_eq!(
+        (app.allocation_drag.epoch, app.allocation_drag.arrange_next),
+        ownership,
+        "rejected drawing packet must not retire the newer input owner"
+    );
+    match (active, app.allocation_drag.active.as_ref()) {
+        (Some((press, crossed, cached)), Some(current)) => {
+            assert!(Arc::ptr_eq(&press, &current.press));
+            assert_eq!((current.crossed, current.cache.len()), (crossed, cached));
+        }
+        (None, None) => {}
+        _ => panic!("rejected drawing packet changed the active Allocation token"),
+    }
+    match (preview, app.allocation_drag.preview.as_ref()) {
+        (Some((token, diagram, delta, project, routed)), Some(current)) => {
+            assert_eq!(current.token, token);
+            assert_eq!(current.placement.diagram, diagram);
+            assert_eq!(current.placement.delta, delta);
+            assert_eq!(current.project(), &project);
+            assert!(Arc::ptr_eq(&current.routed, &routed));
+        }
+        (None, None) => {}
+        _ => panic!("rejected drawing packet changed the Allocation preview"),
+    }
+    assert_eq!(
+        app.allocation_drag.feedback.as_ref().map(|f| (
+            f.press.token,
+            f.text.clone(),
+            f.refused,
+            f.targets.clone(),
+            f.inspection_targets.clone(),
+        )),
+        feedback
+    );
+    assert_eq!(connection(app), session);
+    assert_eq!(app.source_symbols.interaction, interaction);
+    assert_eq!(app.status, status);
+    assert!(Arc::ptr_eq(&document, &app.document.snapshot()));
+    assert_eq!(app.source_workspace.bundle(), document.bundle);
+}
+
+#[test]
+fn captured_connection_after_cancel_preserves_arrange_arm_and_live_group() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut g = group(layer);
+        let old = drawing_source(&mut g, layer);
+        let _ = g.f.app.update(Message::Escape);
+        assert!(g.f.app.connection.is_none());
+        select(&mut g.f.app, &[g.an, g.yn]);
+        let _ = g.f.app.update(Message::WorkDrag(Event::ArrangeNext));
+        assert!(g.f.app.allocation_drag.arrange_next);
+        let current = g.f.app.route_context().unwrap();
+        assert_captured_noop(&mut g.f.app, old, g.y);
+        // Matching context with no session isolates the missing-owner guard.
+        assert_captured_noop(&mut g.f.app, current, g.y);
+
+        let before = g.f.app.project().clone();
+        let source = g.f.app.document.bundle().clone();
+        let held = selection(&g.f.app);
+        let from = node_point(&g.f.app, g.an);
+        let to = from + Vector::new(400., 0.);
+        let mut state = CanvasState::default();
+        let press = begin(&mut g.f.app, &mut state, from);
+        assert_eq!(press.mode, Mode::Arrange);
+        assert!(!g.f.app.allocation_drag.arrange_next);
+        move_pointer(&mut g.f.app, &mut state, to);
+        assert!(matches!(
+            g.f.app
+                .allocation_drag
+                .preview
+                .as_ref()
+                .map(|p| &p.candidate),
+            Some(Candidate::Arrange(_))
+        ));
+        let current = g.f.app.route_context().unwrap();
+        assert_captured_noop(&mut g.f.app, old, g.y);
+        assert_captured_noop(&mut g.f.app, current, g.y);
+        release(&mut g.f.app, &mut state, to);
+        let mut expected = before.clone();
+        let diagram = expected.diagrams.get_mut(&g.f.diagram).unwrap();
+        diagram.nodes.get_mut(&g.an).unwrap().position = xy(500., 100.);
+        diagram.nodes.get_mut(&g.f.node).unwrap().position = xy(540., 200.);
+        diagram.nodes.get_mut(&g.yn).unwrap().position = xy(540., 600.);
+        assert_eq!(selection(&g.f.app), held);
+        exact_history(&mut g.f.app, &before, &source, &expected);
+    }
+}
+
+#[test]
+fn captured_connection_context_mismatches_preserve_the_current_session() {
+    let mut g = group(Layer::Oa);
+    let current = drawing_source(&mut g, Layer::Oa);
+    // Session and current context agree: each old captured field is the sole
+    // invalid relationship, not hidden behind a missing session.
+    for captured in [
+        crate::route_edit::Context {
+            document: Id::new_v4(),
+            ..current
+        },
+        crate::route_edit::Context {
+            diagram: Id::new_v4(),
+            ..current
+        },
+        crate::route_edit::Context {
+            revision: current.revision + 1,
+            ..current
+        },
+        crate::route_edit::Context {
+            epoch: current.epoch + 1,
+            ..current
+        },
+    ] {
+        assert_eq!(g.f.app.connection.as_ref().unwrap().context, current);
+        assert_captured_noop(&mut g.f.app, captured, g.y);
+    }
+    // Captured/session contexts agree, but the rendered view has advanced.
+    // This isolates the live-route predicate from session ownership.
+    g.f.app.canvas_epoch += 1;
+    assert_ne!(g.f.app.route_context(), Some(current));
+    assert_eq!(g.f.app.connection.as_ref().unwrap().context, current);
+    assert_captured_noop(&mut g.f.app, current, g.y);
+    g.f.app.canvas_epoch = current.epoch;
+
+    // Conversely, incoming/current contexts agree. Retain obsolete session
+    // metadata explicitly to isolate the session-context admission branch.
+    g.f.app.connection.as_mut().unwrap().context.epoch += 1;
+    assert_eq!(g.f.app.route_context(), Some(current));
+    assert_captured_noop(&mut g.f.app, current, g.y);
+}
+
+#[test]
+fn captured_connection_current_restart_and_pair_commit_after_tool_boundary() {
+    for begin_tool in [false, true] {
+        let mut g = group(Layer::Oa);
+        select(&mut g.f.app, &[g.an, g.yn]);
+        let _ = g.f.app.update(Message::WorkDrag(Event::ArrangeNext));
+        let from = node_point(&g.f.app, g.an);
+        let mut state = CanvasState::default();
+        begin(&mut g.f.app, &mut state, from);
+        move_pointer(&mut g.f.app, &mut state, from + Vector::new(400., 0.));
+        assert!(g.f.app.allocation_drag.preview.is_some());
+        let before = g.f.app.project().clone();
+        let source = g.f.app.document.bundle().clone();
+        let epoch = g.f.app.allocation_drag.epoch;
+        let event = if begin_tool {
+            ConnectionEvent::Begin(Tool::Interaction, g.f.work)
+        } else {
+            ConnectionEvent::Choose(Some(Tool::Interaction))
+        };
+        let _ = g.f.app.update(Message::Connection(event));
+        assert!(g.f.app.allocation_drag.epoch > epoch);
+        assert!(g.f.app.allocation_drag.active.is_none());
+        assert!(g.f.app.allocation_drag.preview.is_none());
+        assert!(!g.f.app.allocation_drag.arrange_next);
+        let context = g.f.app.route_context().unwrap();
+        if !begin_tool {
+            let _ =
+                g.f.app
+                    .update(Message::Connection(ConnectionEvent::Endpoint(
+                        context, g.f.work,
+                    )));
+        }
+        assert_eq!(g.f.app.connection.as_ref().unwrap().source, Some(g.f.work));
+        assert!(
+            g.f.app
+                .connection
+                .as_ref()
+                .unwrap()
+                .candidates
+                .contains(&g.y)
+        );
+        let document = g.f.app.document.snapshot();
+        let _ =
+            g.f.app
+                .update(Message::Connection(ConnectionEvent::Restart(context)));
+        let context = g.f.app.route_context().unwrap();
+        let restarted = g.f.app.connection.as_ref().unwrap();
+        assert_eq!(restarted.context, context);
+        assert_eq!(restarted.tool, Tool::Interaction);
+        assert_eq!(restarted.source, None);
+        assert!(restarted.candidates.contains(&g.f.work));
+        assert!(Arc::ptr_eq(&document, &g.f.app.document.snapshot()));
+        let _ =
+            g.f.app
+                .update(Message::Connection(ConnectionEvent::Endpoint(
+                    context, g.f.work,
+                )));
+        assert_eq!(g.f.app.connection.as_ref().unwrap().source, Some(g.f.work));
+        let revision = g.f.app.document.revision();
+        let _ =
+            g.f.app
+                .update(Message::Connection(ConnectionEvent::Endpoint(context, g.y)));
+        assert!(g.f.app.connection.is_none());
+        assert_eq!(g.f.app.document.revision(), revision + 1);
+        let relation = &g.f.app.project().relations[&g.f.app.selected];
+        assert_eq!(relation.kind(), RelationKind::Interaction);
+        assert_eq!((relation.source(), relation.target()), (g.f.work, g.y));
+        let mut expected = before.clone();
+        assert!(
+            expected
+                .relations
+                .insert(relation.id, relation.clone())
+                .is_none()
+        );
+        exact_history(&mut g.f.app, &before, &source, &expected);
+    }
+}

crates/oa-desktop/src/app/allocation_drag_tests/group/route_lifetime.rs

@@ -0,0 +1,274 @@
+//! Captured route commits cannot retire a newer Allocation input owner.
+use super::*;
+use crate::route_edit::{Context, Event as RouteEvent};
+
+fn routed_group() -> (Group, Id) {
+    let mut g = group(Layer::Oa);
+    let mut project = g.f.app.project().clone();
+    let edge = project.relate(
+        RelationKind::Interaction,
+        "Reviewed exchange",
+        g.f.work,
+        g.y,
+    );
+    project
+        .diagrams
+        .get_mut(&g.f.diagram)
+        .unwrap()
+        .routes
+        .push(EdgeRoute {
+            edge,
+            waypoints: vec![xy(700., 400.)],
+            label: Some(EdgeLabel {
+                fraction: 0.4,
+                offset: xy(5., 10.),
+            }),
+            source_attachment: None,
+            target_attachment: Some(EdgeAttachment {
+                side: PortAnchorSide::Left,
+                offset: 0.6,
+            }),
+        });
+    validate_candidate(&project).unwrap();
+    g.f.app = App::with_project(project);
+    g.f.app.active_diagram = Some(g.f.diagram);
+    g.f.app.zoom = 1.;
+    g.f.app.pan = Vector::ZERO;
+    g.f.app.fit_to_view = false;
+    choose(&mut g.f.app, SelectionTarget::Edge(edge), Choice::Replace);
+    assert_eq!(g.f.app.selected, edge);
+    let view = projection::project_view(g.f.app.project(), g.f.diagram);
+    assert!(view.edges.iter().any(|e| e.id == edge));
+    assert_eq!(
+        crate::route_edit::attachment_node(
+            g.f.app.project(),
+            &g.f.app.project().diagrams[&g.f.diagram],
+            &view,
+            edge,
+            EdgeEnd::Source,
+        )
+        .unwrap()
+        .id,
+        g.f.node
+    );
+    (g, edge)
+}
+
+fn packet(g: &Group, edge: Id, captured: Context, attachment: bool) -> RouteEvent {
+    let mut route =
+        crate::route_edit::stored_route(&g.f.app.project().diagrams[&g.f.diagram], edge);
+    if attachment {
+        route.source_attachment = Some(EdgeAttachment {
+            side: PortAnchorSide::Top,
+            offset: 0.25,
+        });
+        RouteEvent::CommitAttachment(captured, route, EdgeEnd::Source, g.f.node)
+    } else {
+        route.waypoints[0] = xy(750., 450.);
+        RouteEvent::Commit(captured, route, Some(0))
+    }
+}
+
+fn assert_route_noop(app: &mut App, event: RouteEvent) {
+    let document = app.document.snapshot();
+    let selected = selection(app);
+    let context = app.route_context();
+    let camera = (app.pan, app.zoom, app.canvas_epoch, app.camera_epoch);
+    let ownership = (app.allocation_drag.epoch, app.allocation_drag.arrange_next);
+    let press = app.allocation_drag.active.as_ref().map(|a| a.press.clone());
+    let preview = app.allocation_drag.preview.clone();
+    let feedback = app.allocation_drag.feedback.as_ref().map(|f| {
+        (
+            f.press.token,
+            f.text.clone(),
+            f.refused,
+            f.targets.clone(),
+            f.inspection_targets.clone(),
+        )
+    });
+    let handles = (app.selected_bend, app.selected_attachment);
+    let interaction = app.source_symbols.interaction;
+    let status = app.status.clone();
+    let _ = app.update(Message::Route(event));
+    assert_eq!(selection(app), selected);
+    assert_eq!(app.route_context(), context);
+    assert_eq!(
+        (app.pan, app.zoom, app.canvas_epoch, app.camera_epoch),
+        camera
+    );
+    assert_eq!(
+        (app.allocation_drag.epoch, app.allocation_drag.arrange_next),
+        ownership
+    );
+    match (press, app.allocation_drag.active.as_ref()) {
+        (Some(before), Some(after)) => assert!(Arc::ptr_eq(&before, &after.press)),
+        (None, None) => {}
+        _ => panic!("stale route packet changed the active Allocation token"),
+    }
+    match (preview, app.allocation_drag.preview.as_ref()) {
+        (Some(before), Some(after)) => assert!(Arc::ptr_eq(&before, after)),
+        (None, None) => {}
+        _ => panic!("stale route packet changed the Allocation preview"),
+    }
+    assert_eq!(
+        app.allocation_drag.feedback.as_ref().map(|f| (
+            f.press.token,
+            f.text.clone(),
+            f.refused,
+            f.targets.clone(),
+            f.inspection_targets.clone(),
+        )),
+        feedback
+    );
+    assert_eq!((app.selected_bend, app.selected_attachment), handles);
+    assert_eq!(app.source_symbols.interaction, interaction);
+    assert_eq!(app.status, status);
+    assert!(Arc::ptr_eq(&document, &app.document.snapshot()));
+    assert_eq!(app.source_workspace.bundle(), document.bundle);
+}
+
+fn stale_route_preserves_new_group(attachment: bool, escape: bool) {
+    let (mut g, edge) = routed_group();
+    let old = g.f.app.route_context().unwrap();
+    let delayed = packet(&g, edge, old, attachment);
+    if escape {
+        let _ = g.f.app.update(Message::Escape);
+        assert_ne!(g.f.app.route_context(), Some(old));
+    }
+    select(&mut g.f.app, &[g.an, g.yn]);
+    let _ = g.f.app.update(Message::WorkDrag(Event::ArrangeNext));
+    assert!(g.f.app.allocation_drag.arrange_next);
+    if !escape {
+        assert_eq!(g.f.app.route_context(), Some(old));
+        assert_ne!(g.f.app.selected, edge);
+    }
+    assert_route_noop(&mut g.f.app, delayed.clone());
+    let before = g.f.app.project().clone();
+    let source = g.f.app.document.bundle().clone();
+    let selected = selection(&g.f.app);
+    let from = node_point(&g.f.app, g.an);
+    let to = from + Vector::new(400., 0.);
+    let mut state = CanvasState::default();
+    let press = begin(&mut g.f.app, &mut state, from);
+    assert_eq!(press.mode, Mode::Arrange);
+    move_pointer(&mut g.f.app, &mut state, to);
+    assert!(g.f.app.allocation_drag.preview.is_some());
+    if !escape {
+        assert_eq!(g.f.app.route_context(), Some(old));
+        assert_ne!(g.f.app.selected, edge);
+    }
+    assert_route_noop(&mut g.f.app, delayed);
+    release(&mut g.f.app, &mut state, to);
+    let mut expected = before.clone();
+    let diagram = expected.diagrams.get_mut(&g.f.diagram).unwrap();
+    diagram.nodes.get_mut(&g.an).unwrap().position = xy(500., 100.);
+    diagram.nodes.get_mut(&g.f.node).unwrap().position = xy(540., 200.);
+    diagram.nodes.get_mut(&g.yn).unwrap().position = xy(540., 600.);
+    // Both endpoint placements move by (400, 0); the saved pin follows once,
+    // while label offset and endpoint attachment settings stay unchanged.
+    diagram
+        .routes
+        .iter_mut()
+        .find(|r| r.edge == edge)
+        .unwrap()
+        .waypoints = vec![xy(1100., 400.)];
+    assert_eq!(selection(&g.f.app), selected);
+    exact_history(&mut g.f.app, &before, &source, &expected);
+}
+
+#[test]
+fn stale_route_commit_preserves_arrange_arm_and_live_group() {
+    stale_route_preserves_new_group(false, true);
+}
+
+#[test]
+fn stale_route_attachment_preserves_arrange_arm_and_live_group() {
+    stale_route_preserves_new_group(true, true);
+}
+
+#[test]
+fn same_context_route_commit_after_selection_preserves_arrange_arm_and_live_group() {
+    stale_route_preserves_new_group(false, false);
+}
+
+#[test]
+fn same_context_route_attachment_after_selection_preserves_arrange_arm_and_live_group() {
+    stale_route_preserves_new_group(true, false);
+}
+
+#[test]
+fn captured_route_context_fields_independently_reject_before_retirement() {
+    for attachment in [false, true] {
+        let (mut g, edge) = routed_group();
+        let current = g.f.app.route_context().unwrap();
+        // The selected edge and route payload are valid. Each capture mismatch
+        // is isolated; no nonexistent route session can mask admission.
+        for captured in [
+            Context {
+                document: Id::new_v4(),
+                ..current
+            },
+            Context {
+                diagram: Id::new_v4(),
+                ..current
+            },
+            Context {
+                revision: current.revision + 1,
+                ..current
+            },
+            Context {
+                epoch: current.epoch + 1,
+                ..current
+            },
+        ] {
+            let event = packet(&g, edge, captured, attachment);
+            assert_route_noop(&mut g.f.app, event);
+        }
+        // Hold the captured packet fixed and advance the live context instead.
+        let event = packet(&g, edge, current, attachment);
+        g.f.app.canvas_epoch += 1;
+        assert_route_noop(&mut g.f.app, event.clone());
+        g.f.app.canvas_epoch = current.epoch;
+        g.f.app.active_diagram = None;
+        assert_route_noop(&mut g.f.app, event);
+    }
+}
+
+#[test]
+fn current_route_commits_without_session_preserve_exact_route_history() {
+    for attachment in [false, true] {
+        let (mut g, edge) = routed_group();
+        let current = g.f.app.route_context().unwrap();
+        let event = packet(&g, edge, current, attachment);
+        let before = g.f.app.project().clone();
+        let source = g.f.app.document.bundle().clone();
+        let revision = g.f.app.document.revision();
+        assert!(g.f.app.connection.is_none());
+        assert!(g.f.app.selected_attachment.is_none());
+        let _ = g.f.app.update(Message::Route(event));
+        assert_eq!(g.f.app.document.revision(), revision + 1);
+        assert_eq!(g.f.app.selected, edge);
+        assert_eq!(
+            g.f.app.selected_bend,
+            if attachment { None } else { Some((edge, 0)) }
+        );
+        let mut expected = before.clone();
+        let route = expected
+            .diagrams
+            .get_mut(&g.f.diagram)
+            .unwrap()
+            .routes
+            .iter_mut()
+            .find(|r| r.edge == edge)
+            .unwrap();
+        if attachment {
+            route.source_attachment = Some(EdgeAttachment {
+                side: PortAnchorSide::Top,
+                offset: 0.25,
+            });
+        } else {
+            route.waypoints = vec![xy(750., 450.)];
+        }
+        exact_history(&mut g.f.app, &before, &source, &expected);
+    }
+}

crates/oa-desktop/src/app/allocation_drag_tests/navigation_union.rs

@@ -161,7 +161,7 @@ fn stale_gesture_packets_preserve_navigation_and_a_new_live_cancel_still_works()
         .update(Message::WorkDrag(Event::Cancel(current.token)));
     assert!(f.app.allocation_drag.active.is_none());
     assert!(f.app.allocation_drag.epoch > epoch);
-    assert_eq!(f.app.status, "Work drag canceled");
+    assert_eq!(f.app.status, "Drag canceled");
     assert!(Arc::ptr_eq(&before, &f.app.document.snapshot()));
     assert_eq!(f.app.source_workspace.bundle(), before.bundle);
 }

crates/oa-desktop/src/app/architecture_authoring.rs

@@ -27,30 +27,11 @@ pub enum Event {
     Cancel,
 }
 
-pub fn subscription(app: &App) -> Subscription<Message> {
-    if app.architecture.as_ref().is_some_and(State::inline) {
-        iced::event::listen_with(captured_escape)
-    } else {
-        Subscription::none()
-    }
-}
-
-fn captured_escape(
-    event: iced::Event,
-    status: iced::event::Status,
-    _: iced::window::Id,
-) -> Option<Message> {
-    // A focused Iced text input captures Escape while dropping its focus. Only
-    // inline architecture naming opts into also cancelling that same keypress.
-    (status == iced::event::Status::Captured
-        && matches!(
-            event,
-            iced::Event::Keyboard(iced::keyboard::Event::KeyPressed {
-                key: iced::keyboard::Key::Named(iced::keyboard::key::Named::Escape),
-                ..
-            })
-        ))
-    .then_some(Message::Architecture(Event::CapturedEscape))
+pub(super) fn captured_escape_message(app: &App) -> Option<Message> {
+    app.architecture
+        .as_ref()
+        .is_some_and(State::inline)
+        .then_some(Message::Architecture(Event::CapturedEscape))
 }
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
@@ -138,7 +119,7 @@ pub fn validate_saved(p: &Project, s: &Saved) -> Result<(), String> {
         .diagrams
         .get(&s.diagram)
         .ok_or("The creation draft's diagram is missing.")?;
-    if matches!(d.projection, ProjectionKind::StateMachine { .. })
+    if !d.projection.is_architecture()
         || s.query.len() > 16384
         || s.page > 1_000_000
         || s.point
@@ -180,7 +161,7 @@ pub fn validate_saved(p: &Project, s: &Saved) -> Result<(), String> {
 }
 fn context_kinds(p: &Project, d: &Diagram) -> Vec<Kind> {
     let mut values = match (d.layer, d.projection) {
-        (_, ProjectionKind::StateMachine { .. }) => vec![],
+        (_, ProjectionKind::StateMachine { .. } | ProjectionKind::Scenario { .. }) => vec![],
         (Layer::Oa, ProjectionKind::FunctionalDataflow) => vec![Kind::Activity],
         (Layer::Sa, ProjectionKind::FunctionalDataflow) => vec![Kind::Function],
         (Layer::Oa, ProjectionKind::Capabilities) => vec![
@@ -208,11 +189,12 @@ pub fn kinds(app: &App) -> Vec<Kind> {
         .unwrap_or_default()
 }
 fn compatible(p: &Project, d: &Diagram, id: Id) -> bool {
-    p.elements.get(&id).is_some_and(|e| {
-        e.kind() != Kind::Port
-            && d.projection.includes(e.kind())
-            && (e.layer() == d.layer || d.projection == ProjectionKind::Traceability)
-    })
+    d.projection.is_architecture()
+        && p.elements.get(&id).is_some_and(|e| {
+            e.kind() != Kind::Port
+                && d.projection.includes(e.kind())
+                && (e.layer() == d.layer || d.projection == ProjectionKind::Traceability)
+        })
 }
 fn suggested(p: &Project, d: &Diagram, kind: Kind) -> bool {
     // Existing System remains a useful choice even when the singleton exists.
@@ -257,6 +239,17 @@ pub fn candidates(app: &App) -> Vec<(Id, String, bool)> {
 }
 impl App {
     pub(super) fn architecture_event(&mut self, event: Event) -> Task<Message> {
+        if matches!(
+            &event,
+            Event::Start(..) | Event::Allocate(..) | Event::Existing(..)
+        ) && !self
+            .active_diagram
+            .and_then(|id| self.project().diagrams.get(&id))
+            .is_some_and(|d| d.projection.is_architecture())
+        {
+            self.status = "Choose an architecture view before adding architecture content.".into();
+            return Task::none();
+        }
         match event {
             Event::Start(_, point) | Event::Allocate(_, _, point) | Event::Existing(point) => {
                 if self.architecture.is_some() {
@@ -301,6 +294,17 @@ impl App {
                     _ => return Task::none(),
                 };
                 let placing = point.is_none() && matches!(intent, Intent::Create { .. });
+                let filter = if matches!(intent, Intent::Existing { .. })
+                    && self
+                        .project()
+                        .diagrams
+                        .get(&diagram)
+                        .is_some_and(|d| d.projection == ProjectionKind::Traceability)
+                {
+                    Filter::AllCompatible
+                } else {
+                    Filter::Context
+                };
                 let saved = Saved {
                     version: 1,
                     base: oa_core::transitions::project_fingerprint(self.project()),
@@ -309,7 +313,7 @@ impl App {
                     point,
                     placing,
                     query: String::new(),
-                    filter: Filter::Context,
+                    filter,
                     show_placed: false,
                     page: 0,
                 };

crates/oa-desktop/src/app/architecture_authoring/palette.rs

@@ -229,13 +229,7 @@ pub fn view(app: &App) -> Element<'_, Message> {
     content = content.push(group("Connections"));
     for connection in crate::connection_tool::Tool::for_layer(app.layer) {
         let d = &app.project().diagrams[&app.active_diagram.unwrap()];
-        let kind = match connection {
-            crate::connection_tool::Tool::Interaction => Kind::Activity,
-            crate::connection_tool::Tool::FunctionalExchange => Kind::Function,
-            crate::connection_tool::Tool::CommunicationMean => Kind::Entity,
-            crate::connection_tool::Tool::BoundaryExchange => Kind::System,
-        };
-        if !d.projection.includes(kind) {
+        if !connection.available_in(app.layer, d.projection) {
             continue;
         }
         content = content.push(tool(

crates/oa-desktop/src/app/architecture_authoring/tests.rs

@@ -1,4 +1,5 @@
 use super::*;
+mod traceability;
 
 fn setup(layer: Layer) -> App {
     let mut app = App::with_project(Project::empty());
@@ -233,65 +234,6 @@ fn architecture_stale_submit_keeps_create_and_rename_visible_and_exact() {
     }
 }
 
-fn key_event(named: iced::keyboard::key::Named) -> iced::Event {
-    use iced::keyboard;
-    iced::Event::Keyboard(keyboard::Event::KeyPressed {
-        key: keyboard::Key::Named(named),
-        modified_key: keyboard::Key::Named(named),
-        physical_key: keyboard::key::Physical::Code(keyboard::key::Code::Escape),
-        location: keyboard::Location::Standard,
-        modifiers: keyboard::Modifiers::empty(),
-        text: None,
-        repeat: false,
-    })
-}
-
-fn focused_text_input_escape(name: &str) -> Message {
-    use iced::advanced::{Layout, Shell, layout, widget};
-    let mut field: iced::Element<'_, (), iced::Theme, ()> = text_input("Engineering name", name)
-        .id("architecture-name")
-        .on_input(|_| ())
-        .into();
-    let mut tree = widget::Tree::new(field.as_widget());
-    let size = iced::Size::new(300., 40.);
-    let node =
-        field
-            .as_widget_mut()
-            .layout(&mut tree, &(), &layout::Limits::new(iced::Size::ZERO, size));
-    tree.state
-        .downcast_mut::<iced::widget::text_input::State<()>>()
-        .focus();
-    let escape = key_event(iced::keyboard::key::Named::Escape);
-    let mut messages = Vec::new();
-    let mut shell = Shell::new(&mut messages);
-    field.as_widget_mut().update(
-        &mut tree,
-        &escape,
-        Layout::new(&node),
-        iced::mouse::Cursor::Unavailable,
-        &(),
-        &mut iced::advanced::clipboard::Null,
-        &mut shell,
-        &iced::Rectangle::new(iced::Point::ORIGIN, size),
-    );
-    assert!(
-        shell.is_event_captured(),
-        "Iced consumes focused-input Escape"
-    );
-    assert!(
-        !tree
-            .state
-            .downcast_ref::<iced::widget::text_input::State<()>>()
-            .is_focused()
-    );
-    captured_escape(
-        escape,
-        iced::event::Status::Captured,
-        iced::window::Id::unique(),
-    )
-    .unwrap()
-}
-
 #[test]
 fn architecture_first_focused_input_escape_cancels_create_and_rename() {
     for rename in [false, true] {
@@ -311,8 +253,9 @@ fn architecture_first_focused_input_escape_cancels_create_and_rename() {
         let name = "  Unaccepted long engineering name 雨  ";
         send(&mut app, Event::Name(name.into()));
         assert!(app.architecture.as_ref().unwrap().inline());
-        let message = focused_text_input_escape(name);
-        let _ = app.update(message);
+        let mut messages = crate::app::escape::tests::focused_input_messages(&app);
+        assert_eq!(messages.len(), 1);
+        let _ = app.update(messages.remove(0));
         assert!(app.architecture.is_none());
         assert!(inline_editor(&app).is_none());
         assert_eq!(app.status, "Cancelled · Select / move");
@@ -342,8 +285,8 @@ fn architecture_captured_escape_does_not_cancel_other_controls_or_placement() {
         let before = app.document.bundle().clone();
         let status = app.status.clone();
         let epoch = app.canvas_epoch;
-        let message = focused_text_input_escape("Other field or existing-element search");
-        let _ = app.update(message);
+        let messages = crate::app::escape::tests::focused_input_messages(&app);
+        assert!(messages.is_empty());
         assert_eq!(
             app.architecture
                 .as_ref()
@@ -355,19 +298,7 @@ fn architecture_captured_escape_does_not_cancel_other_controls_or_placement() {
         assert_eq!(app.canvas_epoch, epoch);
     }
     assert!(
-        captured_escape(
-            key_event(iced::keyboard::key::Named::Escape),
-            iced::event::Status::Ignored,
-            iced::window::Id::unique(),
-        )
-        .is_none()
-    );
-    assert!(
-        captured_escape(
-            key_event(iced::keyboard::key::Named::Enter),
-            iced::event::Status::Captured,
-            iced::window::Id::unique(),
-        )
-        .is_none()
+        crate::app::escape::tests::focused_input_key(&app, iced::keyboard::key::Named::Enter,)
+            .is_empty()
     );
 }

crates/oa-desktop/src/app/architecture_authoring/tests/traceability.rs

@@ -0,0 +1,124 @@
+use super::*;
+
+#[test]
+fn traceability_existing_defaults_show_opposite_layer_and_place_only_one_node() {
+    let mut project = Project::empty();
+    let sa = project
+        .add_element(Kind::Function, Layer::Sa, "Deliver report", None)
+        .unwrap();
+    let system = project
+        .add_element(Kind::System, Layer::Sa, "System", None)
+        .unwrap();
+    let diagram = project.ensure_diagram(Layer::Oa);
+    project.diagrams.get_mut(&diagram).unwrap().projection = ProjectionKind::Traceability;
+    let mut app = App::with_project(project);
+    app.page = Page::Diagram;
+    app.layer = Layer::Oa;
+    app.active_diagram = Some(diagram);
+    let before = app.document.snapshot();
+    send(&mut app, Event::Existing(None));
+    assert_eq!(
+        app.architecture.as_ref().unwrap().saved.filter,
+        Filter::AllCompatible
+    );
+    let listed = candidates(&app);
+    assert!(listed.iter().any(|(id, _, shown)| *id == sa && !shown));
+    assert!(listed.iter().any(|(id, _, shown)| *id == system && !shown));
+    send(&mut app, Event::Pick(sa));
+    assert!(app.architecture.as_ref().unwrap().saved.placing);
+    assert_eq!(app.project(), &before.decoded.project);
+    let context = app.route_context().unwrap();
+    let point = Position { x: 345., y: 215. };
+    send(&mut app, Event::Click(context, point));
+    assert!(app.architecture.is_none(), "{}", app.status);
+    assert_eq!(app.active_diagram, Some(diagram));
+    let placed = app.project().diagrams[&diagram]
+        .nodes
+        .values()
+        .find(|n| n.element == sa)
+        .unwrap()
+        .clone();
+    assert_eq!(placed.position, point);
+    let mut expected = before.decoded.project.clone();
+    expected
+        .diagrams
+        .get_mut(&diagram)
+        .unwrap()
+        .nodes
+        .insert(placed.id, placed);
+    assert_eq!(app.project(), &expected);
+    let accepted = app.document.bundle().clone();
+    let _ = app.update(Message::Undo);
+    assert_eq!(app.document.bundle(), &before.bundle);
+    assert!(!app.document.can_undo());
+    let _ = app.update(Message::Redo);
+    assert_eq!(app.project(), &expected);
+    assert_eq!(app.document.bundle(), &accepted);
+}
+
+#[test]
+fn traceability_default_does_not_change_creation_or_ordinary_picker_guards() {
+    let mut app = setup(Layer::Oa);
+    let diagram = app.active_diagram.unwrap();
+    send(&mut app, Event::Existing(None));
+    assert_eq!(
+        app.architecture.as_ref().unwrap().saved.filter,
+        Filter::Context
+    );
+    send(&mut app, Event::Cancel);
+    let _ = app.update(Message::Projection(ProjectionKind::Traceability));
+    send(&mut app, Event::Start(Kind::Entity, None));
+    assert_eq!(
+        app.architecture.as_ref().unwrap().saved.filter,
+        Filter::Context
+    );
+    send(&mut app, Event::Cancel);
+    assert_eq!(app.active_diagram, Some(diagram));
+
+    let mut project = app.project().clone();
+    let sa = project
+        .add_element(Kind::Function, Layer::Sa, "Other layer", None)
+        .unwrap();
+    let port = Id::new_v4();
+    project.elements.insert(
+        port,
+        oa_core::Element {
+            id: port,
+            alias: "legacy_port".into(),
+            name: "Port".into(),
+            description: String::new(),
+            parent: Some(sa),
+            body: ElementBody::shared_in(
+                Layer::Sa,
+                SharedBody::Port {
+                    contract: PortContract::Legacy,
+                    legacy: Some(LegacyPortContract {
+                        direction: PortDirection::InOut,
+                        interface: None,
+                    }),
+                },
+            ),
+        },
+    );
+    oa_core::validate_candidate(&project).unwrap();
+    for projection in [ProjectionKind::Overview, ProjectionKind::Traceability] {
+        let mut p = project.clone();
+        p.diagrams.get_mut(&diagram).unwrap().projection = projection;
+        let mut trial = App::with_project(p);
+        trial.page = Page::Diagram;
+        trial.active_diagram = Some(diagram);
+        trial.layer = Layer::Oa;
+        let before = trial.document.bundle().clone();
+        send(&mut trial, Event::Existing(None));
+        send(&mut trial, Event::Filter(Filter::AllCompatible));
+        assert_eq!(
+            candidates(&trial).iter().any(|(id, _, _)| *id == sa),
+            projection == ProjectionKind::Traceability
+        );
+        assert!(!candidates(&trial).iter().any(|(id, _, _)| *id == port));
+        send(&mut trial, Event::Pick(port));
+        assert!(!trial.architecture.as_ref().unwrap().saved.placing);
+        send(&mut trial, Event::Cancel);
+        assert_eq!(trial.document.bundle(), &before);
+    }
+}

crates/oa-desktop/src/app/behavior_removal_tests.rs

@@ -180,10 +180,36 @@ async fn mounted_scenario_use_delete_keeps_definition_and_second_use_and_rejects
     send(&mut mounted, &mut app, Message::ConfirmDelete(stale)).await;
     assert!(app.delete_pending, "old token does not cancel new dialog");
     // Keep selection and epoch deliberately unchanged: owner is an independent witness.
+    let captured = app.scenario_context().unwrap();
+    assert_eq!(captured.scenario, owners[0]);
+    assert_eq!(
+        app.delete_target.as_ref().unwrap().behavior_owner,
+        Some(owners[0])
+    );
     app.behavior.active_owner = Some(owners[1]);
+    app.reconcile_scenario_workspace();
+    let other = app.scenario_context().unwrap();
+    assert_eq!(other.scenario, owners[1]);
+    assert_eq!(
+        other.representation,
+        crate::behavior::scenario_layout::Representation::Derived { owner: owners[1] }
+    );
+    assert_eq!(other.epoch, captured.epoch);
+    assert_eq!(app.selected, uses[0]);
+    assert!(
+        app.delete_target.as_ref().unwrap().snapshot.valid(&app),
+        "the independent owner guard must reject an otherwise current token"
+    );
     send(&mut mounted, &mut app, Message::ConfirmDelete(token)).await;
     assert_eq!(app.document.bundle(), &original);
+    assert!(!app.delete_pending && app.delete_target.is_none());
+    assert!(!app.document.can_undo() && !app.document.can_redo());
     app.behavior.active_owner = Some(owners[0]);
+    // Restore both owner and qualified presentation before mounting pointer input.
+    // Passive reports from the previous owner cannot repair an inconsistent fixture.
+    app.reconcile_scenario_workspace();
+    assert_eq!(app.scenario_context().unwrap().scenario, owners[0]);
+    assert_eq!(app.selected, uses[0]);
     mounted.settle(&mut app).await;
     select(&mut mounted, &mut app, uses[0]).await;
     let token = delete(&mut mounted, &mut app, false).await;

crates/oa-desktop/src/app/diagram_reveal.rs

@@ -1,5 +1,6 @@
 //! Complete a navigation camera after the destination reports its real viewport.
 use super::*;
+use crate::behavior::scenario_layout::Representation;
 use crate::diagram_usage::{Context, Surface};
 #[cfg(test)]
 mod tests;
@@ -47,11 +48,23 @@ impl App {
                     && c.epoch == *epoch,
             ),
             Message::ScenarioCanvas(behavior::scenario::CanvasEvent::Viewport(c, size)) => (
-                Surface::Scenario(c.scenario),
+                match c.representation {
+                    Representation::Derived { owner } => Surface::Scenario(owner),
+                    Representation::Saved { diagram } => Surface::Saved(diagram),
+                },
                 *size,
                 c.document == context.document
                     && c.revision == context.revision
-                    && c.epoch == *epoch,
+                    && c.epoch == *epoch
+                    && self.pending_scenario_reveal_visit == Some(c.visit)
+                    && self.page == Page::Behavior
+                    && self.behavior.active_owner == Some(c.scenario)
+                    && self.behavior.scenario.context(
+                        self.canvas_document,
+                        c.scenario,
+                        self.document.revision(),
+                        self.canvas_epoch,
+                    ) == Some(*c),
             ),
             Message::StateDiagram(behavior::state_edit::Event::Viewport(c, size)) => (
                 Surface::Saved(c.diagram),
@@ -93,6 +106,7 @@ impl App {
                 | Message::StateDiagram(behavior::state_edit::Event::Viewport(..))
         ) {
             self.pending_diagram_reveal = None;
+            self.pending_scenario_reveal_visit = None;
             if !Self::is_navigation_camera(message) {
                 self.diagram_navigation_focus = None;
             }
@@ -142,5 +156,6 @@ impl App {
             self.reveal_diagram_usage(&usage);
         }
         self.pending_diagram_reveal = None;
+        self.pending_scenario_reveal_visit = None;
     }
 }

crates/oa-desktop/src/app/diagram_reveal/tests.rs

@@ -98,6 +98,7 @@ fn fixture(canvas: Canvas) -> (App, Usage) {
                     layer: Layer::Oa,
                     projection: ProjectionKind::StateMachine { machine },
                     nodes: BTreeMap::new(),
+                    layout: None,
                     routes: vec![],
                     view_options: Default::default(),
                 },
@@ -143,6 +144,7 @@ fn measurement(
     epoch: u64,
     surface: Surface,
     size: Size,
+    visit: Id,
 ) -> Message {
     match canvas {
         Canvas::Architecture => Message::DiagramRevealViewport(context, epoch, size),
@@ -159,6 +161,10 @@ fn measurement(
             behavior::scenario::Context {
                 document: context.document,
                 scenario: surface.id(),
+                representation: Representation::Derived {
+                    owner: surface.id(),
+                },
+                visit,
                 revision: context.revision,
                 epoch,
             },
@@ -176,12 +182,16 @@ fn measurement(
     }
 }
 
-fn stamp(app: &App) -> (Context, u64) {
+fn stamp(app: &App) -> (Context, u64, Id) {
     let (context, _, epoch) = app
         .pending_diagram_reveal
         .as_ref()
         .expect("reveal awaits measured destination");
-    (*context, *epoch)
+    (
+        *context,
+        *epoch,
+        app.pending_scenario_reveal_visit.unwrap_or(Id::nil()),
+    )
 }
 
 fn assert_centered(app: &App, canvas: Canvas, target: &Usage) {
@@ -219,7 +229,11 @@ fn assert_centered(app: &App, canvas: Canvas, target: &Usage) {
             expected.choose_tool(target.surface.id(), behavior::scenario::CanvasTool::Select);
             expected.viewport(ACTUAL);
             expected.zoom(Some(zoom));
-            expected.camera(behavior::canvas_workspace::Event::Pan(pan));
+            expected.camera(
+                app.project(),
+                target.surface.id(),
+                behavior::canvas_workspace::Event::Pan(pan),
+            );
             assert!(app.behavior.scenario.camera_boundary() == expected.camera_boundary());
         }
     }
@@ -238,10 +252,10 @@ fn all_reveal_surfaces_recenter_once_after_the_real_viewport_and_preserve_author
             app.document.dirty(),
         );
         assert!(app.reveal_diagram_usage(&target));
-        let (context, epoch) = stamp(&app);
+        let (context, epoch, visit) = stamp(&app);
         send(
             &mut app,
-            measurement(canvas, context, epoch, target.surface, ACTUAL),
+            measurement(canvas, context, epoch, target.surface, ACTUAL, visit),
         );
         assert!(app.pending_diagram_reveal.is_none());
         assert_centered(&app, canvas, &target);
@@ -260,7 +274,7 @@ fn all_reveal_surfaces_recenter_once_after_the_real_viewport_and_preserve_author
         let camera = app.camera_boundary();
         send(
             &mut app,
-            measurement(canvas, context, epoch, target.surface, ACTUAL),
+            measurement(canvas, context, epoch, target.surface, ACTUAL, visit),
         );
         assert!(app.pending_diagram_reveal.is_none());
         assert!(app.camera_boundary() == camera);
@@ -274,7 +288,7 @@ fn malformed_or_wrong_stamp_measurements_cannot_poison_a_pending_reveal() {
         for invalid in 0..6 {
             let (mut app, target) = fixture(canvas);
             assert!(app.reveal_diagram_usage(&target));
-            let (context, epoch) = stamp(&app);
+            let (context, epoch, visit) = stamp(&app);
             let camera = app.camera_boundary();
             let mut stale = context;
             let mut wrong_epoch = epoch;
@@ -289,13 +303,13 @@ fn malformed_or_wrong_stamp_measurements_cannot_poison_a_pending_reveal() {
             }
             send(
                 &mut app,
-                measurement(canvas, stale, wrong_epoch, target.surface, size),
+                measurement(canvas, stale, wrong_epoch, target.surface, size, visit),
             );
             assert!(
                 app.pending_diagram_reveal.is_some(),
                 "{canvas:?} invalid case {invalid}"
             );
-            assert_eq!(stamp(&app), (context, epoch));
+            assert_eq!(stamp(&app), (context, epoch, visit));
             assert_eq!(app.canvas_epoch, epoch);
             assert!(
                 app.camera_boundary() == camera,
@@ -303,7 +317,7 @@ fn malformed_or_wrong_stamp_measurements_cannot_poison_a_pending_reveal() {
             );
             send(
                 &mut app,
-                measurement(canvas, context, epoch, target.surface, ACTUAL),
+                measurement(canvas, context, epoch, target.surface, ACTUAL, visit),
             );
             assert!(app.pending_diagram_reveal.is_none());
             assert_centered(&app, canvas, &target);
@@ -317,9 +331,10 @@ fn actual_window_resize_before_first_measurement_retains_focus_for_the_new_conte
         let (mut app, target) = fixture(canvas);
         let accepted = app.document.snapshot();
         assert!(app.reveal_diagram_usage(&target));
-        let (context, old_epoch) = stamp(&app);
+        let (context, old_epoch, visit) = stamp(&app);
         send(&mut app, Message::WindowResized(Size::new(1100., 700.)));
-        let (current, epoch) = stamp(&app);
+        let (current, epoch, current_visit) = stamp(&app);
+        assert_eq!(current_visit, visit);
         assert_eq!(current, context);
         assert_eq!(epoch, app.canvas_epoch);
         if matches!(canvas, Canvas::Process | Canvas::Scenario) {
@@ -327,14 +342,14 @@ fn actual_window_resize_before_first_measurement_retains_focus_for_the_new_conte
             let camera = app.camera_boundary();
             send(
                 &mut app,
-                measurement(canvas, context, old_epoch, target.surface, ACTUAL),
+                measurement(canvas, context, old_epoch, target.surface, ACTUAL, visit),
             );
-            assert_eq!(stamp(&app), (current, epoch));
+            assert_eq!(stamp(&app), (current, epoch, visit));
             assert!(app.camera_boundary() == camera);
         }
         send(
             &mut app,
-            measurement(canvas, current, epoch, target.surface, ACTUAL),
+            measurement(canvas, current, epoch, target.surface, ACTUAL, visit),
         );
         assert!(app.pending_diagram_reveal.is_none());
         assert_centered(&app, canvas, &target);
@@ -349,7 +364,7 @@ fn user_camera_edit_and_navigation_cancel_deferred_focus_without_late_snapping()
             let (mut app, target) = fixture(canvas);
             let accepted = app.document.snapshot();
             assert!(app.reveal_diagram_usage(&target));
-            let (context, epoch) = stamp(&app);
+            let (context, epoch, visit) = stamp(&app);
             let event = match action {
                 0 => match canvas {
                     Canvas::Architecture => Message::Pan(Vector::new(31., -17.)),
@@ -386,7 +401,7 @@ fn user_camera_edit_and_navigation_cancel_deferred_focus_without_late_snapping()
             // restore the old navigation camera after deliberate user input.
             send(
                 &mut app,
-                measurement(canvas, context, epoch, target.surface, WIDE),
+                measurement(canvas, context, epoch, target.surface, WIDE, visit),
             );
             assert!(app.pending_diagram_reveal.is_none());
             assert!(

crates/oa-desktop/src/app/diagram_usages.rs

@@ -1,5 +1,6 @@
 //! Navigation-only adapter: validates destinations before changing presentation.
 use super::*;
+use crate::behavior::scenario_layout::{Representation, presentation};
 use crate::diagram_usage::{self as usage, Context, Event, Panel, Surface, Target, Usage};
 #[cfg(test)]
 mod tests;
@@ -181,6 +182,7 @@ impl App {
             // Only an accepted new chooser supersedes the previous reveal.
             // Rejected/stale panel envelopes leave its first measurement intact.
             self.pending_diagram_reveal = None;
+            self.pending_scenario_reveal_visit = None;
             self.diagram_navigation_focus = None;
             self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
             return Task::batch([
@@ -291,11 +293,78 @@ impl App {
         Task::none()
     }
 
+    /// Explicit saved-Scenario reveal runs before generic Apply. An absent target
+    /// never selects the owner or another saved arrangement as a fallback.
+    pub(super) fn reveal_saved_scenario(&mut self, diagram: Id, selected: Id) -> Task<Message> {
+        if self.diagram_usages.is_some() || !self.usage_navigation_available() {
+            self.status = "Apply or revert pending edits before revealing a saved Scenario. Your inputs are retained.".into();
+            return Task::none();
+        }
+        if presentation::checked_owner(self.project(), Representation::Saved { diagram }).is_none()
+        {
+            return Task::none();
+        }
+        let Some(found) = self
+            .current_surface_usages(selected, Surface::Saved(diagram))
+            .into_iter()
+            .find(|row| matches!(row.target, Target::Whole | Target::ScenarioObject(_)))
+        else {
+            self.status = "This object has no visible target in that saved Scenario.".into();
+            return Task::none();
+        };
+        self.reveal_diagram_usage(&found);
+        Task::none()
+    }
+
     pub(super) fn reveal_diagram_usage(&mut self, usage: &Usage) -> bool {
         if !self.usage_navigation_available() {
             return false;
         }
         let previous_layer = self.layer;
+        let scenario_representation = match usage.surface {
+            Surface::Saved(diagram) if self.saved_scenario_diagram(diagram) => {
+                Some(Representation::Saved { diagram })
+            }
+            Surface::Scenario(owner) => Some(Representation::Derived { owner }),
+            _ => None,
+        };
+        if let Some(representation) = scenario_representation {
+            let Some(owner) = presentation::checked_owner(self.project(), representation) else {
+                return false;
+            };
+            if !self
+                .behavior
+                .scenario
+                .representation_usages(self.project(), representation, usage.subject)
+                .iter()
+                .any(|row| row == usage)
+            {
+                return false;
+            }
+            // Finish target/camera admission before changing the App route. The
+            // checked immutable owner also makes the following entry infallible.
+            let revealed = match representation {
+                Representation::Derived { .. } => self.behavior.scenario.reveal_usage(
+                    self.document.project(),
+                    self.canvas_document,
+                    owner,
+                    &usage.target,
+                ),
+                Representation::Saved { .. } => self.behavior.scenario.reveal_representation_usage(
+                    self.document.project(),
+                    self.canvas_document,
+                    owner,
+                    representation,
+                    &usage.target,
+                ),
+            };
+            if !revealed {
+                return false;
+            }
+            if !self.enter_scenario_representation(representation) {
+                return false;
+            }
+        }
         let p = self.document.project();
         let (selected, placement) = match &usage.target {
             Target::Whole => (usage.surface.id(), None),
@@ -328,7 +397,10 @@ impl App {
                 };
                 self.layer = diagram.layer;
                 self.active_diagram = Some(id);
-                if let Some(machine) = diagram.projection.state_machine() {
+                if let Some(owner) = diagram.projection.scenario() {
+                    self.behavior.active_owner = Some(owner);
+                    self.page = Page::Behavior;
+                } else if let Some(machine) = diagram.projection.state_machine() {
                     let viewport = self.behavior.diagram.viewport.unwrap_or(iced::Size::new(
                         (self.window_size.width - 610.).max(280.),
                         (self.window_size.height - 320.).max(240.),
@@ -370,19 +442,14 @@ impl App {
                 self.page = Page::Behavior;
             }
             Surface::Scenario(owner) => {
-                if !self.behavior.scenario.reveal_usage(
-                    p,
-                    self.canvas_document,
-                    owner,
-                    &usage.target,
-                ) {
-                    return false;
-                }
                 self.layer = p.elements[&owner].layer();
                 self.behavior.active_owner = Some(owner);
                 self.page = Page::Behavior;
             }
         }
+        if scenario_representation.is_none() {
+            self.behavior.scenario.forget_view();
+        }
         self.selected = selected;
         self.selected_node = placement;
         self.model_menu = None;
@@ -409,6 +476,18 @@ impl App {
             usage: usage.clone(),
             selected,
         });
+        self.pending_scenario_reveal_visit = scenario_representation.and_then(|representation| {
+            let owner = presentation::checked_owner(self.project(), representation)?;
+            self.behavior
+                .scenario
+                .context(
+                    self.canvas_document,
+                    owner,
+                    self.document.revision(),
+                    self.canvas_epoch,
+                )
+                .map(|context| context.visit)
+        });
         self.pending_diagram_reveal = Some((
             Context {
                 document: self.canvas_document,
@@ -429,10 +508,20 @@ impl App {
             Surface::Saved(id) => {
                 self.active_diagram == Some(id)
                     && matches!(self.page, Page::Diagram | Page::Behavior)
+                    && (!self.saved_scenario_diagram(id)
+                        || (self.page == Page::Behavior
+                            && self.behavior.scenario.representation()
+                                == Some(Representation::Saved { diagram: id })))
             }
-            Surface::Process(owner) | Surface::Scenario(owner) => {
+            Surface::Process(owner) => {
                 self.page == Page::Behavior && self.behavior.active_owner == Some(owner)
             }
+            Surface::Scenario(owner) => {
+                self.page == Page::Behavior
+                    && self.behavior.active_owner == Some(owner)
+                    && self.behavior.scenario.representation()
+                        == Some(Representation::Derived { owner })
+            }
         };
         (current_surface
             && focus.usage.surface == surface

crates/oa-desktop/src/app/diagram_usages/tests.rs

@@ -1451,3 +1451,5 @@ fn completion_releases_worker_behind_busy_modal_without_navigation() {
     assert_eq!(location(&app), prior);
     assert_eq!(authored(&app), before);
 }
+
+mod saved_scenario;

crates/oa-desktop/src/app/diagram_usages/tests/saved_scenario.arcadia

@@ -0,0 +1,108 @@
+arcadia 7;
+project incident_workspace "Incident report review" id "70200000-0000-4000-8000-000000000001" {
+    // Two operational activities, with one lifeline appearance per Scenario.
+    oa_activity report_incident "Report incident" id "70200000-0000-4000-8000-000000000002" {}
+    oa_activity assess_incident "Assess incident" id "70200000-0000-4000-8000-000000000003" {}
+    interaction incident_report "Incident report" id "70200000-0000-4000-8000-000000000004" {
+        source @report_incident;
+        target @assess_incident;
+    }
+
+    oa_scenario incident_response "Review a reported incident" id "70200000-0000-4000-8000-000000000010" {
+        viewpoint OperationalActivity;
+        steps [@initial_report, @updated_report, @assess_call, @assess_reply, @unfinished_notice, @use_review];
+    }
+    oa_lifeline reporter "Reporting activity" id "70200000-0000-4000-8000-000000000011" {
+        parent @incident_response; represented @report_incident;
+    }
+    oa_lifeline assessor "Assessment activity" id "70200000-0000-4000-8000-000000000012" {
+        parent @incident_response; represented @assess_incident;
+    }
+    // Both appearances reuse one definition. Navigation must retain the occurrence.
+    oa_occurrence initial_report "Initial incident report" id "70200000-0000-4000-8000-000000000020" {
+        parent @incident_response;
+        body { Exchange { exchange @incident_report; sender @reporter; receiver @assessor; message_kind Asynchronous; }; };
+    }
+    oa_occurrence updated_report "Updated incident report" id "70200000-0000-4000-8000-000000000021" {
+        parent @incident_response;
+        body { Exchange { exchange @incident_report; sender @reporter; receiver @assessor; message_kind Asynchronous; }; };
+    }
+    // A correlated self call/reply with deliberately unassigned exchange definitions.
+    oa_occurrence assess_call "Assess report details" id "70200000-0000-4000-8000-000000000022" {
+        parent @incident_response;
+        body { Exchange { exchange none; sender @assessor; receiver @assessor; message_kind Call; }; };
+    }
+    oa_occurrence assess_reply "Assessment ready" id "70200000-0000-4000-8000-000000000023" {
+        parent @incident_response;
+        body { Exchange { exchange none; sender @assessor; receiver @assessor; message_kind Reply; reply_to @assess_call; }; };
+    }
+    // Intentional unfinished work: no receiver and therefore no fabricated arrow.
+    oa_occurrence unfinished_notice "Follow-up recipient undecided" id "70200000-0000-4000-8000-000000000024" {
+        parent @incident_response;
+        body { Exchange { exchange @incident_report; sender @reporter; receiver none; message_kind Asynchronous; }; };
+    }
+    oa_occurrence use_review "Use the reviewed reporting procedure" id "70200000-0000-4000-8000-000000000025" {
+        parent @incident_response;
+        body { ScenarioUse {
+            bindings [{ local @reporter; referenced @review_reporter; }, { local @assessor; referenced @review_assessor; }];
+            scenario @reporting_review;
+        }; };
+    }
+
+    // This definition stays opaque in the caller. Open it, then Back to the saved view.
+    oa_scenario reporting_review "Reporting procedure detail" id "70200000-0000-4000-8000-000000000030" {
+        viewpoint OperationalActivity;
+        steps [@review_delivery];
+    }
+    oa_lifeline review_reporter "Reporting activity in detail" id "70200000-0000-4000-8000-000000000031" {
+        parent @reporting_review; represented @report_incident;
+    }
+    oa_lifeline review_assessor "Assessment activity in detail" id "70200000-0000-4000-8000-000000000032" {
+        parent @reporting_review; represented @assess_incident;
+    }
+    oa_occurrence review_delivery "Check the incident report" id "70200000-0000-4000-8000-000000000033" {
+        parent @reporting_review;
+        body { Exchange { exchange @incident_report; sender @review_reporter; receiver @review_assessor; message_kind Asynchronous; }; };
+    }
+
+    diagram incident_readable "A - Incident review readable" id "70200000-0000-4000-8000-000000000040" {
+        layer Oa;
+        projection { Scenario { scenario @incident_response; }; };
+        layout { Scenario {
+            lanes [{ lifeline @reporter; x 160; }, { lifeline @assessor; x 640; }];
+            messages [
+                { address { references []; occurrence @initial_report; }; send_y 160; },
+                { address { references []; occurrence @updated_report; }; send_y 252; },
+                { address { references []; occurrence @assess_call; }; send_y 344; },
+                { address { references []; occurrence @assess_reply; }; send_y 436; }
+            ];
+        }; };
+    }
+    diagram incident_wide "B - Incident review negative and far" id "70200000-0000-4000-8000-000000000041" {
+        layer Oa;
+        projection { Scenario { scenario @incident_response; }; };
+        layout { Scenario {
+            lanes [{ lifeline @reporter; x -500; }, { lifeline @assessor; x 50000; }];
+            messages [
+                { address { references []; occurrence @initial_report; }; send_y 160; },
+                { address { references []; occurrence @updated_report; }; send_y 252; },
+                { address { references []; occurrence @assess_call; }; send_y 344; },
+                { address { references []; occurrence @assess_reply; }; send_y 436; }
+            ];
+        }; };
+    }
+    diagram incident_repair "C - Incident review needs layout repair" id "70200000-0000-4000-8000-000000000042" {
+        layer Oa;
+        projection { Scenario { scenario @incident_response; }; };
+        layout { Scenario {
+            // These valid authored lanes must remain saved during complete fallback.
+            lanes [{ lifeline @reporter; x 900; }, { lifeline @assessor; x -500; }];
+            messages [
+                // REPAIR: change only this 300 to 424, then Undo and Redo the edit.
+                { address { references []; occurrence @assess_reply; }; send_y 300; },
+                // This authored value stays latent while the receiver is missing.
+                { address { references []; occurrence @unfinished_notice; }; send_y 2000; }
+            ];
+        }; };
+    }
+}

crates/oa-desktop/src/app/diagram_usages/tests/saved_scenario.rs

@@ -0,0 +1,362 @@
+//! Actual App chooser/explicit-reveal checks for saved Scenario identity and source history.
+use super::*;
+use crate::behavior::scenario::{CanvasEvent, State};
+use crate::behavior::scenario_layout::{
+    Representation,
+    presentation::{self, PresentationStatus},
+};
+use iced::{Size, Vector};
+
+fn fixture() -> App {
+    let p = language::parse(include_str!("saved_scenario.arcadia")).unwrap();
+    let errors: Vec<_> = oa_core::validation::validate(&p)
+        .into_iter()
+        .filter(|d| d.severity == oa_core::validation::Severity::Error)
+        .collect();
+    assert!(errors.is_empty(), "{errors:?}");
+    App::with_project(p)
+}
+fn id(app: &App, alias: &str) -> Id {
+    app.project()
+        .identities()
+        .into_iter()
+        .find(|(_, a)| *a == alias)
+        .unwrap()
+        .0
+}
+fn representation(view: Id) -> Representation {
+    Representation::Saved { diagram: view }
+}
+fn find(app: &App, subject: Id, view: Id) -> Usage {
+    usage::saved_usages_for(app.project(), subject, Some(view))
+        .into_iter()
+        .find(|row| row.target == Target::ScenarioObject(subject))
+        .expect("exact saved occurrence")
+}
+fn context(app: &App) -> behavior::scenario::Context {
+    let owner = app.behavior.active_owner.unwrap();
+    app.behavior
+        .scenario
+        .context(
+            app.canvas_document,
+            owner,
+            app.document.revision(),
+            app.canvas_epoch,
+        )
+        .unwrap()
+}
+fn navigate(app: &mut App, subject: Id, view: Id) -> Id {
+    let (token, rows) = open(app, subject);
+    let found = rows
+        .into_iter()
+        .find(|u| u.surface == Surface::Saved(view) && u.target == Target::ScenarioObject(subject))
+        .expect("saved chooser destination");
+    choose(app, token, found);
+    assert!(app.diagram_usages.is_none());
+    assert_eq!(app.page, Page::Behavior);
+    assert_eq!(app.active_diagram, Some(view));
+    assert_eq!(
+        app.behavior.scenario.representation(),
+        Some(representation(view))
+    );
+    assert_eq!(app.selected, subject);
+    token
+}
+
+#[test]
+fn saved_queries_use_each_actual_presentation_and_keep_repeated_appearances_and_references_opaque()
+{
+    let app = fixture();
+    let owner = id(&app, "incident_response");
+    let first = id(&app, "initial_report");
+    let second = id(&app, "updated_report");
+    let exchange = id(&app, "incident_report");
+    let latent = id(&app, "unfinished_notice");
+    let callee_message = id(&app, "review_delivery");
+    let views = ["incident_readable", "incident_wide", "incident_repair"].map(|a| id(&app, a));
+    let derived = app
+        .behavior
+        .scenario
+        .diagram_usages(app.project(), owner, first)
+        .pop()
+        .unwrap();
+    let rows = views.map(|view| find(&app, first, view));
+    assert_eq!(rows[0].bounds.y - derived.bounds.y, 12.);
+    assert_ne!(rows[0].bounds, rows[1].bounds);
+    assert_eq!(
+        rows[2].bounds, derived.bounds,
+        "complete fallback cannot retain the authored lane override"
+    );
+    for view in views {
+        let represented = usage::saved_usages_for(app.project(), exchange, Some(view));
+        assert_eq!(represented.len(), 2);
+        assert!(
+            represented
+                .iter()
+                .any(|u| u.target == Target::ScenarioObject(first))
+        );
+        assert!(
+            represented
+                .iter()
+                .any(|u| u.target == Target::ScenarioObject(second))
+        );
+        assert!(
+            represented
+                .iter()
+                .all(|u| u.surface == Surface::Saved(view))
+        );
+        assert!(usage::saved_usages_for(app.project(), callee_message, Some(view)).is_empty());
+        assert_eq!(
+            find(&app, latent, view).target,
+            Target::ScenarioObject(latent)
+        );
+        let shown = presentation::present(app.project(), representation(view), owner);
+        let whole = usage::saved_usages_for(app.project(), view, Some(view));
+        assert_eq!(whole.len(), 1);
+        assert_eq!(whole[0].target, Target::Whole);
+        assert_eq!(Some(whole[0].bounds), shown.bounds());
+    }
+    let wide = presentation::present(app.project(), representation(views[1]), owner)
+        .bounds()
+        .unwrap();
+    assert!(wide.x < -500. && wide.x + wide.width > 50000.);
+    let fallback = presentation::present(app.project(), representation(views[2]), owner);
+    assert!(matches!(
+        fallback.status(),
+        PresentationStatus::Fallback { .. }
+    ));
+    assert_eq!(fallback.latent_messages(), &[latent]);
+    assert!(!fallback.capabilities().coordinate_input);
+}
+
+#[test]
+fn saved_chooser_and_explicit_reveal_preserve_complete_source_and_actual_undo_redo() {
+    for alias in ["incident_readable", "incident_wide", "incident_repair"] {
+        let mut app = fixture();
+        let view = id(&app, alias);
+        let first = id(&app, "initial_report");
+        let owner = id(&app, "incident_response");
+        let original = app.document.snapshot();
+        app.document
+            .execute(Command::Rename(first, "Reviewed incident report".into()))
+            .unwrap();
+        let edited = app.document.snapshot();
+        app.sync_source();
+        app.refresh_draft();
+        let before = authored(&app);
+        navigate(&mut app, first, view);
+        assert_eq!(app.behavior.active_owner, Some(owner));
+        assert_eq!(authored(&app), before);
+        send(&mut app, Message::RevealInDiagram(view, first));
+        assert_eq!(app.active_diagram, Some(view));
+        assert_eq!(authored(&app), before);
+        assert!(app.document.undo());
+        assert_eq!(app.project(), &original.decoded.project);
+        assert_eq!(app.document.bundle(), &original.bundle);
+        assert!(app.document.redo());
+        assert_eq!(app.project(), &edited.decoded.project);
+        assert_eq!(app.document.bundle(), &edited.bundle);
+    }
+}
+
+#[test]
+fn saved_reveal_and_chooser_refuse_source_property_and_behavior_drafts() {
+    for chooser in [false, true] {
+        for block in 0..3 {
+            let mut app = fixture();
+            let view = id(&app, "incident_repair");
+            let first = id(&app, "initial_report");
+            let choice = chooser.then(|| {
+                let (token, rows) = open(&mut app, first);
+                (
+                    token,
+                    rows.into_iter()
+                        .find(|u| u.surface == Surface::Saved(view))
+                        .unwrap(),
+                )
+            });
+            match block {
+                0 => {
+                    let cursor = app.source_editor.cursor();
+                    app.source_workspace
+                        .edit("? preserve unfinished source".into(), cursor);
+                }
+                1 => {
+                    app.draft
+                        .as_mut()
+                        .unwrap()
+                        .input("/name", "Unapplied inspector value".into());
+                    assert!(app.draft_dirty());
+                }
+                _ => {
+                    let p = app.project().clone();
+                    app.behavior
+                        .creation
+                        .update(&p, behavior::creation::Event::Open(Layer::Oa))
+                        .unwrap();
+                    assert!(app.behavior.has_pending());
+                }
+            }
+            let before = authored(&app);
+            let prior = location(&app);
+            let draft = app
+                .draft
+                .as_ref()
+                .map(|d| serde_json::to_value(d.recovery_snapshot()).unwrap());
+            if let Some((token, row)) = choice {
+                choose(&mut app, token, row);
+            } else {
+                send(&mut app, Message::RevealInDiagram(view, first));
+            }
+            assert_eq!(authored(&app), before);
+            assert_eq!(location(&app), prior);
+            assert_eq!(
+                app.draft
+                    .as_ref()
+                    .map(|d| serde_json::to_value(d.recovery_snapshot()).unwrap()),
+                draft
+            );
+        }
+    }
+}
+
+#[test]
+fn saved_a_b_a_rejects_old_visit_and_panel_callbacks_before_deferred_measurement() {
+    let mut app = fixture();
+    let a = id(&app, "incident_readable");
+    let b = id(&app, "incident_wide");
+    let first = id(&app, "initial_report");
+    let before = authored(&app);
+    let old_token = navigate(&mut app, first, a);
+    let old = context(&app);
+    navigate(&mut app, first, b);
+    navigate(&mut app, first, a);
+    let current = context(&app);
+    assert_ne!(old.visit, current.visit);
+    let held = behavior::scenario::Context {
+        epoch: current.epoch,
+        ..old
+    };
+    let camera = app.behavior.scenario.camera_boundary();
+    send(
+        &mut app,
+        Message::ScenarioCanvas(CanvasEvent::Viewport(held, Size::new(900., 900.))),
+    );
+    send(
+        &mut app,
+        Message::ScenarioCanvas(CanvasEvent::Shelf(
+            held,
+            crate::behavior::scenario::Shelf::Selection,
+        )),
+    );
+    send(
+        &mut app,
+        Message::DiagramUsage(Event::Search(old_token, "obsolete filter".into())),
+    );
+    send(&mut app, Message::DiagramUsage(Event::Close(old_token)));
+    assert_eq!(app.pending_scenario_reveal_visit, Some(current.visit));
+    assert!(app.pending_diagram_reveal.is_some());
+    assert!(app.behavior.scenario.camera_boundary() == camera);
+    let bounds = find(&app, first, a).bounds;
+    send(
+        &mut app,
+        Message::ScenarioCanvas(CanvasEvent::Viewport(current, Size::new(500., 300.))),
+    );
+    assert!(app.pending_diagram_reveal.is_none());
+    assert_eq!(context(&app).visit, current.visit);
+    let mut expected = State::default();
+    expected.enter_representation(app.canvas_document, current.scenario, representation(a));
+    expected.viewport(Size::new(500., 300.));
+    expected.zoom(Some(1.25));
+    expected.camera(
+        app.project(),
+        current.scenario,
+        behavior::canvas_workspace::Event::Pan(Vector::new(
+            250. - bounds.center_x() * 1.25,
+            150. - bounds.center_y() * 1.25,
+        )),
+    );
+    assert!(app.behavior.scenario.camera_boundary() == expected.camera_boundary());
+    assert_eq!(authored(&app), before);
+}
+
+#[test]
+fn retargeted_saved_view_cannot_reveal_a_former_owner_occurrence() {
+    let mut app = fixture();
+    let first = id(&app, "initial_report");
+    let view = id(&app, "incident_readable");
+    let other = id(&app, "reporting_review");
+    let (token, rows) = open(&mut app, first);
+    let old = rows
+        .into_iter()
+        .find(|u| u.surface == Surface::Saved(view))
+        .unwrap();
+    let mut replacement = app.project().diagrams[&view].clone();
+    replacement.projection = ProjectionKind::Scenario { scenario: other };
+    replacement.layout = None;
+    app.document
+        .execute(Command::EditDiagram(view, replacement))
+        .unwrap();
+    app.sync_source();
+    app.refresh_draft();
+    let before = authored(&app);
+    let prior = location(&app);
+    choose(&mut app, token, old);
+    assert_eq!(location(&app), prior);
+    assert_eq!(authored(&app), before);
+    finish_lookup(&mut app);
+    let token = app.diagram_usages.as_ref().unwrap().token;
+    assert!(
+        app.diagram_usages
+            .as_ref()
+            .unwrap()
+            .usages
+            .iter()
+            .all(|u| u.surface != Surface::Saved(view))
+    );
+    send(&mut app, Message::DiagramUsage(Event::Close(token)));
+    send(&mut app, Message::RevealInDiagram(view, first));
+    assert_eq!(location(&app), prior);
+    assert_eq!(authored(&app), before);
+}
+
+#[test]
+fn explicit_saved_layout_repair_undo_redo_requeries_authored_and_fallback_geometry_without_extra_history()
+ {
+    let mut app = fixture();
+    let view = id(&app, "incident_repair");
+    let first = id(&app, "initial_report");
+    let reply = id(&app, "assess_reply");
+    let before = app.document.snapshot();
+    let fallback = find(&app, first, view);
+    app.document
+        .execute(Command::SetScenarioMessagePosition {
+            diagram: view,
+            position: oa_core::ScenarioMessagePosition {
+                address: oa_core::OccurrenceEndpoint {
+                    references: vec![],
+                    occurrence: reply,
+                },
+                send_y: 424.,
+            },
+        })
+        .unwrap();
+    app.sync_source();
+    app.refresh_draft();
+    let repaired = app.document.snapshot();
+    let authored_row = find(&app, first, view);
+    assert_ne!(authored_row.bounds, fallback.bounds);
+    navigate(&mut app, first, view);
+    assert!(app.document.undo());
+    app.sync_source();
+    app.refresh_draft();
+    assert_eq!(app.project(), &before.decoded.project);
+    assert_eq!(app.document.bundle(), &before.bundle);
+    assert_eq!(find(&app, first, view).bounds, fallback.bounds);
+    assert!(app.document.redo());
+    app.sync_source();
+    app.refresh_draft();
+    assert_eq!(app.project(), &repaired.decoded.project);
+    assert_eq!(app.document.bundle(), &repaired.bundle);
+    assert_eq!(find(&app, first, view).bounds, authored_row.bounds);
+}

crates/oa-desktop/src/app/escape.rs

@@ -0,0 +1,198 @@
+//! Keep overlay Escape ahead of modal cancellation in the ordinary widget tree.
+//!
+//! Iced skips root.update when an overlay captures an event. Keeping this
+//! wrapper present even when inactive preserves the child's widget state. A
+//! current-overlay preflight also handles pickers opened mid-batch. Passive
+//! overlays may see an ignored Escape again: the raw-input observer only makes
+//! pending focus requests stale; it does not publish modal cancellation.
+use super::{App, Message, Page, architecture_authoring};
+use iced::advanced::{Clipboard, Layout, Shell, Widget, layout, overlay, renderer, widget};
+use iced::{Element, Event, Length, Rectangle, Size, Theme, Vector, keyboard, mouse};
+
+pub(crate) fn root<'a, R: renderer::Renderer + 'a>(
+    app: &App,
+    content: Element<'a, Message, Theme, R>,
+) -> Element<'a, Message, Theme, R> {
+    let modal = app.text_workspace.menu().is_none()
+        && (app.behavior.creation.has_pending()
+            || app.diagram_usages.is_some()
+            || app.behavior.source_active()
+            || (app.page == Page::Text
+                && (app.text_workspace.drawer().is_some()
+                    || app.source_navigation.open
+                    || app.source_rename.open())
+                && app.architecture.is_none()));
+    Element::new(Bridge {
+        content,
+        messages: [
+            architecture_authoring::captured_escape_message(app),
+            modal.then_some(Message::Escape),
+        ],
+    })
+}
+
+struct Bridge<'a, R> {
+    content: Element<'a, Message, Theme, R>,
+    messages: [Option<Message>; 2],
+}
+
+impl<R: renderer::Renderer> Widget<Message, Theme, R> for Bridge<'_, R> {
+    fn children(&self) -> Vec<widget::Tree> {
+        vec![widget::Tree::new(self.content.as_widget())]
+    }
+
+    fn diff(&self, tree: &mut widget::Tree) {
+        tree.diff_children(std::slice::from_ref(&self.content));
+    }
+
+    fn size(&self) -> Size<Length> {
+        self.content.as_widget().size()
+    }
+
+    fn size_hint(&self) -> Size<Length> {
+        self.content.as_widget().size_hint()
+    }
+
+    fn layout(
+        &mut self,
+        tree: &mut widget::Tree,
+        renderer: &R,
+        limits: &layout::Limits,
+    ) -> layout::Node {
+        self.content
+            .as_widget_mut()
+            .layout(&mut tree.children[0], renderer, limits)
+    }
+
+    fn operate(
+        &mut self,
+        tree: &mut widget::Tree,
+        layout: Layout<'_>,
+        renderer: &R,
+        operation: &mut dyn widget::Operation,
+    ) {
+        self.content
+            .as_widget_mut()
+            .operate(&mut tree.children[0], layout, renderer, operation);
+    }
+
+    fn update(
+        &mut self,
+        tree: &mut widget::Tree,
+        event: &Event,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        renderer: &R,
+        clipboard: &mut dyn Clipboard,
+        shell: &mut Shell<'_, Message>,
+        viewport: &Rectangle,
+    ) {
+        let escape = matches!(
+            event,
+            Event::Keyboard(keyboard::Event::KeyPressed {
+                key: keyboard::Key::Named(keyboard::key::Named::Escape),
+                ..
+            })
+        );
+        // Iced collects overlays before processing a batch of base events. A
+        // preceding click in that batch can therefore open a picker whose
+        // Escape would otherwise reach focused fields underneath it. Offer only
+        // Escape to the current overlay before updating the ordinary tree.
+        if escape {
+            if let Some(element) = self.content.as_widget_mut().overlay(
+                &mut tree.children[0],
+                layout,
+                renderer,
+                viewport,
+                Vector::ZERO,
+            ) {
+                let mut overlay = overlay::Nested::new(element);
+                let node = overlay.layout(renderer, viewport.size());
+                overlay.update(
+                    event,
+                    Layout::new(&node),
+                    cursor,
+                    renderer,
+                    clipboard,
+                    shell,
+                );
+            }
+            if shell.is_event_captured() {
+                return;
+            }
+        }
+        self.content.as_widget_mut().update(
+            &mut tree.children[0],
+            event,
+            layout,
+            cursor,
+            renderer,
+            clipboard,
+            shell,
+            viewport,
+        );
+        if shell.is_event_captured() && escape {
+            for message in self.messages.iter().flatten() {
+                shell.publish(message.clone());
+            }
+        }
+    }
+
+    fn draw(
+        &self,
+        tree: &widget::Tree,
+        renderer: &mut R,
+        theme: &Theme,
+        style: &renderer::Style,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        viewport: &Rectangle,
+    ) {
+        self.content.as_widget().draw(
+            &tree.children[0],
+            renderer,
+            theme,
+            style,
+            layout,
+            cursor,
+            viewport,
+        );
+    }
+
+    fn mouse_interaction(
+        &self,
+        tree: &widget::Tree,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        viewport: &Rectangle,
+        renderer: &R,
+    ) -> mouse::Interaction {
+        self.content.as_widget().mouse_interaction(
+            &tree.children[0],
+            layout,
+            cursor,
+            viewport,
+            renderer,
+        )
+    }
+
+    fn overlay<'b>(
+        &'b mut self,
+        tree: &'b mut widget::Tree,
+        layout: Layout<'b>,
+        renderer: &R,
+        viewport: &Rectangle,
+        translation: Vector,
+    ) -> Option<overlay::Element<'b, Message, Theme, R>> {
+        self.content.as_widget_mut().overlay(
+            &mut tree.children[0],
+            layout,
+            renderer,
+            viewport,
+            translation,
+        )
+    }
+}
+
+#[cfg(test)]
+pub(crate) mod tests;

crates/oa-desktop/src/app/escape/tests.rs

@@ -0,0 +1,618 @@
+use super::*;
+use crate::behavior::canvas_workspace::tests::key;
+use iced::advanced::{subscription, widget::operation};
+use iced::futures::{StreamExt, stream, task::noop_waker_ref};
+use iced::keyboard::key::Named;
+use iced::widget::{column, container, pick_list, text_input};
+use iced_runtime::user_interface::{Cache, UserInterface};
+use oa_core::{Layer, Project};
+use std::task::{Context, Poll};
+
+struct FocusInputs;
+impl widget::Operation for FocusInputs {
+    fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn widget::Operation)) {
+        visit(self);
+    }
+    fn focusable(
+        &mut self,
+        _: Option<&widget::Id>,
+        _: Rectangle,
+        state: &mut dyn operation::Focusable,
+    ) {
+        state.focus();
+    }
+}
+
+pub(crate) fn subscriptions(
+    app: &App,
+    event: Event,
+    status: iced::event::Status,
+    messages: &mut Vec<Message>,
+) {
+    let interaction = subscription::Event::Interaction {
+        window: iced::window::Id::unique(),
+        event,
+        status,
+    };
+    let mut boundaries = 0;
+    for recipe in subscription::into_recipes(app.subscription()) {
+        let mut output = recipe.stream(Box::pin(stream::iter([interaction.clone()])));
+        let mut cx = Context::from_waker(noop_waker_ref());
+        while let Poll::Ready(Some(message)) = output.poll_next_unpin(&mut cx) {
+            if matches!(
+                message,
+                Message::WorkDrag(crate::app::allocation_drag::Event::KeyboardBoundary)
+            ) {
+                boundaries += 1;
+            } else {
+                messages.push(message);
+            }
+        }
+    }
+    assert_eq!(
+        boundaries, 1,
+        "one passive allocation keyboard notification"
+    );
+}
+
+/// A real focused text input, production root bridge, UserInterface dispatch,
+/// and actual subscriptions. Existing app-policy tests use this instead of
+/// pretending every captured event came from a text control.
+pub(crate) fn focused_input_messages(app: &App) -> Vec<Message> {
+    focused_input_key(app, Named::Escape)
+}
+
+pub(crate) fn focused_input_key(app: &App, named: Named) -> Vec<Message> {
+    input_messages(app, named, true)
+}
+
+pub(crate) fn input_messages(app: &App, named: Named, focused: bool) -> Vec<Message> {
+    let runtime = tokio::runtime::Builder::new_current_thread()
+        .enable_time()
+        .build()
+        .unwrap();
+    let _entered = runtime.enter();
+    let input: Element<'_, Message, Theme, ()> = text_input("Retained input", "Uncommitted 雨")
+        .on_input(|_| Message::Escape)
+        .into();
+    let mut renderer = ();
+    let mut ui = UserInterface::build(
+        root(app, input),
+        Size::new(400., 100.),
+        Cache::new(),
+        &mut renderer,
+    );
+    if focused {
+        ui.operate(&renderer, &mut FocusInputs);
+    }
+    let event = key(named);
+    let mut messages = vec![];
+    let (_, statuses) = ui.update(
+        std::slice::from_ref(&event),
+        mouse::Cursor::Unavailable,
+        &mut renderer,
+        &mut iced::advanced::clipboard::Null,
+        &mut messages,
+    );
+    if named == Named::Escape {
+        assert_eq!(
+            statuses,
+            [if focused {
+                iced::event::Status::Captured
+            } else {
+                iced::event::Status::Ignored
+            }]
+        );
+    }
+    subscriptions(app, event, statuses[0], &mut messages);
+    messages
+}
+
+#[derive(Clone, Debug, PartialEq)]
+enum PickMessage {
+    Selected(&'static str),
+    Opened,
+    Closed,
+}
+
+fn picker(
+    selected: Option<&'static str>,
+    notify: bool,
+) -> Element<'static, PickMessage, Theme, ()> {
+    let list = pick_list(["Alpha", "Beta"], selected, PickMessage::Selected)
+        .width(200)
+        .padding(10)
+        .text_size(16)
+        .on_open(PickMessage::Opened);
+    if notify {
+        list.on_close(PickMessage::Closed).into()
+    } else {
+        list.into()
+    }
+}
+
+fn update<M>(
+    ui: &mut UserInterface<'_, M, Theme, ()>,
+    events: &[Event],
+    cursor: mouse::Cursor,
+) -> (Vec<M>, Vec<iced::event::Status>) {
+    let mut messages = vec![];
+    let (_, statuses) = ui.update(
+        events,
+        cursor,
+        &mut (),
+        &mut iced::advanced::clipboard::Null,
+        &mut messages,
+    );
+    (messages, statuses)
+}
+
+fn press_at(point: iced::Point) -> (Vec<Event>, mouse::Cursor) {
+    (
+        vec![
+            Event::Mouse(mouse::Event::CursorMoved { position: point }),
+            Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
+            Event::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left)),
+        ],
+        mouse::Cursor::Available(point),
+    )
+}
+
+#[test]
+fn picker_overlay_escape_closes_once_reopens_selects_and_retains_outside_click() {
+    for selected in [None, Some("Alpha")] {
+        for notify in [false, true] {
+            let mut ui = UserInterface::build(
+                picker(selected, notify),
+                Size::new(400., 300.),
+                Cache::new(),
+                &mut (),
+            );
+            let (click, cursor) = press_at(iced::Point::new(50., 15.));
+            assert_eq!(update(&mut ui, &click, cursor).0, [PickMessage::Opened]);
+            let cache = ui.into_cache();
+            let mut ui = UserInterface::build(
+                picker(selected, notify),
+                Size::new(400., 300.),
+                cache,
+                &mut (),
+            );
+            let (messages, statuses) = update(
+                &mut ui,
+                &[key(Named::Escape), key(Named::Escape)],
+                mouse::Cursor::Unavailable,
+            );
+            assert_eq!(
+                messages,
+                if notify {
+                    vec![PickMessage::Closed]
+                } else {
+                    vec![]
+                }
+            );
+            assert_eq!(
+                statuses,
+                [iced::event::Status::Captured, iced::event::Status::Ignored]
+            );
+            let cache = ui.into_cache();
+            let mut ui = UserInterface::build(
+                picker(selected, notify),
+                Size::new(400., 300.),
+                cache,
+                &mut (),
+            );
+            assert_eq!(update(&mut ui, &click, cursor).0, [PickMessage::Opened]);
+            let cache = ui.into_cache();
+            let mut ui = UserInterface::build(
+                picker(selected, notify),
+                Size::new(400., 300.),
+                cache,
+                &mut (),
+            );
+            let (outside, cursor) = press_at(iced::Point::new(350., 250.));
+            assert_eq!(
+                update(&mut ui, &outside, cursor).0,
+                if notify {
+                    vec![PickMessage::Closed]
+                } else {
+                    vec![]
+                }
+            );
+            let cache = ui.into_cache();
+            let mut ui = UserInterface::build(
+                picker(selected, notify),
+                Size::new(400., 300.),
+                cache,
+                &mut (),
+            );
+            let (click, cursor) = press_at(iced::Point::new(50., 15.));
+            assert_eq!(update(&mut ui, &click, cursor).0, [PickMessage::Opened]);
+            let cache = ui.into_cache();
+            let mut ui = UserInterface::build(
+                picker(selected, notify),
+                Size::new(400., 300.),
+                cache,
+                &mut (),
+            );
+            // Default 16px text uses 1.3 line-height: button/option height 40.8.
+            let (option, cursor) = press_at(iced::Point::new(50., 100.));
+            assert_eq!(
+                update(&mut ui, &option, cursor).0,
+                [PickMessage::Selected("Beta")]
+            );
+            let cache = ui.into_cache();
+            let mut ui = UserInterface::build(
+                picker(Some("Beta"), notify),
+                Size::new(400., 300.),
+                cache,
+                &mut (),
+            );
+            assert_eq!(
+                update(&mut ui, &[key(Named::Escape)], mouse::Cursor::Unavailable),
+                (vec![], vec![iced::event::Status::Ignored])
+            );
+        }
+    }
+}
+
+#[test]
+fn initially_closed_picker_handles_open_then_escape_in_one_runtime_batch() {
+    for notify in [false, true] {
+        let mut ui = UserInterface::build(
+            picker(Some("Alpha"), notify),
+            Size::new(400., 300.),
+            Cache::new(),
+            &mut (),
+        );
+        let (mut events, cursor) = press_at(iced::Point::new(50., 15.));
+        events.push(key(Named::Escape));
+        let (messages, statuses) = update(&mut ui, &events, cursor);
+        assert_eq!(
+            messages,
+            if notify {
+                vec![PickMessage::Opened, PickMessage::Closed]
+            } else {
+                vec![PickMessage::Opened]
+            }
+        );
+        assert_eq!(statuses.last(), Some(&iced::event::Status::Captured));
+        assert_eq!(
+            update(&mut ui, &[key(Named::Escape)], mouse::Cursor::Unavailable),
+            (vec![], vec![iced::event::Status::Ignored])
+        );
+    }
+}
+
+#[test]
+fn dismissed_picker_ignores_a_queued_click_in_its_old_option_area() {
+    let mut ui = UserInterface::build(
+        picker(Some("Alpha"), true),
+        Size::new(400., 300.),
+        Cache::new(),
+        &mut (),
+    );
+    let (click, cursor) = press_at(iced::Point::new(50., 15.));
+    assert_eq!(update(&mut ui, &click, cursor).0, [PickMessage::Opened]);
+    let cache = ui.into_cache();
+    let mut ui = UserInterface::build(
+        picker(Some("Alpha"), true),
+        Size::new(400., 300.),
+        cache,
+        &mut (),
+    );
+    let (click, cursor) = press_at(iced::Point::new(50., 100.));
+    let mut batch = vec![key(Named::Escape)];
+    batch.extend(click);
+    let (messages, _) = update(&mut ui, &batch, cursor);
+    assert_eq!(
+        messages,
+        [PickMessage::Closed],
+        "queued old-option click must not select Beta"
+    );
+}
+
+fn draft_with_picker(app: &App) -> Element<'_, Message, Theme, ()> {
+    // This composition deliberately keeps a focused input beneath the actual
+    // picker overlay. It tests event ownership, not a claimed production form.
+    root(
+        app,
+        crate::source_navigation::interaction::observe(
+            column![
+                container(
+                    text_input("Raw draft", "Keep exact bytes 雨").on_input(|_| Message::Escape)
+                )
+                .height(40),
+                pick_list([Layer::Oa, Layer::Sa], Some(Layer::Oa), Message::Layer)
+                    .width(200)
+                    .padding(10),
+            ]
+            .into(),
+            app.source_symbols.raw_interaction.clone(),
+        ),
+    )
+}
+
+#[test]
+fn picker_overlay_precedes_focused_input_and_creation_source_drafts() {
+    use crate::behavior::{Event as BehaviorEvent, creation, source_draft};
+    let runtime = tokio::runtime::Builder::new_current_thread()
+        .enable_time()
+        .build()
+        .unwrap();
+    let _entered = runtime.enter();
+    for (source, same_batch) in [(false, false), (true, false), (false, true), (true, true)] {
+        let mut app = App::with_project(Project::empty());
+        let send = |app: &mut App, event| {
+            let _ = app.update(Message::Behavior(BehaviorEvent::Creation(event)));
+        };
+        send(&mut app, creation::Event::Open(Layer::Oa));
+        send(&mut app, creation::Event::Choose(creation::Family::Machine));
+        send(
+            &mut app,
+            creation::Event::Name("Retained machine 雨".into()),
+        );
+        if source {
+            let recovery = app.behavior.creation.recovery_snapshot().unwrap().unwrap();
+            let invocation = serde_json::from_value(recovery["invocation"].clone()).unwrap();
+            send(
+                &mut app,
+                creation::Event::Source(source_draft::Event::Open(invocation)),
+            );
+            let recovery = app.behavior.creation.recovery_snapshot().unwrap().unwrap();
+            let token =
+                serde_json::from_value(recovery["source"]["editing"]["token"].clone()).unwrap();
+            send(
+                &mut app,
+                creation::Event::Source(source_draft::Event::Edit(
+                    token,
+                    source_draft::Edit::Name("Uncommitted owner 雨".into()),
+                )),
+            );
+            assert_eq!(
+                app.behavior.creation.recovery_snapshot().unwrap().unwrap()["source"]["editing"]["name"],
+                "Uncommitted owner 雨"
+            );
+        }
+        let draft = app.behavior.recovery_snapshot().unwrap();
+        let project = app.project().clone();
+        let bundle = app.document.bundle().clone();
+        let revision = app.document.revision();
+        let selection = (app.selected, app.selected_node, app.active_diagram);
+        let camera = (app.pan, app.zoom);
+        let raw_epoch = app
+            .source_symbols
+            .raw_interaction
+            .load(std::sync::atomic::Ordering::Acquire);
+        let mut ui = UserInterface::build(
+            draft_with_picker(&app),
+            Size::new(500., 400.),
+            Cache::new(),
+            &mut (),
+        );
+        let event = key(Named::Escape);
+        let (mut click, cursor) = press_at(iced::Point::new(50., 55.));
+        let (mut messages, statuses) = if same_batch {
+            ui.operate(&(), &mut FocusInputs);
+            click.push(event.clone());
+            update(&mut ui, &click, cursor)
+        } else {
+            assert!(update(&mut ui, &click, cursor).0.is_empty());
+            let cache = ui.into_cache();
+            ui = UserInterface::build(
+                draft_with_picker(&app),
+                Size::new(500., 400.),
+                cache,
+                &mut (),
+            );
+            ui.operate(&(), &mut FocusInputs);
+            update(
+                &mut ui,
+                std::slice::from_ref(&event),
+                mouse::Cursor::Unavailable,
+            )
+        };
+        assert_eq!(statuses.last(), Some(&iced::event::Status::Captured));
+        subscriptions(&app, event, *statuses.last().unwrap(), &mut messages);
+        assert!(
+            messages.is_empty(),
+            "picker must not forward global modal cancellation"
+        );
+        let cache = ui.into_cache();
+        assert_eq!(app.behavior.recovery_snapshot().unwrap(), draft);
+        assert!(!crate::source_navigation::interaction::is_current(
+            &app.source_symbols.raw_interaction,
+            raw_epoch,
+        ));
+        let mut ui = UserInterface::build(
+            draft_with_picker(&app),
+            Size::new(500., 400.),
+            cache,
+            &mut (),
+        );
+        let event = key(Named::Escape);
+        let (mut messages, statuses) = update(
+            &mut ui,
+            std::slice::from_ref(&event),
+            mouse::Cursor::Unavailable,
+        );
+        subscriptions(&app, event, statuses[0], &mut messages);
+        assert_eq!(messages.len(), 1);
+        assert!(matches!(messages[0], Message::Escape));
+        drop(ui);
+        let _ = app.update(messages.remove(0));
+        if source {
+            assert!(app.behavior.creation.has_pending());
+            assert!(!app.behavior.creation.source_open());
+            assert_eq!(
+                app.behavior.creation.recovery_snapshot().unwrap().unwrap()["name"],
+                "Retained machine 雨"
+            );
+        } else {
+            assert!(!app.behavior.creation.has_pending());
+        }
+        assert_eq!(app.project(), &project);
+        assert_eq!(app.document.bundle(), &bundle);
+        assert_eq!(app.document.revision(), revision);
+        assert_eq!(
+            (app.selected, app.selected_node, app.active_diagram),
+            selection
+        );
+        assert_eq!((app.pan, app.zoom), camera);
+        assert!(!app.document.can_undo() && !app.document.can_redo());
+    }
+}
+
+#[test]
+fn ignored_tooltip_escape_preserves_modal_priority_and_rejects_stale_focus() {
+    use crate::source_navigation::interaction;
+    use iced::widget::{text, tooltip};
+    use std::sync::atomic::Ordering;
+
+    let runtime = tokio::runtime::Builder::new_current_thread()
+        .enable_time()
+        .build()
+        .unwrap();
+    let _entered = runtime.enter();
+    let mut app = App::with_project(Project::empty());
+    app.page = Page::Text;
+    app.source_navigation.open = true;
+    let project = app.project().clone();
+    let source = app.document.bundle().clone();
+    let context = (
+        app.selected,
+        app.selected_node,
+        app.active_diagram,
+        app.pan,
+        app.zoom,
+    );
+    let content = || -> Element<'_, Message, Theme, ()> {
+        let field = text_input("Find", "Retained query 雨").on_input(|_| Message::Escape);
+        let tip = tooltip(field, text("Help"), tooltip::Position::Bottom)
+            .delay(std::time::Duration::ZERO);
+        root(
+            &app,
+            interaction::observe(tip.into(), app.source_symbols.raw_interaction.clone()),
+        )
+    };
+    let mut ui = UserInterface::build(content(), Size::new(400., 180.), Cache::new(), &mut ());
+    let point = iced::Point::new(10., 10.);
+    let cursor = mouse::Cursor::Available(point);
+    assert!(
+        update(
+            &mut ui,
+            &[Event::Mouse(mouse::Event::CursorMoved { position: point })],
+            cursor
+        )
+        .0
+        .is_empty()
+    );
+    let cache = ui.into_cache();
+    let mut ui = UserInterface::build(content(), Size::new(400., 180.), cache, &mut ());
+    ui.operate(&(), &mut FocusInputs);
+    let epoch = app.source_symbols.raw_interaction.load(Ordering::Acquire);
+    let event = key(Named::Escape);
+    let (mut messages, statuses) = update(&mut ui, std::slice::from_ref(&event), cursor);
+    assert_eq!(statuses, [iced::event::Status::Captured]);
+    subscriptions(&app, event, statuses[0], &mut messages);
+    assert_eq!(messages.len(), 1);
+    assert!(matches!(messages[0], Message::Escape));
+    assert!(!interaction::is_current(
+        &app.source_symbols.raw_interaction,
+        epoch
+    ));
+    drop(ui);
+    let _ = app.update(messages.remove(0));
+    assert!(!app.source_navigation.open);
+    assert_eq!(app.project(), &project);
+    assert_eq!(app.document.bundle(), &source);
+    assert_eq!(
+        (
+            app.selected,
+            app.selected_node,
+            app.active_diagram,
+            app.pan,
+            app.zoom
+        ),
+        context
+    );
+    assert!(!app.document.can_undo() && !app.document.can_redo());
+}
+
+#[test]
+fn toggling_bridge_policy_retains_focused_child_state() {
+    let mut app = App::with_project(Project::empty());
+    let content = || -> Element<'static, Message, Theme, ()> {
+        text_input("Raw field", "Still focused")
+            .on_input(|_| Message::Escape)
+            .into()
+    };
+    let mut ui = UserInterface::build(
+        root(&app, content()),
+        Size::new(400., 100.),
+        Cache::new(),
+        &mut (),
+    );
+    ui.operate(&(), &mut FocusInputs);
+    let cache = ui.into_cache();
+    app.page = Page::Text;
+    app.source_navigation.open = true;
+    let mut ui = UserInterface::build(root(&app, content()), Size::new(400., 100.), cache, &mut ());
+    let (messages, status) = update(&mut ui, &[key(Named::Escape)], mouse::Cursor::Unavailable);
+    assert_eq!(status, [iced::event::Status::Captured]);
+    assert_eq!(messages.len(), 1);
+    assert!(matches!(messages[0], Message::Escape));
+}
+
+#[tokio::test]
+async fn mounted_creation_name_escape_keeps_pending_modal_priority() {
+    use crate::behavior::canvas_workspace::tests::Mounted;
+    use crate::behavior::{Event as BehaviorEvent, creation};
+    for pending in [false, true] {
+        let mut app = App::with_project(Project::empty());
+        for event in [
+            creation::Event::Open(Layer::Oa),
+            creation::Event::Choose(creation::Family::Sequence),
+            creation::Event::Name("Exact unfinished process 雨".into()),
+        ] {
+            let _ = app.update(Message::Behavior(BehaviorEvent::Creation(event)));
+        }
+        app.page = Page::Behavior;
+        let mut mounted = Mounted::new(&mut app).await;
+        mounted
+            .perform(
+                &mut app,
+                iced::widget::operation::focus(creation::NAME_INPUT),
+            )
+            .await;
+        if pending {
+            app.pending = Some(super::super::Pending::Walkthrough);
+        }
+        let before = app.document.snapshot();
+        let draft = app.behavior.recovery_snapshot().unwrap();
+        let event = key(Named::Escape);
+        let (mut messages, statuses) = mounted.input_with_status(
+            &app,
+            std::slice::from_ref(&event),
+            mouse::Cursor::Unavailable,
+        );
+        subscriptions(&app, event, statuses[0], &mut messages);
+        assert_eq!(
+            messages
+                .iter()
+                .filter(|message| matches!(message, Message::Escape))
+                .count(),
+            1
+        );
+        for message in messages {
+            let _ = app.update(message);
+        }
+        if pending {
+            assert!(app.pending.is_none());
+            assert_eq!(app.behavior.recovery_snapshot().unwrap(), draft);
+        } else {
+            assert!(!app.behavior.creation.has_pending());
+        }
+        assert!(std::sync::Arc::ptr_eq(&before, &app.document.snapshot()));
+        assert!(!app.document.can_undo() && !app.document.can_redo());
+    }
+}

crates/oa-desktop/src/app/multiselect.rs

@@ -64,7 +64,7 @@ pub(crate) fn placements(snapshot: &Snapshot) -> Option<std::collections::BTreeS
         .collect()
 }
 
-fn visible(
+pub(super) fn visible(
     project: &Project,
     diagram: Id,
     view: &projection::ProjectedView,
@@ -283,7 +283,7 @@ impl App {
         }
     }
 
-    fn inspect_multiselect_primary(&mut self) {
+    pub(super) fn inspect_multiselect_primary(&mut self) {
         if self.topology_context().is_some() {
             self.inspect_process_multiselect_primary();
             return;
@@ -422,7 +422,7 @@ impl App {
                     })
                 {
                     self.status =
-                        "Group allocation drag is not available yet. The selection was retained."
+                        "Use an Allocation drag to assign this selection, or arm Arrange next drag."
                             .into();
                     return;
                 }

crates/oa-desktop/src/app/multiselect_tests.rs

@@ -145,6 +145,202 @@ fn assert_source_matches_model(app: &App) {
     assert_eq!(&compiled.bundle, app.document.bundle());
 }
 
+fn text_apply_group_fixture(state: bool) -> (App, Id, Id, Id) {
+    let ordinary = fixture();
+    if !state {
+        return (ordinary.app, ordinary.diagram, ordinary.a, ordinary.b);
+    }
+    // Keep the ordinary diagram, routes and opposite-layer view in the same
+    // Project so the complete-model oracle also protects non-active surfaces.
+    let mut project = ordinary.app.project().clone();
+    let ordinary_view = project.diagrams[&ordinary.diagram].clone();
+    let system = project
+        .add_element(Kind::System, Layer::Sa, "System", None)
+        .unwrap();
+    let machine = project
+        .add_element(Kind::StateMachine, Layer::Sa, "Modes", Some(system))
+        .unwrap();
+    let region = project
+        .add_element(Kind::Region, Layer::Sa, "Region", Some(machine))
+        .unwrap();
+    let first = project
+        .add_element(Kind::State, Layer::Sa, "Before text", Some(region))
+        .unwrap();
+    let second = project
+        .add_element(Kind::State, Layer::Sa, "Other state", Some(region))
+        .unwrap();
+    let diagram = project.ensure_diagram(Layer::Sa);
+    assert_ne!(diagram, ordinary.diagram);
+    project.diagrams.get_mut(&diagram).unwrap().projection =
+        ProjectionKind::StateMachine { machine };
+    let a = project.place(diagram, first, point(20., 30.));
+    let b = project.place(diagram, second, point(420., 30.));
+    assert_eq!(project.diagrams[&ordinary.diagram], ordinary_view);
+    let mut app = App::with_project(project);
+    app.page = Page::Behavior;
+    app.layer = Layer::Sa;
+    app.active_diagram = Some(ordinary.diagram);
+    app.behavior.active_owner = Some(machine);
+    app.behavior.diagram = crate::behavior::state_view::State {
+        diagram: Some(diagram),
+        ..Default::default()
+    };
+    app.selected = diagram;
+    app.selected_node = None;
+    app.refresh_draft();
+    app.reconcile_multiselect();
+    assert_eq!(app.state_context().unwrap().diagram, diagram);
+    (app, diagram, a, b)
+}
+
+#[test]
+fn completed_text_apply_rejects_captured_ordinary_and_state_group_actions() {
+    for state in [false, true] {
+        let (mut app, diagram, a, b) = text_apply_group_fixture(state);
+        choose(&mut app, Target::Placement(a), GroupChoice::Replace);
+        choose(&mut app, Target::Placement(b), GroupChoice::Add);
+        let stale = app.multiselect_snapshot().unwrap();
+        let before = app.document.snapshot();
+        assert!(!app.document.can_undo());
+        let element = app.project().diagrams[&diagram].nodes[&a].element;
+        let location = app.document.compiled().index.declarations[&element].clone();
+        let old_name = if state { "Before text" } else { "Send" };
+        assert_eq!(app.project().elements[&element].name, old_name);
+        let quoted_name = format!("\"{old_name}\"");
+        let original = &before.bundle.files[&location.path];
+        assert_eq!(original.matches(quoted_name.as_str()).count(), 1);
+        let edited = original.replace(quoted_name.as_str(), "\"Changed through Text\"");
+        let mut expected_model = before.decoded.project.clone();
+        expected_model.elements.get_mut(&element).unwrap().name = "Changed through Text".into();
+        let mut expected_bundle = before.bundle.clone();
+        expected_bundle
+            .files
+            .insert(location.path.clone(), edited.clone());
+
+        let _ = app.update(Message::Page(Page::Text));
+        let _ = app.update(Message::SourceFile(location.path));
+        let _ = app.update(Message::SourceEdit(text_editor::Action::SelectAll));
+        let _ = app.update(Message::SourceEdit(text_editor::Action::Edit(
+            text_editor::Edit::Paste(Arc::new(edited.clone())),
+        )));
+        assert!(app.source_dirty());
+        assert_eq!(app.source_editor.text(), edited);
+        assert_eq!(app.project(), &before.decoded.project);
+        assert_eq!(app.document.bundle(), &before.bundle);
+        let _ = app.update(Message::ApplySource);
+        assert!(!app.source_dirty(), "{}", app.status);
+        assert_eq!(app.project(), &expected_model);
+        assert_eq!(app.document.bundle(), &expected_bundle);
+        assert!(app.document.can_undo());
+        assert!(!app.document.can_redo());
+        assert_source_matches_model(&app);
+
+        let _ = app.update(Message::Page(if state {
+            Page::Behavior
+        } else {
+            Page::Diagram
+        }));
+        choose(&mut app, Target::Placement(a), GroupChoice::Replace);
+        choose(&mut app, Target::Placement(b), GroupChoice::Add);
+        let current = app.multiselect_snapshot().unwrap();
+        assert_eq!(
+            current.targets(),
+            &[Target::Placement(a), Target::Placement(b)]
+        );
+        assert_eq!(current.primary(), Some(&Target::Placement(b)));
+        assert_ne!(current.context(), stale.context());
+        assert!(app.multiselect_envelope(&GroupEvent::Hide(current.clone())));
+        app.status = "Feedback after completed Text Apply".into();
+        app.allocation_drag.arrange_next = true;
+        let revision = app.document.revision();
+        let epochs = (
+            app.canvas_epoch,
+            app.camera_epoch,
+            app.allocation_drag.epoch,
+        );
+        let legacy = (
+            app.selected,
+            app.selected_node,
+            app.behavior.diagram.placement,
+        );
+        let camera = (app.zoom, app.pan, app.fit_to_view, app.canvas_size);
+        let state_camera = (
+            app.behavior.diagram.zoom,
+            app.behavior.diagram.pan,
+            app.behavior.diagram.fit,
+            app.behavior.diagram.viewport,
+        );
+        let draft = app
+            .draft
+            .as_ref()
+            .map(|d| serde_json::to_value(d.recovery_snapshot()).unwrap());
+        for event in [
+            GroupEvent::Move(stale.clone(), point(900., 800.)),
+            GroupEvent::Hide(stale.clone()),
+            GroupEvent::Collapse(stale.clone(), Target::Placement(a)),
+            GroupEvent::Refuse(stale.clone(), "Obsolete refusal".into()),
+        ] {
+            dispatch(&mut app, event);
+            assert_eq!(app.project(), &expected_model);
+            assert_eq!(app.document.bundle(), &expected_bundle);
+            assert_eq!(app.document.revision(), revision);
+            assert_eq!(app.multiselect_snapshot(), Some(current.clone()));
+            assert_eq!(
+                (
+                    app.selected,
+                    app.selected_node,
+                    app.behavior.diagram.placement
+                ),
+                legacy
+            );
+            assert_eq!(
+                (
+                    app.canvas_epoch,
+                    app.camera_epoch,
+                    app.allocation_drag.epoch
+                ),
+                epochs
+            );
+            assert_eq!(
+                (app.zoom, app.pan, app.fit_to_view, app.canvas_size),
+                camera
+            );
+            assert_eq!(
+                (
+                    app.behavior.diagram.zoom,
+                    app.behavior.diagram.pan,
+                    app.behavior.diagram.fit,
+                    app.behavior.diagram.viewport
+                ),
+                state_camera
+            );
+            assert_eq!(app.status, "Feedback after completed Text Apply");
+            assert!(app.allocation_drag.arrange_next);
+            assert!(!app.source_dirty());
+            assert_eq!(
+                app.draft
+                    .as_ref()
+                    .map(|d| serde_json::to_value(d.recovery_snapshot()).unwrap()),
+                draft
+            );
+            assert!(app.document.can_undo());
+            assert!(!app.document.can_redo());
+        }
+        // Actual Text Apply is the sole history entry; no stale group action
+        // can create a hidden second edit or damage either round-trip snapshot.
+        let _ = app.update(Message::Undo);
+        assert_eq!(app.project(), &before.decoded.project);
+        assert_eq!(app.document.bundle(), &before.bundle);
+        assert!(!app.document.can_undo());
+        assert!(app.document.can_redo());
+        let _ = app.update(Message::Redo);
+        assert_eq!(app.project(), &expected_model);
+        assert_eq!(app.document.bundle(), &expected_bundle);
+        assert!(app.document.can_undo());
+        assert!(!app.document.can_redo());
+    }
+}
+
 #[test]
 fn toggled_group_moves_model_and_source_once_and_keeps_primary_through_history() {
     let mut f = fixture();

crates/oa-desktop/src/app/process_canvas.rs

@@ -65,6 +65,7 @@ impl App {
                 owner: context.owner,
                 revision: context.revision,
                 epoch: lifetime,
+                scenario_view: None,
             };
             if self.behavior.has_pending()
                 || self.draft_dirty()

crates/oa-desktop/src/app/process_multiselect/tests.rs

@@ -144,6 +144,151 @@ fn marker(app: &mut App, owner: Id, occurrence: Id) {
     assert!(app.diagram_focus(Surface::Process(owner)).is_some());
 }
 
+#[test]
+fn completed_text_apply_rejects_captured_process_reorder_without_retiring_current_state() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = fixture(layer);
+        pair(&mut f);
+        let stale = f.app.multiselect_snapshot().unwrap();
+        let before = f.app.document.snapshot();
+        assert!(!f.app.document.can_undo());
+        let element = f.nodes[0];
+        let location = f.app.document.compiled().index.declarations[&element].clone();
+        let original = &before.bundle.files[&location.path];
+        let quoted_name = format!("\"{}\"", f.app.project().elements[&element].name);
+        assert_eq!(original.matches(quoted_name.as_str()).count(), 1);
+        let edited = original.replace(quoted_name.as_str(), "\"Changed through Text\"");
+        let mut expected = before.decoded.project.clone();
+        expected.elements.get_mut(&element).unwrap().name = "Changed through Text".into();
+        let mut expected_bundle = before.bundle.clone();
+        expected_bundle
+            .files
+            .insert(location.path.clone(), edited.clone());
+
+        let _ = f.app.update(Message::Page(Page::Text));
+        let _ = f.app.update(Message::SourceFile(location.path));
+        let _ = f
+            .app
+            .update(Message::SourceEdit(text_editor::Action::SelectAll));
+        let _ = f.app.update(Message::SourceEdit(text_editor::Action::Edit(
+            text_editor::Edit::Paste(Arc::new(edited.clone())),
+        )));
+        assert!(f.app.source_dirty());
+        assert_eq!(f.app.source_editor.text(), edited);
+        assert!(Arc::ptr_eq(&before, &f.app.document.snapshot()));
+        let _ = f.app.update(Message::ApplySource);
+        assert!(!f.app.source_dirty(), "{}", f.app.status);
+        assert_eq!(f.app.project(), &expected);
+        assert_eq!(f.app.document.bundle(), &expected_bundle);
+        source_matches(&f.app);
+
+        let _ = f.app.update(Message::Page(Page::Behavior));
+        assert_eq!(f.app.topology_context().unwrap().owner, f.owner);
+        pair(&mut f);
+        let current = f.app.multiselect_snapshot().unwrap();
+        assert_eq!(current.targets(), stale.targets());
+        assert_eq!(current.primary(), stale.primary());
+        assert_ne!(current.context(), stale.context());
+        let destination = Destination::After(f.nodes[2]);
+        assert!(
+            matches!(
+                Prepared::new(f.app.project(), f.owner, current.targets())
+                    .unwrap()
+                    .plan(destination)
+                    .unwrap(),
+                Plan::Change(_)
+            ),
+            "the replay must be a real reorder, not a no-op"
+        );
+        assert!(
+            f.app
+                .multiselect_envelope(&Event::ProcessReorder(current.clone(), destination))
+        );
+        let accepted = f.app.document.snapshot();
+        let revision = f.app.document.revision();
+        let workspace = f.app.source_workspace.bundle();
+        let editor = f.app.source_editor.text();
+        let selected = (
+            f.app.selected,
+            f.app.selected_node,
+            f.app.selected_bend,
+            f.app.selected_attachment,
+        );
+        let camera = (f.app.zoom, f.app.pan, f.app.fit_to_view, f.app.canvas_size);
+        let process_camera = f.app.behavior.topology.camera_boundary();
+        let epochs = (
+            f.app.canvas_epoch,
+            f.app.camera_epoch,
+            f.app.allocation_drag.epoch,
+        );
+        let draft = f
+            .app
+            .draft
+            .as_ref()
+            .map(|d| serde_json::to_value(d.recovery_snapshot()).unwrap());
+        let form = f.app.behavior.recovery_snapshot();
+        let status = f.app.status.clone();
+        let pending_reveal = f.app.pending_diagram_reveal.clone();
+
+        send(&mut f.app, Event::ProcessReorder(stale, destination));
+        assert!(Arc::ptr_eq(&accepted, &f.app.document.snapshot()));
+        assert_eq!(f.app.project(), &expected);
+        assert_eq!(f.app.document.bundle(), &expected_bundle);
+        assert_eq!(f.app.document.revision(), revision);
+        assert_eq!(f.app.source_workspace.bundle(), workspace);
+        assert_eq!(f.app.source_editor.text(), editor);
+        assert_eq!(f.app.multiselect_snapshot(), Some(current));
+        assert_eq!(
+            (
+                f.app.selected,
+                f.app.selected_node,
+                f.app.selected_bend,
+                f.app.selected_attachment
+            ),
+            selected
+        );
+        assert_eq!(
+            (f.app.zoom, f.app.pan, f.app.fit_to_view, f.app.canvas_size),
+            camera
+        );
+        assert!(f.app.behavior.topology.camera_boundary() == process_camera);
+        assert_eq!(
+            (
+                f.app.canvas_epoch,
+                f.app.camera_epoch,
+                f.app.allocation_drag.epoch
+            ),
+            epochs
+        );
+        assert_eq!(
+            f.app
+                .draft
+                .as_ref()
+                .map(|d| serde_json::to_value(d.recovery_snapshot()).unwrap()),
+            draft
+        );
+        assert_eq!(f.app.behavior.recovery_snapshot(), form);
+        assert_eq!(f.app.pending_diagram_reveal, pending_reveal);
+        assert_eq!(f.app.status, status);
+        assert!(!f.app.source_dirty());
+        assert!(f.app.document.can_undo());
+        assert!(!f.app.document.can_redo());
+
+        let _ = f.app.update(Message::Undo);
+        assert_eq!(f.app.project(), &before.decoded.project);
+        assert_eq!(f.app.document.bundle(), &before.bundle);
+        assert!(!f.app.document.can_undo());
+        assert!(f.app.document.can_redo());
+        source_matches(&f.app);
+        let _ = f.app.update(Message::Redo);
+        assert_eq!(f.app.project(), &expected);
+        assert_eq!(f.app.document.bundle(), &expected_bundle);
+        assert!(f.app.document.can_undo());
+        assert!(!f.app.document.can_redo());
+        source_matches(&f.app);
+    }
+}
+
 #[test]
 fn process_group_reverse_click_order_changes_only_owner_steps_and_undoes_once() {
     for layer in [Layer::Oa, Layer::Sa] {

crates/oa-desktop/src/app/scenario_details_tests.rs

@@ -0,0 +1,279 @@
+//! Actual arrangement selection and current-record Details admission.
+use super::*;
+use crate::behavior::canvas_workspace::tests::Mounted;
+use crate::behavior::scenario::{CanvasEvent, Context, Shelf};
+use crate::behavior::scenario_layout::Representation;
+use iced::{Point, Size, advanced::widget};
+
+const FIXTURE: &str = include_str!("diagram_usages/tests/saved_scenario.arcadia");
+
+fn id(app: &App, alias: &str) -> Id {
+    app.project()
+        .identities()
+        .into_iter()
+        .find(|(_, name)| *name == alias)
+        .unwrap()
+        .0
+}
+fn setup() -> (App, Id, Id, Id) {
+    let mut app = App::with_project(oa_core::language::parse(FIXTURE).unwrap());
+    let a = id(&app, "incident_readable");
+    let b = id(&app, "incident_wide");
+    let owner = id(&app, "incident_response");
+    let _ = app.update(Message::Select(owner));
+    let _ = app.update(Message::Page(Page::Behavior));
+    choose(&mut app, Representation::Saved { diagram: a });
+    let _ = app.update(Message::Select(a));
+    app.window_size = Size::new(1440., 1000.);
+    (app, a, b, owner)
+}
+fn send(app: &mut App, event: impl FnOnce(Context) -> CanvasEvent) {
+    let context = app.scenario_context().unwrap();
+    let _ = app.update(Message::ScenarioCanvas(event(context)));
+}
+fn choose(app: &mut App, representation: Representation) {
+    send(app, |context| {
+        CanvasEvent::Representation(context, representation)
+    });
+}
+fn model_state(app: &App) -> (u64, bool, bool, bool) {
+    (
+        app.document.revision(),
+        app.document.dirty(),
+        app.document.can_undo(),
+        app.document.can_redo(),
+    )
+}
+
+#[tokio::test]
+async fn actual_arrangement_picker_follows_selected_saved_record_and_opens_b_properties() {
+    let (mut app, a, b, _) = setup();
+    let mut mounted = Mounted::new(&mut app).await;
+    let snapshot = app.document.snapshot();
+    let before = model_state(&app);
+    let captured = app.scenario_context().unwrap();
+    let picker = mounted.geometry(&app).bounds("scenario-arrangement-picker");
+    assert!(
+        app.window_size.height - (picker.y + picker.height) > picker.y,
+        "fixture has room for Iced's menu below the actual picker"
+    );
+    assert_eq!(app.selected, a);
+    mounted.click(&mut app, picker.center()).await;
+    // iced_widget 0.14.2 overlay/menu.rs uses default line height plus
+    // vertical padding for each row. The real workspace orders Automatic,
+    // then the fixture's A/B/C Diagram IDs. Select B from the actual overlay.
+    let row_height =
+        f32::from(iced::advanced::text::LineHeight::default().to_absolute(12.into())) + 10.;
+    let b_row = Point::new(
+        picker.center_x(),
+        picker.y + picker.height + row_height * 2.5,
+    );
+    assert!(b_row.y < app.window_size.height);
+    let events = mounted.click(&mut app, b_row).await;
+    assert!(events.iter().any(|event| matches!(event,
+        Message::ScenarioCanvas(CanvasEvent::Representation(context, Representation::Saved { diagram }))
+        if *context == captured && *diagram == b)), "must exercise the actual arrangement callback");
+    assert_eq!(app.selected, b);
+    assert_eq!(app.draft.as_ref().unwrap().original, b);
+    assert_eq!(
+        app.draft.as_ref().unwrap().value["name"],
+        "B - Incident review negative and far"
+    );
+    assert_eq!(app.active_diagram, Some(b));
+    assert_eq!(
+        app.scenario_context().unwrap().representation,
+        Representation::Saved { diagram: b }
+    );
+    assert_ne!(app.scenario_context().unwrap().visit, captured.visit);
+
+    send(&mut app, |context| {
+        CanvasEvent::Shelf(context, Shelf::Selection)
+    });
+    mounted.settle(&mut app).await;
+    let geometry = mounted.geometry(&app);
+    let (details, offset) = geometry.scrolls[&widget::Id::new("scenario-details")];
+    let point = geometry.bounds("scenario-properties").center() - offset;
+    assert!(details.contains(point));
+    let events = mounted.click(&mut app, point).await;
+    assert!(events.iter().any(|event| matches!(event,
+        Message::ScenarioCanvas(CanvasEvent::Properties(_, selected)) if *selected == b)));
+    mounted.settle(&mut app).await;
+    let geometry = mounted.geometry(&app);
+    let (inspector, offset) = geometry.scrolls[&widget::Id::new("inspector")];
+    assert!(
+        geometry
+            .text_inputs
+            .iter()
+            .any(|bounds| inspector.contains(bounds.center() - offset)),
+        "current B Properties must expose an actual editable field"
+    );
+    assert!(
+        !geometry
+            .scrolls
+            .contains_key(&widget::Id::new("scenario-details"))
+    );
+    assert_eq!(
+        app.inspector_tab,
+        crate::navigation::InspectorTab::Properties
+    );
+    assert_eq!(app.selected, b);
+    assert_eq!(app.draft.as_ref().unwrap().original, b);
+    assert!(Arc::ptr_eq(&snapshot, &app.document.snapshot()));
+    assert_eq!(app.project(), &snapshot.decoded.project);
+    assert_eq!(app.document.bundle(), &snapshot.bundle);
+    assert_eq!(model_state(&app), before);
+}
+
+#[test]
+fn arrangement_change_preserves_independent_semantic_and_foreign_view_selection() {
+    for alias in [
+        "initial_report",
+        "reporter",
+        "incident_response",
+        "incident_repair",
+    ] {
+        let (mut app, _, b, _) = setup();
+        let selected = id(&app, alias);
+        let _ = app.update(Message::Select(selected));
+        let snapshot = app.document.snapshot();
+        let before = model_state(&app);
+        choose(&mut app, Representation::Saved { diagram: b });
+        assert_eq!(app.selected, selected, "independent selection {alias}");
+        assert_eq!(app.draft.as_ref().unwrap().original, selected);
+        assert_eq!(app.active_diagram, Some(b));
+        assert!(Arc::ptr_eq(&snapshot, &app.document.snapshot()));
+        assert_eq!(app.document.bundle(), &snapshot.bundle);
+        assert_eq!(model_state(&app), before);
+        if alias == "incident_repair" {
+            assert!(!behavior::scenario::properties_target(
+                app.project(),
+                app.scenario_context().unwrap(),
+                selected
+            ));
+        }
+    }
+}
+
+#[test]
+fn arrangement_follows_view_record_to_automatic_owner_but_not_owner_back_to_saved() {
+    let (mut app, _, b, owner) = setup();
+    let snapshot = app.document.snapshot();
+    let before = model_state(&app);
+    choose(&mut app, Representation::Derived { owner });
+    assert_eq!(app.selected, owner);
+    assert_eq!(app.draft.as_ref().unwrap().original, owner);
+    assert_eq!(app.active_diagram, None);
+    assert!(behavior::scenario::properties_target(
+        app.project(),
+        app.scenario_context().unwrap(),
+        owner
+    ));
+    choose(&mut app, Representation::Saved { diagram: b });
+    assert_eq!(
+        app.selected, owner,
+        "Scenario owner is now independent semantic selection"
+    );
+    assert_eq!(app.draft.as_ref().unwrap().original, owner);
+    assert_eq!(app.active_diagram, Some(b));
+    assert!(Arc::ptr_eq(&snapshot, &app.document.snapshot()));
+    assert_eq!(app.document.bundle(), &snapshot.bundle);
+    assert_eq!(model_state(&app), before);
+}
+
+#[test]
+fn arrangement_applies_only_the_old_view_draft_then_follows_b_with_one_undo() {
+    let (mut app, a, b, _) = setup();
+    let snapshot = app.document.snapshot();
+    let mut expected = app.project().clone();
+    expected.diagrams.get_mut(&a).unwrap().name = "Reviewed A".into();
+    let revision = app.document.revision();
+    let _ = app.update(Message::Field("/name".into(), "Reviewed A".into()));
+    choose(&mut app, Representation::Saved { diagram: b });
+    assert_eq!(app.project(), &expected);
+    assert_eq!(app.selected, b);
+    assert_eq!(app.draft.as_ref().unwrap().original, b);
+    assert!(!app.draft_dirty());
+    assert_eq!(app.document.revision(), revision + 1);
+    let accepted = app.document.snapshot();
+    let _ = app.update(Message::Undo);
+    assert_eq!(app.project(), &snapshot.decoded.project);
+    assert_eq!(app.document.bundle(), &snapshot.bundle);
+    assert!(!app.document.can_undo() && app.document.can_redo());
+    let _ = app.update(Message::Redo);
+    assert_eq!(app.project(), &expected);
+    assert_eq!(app.document.bundle(), &accepted.bundle);
+    assert!(app.document.can_undo() && !app.document.can_redo());
+}
+
+#[test]
+fn same_arrangement_uuid_edit_follows_the_reidentified_record_and_round_trips_source() {
+    let (mut app, a, _, _) = setup();
+    let snapshot = app.document.snapshot();
+    let replacement = Id::parse_str("70200000-0000-4000-8000-000000000099").unwrap();
+    let mut expected = app.project().clone();
+    let mut diagram = expected.diagrams.remove(&a).unwrap();
+    diagram.id = replacement;
+    expected.diagrams.insert(replacement, diagram);
+    let _ = app.update(Message::Field("/id".into(), replacement.to_string()));
+    choose(&mut app, Representation::Saved { diagram: a });
+    assert_eq!(app.project(), &expected);
+    assert_eq!(app.selected, replacement);
+    assert_eq!(app.draft.as_ref().unwrap().original, replacement);
+    assert_eq!(app.active_diagram, Some(replacement));
+    assert_eq!(
+        app.scenario_context().unwrap().representation,
+        Representation::Saved {
+            diagram: replacement
+        }
+    );
+    let accepted = app.document.snapshot();
+    let _ = app.update(Message::Undo);
+    assert_eq!(app.project(), &snapshot.decoded.project);
+    assert_eq!(app.document.bundle(), &snapshot.bundle);
+    assert!(!app.document.can_undo() && app.document.can_redo());
+    let _ = app.update(Message::Redo);
+    assert_eq!(app.project(), &expected);
+    assert_eq!(app.document.bundle(), &accepted.bundle);
+    assert!(!app.document.can_redo());
+}
+
+#[test]
+fn invalid_draft_and_stale_arrangement_preserve_selection_inputs_and_accepted_state() {
+    let (mut app, a, b, _) = setup();
+    let old = app.scenario_context().unwrap();
+    let snapshot = app.document.snapshot();
+    let before = model_state(&app);
+    let _ = app.update(Message::Field("/id".into(), "not-a-uuid".into()));
+    let draft_value = app.draft.as_ref().unwrap().value.clone();
+    choose(&mut app, Representation::Saved { diagram: b });
+    assert_eq!(app.selected, a);
+    assert_eq!(app.active_diagram, Some(a));
+    assert_eq!(
+        app.scenario_context().unwrap().representation,
+        old.representation
+    );
+    assert_eq!(app.draft.as_ref().unwrap().value, draft_value);
+    assert_eq!(app.draft.as_ref().unwrap().inputs["/id"].raw, "not-a-uuid");
+    assert!(app.draft_dirty());
+    assert!(Arc::ptr_eq(&snapshot, &app.document.snapshot()));
+    assert_eq!(model_state(&app), before);
+    let _ = app.update(Message::RevertProperties);
+    choose(&mut app, Representation::Saved { diagram: b });
+    let current = app.scenario_context().unwrap();
+    let _ = app.update(Message::Field("/name".into(), "Retained B input".into()));
+    let selected = app.selected;
+    let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Representation(
+        old,
+        Representation::Saved { diagram: a },
+    )));
+    assert_eq!(app.selected, selected);
+    assert_eq!(app.active_diagram, Some(b));
+    assert_eq!(app.scenario_context().unwrap().visit, current.visit);
+    assert_eq!(
+        app.draft.as_ref().unwrap().inputs["/name"].raw,
+        "Retained B input"
+    );
+    assert!(Arc::ptr_eq(&snapshot, &app.document.snapshot()));
+    assert_eq!(app.document.bundle(), &snapshot.bundle);
+    assert_eq!(model_state(&app), before);
+}

crates/oa-desktop/src/app/scenario_diagram.rs

@@ -0,0 +1,96 @@
+//! Saved Scenario navigation is presentation state, never a document edit.
+use super::*;
+use crate::behavior::scenario_layout::{Representation, presentation::checked_owner};
+
+impl App {
+    pub(super) fn enter_scenario_representation(&mut self, representation: Representation) -> bool {
+        let Some(owner) = checked_owner(self.project(), representation) else {
+            self.status =
+                "This Scenario view is no longer available or has an incompatible owner.".into();
+            return false;
+        };
+        self.layer = self.project().elements[&owner].layer();
+        self.page = Page::Behavior;
+        self.behavior.active_owner = Some(owner);
+        match representation {
+            Representation::Saved { diagram } => self.active_diagram = Some(diagram),
+            Representation::Derived { .. } => {
+                if self
+                    .active_diagram
+                    .is_some_and(|id| self.saved_scenario_diagram(id))
+                {
+                    self.active_diagram = None;
+                }
+            }
+        }
+        self.selected_node = None;
+        if self
+            .behavior
+            .scenario
+            .enter_representation(self.canvas_document, owner, representation)
+        {
+            self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
+        }
+        true
+    }
+
+    /// Reconcile after navigation/adoption without selecting or applying a draft.
+    /// A retained invalid Saved identity remains unavailable; it must not silently
+    /// turn into a different automatic Scenario or another saved arrangement.
+    pub(super) fn reconcile_scenario_workspace(&mut self) {
+        if self.page == Page::Diagram
+            && !self.behavior.has_pending()
+            && let Some(diagram) = self
+                .active_diagram
+                .filter(|id| self.saved_scenario_diagram(*id))
+        {
+            self.enter_scenario_representation(Representation::Saved { diagram });
+        }
+        if self.page != Page::Behavior {
+            self.behavior.scenario.leave();
+            return;
+        }
+        if let Some(rep @ Representation::Saved { diagram }) =
+            self.behavior.scenario.representation()
+        {
+            // The requested view is authoritative until explicit navigation
+            // retires it. This also recovers the same view when Undo restores it.
+            if let Some(owner) = checked_owner(self.project(), rep) {
+                self.active_diagram = Some(diagram);
+                self.layer = self.project().elements[&owner].layer();
+                self.behavior.active_owner = Some(owner);
+                self.behavior
+                    .scenario
+                    .enter_representation(self.canvas_document, owner, rep);
+            } else if let Some(owner) = self.behavior.scenario.owner() {
+                self.behavior
+                    .scenario
+                    .enter_representation(self.canvas_document, owner, rep);
+            }
+            return;
+        }
+        let Some(owner) = behavior::selected_owner(self) else {
+            self.behavior.scenario.leave();
+            return;
+        };
+        if self
+            .project()
+            .elements
+            .get(&owner)
+            .is_some_and(|e| e.kind() == Kind::Scenario)
+        {
+            self.behavior.scenario.enter(self.canvas_document, owner);
+        } else {
+            self.behavior.scenario.leave();
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests;
+
+#[cfg(test)]
+mod adoption_tests;
+
+#[cfg(test)]
+mod owner_navigation_tests;

crates/oa-desktop/src/app/scenario_diagram/adoption_tests.rs

@@ -0,0 +1,264 @@
+//! Independent adoption oracles: expected Projects are edited directly in the
+//! fixture, then admitted through the actual source editor/Document transaction.
+//! Navigation is checked separately from the expected authored mutation.
+use super::*;
+use crate::behavior::canvas_workspace::tests::Mounted;
+use iced::advanced::widget;
+use iced::widget::text_editor;
+use oa_core::language;
+use std::sync::Arc;
+
+struct Fixture {
+    app: App,
+    owner: Id,
+    same_layer: Id,
+    other_layer: Id,
+    view: Id,
+    spare_view: Id,
+}
+
+fn fixture() -> Fixture {
+    let mut project = Project::empty();
+    let owner = project
+        .add_element(Kind::Scenario, Layer::Oa, "Original owner", None)
+        .unwrap();
+    let same_layer = project
+        .add_element(Kind::Scenario, Layer::Oa, "Other OA owner", None)
+        .unwrap();
+    let other_layer = project
+        .add_element(Kind::Scenario, Layer::Sa, "SA owner", None)
+        .unwrap();
+    // A remaining topology makes silent fallback observably different from the
+    // required unavailable Saved view after its owner is deleted.
+    project
+        .add_element(Kind::Process, Layer::Oa, "Remaining process", None)
+        .unwrap();
+    let mut make_view = |alias: &str, name: &str, owner| {
+        let id = Id::new_v4();
+        project.diagrams.insert(
+            id,
+            Diagram {
+                id,
+                alias: alias.into(),
+                name: name.into(),
+                description: String::new(),
+                layer: Layer::Oa,
+                projection: ProjectionKind::Scenario { scenario: owner },
+                layout: None,
+                nodes: Default::default(),
+                routes: vec![],
+                view_options: Default::default(),
+            },
+        );
+        id
+    };
+    let view = make_view("retained_view", "Retained arrangement", owner);
+    let spare_view = make_view("spare_view", "Spare arrangement", same_layer);
+    let mut app = App::with_project(project);
+    let _ = app.update(Message::Select(owner));
+    choose(&mut app, view);
+    assert_saved(&app, view, owner, Layer::Oa);
+    assert!(!app.document.can_undo());
+    Fixture {
+        app,
+        owner,
+        same_layer,
+        other_layer,
+        view,
+        spare_view,
+    }
+}
+
+fn choose(app: &mut App, id: Id) {
+    let _ = app.update(Message::Diagram(Choice {
+        id,
+        label: "Previously captured picker item".into(),
+    }));
+}
+
+fn assert_saved(app: &App, view: Id, owner: Id, layer: Layer) {
+    assert_eq!(app.page, Page::Behavior);
+    assert_eq!(app.layer, layer);
+    assert_eq!(app.active_diagram, Some(view));
+    let context = app
+        .scenario_context()
+        .expect("saved owner remains the visible context");
+    assert_eq!(context.scenario, owner);
+    assert_eq!(
+        context.representation,
+        Representation::Saved { diagram: view }
+    );
+    assert!(!context.visit.is_nil());
+}
+
+fn adopt_from_source(app: &mut App, expected: &Project) {
+    let text = language::format(expected);
+    // Parser equality is a fixture precondition, not the navigation oracle.
+    assert_eq!(language::parse(&text).unwrap(), *expected);
+    let _ = app.update(Message::Page(Page::Text));
+    let _ = app.update(Message::SourceEdit(text_editor::Action::SelectAll));
+    let _ = app.update(Message::SourceEdit(text_editor::Action::Edit(
+        text_editor::Edit::Paste(Arc::new(text)),
+    )));
+    assert!(app.source_dirty());
+    let _ = app.update(Message::ApplySource);
+    assert!(!app.source_dirty(), "{}", app.status);
+    assert_eq!(
+        app.project(),
+        expected,
+        "actual source transaction must adopt exactly the fixture change"
+    );
+    let _ = app.update(Message::Page(Page::Behavior));
+}
+
+fn retarget(cross_layer: bool) {
+    let mut f = fixture();
+    let before = f.app.document.snapshot();
+    let old_context = f.app.scenario_context().unwrap();
+    let revision = f.app.document.revision();
+    let target = if cross_layer {
+        f.other_layer
+    } else {
+        f.same_layer
+    };
+    let layer = if cross_layer { Layer::Sa } else { Layer::Oa };
+    let mut expected = before.decoded.project.clone();
+    let view = expected.diagrams.get_mut(&f.view).unwrap();
+    view.projection = ProjectionKind::Scenario { scenario: target };
+    view.layer = layer;
+
+    adopt_from_source(&mut f.app, &expected);
+    assert_saved(&f.app, f.view, target, layer);
+    assert_ne!(f.app.scenario_context().unwrap().visit, old_context.visit);
+    assert_eq!(
+        f.app.document.revision(),
+        revision + 1,
+        "routing must not create a second transaction"
+    );
+    assert_eq!(
+        f.app.project().diagrams[&f.spare_view],
+        before.decoded.project.diagrams[&f.spare_view]
+    );
+    let adopted_bundle = f.app.document.bundle().clone();
+
+    let _ = f.app.update(Message::Undo);
+    assert_saved(&f.app, f.view, f.owner, Layer::Oa);
+    assert_eq!(f.app.project(), &before.decoded.project);
+    assert_eq!(f.app.document.bundle(), &before.bundle);
+    assert!(
+        !f.app.document.can_undo(),
+        "exactly one authored adoption must be undone"
+    );
+    let _ = f.app.update(Message::Redo);
+    assert_saved(&f.app, f.view, target, layer);
+    assert_eq!(f.app.project(), &expected);
+    assert_eq!(f.app.document.bundle(), &adopted_bundle);
+    assert!(!f.app.document.can_redo());
+}
+
+#[test]
+fn source_same_layer_owner_retarget_undo_redo_keeps_requested_saved_uuid() {
+    retarget(false);
+}
+
+#[test]
+fn source_cross_layer_owner_retarget_undo_redo_keeps_requested_saved_uuid() {
+    retarget(true);
+}
+
+#[tokio::test]
+async fn source_deleted_owner_and_saved_view_mount_unavailable_instead_of_another_behavior() {
+    let mut f = fixture();
+    let before = f.app.document.snapshot();
+    let mut expected = before.decoded.project.clone();
+    assert!(expected.elements.remove(&f.owner).is_some());
+    assert!(expected.diagrams.remove(&f.view).is_some());
+    assert!(expected.elements.contains_key(&f.same_layer));
+    assert!(
+        expected
+            .elements
+            .values()
+            .any(|e| e.kind() == Kind::Process)
+    );
+    adopt_from_source(&mut f.app, &expected);
+    assert_eq!(
+        f.app.behavior.scenario.representation(),
+        Some(Representation::Saved { diagram: f.view })
+    );
+    let adopted = f.app.document.snapshot();
+    let revision = f.app.document.revision();
+    let mut mounted = Mounted::new(&mut f.app).await;
+    let geometry = mounted.geometry(&f.app);
+    assert!(
+        geometry
+            .containers
+            .contains_key(&widget::Id::from("scenario-viewport-unavailable"))
+    );
+    assert!(
+        !geometry
+            .containers
+            .contains_key(&widget::Id::from("scenario-viewport"))
+    );
+    assert_eq!(f.app.project(), &expected);
+    assert_eq!(f.app.document.bundle(), &adopted.bundle);
+    assert_eq!(
+        f.app.document.revision(),
+        revision,
+        "mounting unavailable must remain passive"
+    );
+
+    let _ = f.app.update(Message::Undo);
+    assert_saved(&f.app, f.view, f.owner, Layer::Oa);
+    assert_eq!(f.app.document.bundle(), &before.bundle);
+    let _ = f.app.update(Message::Redo);
+    assert_eq!(
+        f.app.behavior.scenario.representation(),
+        Some(Representation::Saved { diagram: f.view })
+    );
+    mounted.settle(&mut f.app).await;
+    assert!(
+        mounted
+            .geometry(&f.app)
+            .containers
+            .contains_key(&widget::Id::from("scenario-viewport-unavailable"))
+    );
+    assert_eq!(f.app.project(), &expected);
+    assert_eq!(f.app.document.bundle(), &adopted.bundle);
+}
+
+#[test]
+fn missing_and_deleted_picker_ids_cannot_apply_an_unrelated_valid_property_draft() {
+    let mut f = fixture();
+    let mut expected = f.app.project().clone();
+    expected.diagrams.remove(&f.spare_view).unwrap();
+    adopt_from_source(&mut f.app, &expected);
+    let _ = f.app.update(Message::Select(f.owner));
+    let _ = f.app.update(Message::Field(
+        "/name".into(),
+        "Pending valid owner rename".into(),
+    ));
+    assert!(f.app.draft_dirty());
+    let before = f.app.document.snapshot();
+    let revision = f.app.document.revision();
+    let selected = f.app.selected;
+    for invalid in [Id::nil(), f.spare_view] {
+        choose(&mut f.app, invalid);
+        assert_saved(&f.app, f.view, f.owner, Layer::Oa);
+        assert_eq!(f.app.selected, selected);
+        assert!(f.app.draft_dirty());
+        assert_eq!(f.app.project(), &before.decoded.project);
+        assert_eq!(f.app.document.bundle(), &before.bundle);
+        assert_eq!(f.app.document.revision(), revision);
+    }
+    // Establish that the retained draft really was valid, not merely refused by
+    // the property validator: explicit Apply commits it in exactly one step.
+    assert!(f.app.apply(), "{}", f.app.status);
+    assert_eq!(
+        f.app.project().elements[&f.owner].name,
+        "Pending valid owner rename"
+    );
+    assert_eq!(f.app.document.revision(), revision + 1);
+    let _ = f.app.update(Message::Undo);
+    assert_eq!(f.app.project(), &before.decoded.project);
+    assert_eq!(f.app.document.bundle(), &before.bundle);
+}

crates/oa-desktop/src/app/scenario_diagram/owner_navigation_tests.rs

@@ -0,0 +1,116 @@
+//! Explicit owner navigation must retire a retained Saved Scenario, including
+//! when selection was made on a different page. These are real App events.
+use super::*;
+use crate::behavior::scenario::CanvasEvent;
+
+fn setup(kind: Kind) -> (App, Id, Id) {
+    let mut project = Project::empty();
+    let scenario = project
+        .add_element(Kind::Scenario, Layer::Oa, "Incident review", None)
+        .unwrap();
+    let target = project
+        .add_element(kind, Layer::Oa, "Explicit destination", None)
+        .unwrap();
+    let view = Id::new_v4();
+    project.diagrams.insert(
+        view,
+        Diagram {
+            id: view,
+            alias: "incident_saved".into(),
+            name: "Incident saved arrangement".into(),
+            description: String::new(),
+            layer: Layer::Oa,
+            projection: ProjectionKind::Scenario { scenario },
+            layout: None,
+            nodes: Default::default(),
+            routes: vec![],
+            view_options: Default::default(),
+        },
+    );
+    let errors: Vec<_> = oa_core::validation::validate(&project)
+        .into_iter()
+        .filter(|issue| issue.severity == oa_core::validation::Severity::Error)
+        .collect();
+    assert!(errors.is_empty(), "{errors:?}");
+    let mut app = App::with_project(project);
+    let _ = app.update(Message::Select(scenario));
+    let _ = app.update(Message::Diagram(Choice {
+        id: view,
+        label: "Incident saved arrangement".into(),
+    }));
+    assert_eq!(app.page, Page::Behavior);
+    assert_eq!(
+        app.scenario_context().unwrap().representation,
+        Representation::Saved { diagram: view }
+    );
+    assert_eq!(app.selected, scenario);
+    (app, scenario, target)
+}
+
+fn assert_destination(app: &App, target: Id) {
+    assert_eq!(app.page, Page::Behavior);
+    assert_eq!(app.selected, target);
+    assert_eq!(app.behavior.active_owner, Some(target));
+    assert_eq!(behavior::selected_owner(app), Some(target));
+    assert_eq!(
+        app.behavior.scenario.representation(),
+        None,
+        "explicit non-Scenario destination must not retain an overriding Saved request"
+    );
+    assert!(app.scenario_context().is_none());
+}
+
+fn exercise(via_guide: bool) {
+    for kind in [Kind::Process, Kind::StateMachine] {
+        let (mut app, scenario, target) = setup(kind);
+        assert_ne!(scenario, target);
+        let held = app.scenario_context().unwrap();
+        let accepted = app.document.snapshot();
+        let drafts = app.source_workspace.bundle();
+        let revision = app.document.revision();
+        let dirty = (app.document.dirty(), app.dirty(), app.source_dirty());
+        assert!(!app.document.can_undo() && !app.document.can_redo());
+        if via_guide {
+            let _ = app.update(Message::Page(Page::Guide));
+            assert_eq!(app.page, Page::Guide);
+            assert!(app.scenario_context().is_none());
+        }
+        let _ = app.update(Message::Select(target));
+        if via_guide {
+            assert_eq!(
+                app.page,
+                Page::Guide,
+                "explorer selection must not itself switch the page"
+            );
+            let _ = app.update(Message::Page(Page::Behavior));
+        }
+        assert_destination(&app, target);
+        let camera = app.camera_boundary();
+        // The prior saved canvas cannot open its outline after either owner route.
+        let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Shelf(
+            held,
+            crate::behavior::scenario::Shelf::Selection,
+        )));
+        assert_destination(&app, target);
+        assert!(app.camera_boundary() == camera);
+        assert_eq!(app.project(), &accepted.decoded.project);
+        assert_eq!(app.document.bundle(), &accepted.bundle);
+        assert_eq!(app.source_workspace.bundle(), drafts);
+        assert_eq!(app.document.revision(), revision);
+        assert_eq!(
+            (app.document.dirty(), app.dirty(), app.source_dirty()),
+            dirty
+        );
+        assert!(!app.document.can_undo() && !app.document.can_redo());
+    }
+}
+
+#[test]
+fn saved_scenario_guide_selection_returns_to_explicit_process_or_state_owner() {
+    exercise(true);
+}
+
+#[test]
+fn saved_scenario_direct_behavior_selection_enters_explicit_process_or_state_owner() {
+    exercise(false);
+}

crates/oa-desktop/src/app/scenario_diagram/tests.rs

@@ -0,0 +1,205 @@
+use super::*;
+use crate::behavior::scenario::{CanvasEvent, ScrollArea};
+
+fn saved(p: &mut Project, owner: Id, name: &str) -> Id {
+    let id = Id::new_v4();
+    p.diagrams.insert(
+        id,
+        Diagram {
+            id,
+            alias: format!("view_{}", p.diagrams.len()),
+            name: name.into(),
+            description: String::new(),
+            layer: Layer::Oa,
+            projection: ProjectionKind::Scenario { scenario: owner },
+            layout: None,
+            routes: vec![],
+            nodes: Default::default(),
+            view_options: Default::default(),
+        },
+    );
+    id
+}
+fn setup() -> (App, Id, Id, Id, Id) {
+    let (mut p, [owner, callee, _], [reference, _, _]) =
+        behavior::scenario::direct_tests::navigation_fixture();
+    let a = saved(&mut p, owner, "Review A");
+    let b = saved(&mut p, owner, "Review B");
+    let mut app = App::with_project(p);
+    app.select(owner);
+    (app, a, b, reference, callee)
+}
+fn choose(app: &mut App, diagram: Id) {
+    let _ = app.update(Message::Diagram(Choice {
+        id: diagram,
+        label: "Captured view".into(),
+    }));
+}
+fn event(app: &mut App, f: impl FnOnce(behavior::scenario::Context) -> CanvasEvent) {
+    let context = app.scenario_context().unwrap();
+    let _ = app.update(Message::ScenarioCanvas(f(context)));
+}
+#[test]
+fn saved_view_switches_are_distinct_passive_visits_and_preserve_actual_history() {
+    let (mut app, a, b, _, _) = setup();
+    let original = app.document.snapshot();
+    let owner = app.selected;
+    assert!(app.execute(Command::Rename(owner, "Previously edited caller".into())));
+    let edited = app.document.snapshot();
+    let edited_revision = app.document.revision();
+    choose(&mut app, a);
+    let first = app.scenario_context().unwrap();
+    choose(&mut app, b);
+    let second = app.scenario_context().unwrap();
+    choose(&mut app, a);
+    let third = app.scenario_context().unwrap();
+    assert_eq!(first.scenario, owner);
+    assert_eq!(first.representation, Representation::Saved { diagram: a });
+    assert_eq!(second.representation, Representation::Saved { diagram: b });
+    assert_ne!(first.visit, second.visit);
+    assert_ne!(first.visit, third.visit);
+    assert_eq!(app.page, Page::Behavior);
+    assert_eq!(app.selected, owner);
+    assert_eq!(app.document.bundle(), &edited.bundle);
+    assert_eq!(app.project(), &edited.decoded.project);
+    assert_eq!(app.document.revision(), edited_revision);
+    let _ = app.update(Message::Undo);
+    assert_eq!(app.document.bundle(), &original.bundle);
+    assert_eq!(app.project(), &original.decoded.project);
+    let _ = app.update(Message::Redo);
+    assert_eq!(app.document.bundle(), &edited.bundle);
+    assert_eq!(app.project(), &edited.decoded.project);
+}
+#[test]
+fn saved_view_return_rejects_old_passive_events_without_an_intermediate_frame() {
+    let (mut app, a, b, _, _) = setup();
+    choose(&mut app, a);
+    let old = app.scenario_context().unwrap();
+    choose(&mut app, b);
+    choose(&mut app, a);
+    let current = app.scenario_context().unwrap();
+    let camera = app.behavior.scenario.camera_boundary();
+    let before = app.document.snapshot();
+    for stale in [
+        CanvasEvent::Viewport(old, iced::Size::new(432., 321.)),
+        CanvasEvent::Scrolled(old, ScrollArea::Page, iced::Vector::new(0., 800.)),
+        CanvasEvent::FormShown(old, Id::new_v4()),
+        CanvasEvent::Restored(
+            old,
+            Id::new_v4(),
+            ScrollArea::Page,
+            iced::Vector::new(0., 800.),
+        ),
+        CanvasEvent::Camera(
+            old,
+            app.camera_epoch,
+            behavior::canvas_workspace::Event::Pan(iced::Vector::new(90., 80.)),
+        ),
+    ] {
+        let _ = app.update(Message::ScenarioCanvas(stale));
+        assert_eq!(app.scenario_context(), Some(current));
+        assert!(app.behavior.scenario.camera_boundary() == camera);
+        assert_eq!(app.document.bundle(), &before.bundle);
+    }
+}
+#[test]
+fn saved_reference_back_restores_exact_view_with_a_fresh_visit() {
+    let (mut app, a, _, reference, callee) = setup();
+    choose(&mut app, a);
+    let caller = app.scenario_context().unwrap();
+    let before = app.document.snapshot();
+    event(&mut app, |ctx| CanvasEvent::OpenUse(ctx, reference));
+    let target = app.scenario_context().unwrap();
+    assert_eq!(target.scenario, callee);
+    assert_eq!(
+        target.representation,
+        Representation::Derived { owner: callee }
+    );
+    assert_eq!(app.active_diagram, None);
+    event(&mut app, CanvasEvent::Back);
+    let returned = app.scenario_context().unwrap();
+    assert_eq!(returned.representation, caller.representation);
+    assert_eq!(app.active_diagram, Some(a));
+    assert_eq!(app.selected, reference);
+    assert_ne!(returned.visit, caller.visit);
+    assert_eq!(app.document.bundle(), &before.bundle);
+    assert_eq!(app.project(), &before.decoded.project);
+    assert!(!app.document.can_undo());
+}
+#[test]
+fn saved_picker_applies_valid_old_draft_and_uuid_edit_follows_that_same_view() {
+    let (mut app, a, b, _, _) = setup();
+    choose(&mut app, a);
+    let _ = app.update(Message::Select(a));
+    let before = app.document.snapshot();
+    let _ = app.update(Message::Field("/name".into(), "Renamed A".into()));
+    choose(&mut app, b);
+    assert_eq!(app.project().diagrams[&a].name, "Renamed A");
+    assert_eq!(app.selected, b);
+    assert_eq!(
+        app.scenario_context().unwrap().representation,
+        Representation::Saved { diagram: b }
+    );
+    let _ = app.update(Message::Undo);
+    assert_eq!(app.document.bundle(), &before.bundle);
+    choose(&mut app, a);
+    let replacement = Id::new_v4();
+    let _ = app.update(Message::Field("/id".into(), replacement.to_string()));
+    choose(&mut app, a);
+    assert!(!app.project().diagrams.contains_key(&a));
+    assert_eq!(app.active_diagram, Some(replacement));
+    assert_eq!(app.selected, replacement);
+    assert_eq!(
+        app.scenario_context().unwrap().representation,
+        Representation::Saved {
+            diagram: replacement
+        }
+    );
+}
+#[test]
+fn leaving_and_reentering_saved_view_preserves_source_and_retires_passive_visit() {
+    let (mut app, a, _, _, _) = setup();
+    choose(&mut app, a);
+    let old = app.scenario_context().unwrap();
+    let before = app.document.snapshot();
+    let _ = app.update(Message::Page(Page::Guide));
+    assert!(app.scenario_context().is_none());
+    let _ = app.update(Message::Page(Page::Behavior));
+    let fresh = app.scenario_context().unwrap();
+    assert_eq!(fresh.representation, old.representation);
+    assert_ne!(fresh.visit, old.visit);
+    assert_eq!(app.document.bundle(), &before.bundle);
+}
+
+#[test]
+fn arrangement_picker_rejects_previous_visit_and_switches_automatic_without_model_changes() {
+    let (mut app, a, b, _, _) = setup();
+    choose(&mut app, a);
+    let stale = app.scenario_context().unwrap();
+    choose(&mut app, b);
+    let current = app.scenario_context().unwrap();
+    let before = app.document.snapshot();
+    let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Representation(
+        stale,
+        Representation::Saved { diagram: a },
+    )));
+    assert_eq!(app.scenario_context(), Some(current));
+    event(&mut app, |context| {
+        CanvasEvent::Representation(
+            context,
+            Representation::Derived {
+                owner: context.scenario,
+            },
+        )
+    });
+    assert_eq!(
+        app.scenario_context().unwrap().representation,
+        Representation::Derived {
+            owner: current.scenario
+        }
+    );
+    assert_eq!(app.active_diagram, None);
+    assert_eq!(app.document.bundle(), &before.bundle);
+    assert_eq!(app.project(), &before.decoded.project);
+    assert!(!app.document.can_undo());
+}

crates/oa-desktop/src/app/scenario_spacing.rs

@@ -0,0 +1,88 @@
+//! Admit spacing packets before ordinary navigation can retire a newer reveal.
+use super::*;
+use behavior::scenario::spacing::{Event, controller::Finish};
+
+#[cfg(test)]
+mod tests;
+
+impl App {
+    pub(super) fn spacing_enabled(&self) -> bool {
+        self.pending_diagram_reveal.is_none()
+            && !self.behavior.has_pending()
+            && !self.draft_dirty()
+            && !self.source_dirty()
+            && !self.source_rename.open()
+            && behavior::canvas_workspace::keyboard_enabled(self)
+    }
+
+    pub(super) fn scenario_spacing(&mut self, event: Event) -> Task<Message> {
+        let stamp = event.stamp();
+        if self.scenario_context() != Some(stamp.context) || self.camera_epoch != stamp.camera_epoch
+        {
+            return Task::none();
+        }
+        let state = &self.behavior.scenario;
+        let matches =
+            state.spacing_token() == Some(event.token()) && state.spacing_stamp() == Some(stamp);
+        if match event {
+            Event::Begin { token, .. } => token.is_nil() || state.spacing_token().is_some(),
+            _ => !matches,
+        } {
+            return Task::none();
+        }
+        if matches!(event, Event::Cancel { .. }) || !self.spacing_enabled() {
+            if self.behavior.scenario.cancel_spacing() {
+                self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
+            }
+            return Task::none();
+        }
+        match event {
+            Event::Begin { .. } => {
+                let mut state = std::mem::take(&mut self.behavior.scenario);
+                let result = state.begin_spacing(self.project(), event);
+                self.behavior.scenario = state;
+                if result.is_err() {
+                    self.status = "The drag could not start in this view. Try again.".into();
+                }
+            }
+            Event::Move { screen, .. } => self.behavior.scenario.move_spacing(screen),
+            Event::Finish { screen, .. } => {
+                let finished = self.behavior.scenario.finish_spacing(screen);
+                // Retire queued packets even for zero motion or a refused finish.
+                self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
+                match finished {
+                    Ok(Finish::Click(target)) => self.select(target),
+                    Ok(Finish::Noop) => {}
+                    Ok(Finish::Commit {
+                        command,
+                        selected,
+                        scale,
+                        pan,
+                    }) => {
+                        // Document prepares and writes the source candidate before
+                        // committing its snapshot. Failure leaves camera/selection
+                        // and source/history at their accepted values.
+                        match self.document.execute(*command) {
+                            Ok(_) => {
+                                self.selected = selected;
+                                self.selected_node = None;
+                                self.diagram_navigation_focus = None;
+                                self.behavior.scenario.accept_spacing_camera(scale, pan);
+                                self.sync();
+                                self.status = "Scenario spacing updated.".into();
+                            }
+                            Err(error) => self.status = format!("Spacing was not applied: {error}"),
+                        }
+                    }
+                    Err(_) => {
+                        self.status =
+                            "That position cannot be applied. The saved arrangement is unchanged."
+                                .into()
+                    }
+                }
+            }
+            Event::Cancel { .. } => unreachable!(),
+        }
+        Task::none()
+    }
+}

crates/oa-desktop/src/app/scenario_spacing/tests.rs

@@ -0,0 +1,393 @@
+use super::*;
+use behavior::scenario::{
+    CanvasEvent,
+    spacing::{
+        Target,
+        controller::tests::{fixture, packet},
+    },
+};
+use iced::{Point, Size, Vector};
+
+fn setup() -> (App, Id, Id) {
+    let (document, owner, diagram, lane, message) = fixture();
+    let mut app = App::with_project(document.project().clone());
+    let _ = app.update(Message::Select(owner));
+    let _ = app.update(Message::Diagram(Choice {
+        id: diagram,
+        label: "Saved".into(),
+    }));
+    let c = app.scenario_context().unwrap();
+    let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Viewport(
+        c,
+        Size::new(900., 600.),
+    )));
+    assert!(app.spacing_enabled());
+    (app, lane, message)
+}
+
+#[test]
+fn stale_text_and_scenario_messages_do_not_retire_a_new_saved_spacing_gesture() {
+    let (mut app, lane, _) = setup();
+    let previous = app.scenario_context().unwrap();
+    let diagram = match previous.representation {
+        behavior::scenario_layout::Representation::Saved { diagram } => diagram,
+        _ => unreachable!(),
+    };
+    let _ = app.update(Message::Page(Page::Text));
+    let old_indent = Message::SourceIndent(app.source_symbol_context(), false);
+    let old_drawer = Message::TextWorkspace(text_workspace::Event::ShowDrawer(
+        app.text_drawer_context(),
+        text_workspace::DrawerTab::Problems,
+    ));
+    let old_command = app.text_command_message(text_workspace::Command::ShowStatus);
+    let _ = app.update(Message::Diagram(Choice {
+        id: diagram,
+        label: "Saved".into(),
+    }));
+    let context = app.scenario_context().unwrap();
+    assert_ne!(context.visit, previous.visit);
+    let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Viewport(
+        context,
+        Size::new(900., 600.),
+    )));
+    let context = app.scenario_context().unwrap();
+    let (event, start, _) = begin(&mut app, Target::Lane(lane));
+    move_to(&mut app, event, start + Vector::new(24., 0.));
+    let accepted = app.document.snapshot();
+    let source = app.source_workspace.bundle();
+    let source_version = app.source_version;
+    let camera = app.camera_boundary();
+    let selected = app.selected;
+    let events = [
+        old_indent,
+        old_drawer,
+        old_command,
+        Message::ScenarioCanvas(CanvasEvent::Shelf(
+            previous,
+            behavior::scenario::Shelf::Selection,
+        )),
+        Message::ScenarioCanvas(CanvasEvent::Properties(previous, lane)),
+    ];
+    for rejected in events {
+        let _ = app.update(rejected);
+        assert_eq!(app.scenario_context(), Some(context));
+        assert_eq!(app.behavior.scenario.spacing_token(), Some(event.token()));
+        assert_eq!(app.behavior.scenario.spacing_stamp(), Some(event.stamp()));
+        assert!(app.camera_boundary() == camera);
+        assert_eq!(app.selected, selected);
+        assert_eq!(app.source_version, source_version);
+        assert_eq!(app.source_workspace.bundle(), source);
+        assert_eq!(app.document.bundle(), &accepted.bundle);
+        assert_eq!(app.project(), &accepted.decoded.project);
+        assert!(app.text_workspace.drawer().is_none());
+        assert!(!app.document.can_undo() && !app.document.can_redo());
+    }
+    finish(&mut app, event, start + Vector::new(24., 0.));
+    assert!(
+        app.document.can_undo(),
+        "the current gesture remains usable"
+    );
+}
+fn begin(app: &mut App, target: Target) -> (Event, Point, f32) {
+    let event = packet(
+        app.project(),
+        &app.behavior.scenario,
+        app.scenario_context().unwrap(),
+        app.camera_epoch,
+        target,
+    );
+    let Event::Begin {
+        press_screen,
+        scale,
+        ..
+    } = event
+    else {
+        unreachable!()
+    };
+    let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Spacing(event)));
+    assert_eq!(app.behavior.scenario.spacing_token(), Some(event.token()));
+    (event, press_screen, scale)
+}
+fn send(app: &mut App, event: Event) {
+    let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Spacing(event)));
+}
+fn move_to(app: &mut App, begin: Event, screen: Point) {
+    send(
+        app,
+        Event::Move {
+            stamp: begin.stamp(),
+            token: begin.token(),
+            screen,
+        },
+    );
+}
+fn finish(app: &mut App, begin: Event, screen: Point) {
+    send(
+        app,
+        Event::Finish {
+            stamp: begin.stamp(),
+            token: begin.token(),
+            screen,
+        },
+    );
+}
+
+#[test]
+fn same_batch_preview_is_immutable_and_one_commit_undo_redo_has_exact_source_parity() {
+    let (mut app, lane, _) = setup();
+    let original = app.document.snapshot();
+    let source = app.source_workspace.bundle();
+    let selected = app.selected;
+    let epoch = app.canvas_epoch;
+    let (event, start, scale) = begin(&mut app, Target::Lane(lane));
+    move_to(&mut app, event, start + Vector::new(40., 300.));
+    assert_eq!(app.selected, selected);
+    assert_eq!(app.canvas_epoch, epoch);
+    assert_eq!(app.project(), &original.decoded.project);
+    assert_eq!(app.source_workspace.bundle(), source);
+    assert!(!app.document.can_undo() && !app.document.can_redo());
+    finish(&mut app, event, start + Vector::new(40., 300.));
+    assert_eq!(app.selected, lane);
+    assert!(app.document.can_undo() && !app.document.can_redo());
+    let accepted = app.document.snapshot();
+    assert_ne!(accepted.bundle, original.bundle);
+    let expected = behavior::scenario::spacing::controller::tests::expected(
+        &original.decoded.project,
+        match event.stamp().context.representation {
+            behavior::scenario_layout::Representation::Saved { diagram } => diagram,
+            _ => unreachable!(),
+        },
+        Target::Lane(lane),
+        40. / scale,
+    );
+    assert_eq!(app.project(), &expected);
+    let _ = app.update(Message::ShortcutUndo(false));
+    assert_eq!(app.project(), &original.decoded.project);
+    assert_eq!(app.document.bundle(), &original.bundle);
+    assert!(!app.document.can_undo() && app.document.can_redo());
+    let _ = app.update(Message::ShortcutUndo(true));
+    assert_eq!(app.project(), &accepted.decoded.project);
+    assert_eq!(app.document.bundle(), &accepted.bundle);
+}
+
+#[test]
+fn click_selects_but_crossed_return_and_cancel_preserve_selection_camera_and_history() {
+    let (mut app, lane, message) = setup();
+    let original = app.document.snapshot();
+    let camera = app.behavior.scenario.camera_boundary();
+    let (event, start, _) = begin(&mut app, Target::Message(message));
+    finish(&mut app, event, start + Vector::new(30., 2.));
+    assert_eq!(app.selected, message);
+    assert!(camera == app.behavior.scenario.camera_boundary());
+    for cancel in [false, true] {
+        let (event, start, _) = begin(&mut app, Target::Lane(lane));
+        move_to(&mut app, event, start + Vector::new(30., 0.));
+        if cancel {
+            send(
+                &mut app,
+                Event::Cancel {
+                    stamp: event.stamp(),
+                    token: event.token(),
+                },
+            );
+        } else {
+            finish(&mut app, event, start);
+        }
+        assert_eq!(app.selected, message);
+        assert!(camera == app.behavior.scenario.camera_boundary());
+        assert_eq!(app.document.bundle(), &original.bundle);
+        assert_eq!(app.project(), &original.decoded.project);
+        assert!(!app.document.can_undo() && !app.document.can_redo());
+    }
+}
+
+#[test]
+fn stale_finish_after_new_view_and_forged_token_are_inert_before_reveal_reconciliation() {
+    let (mut app, lane, _) = setup();
+    let (event, start, _) = begin(&mut app, Target::Lane(lane));
+    let held_epoch = app.canvas_epoch;
+    send(
+        &mut app,
+        Event::Finish {
+            stamp: event.stamp(),
+            token: Id::new_v4(),
+            screen: start + Vector::new(30., 0.),
+        },
+    );
+    assert_eq!(app.canvas_epoch, held_epoch);
+    assert_eq!(app.behavior.scenario.spacing_token(), Some(event.token()));
+    let owner = event.stamp().context.scenario;
+    let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Representation(
+        event.stamp().context,
+        behavior::scenario_layout::Representation::Derived { owner },
+    )));
+    let current = app.scenario_context();
+    let epoch = app.canvas_epoch;
+    let original = app.document.snapshot();
+    finish(&mut app, event, start + Vector::new(50., 0.));
+    assert_eq!(app.scenario_context(), current);
+    assert_eq!(app.canvas_epoch, epoch);
+    assert!(app.behavior.scenario.spacing_token().is_none());
+    assert_eq!(app.document.bundle(), &original.bundle);
+}
+
+#[test]
+fn source_write_failure_cannot_commit_candidate_or_materialize_camera() {
+    let (mut app, lane, _) = setup();
+    let bundle = app.document.bundle().clone();
+    let mut limits = oa_core::source_project::ProjectLimits::default();
+    limits.model.max_source_bytes = bundle.files.values().map(String::len).sum();
+    app.document = Document::from_bundle(bundle, limits).unwrap();
+    app.sync();
+    let original = app.document.snapshot();
+    let selected = app.selected;
+    let camera = app.behavior.scenario.camera_boundary();
+    let (event, start, _) = begin(&mut app, Target::Lane(lane));
+    move_to(&mut app, event, start + Vector::new(40., 0.));
+    finish(&mut app, event, start + Vector::new(40., 0.));
+    assert!(
+        app.status.starts_with("Spacing was not applied:"),
+        "{}",
+        app.status
+    );
+    assert_eq!(app.selected, selected);
+    assert!(camera == app.behavior.scenario.camera_boundary());
+    assert_eq!(app.project(), &original.decoded.project);
+    assert_eq!(app.document.bundle(), &original.bundle);
+    assert!(!app.document.can_undo() && !app.document.can_redo());
+    assert!(app.behavior.scenario.spacing_token().is_none());
+}
+
+#[test]
+fn pending_semantic_draft_and_source_edit_cancel_and_reject_held_finish() {
+    for source in [false, true] {
+        let (mut app, lane, _) = setup();
+        let original = app.document.snapshot();
+        let selected = app.selected;
+        let (event, start, _) = begin(&mut app, Target::Lane(lane));
+        move_to(&mut app, event, start + Vector::new(30., 0.));
+        if source {
+            let _ = app.update(Message::SourceEdit(text_editor::Action::Edit(
+                text_editor::Edit::Insert(' '),
+            )));
+            assert!(app.source_dirty());
+        } else {
+            let _ = app.update(Message::Behavior(behavior::Event::Scenario(
+                behavior::scenario::Event::Start(
+                    event.stamp().context.scenario,
+                    behavior::scenario::Tool::Lifeline,
+                ),
+            )));
+            assert!(app.behavior.has_pending());
+        }
+        let draft = app.source_workspace.bundle();
+        assert!(app.behavior.scenario.spacing_token().is_none());
+        finish(&mut app, event, start + Vector::new(30., 0.));
+        assert_eq!(app.project(), &original.decoded.project);
+        assert_eq!(app.document.bundle(), &original.bundle);
+        assert_eq!(app.source_workspace.bundle(), draft);
+        assert_eq!(app.selected, selected);
+        assert!(!app.document.can_undo());
+    }
+}
+
+#[test]
+fn stale_finish_cannot_remove_new_same_view_deferred_reveal() {
+    let (mut app, lane, message) = setup();
+    let (event, start, _) = begin(&mut app, Target::Lane(lane));
+    let behavior::scenario_layout::Representation::Saved { diagram } =
+        event.stamp().context.representation
+    else {
+        unreachable!()
+    };
+    let _ = app.update(Message::RevealInDiagram(diagram, message));
+    assert!(app.pending_diagram_reveal.is_some());
+    let epoch = app.canvas_epoch;
+    let selected = app.selected;
+    let visit = app.pending_scenario_reveal_visit;
+    let original = app.document.snapshot();
+    finish(&mut app, event, start + Vector::new(50., 0.));
+    assert_eq!(app.canvas_epoch, epoch);
+    assert_eq!(app.pending_scenario_reveal_visit, visit);
+    assert!(app.pending_diagram_reveal.is_some());
+    assert_eq!(app.selected, selected);
+    assert_eq!(app.document.bundle(), &original.bundle);
+    assert!(!app.document.can_undo());
+}
+
+#[test]
+fn stale_active_actions_cannot_remove_new_same_visit_deferred_reveal() {
+    let (mut app, lane, message) = setup();
+    let old = app.scenario_context().unwrap();
+    let behavior::scenario_layout::Representation::Saved { diagram } = old.representation else {
+        unreachable!()
+    };
+    let accepted = app.document.snapshot();
+    let source = app.source_workspace.bundle();
+    let _ = app.update(Message::RevealInDiagram(diagram, message));
+    let current = app.scenario_context().unwrap();
+    assert_eq!(current.visit, old.visit);
+    assert_eq!(current.representation, old.representation);
+    assert_eq!(current.revision, old.revision);
+    assert_ne!(current.epoch, old.epoch);
+    let pending = app.pending_diagram_reveal.clone();
+    assert!(pending.is_some());
+    let focus = app.diagram_navigation_focus.as_ref().unwrap();
+    let focus = (focus.context, focus.usage.clone(), focus.selected);
+    let camera = app.camera_boundary();
+    for event in [
+        CanvasEvent::Representation(old, old.representation),
+        CanvasEvent::Shelf(old, behavior::scenario::Shelf::Selection),
+        CanvasEvent::Select(old, lane),
+        CanvasEvent::Zoom(old, Some(1.)),
+    ] {
+        let _ = app.update(Message::ScenarioCanvas(event));
+        assert_eq!(app.scenario_context(), Some(current));
+        assert_eq!(app.pending_diagram_reveal, pending);
+        assert_eq!(app.pending_scenario_reveal_visit, Some(current.visit));
+        let actual = app.diagram_navigation_focus.as_ref().unwrap();
+        assert_eq!(
+            (actual.context, actual.usage.clone(), actual.selected),
+            focus
+        );
+        assert!(app.camera_boundary() == camera);
+        assert_eq!(app.selected, message);
+        assert_eq!(app.document.bundle(), &accepted.bundle);
+        assert_eq!(app.project(), &accepted.decoded.project);
+        assert_eq!(app.source_workspace.bundle(), source);
+        assert!(!app.document.can_undo() && !app.document.can_redo());
+    }
+    let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Viewport(
+        current,
+        Size::new(800., 500.),
+    )));
+    assert!(app.pending_diagram_reveal.is_none());
+    assert!(app.pending_scenario_reveal_visit.is_none());
+    assert!(
+        app.diagram_focus(crate::diagram_usage::Surface::Saved(diagram))
+            .is_some()
+    );
+    assert_eq!(app.selected, message);
+    assert_eq!(app.document.bundle(), &accepted.bundle);
+    assert!(!app.document.can_undo() && !app.document.can_redo());
+}
+
+#[test]
+fn modal_open_cancels_preview_and_captured_begin_stays_retired_after_close() {
+    let (mut app, lane, _) = setup();
+    let original = app.document.snapshot();
+    let camera = app.behavior.scenario.camera_boundary();
+    let (event, start, _) = begin(&mut app, Target::Lane(lane));
+    move_to(&mut app, event, start + Vector::new(30., 0.));
+    let _ = app.update(Message::Delete);
+    assert!(app.delete_pending);
+    assert!(app.behavior.scenario.spacing_token().is_none());
+    finish(&mut app, event, start + Vector::new(30., 0.));
+    let _ = app.update(Message::CancelDelete);
+    send(&mut app, event);
+    assert!(app.behavior.scenario.spacing_token().is_none());
+    assert_eq!(app.project(), &original.decoded.project);
+    assert_eq!(app.document.bundle(), &original.bundle);
+    assert!(camera == app.behavior.scenario.camera_boundary());
+    assert!(!app.document.can_undo());
+}

crates/oa-desktop/src/app/source_indentation_tests.rs

@@ -0,0 +1,77 @@
+//! Controller acceptance: one indentation gesture is one draft transaction.
+use super::*;
+
+fn fixture(source: &str) -> App {
+    let mut app = App::with_project(Project::empty());
+    app.page = Page::Text;
+    app.source_workspace = Workspace::new(
+        &oa_core::source_project::SourceBundle {
+            entry: "project.arcadia".into(),
+            files: std::collections::BTreeMap::from([("project.arcadia".into(), source.into())]),
+        },
+        true,
+    );
+    app.show_source_file(false);
+    app
+}
+fn indent(app: &mut App, outdent: bool) {
+    let message = Message::SourceIndent(app.source_symbol_context(), outdent);
+    let _ = app.update(message);
+}
+
+#[test]
+fn indentation_updates_draft_snapshot_version_and_single_undo_redo_without_model_change() {
+    let source = "雨\r\n🚀\r\n";
+    let mut app = fixture(source);
+    app.source_editor.perform(text_editor::Action::SelectAll);
+    let version = app.source_version;
+    let revision = app.source_workspace.revision();
+    let model = app.document.revision();
+    indent(&mut app, false);
+    let after = "    雨\r\n    🚀\r\n";
+    assert_eq!(app.source_editor.text(), after);
+    assert_eq!(app.source_snapshot.as_ref(), after);
+    assert_eq!(app.source_workspace.files["project.arcadia"].text, after);
+    assert!(app.source_workspace.has_edits());
+    assert_eq!(app.source_version, version + 1);
+    assert_eq!(app.source_workspace.revision(), revision + 1);
+    assert_eq!(app.document.revision(), model);
+    let _ = app.update(Message::SourceUndo);
+    assert_eq!(app.source_editor.text(), source);
+    assert!(!app.source_workspace.has_edits());
+    let _ = app.update(Message::SourceRedo);
+    assert_eq!(app.source_editor.text(), after);
+    assert_eq!(app.document.revision(), model);
+}
+
+#[test]
+fn stale_hidden_and_modal_indentation_is_rejected_before_navigation_invalidation() {
+    for rejected in 0..7 {
+        let mut app = fixture("alpha");
+        let mut context = app.source_symbol_context();
+        match rejected {
+            0 => context.path = "elsewhere.arcadia".into(),
+            1 => context.session = Id::new_v4(),
+            2 => app.page = Page::Home,
+            3 => app.busy = true,
+            4 => app.delete_pending = true,
+            5 => app.hosted.visible = true,
+            _ => app.pending = Some(Pending::New),
+        }
+        let interaction = app.source_symbols.interaction;
+        let version = app.source_version;
+        let _ = app.update(Message::SourceIndent(context, false));
+        assert_eq!(app.source_editor.text(), "alpha");
+        assert_eq!(app.source_version, version);
+        assert_eq!(app.source_symbols.interaction, interaction);
+    }
+}
+
+#[test]
+fn no_op_outdent_does_not_add_history_or_increment_source_version() {
+    let mut app = fixture("alpha");
+    let version = app.source_version;
+    indent(&mut app, true);
+    assert_eq!(app.source_version, version);
+    assert!(!app.source_workspace.undo(false));
+}

crates/oa-desktop/src/app/source_rename/tests.rs

@@ -754,76 +754,7 @@ fn invalid_open_retains_accepted_document_but_refuses_alias_rename() {
 }
 
 fn captured_escape(app: &App) -> Vec<Message> {
-    use iced::advanced::{Layout, Shell, layout, subscription, widget};
-    use iced::futures::{StreamExt, stream, task::noop_waker_ref};
-    use iced::keyboard::{self, key::Named};
-    use std::task::{Context as PollContext, Poll};
-    let mut input: iced::Element<'_, (), iced::Theme, ()> =
-        iced::widget::text_input("Source alias", "retained_alias")
-            .on_input(|_| ())
-            .into();
-    let mut tree = widget::Tree::new(input.as_widget());
-    let size = iced::Size::new(300., 40.);
-    let node =
-        input
-            .as_widget_mut()
-            .layout(&mut tree, &(), &layout::Limits::new(iced::Size::ZERO, size));
-    tree.state
-        .downcast_mut::<iced::widget::text_input::State<()>>()
-        .focus();
-    let event = iced::Event::Keyboard(keyboard::Event::KeyPressed {
-        key: keyboard::Key::Named(Named::Escape),
-        modified_key: keyboard::Key::Named(Named::Escape),
-        physical_key: keyboard::key::Physical::Code(keyboard::key::Code::Escape),
-        location: keyboard::Location::Standard,
-        modifiers: keyboard::Modifiers::empty(),
-        text: None,
-        repeat: false,
-    });
-    let mut widget_messages = Vec::new();
-    let mut shell = Shell::new(&mut widget_messages);
-    input.as_widget_mut().update(
-        &mut tree,
-        &event,
-        Layout::new(&node),
-        iced::mouse::Cursor::Unavailable,
-        &(),
-        &mut iced::advanced::clipboard::Null,
-        &mut shell,
-        &iced::Rectangle::new(iced::Point::ORIGIN, size),
-    );
-    assert!(shell.is_event_captured());
-    let event = subscription::Event::Interaction {
-        window: iced::window::Id::unique(),
-        event,
-        status: iced::event::Status::Captured,
-    };
-    let runtime = tokio::runtime::Builder::new_current_thread()
-        .enable_time()
-        .build()
-        .unwrap();
-    let _entered = runtime.enter();
-    let mut messages = Vec::new();
-    let mut keyboard_boundaries = 0;
-    for recipe in subscription::into_recipes(app.subscription()) {
-        let mut output = recipe.stream(Box::pin(stream::iter([event.clone()])));
-        let mut context = PollContext::from_waker(noop_waker_ref());
-        while let Poll::Ready(Some(message)) = output.poll_next_unpin(&mut context) {
-            if matches!(
-                &message,
-                Message::WorkDrag(crate::app::allocation_drag::Event::KeyboardBoundary)
-            ) {
-                keyboard_boundaries += 1;
-            } else {
-                messages.push(message);
-            }
-        }
-    }
-    assert_eq!(
-        keyboard_boundaries, 1,
-        "each key has exactly one passive allocation notification"
-    );
-    messages
+    crate::app::escape::tests::focused_input_messages(app)
 }
 
 #[test]

crates/oa-desktop/src/app/source_symbols.rs

@@ -33,6 +33,9 @@ fn admission_notice(error: query::AdmissionError) -> String {
 impl App {
     pub(super) fn source_input_envelope(&self, message: &Message) -> bool {
         match message {
+            Message::SourceIndent(context, _) => {
+                context == &self.source_symbol_context() && self.source_navigation_available()
+            }
             Message::SourceSymbols(context, event) => {
                 context.session == self.source_workspace.session()
                     && context.path == self.source_workspace.active

crates/oa-desktop/src/app/source_symbols/tests.rs

@@ -864,99 +864,11 @@ fn captured_input_subscription_messages(app: &App) -> Vec<Message> {
 }
 
 fn input_subscription_messages(app: &App, focused: bool) -> Vec<Message> {
-    use iced::advanced::{Layout, Shell, layout, subscription, widget};
-    use iced::futures::{StreamExt, stream, task::noop_waker_ref};
-    use iced::keyboard::{self, key::Named};
-    use std::task::{Context, Poll};
-
-    let mut input: iced::Element<'_, (), iced::Theme, ()> =
-        iced::widget::text_input("Find / modal input", "Retain exact text 雨")
-            .on_input(|_| ())
-            .into();
-    let mut tree = widget::Tree::new(input.as_widget());
-    let size = iced::Size::new(300., 40.);
-    let node =
-        input
-            .as_widget_mut()
-            .layout(&mut tree, &(), &layout::Limits::new(iced::Size::ZERO, size));
-    if focused {
-        tree.state
-            .downcast_mut::<iced::widget::text_input::State<()>>()
-            .focus();
-    }
-    let event = iced::Event::Keyboard(keyboard::Event::KeyPressed {
-        key: keyboard::Key::Named(Named::Escape),
-        modified_key: keyboard::Key::Named(Named::Escape),
-        physical_key: keyboard::key::Physical::Code(keyboard::key::Code::Escape),
-        location: keyboard::Location::Standard,
-        modifiers: keyboard::Modifiers::empty(),
-        text: None,
-        repeat: false,
-    });
-    let mut input_messages = Vec::new();
-    let mut shell = Shell::new(&mut input_messages);
-    input.as_widget_mut().update(
-        &mut tree,
-        &event,
-        Layout::new(&node),
-        iced::mouse::Cursor::Unavailable,
-        &(),
-        &mut iced::advanced::clipboard::Null,
-        &mut shell,
-        &iced::Rectangle::new(iced::Point::ORIGIN, size),
-    );
-    let captured = shell.is_event_captured();
-    assert_eq!(captured, focused);
-    assert!(input_messages.is_empty());
-    assert!(
-        !tree
-            .state
-            .downcast_ref::<iced::widget::text_input::State<()>>()
-            .is_focused()
-    );
-    let event = subscription::Event::Interaction {
-        window: iced::window::Id::unique(),
-        event,
-        status: if captured {
-            iced::event::Status::Captured
-        } else {
-            iced::event::Status::Ignored
-        },
-    };
-    let runtime = tokio::runtime::Builder::new_current_thread()
-        .enable_time()
-        .build()
-        .unwrap();
-    let _entered = runtime.enter();
-    let mut messages = Vec::new();
-    let mut keyboard_boundaries = 0;
-    for recipe in subscription::into_recipes(app.subscription()) {
-        let mut output = recipe.stream(Box::pin(stream::iter([event.clone()])));
-        let mut context = Context::from_waker(noop_waker_ref());
-        while let Poll::Ready(Some(message)) = output.poll_next_unpin(&mut context) {
-            assert!(
-                !matches!(message, Message::CheckpointTick),
-                "timer must remain pending"
-            );
-            if matches!(
-                &message,
-                Message::WorkDrag(crate::app::allocation_drag::Event::KeyboardBoundary)
-            ) {
-                keyboard_boundaries += 1;
-            } else {
-                messages.push(message);
-            }
-        }
-    }
-    assert_eq!(
-        keyboard_boundaries, 1,
-        "each key has exactly one passive allocation notification"
-    );
-    messages
+    crate::app::escape::tests::input_messages(app, iced::keyboard::key::Named::Escape, focused)
 }
 
 #[test]
-fn captured_find_and_modal_escape_use_one_actual_subscription_and_preserve_pending_work() {
+fn captured_find_and_modal_escape_use_one_actual_delivery_and_preserve_pending_work() {
     for pending in [false, true] {
         for modal in 0..4 {
             let mut app = fixture();
@@ -1053,7 +965,7 @@ fn captured_find_and_modal_escape_use_one_actual_subscription_and_preserve_pendi
 }
 
 #[test]
-fn captured_subscription_does_not_duplicate_existing_behavior_or_architecture_routes() {
+fn captured_delivery_does_not_duplicate_existing_behavior_or_architecture_routes() {
     let mut app = fixture();
     app.text_workspace.show_drawer(Some(DrawerTab::References));
     let project = app.project().clone();

crates/oa-desktop/src/app/state_diagram.rs

@@ -24,6 +24,7 @@ impl App {
         if self.behavior.has_pending() {
             return;
         }
+        self.behavior.scenario.forget_view();
         self.layer = layer;
         self.page = Page::Behavior;
         self.behavior.active_owner = Some(machine);

crates/oa-desktop/src/app/state_diagram_tests.rs

@@ -4,6 +4,8 @@ use super::*;
 mod attachment_escape;
 #[path = "state_bend_tests.rs"]
 mod bends;
+#[path = "state_picker_escape_tests.rs"]
+mod picker_escape;
 use crate::behavior::{
     self,
     state_edit::{self, Context, Endpoint, Event, Tool},

crates/oa-desktop/src/app/state_picker_escape_tests.rs

@@ -0,0 +1,104 @@
+//! The actual State workspace picker, App root and subscriptions.
+use super::*;
+use crate::behavior::canvas_workspace::tests::{Mounted, key};
+use iced::{keyboard::key::Named, mouse};
+
+async fn press_escape(mounted: &mut Mounted, app: &mut App) -> Vec<Message> {
+    let input = key(Named::Escape);
+    let (mut messages, statuses) = mounted.input_with_status(
+        app,
+        std::slice::from_ref(&input),
+        mouse::Cursor::Unavailable,
+    );
+    assert_eq!(
+        statuses,
+        [iced::event::Status::Captured],
+        "the mounted picker must capture Escape before App subscriptions"
+    );
+    crate::app::escape::tests::subscriptions(app, input, statuses[0], &mut messages);
+    for message in messages.iter().cloned() {
+        let task = app.update(message);
+        mounted.perform(app, task).await;
+    }
+    mounted.settle(app).await;
+    messages
+}
+
+#[tokio::test]
+async fn mounted_state_missing_picker_escape_preserves_exact_document_then_reopens_and_places() {
+    let mut f = fixture();
+    let diagram = create_view(&mut f).diagram;
+    let mut project = f.app.project().clone();
+    project
+        .diagrams
+        .get_mut(&diagram)
+        .unwrap()
+        .nodes
+        .retain(|_, node| node.element != f.b);
+    let mut app = App::with_project(project);
+    app.window_size = iced::Size::new(1800., 1100.);
+    send(&mut app, Message::Select(f.a));
+    send(&mut app, Message::Page(Page::Behavior));
+    let choice = Choice {
+        id: diagram,
+        label: app.project().diagrams[&diagram].name.clone(),
+    };
+    send(&mut app, Message::BehaviorDiagram(choice));
+    let mut mounted = Mounted::new(&mut app).await;
+    assert_eq!(state_edit::unplaced(app.project(), diagram), vec![f.b]);
+    // Locate the stable picker slot itself: selection controls may sit between
+    // it and the canvas. The single menu option opens below this slot.
+    let bounds = mounted.geometry(&app).bounds("state-missing-picker");
+    let picker = bounds.center();
+    let option = iced::Point::new(picker.x, bounds.y + bounds.height * 1.5);
+    let before = app.document.snapshot();
+    let original = app.project().clone();
+    let source = app.document.bundle().clone();
+    let selection = (
+        app.selected,
+        app.selected_node,
+        app.behavior.diagram.placement,
+    );
+    let camera = (
+        app.behavior.diagram.zoom,
+        app.behavior.diagram.pan,
+        app.behavior.diagram.fit,
+    );
+    let revision = app.document.revision();
+    let history = (app.document.can_undo(), app.document.can_redo());
+    mounted.click(&mut app, picker).await;
+    assert!(
+        press_escape(&mut mounted, &mut app).await.is_empty(),
+        "open picker owns Escape, not the State canvas or App"
+    );
+    assert!(std::sync::Arc::ptr_eq(&before, &app.document.snapshot()));
+    assert_eq!(app.document.bundle(), &source);
+    assert_eq!(
+        (
+            app.selected,
+            app.selected_node,
+            app.behavior.diagram.placement
+        ),
+        selection
+    );
+    assert_eq!(
+        (
+            app.behavior.diagram.zoom,
+            app.behavior.diagram.pan,
+            app.behavior.diagram.fit
+        ),
+        camera
+    );
+    assert_eq!(app.document.revision(), revision);
+    assert_eq!((app.document.can_undo(), app.document.can_redo()), history);
+    // If Escape left the menu open this click would close it, and the following
+    // option click would fail to place. This checks actual overlay dismissal.
+    mounted.click(&mut app, picker).await;
+    let messages = mounted.click(&mut app, option).await;
+    assert!(messages.iter().any(|message| matches!(message, Message::StateDiagram(Event::Place { element, .. }) if *element == f.b)));
+    assert!(state_edit::unplaced(app.project(), diagram).is_empty());
+    assert_eq!(app.project().elements, original.elements);
+    assert_eq!(app.project().relations, original.relations);
+    let _ = app.update(Message::Undo);
+    assert_eq!(app.document.bundle(), &source);
+}

crates/oa-desktop/src/app/traceability_navigation_tests.rs

@@ -0,0 +1,277 @@
+use super::*;
+use crate::{context_menu::Entry, model_menu, views::traceability::Filter};
+
+fn send(app: &mut App, message: Message) {
+    let _ = app.update(message);
+}
+
+fn fixture() -> (App, Id, Id, Id, Id) {
+    let mut p = Project::empty();
+    let oa = p
+        .add_element(Kind::Activity, Layer::Oa, "Observe", None)
+        .unwrap();
+    let sa = p
+        .add_element(Kind::Function, Layer::Sa, "Detect", None)
+        .unwrap();
+    let mixed = p.ensure_diagram(Layer::Oa);
+    p.diagrams.get_mut(&mixed).unwrap().projection = ProjectionKind::Traceability;
+    p.place(mixed, oa, Position { x: 300., y: 200. });
+    let system = p.ensure_diagram(Layer::Sa);
+    p.place(system, sa, Position { x: 700., y: 200. });
+    oa_core::validate_candidate(&p).unwrap();
+    let mut app = App::with_project(p);
+    app.page = Page::Diagram;
+    app.layer = Layer::Oa;
+    app.active_diagram = Some(mixed);
+    app.selected = oa;
+    app.refresh_draft();
+    app.traceability.filter = Filter::Artifacts;
+    app.traceability.query = "stale artifact query".into();
+    (app, mixed, system, oa, sa)
+}
+
+fn show_action(app: &mut App, element: Id) -> Message {
+    send(app, model_menu::open(element, iced::Point::ORIGIN));
+    model_menu::popup(app)
+        .unwrap()
+        .entries
+        .into_iter()
+        .find_map(|entry| match entry {
+            Entry::Action { label, message, .. } if label == "Show in this diagram" => {
+                Some(message)
+            }
+            _ => None,
+        })
+        .expect("eligible real menu action")
+        .expect("eligible menu action must be enabled")
+}
+
+#[test]
+fn review_layer_traces_resets_inventory_without_applying_property_or_source_drafts() {
+    for source_draft in [false, true] {
+        let (mut app, mixed, _, oa, _) = fixture();
+        if source_draft {
+            send(&mut app, Message::Page(Page::Text));
+            send(
+                &mut app,
+                Message::SourceEdit(iced::widget::text_editor::Action::Edit(
+                    iced::widget::text_editor::Edit::Insert('x'),
+                )),
+            );
+            assert!(app.source_dirty());
+        } else {
+            send(
+                &mut app,
+                Message::Field("/alias".into(), "invalid alias".into()),
+            );
+            assert!(app.draft_dirty());
+        }
+        let raw = serde_json::to_value(app.draft.as_ref().unwrap().recovery_snapshot()).unwrap();
+        let source = app.source_editor.text();
+        let before = app.document.snapshot();
+        let camera = (app.zoom, app.pan);
+        send(&mut app, Message::ReviewLayerTraces);
+        assert_eq!(app.page, Page::Traces);
+        assert_eq!(app.traceability.filter, Filter::Traces);
+        assert!(app.traceability.query.is_empty());
+        assert_eq!(
+            (app.layer, app.active_diagram, app.selected),
+            (Layer::Oa, Some(mixed), oa)
+        );
+        assert_eq!((app.zoom, app.pan), camera);
+        assert_eq!(
+            serde_json::to_value(app.draft.as_ref().unwrap().recovery_snapshot()).unwrap(),
+            raw
+        );
+        assert_eq!(app.source_editor.text(), source);
+        assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+        assert!(!app.document.can_undo());
+    }
+}
+
+#[test]
+fn review_layer_traces_respects_busy_modal_and_active_placement_guards() {
+    for already_traces in [false, true] {
+        for guard in 0..5 {
+            let (mut app, mixed, _, oa, _) = fixture();
+            match guard {
+                0 => app.busy = true,
+                1 => app.delete_pending = true,
+                2 => app.hosted.visible = true,
+                3 => send(
+                    &mut app,
+                    Message::Architecture(architecture_authoring::Event::Existing(None)),
+                ),
+                4 => {
+                    app.page = Page::Behavior;
+                    let p = app.project().clone();
+                    app.behavior
+                        .creation
+                        .update(&p, behavior::creation::Event::Open(Layer::Oa))
+                        .unwrap();
+                    assert!(app.behavior.has_pending());
+                }
+                _ => unreachable!(),
+            }
+            if already_traces {
+                app.page = Page::Traces;
+            }
+            let original_page = app.page;
+            let before = app.document.snapshot();
+            let behavior_before = app.behavior.recovery_snapshot().unwrap();
+            send(&mut app, Message::ReviewLayerTraces);
+            assert_eq!(
+                app.page, original_page,
+                "guard {guard}, already traces {already_traces}"
+            );
+            assert_eq!(app.traceability.filter, Filter::Artifacts);
+            assert_eq!(app.traceability.query, "stale artifact query");
+            assert_eq!(
+                (app.layer, app.active_diagram, app.selected),
+                (Layer::Oa, Some(mixed), oa)
+            );
+            assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+            assert_eq!(app.behavior.recovery_snapshot().unwrap(), behavior_before);
+            if guard == 3 {
+                assert!(app.architecture.is_some());
+            }
+        }
+    }
+}
+
+#[test]
+fn mixed_view_show_keeps_its_context_for_every_diagram_app_and_target_layer() {
+    for diagram_layer in [Layer::Oa, Layer::Sa] {
+        for app_layer in [Layer::Oa, Layer::Sa] {
+            for target_layer in [Layer::Oa, Layer::Sa] {
+                let mut p = Project::empty();
+                let oa = p
+                    .add_element(Kind::Activity, Layer::Oa, "Observe", None)
+                    .unwrap();
+                let sa = p
+                    .add_element(Kind::Function, Layer::Sa, "Detect", None)
+                    .unwrap();
+                let target = if target_layer == Layer::Oa { oa } else { sa };
+                let other = if target_layer == Layer::Oa { sa } else { oa };
+                let mixed = p.ensure_diagram(diagram_layer);
+                p.diagrams.get_mut(&mixed).unwrap().projection = ProjectionKind::Traceability;
+                // An attractive same-layer alternative makes accidental
+                // semantic-selection navigation observable in both directions.
+                let mut alternative = p.diagrams[&mixed].clone();
+                alternative.id = Id::new_v4();
+                alternative.alias = "same_layer_alternative".into();
+                alternative.layer = target_layer;
+                alternative.projection = ProjectionKind::Overview;
+                let alternative_id = alternative.id;
+                p.diagrams.insert(alternative_id, alternative);
+                p.place(alternative_id, target, Position { x: 700., y: 200. });
+                oa_core::validate_candidate(&p).unwrap();
+                let mut app = App::with_project(p);
+                app.page = Page::Diagram;
+                app.layer = app_layer;
+                app.active_diagram = Some(mixed);
+                app.selected = other;
+                app.refresh_draft();
+                let before = app.project().clone();
+                let action = show_action(&mut app, target);
+                send(&mut app, action);
+                // The existing RevealInDiagram action synchronizes the layer
+                // to the captured view, even if the prior perspective differed.
+                assert_eq!(
+                    (app.active_diagram, app.layer, app.selected),
+                    (Some(mixed), diagram_layer, target)
+                );
+                let added = app.project().diagrams[&mixed]
+                    .nodes
+                    .values()
+                    .find(|n| n.element == target)
+                    .unwrap()
+                    .clone();
+                assert_eq!(app.selected_node, Some(added.id));
+                let mut expected = before;
+                expected
+                    .diagrams
+                    .get_mut(&mixed)
+                    .unwrap()
+                    .nodes
+                    .insert(added.id, added);
+                assert_eq!(app.project(), &expected);
+            }
+        }
+    }
+}
+
+#[test]
+fn mixed_view_show_menu_places_in_captured_view_with_exact_undo_redo() {
+    let (mut app, mixed, system, _, sa) = fixture();
+    let before = app.document.snapshot();
+    let action = show_action(&mut app, sa);
+    send(&mut app, action);
+    assert_eq!(
+        (app.active_diagram, app.layer, app.selected),
+        (Some(mixed), Layer::Oa, sa)
+    );
+    let added = app.project().diagrams[&mixed]
+        .nodes
+        .values()
+        .find(|n| n.element == sa)
+        .unwrap()
+        .clone();
+    assert_eq!(added.position, Position { x: 60., y: 60. });
+    let mut expected = before.decoded.project.clone();
+    expected
+        .diagrams
+        .get_mut(&mixed)
+        .unwrap()
+        .nodes
+        .insert(added.id, added);
+    assert_eq!(app.project(), &expected);
+    assert_eq!(
+        app.project().diagrams[&system],
+        before.decoded.project.diagrams[&system]
+    );
+    let after = app.document.snapshot();
+    send(&mut app, Message::Undo);
+    assert_eq!(app.project(), &before.decoded.project);
+    assert_eq!(app.document.bundle(), &before.bundle);
+    assert!(!app.document.can_undo());
+    send(&mut app, Message::Redo);
+    assert_eq!(app.project(), &after.decoded.project);
+    assert_eq!(app.document.bundle(), &after.bundle);
+}
+
+#[test]
+fn mixed_view_show_menu_rejects_stale_context_and_pending_property_changes() {
+    for refusal in 0..3 {
+        let (mut app, mixed, system, oa, sa) = fixture();
+        let action = show_action(&mut app, sa);
+        match refusal {
+            0 => app.active_diagram = Some(system),
+            1 => app.canvas_epoch = app.canvas_epoch.wrapping_add(1),
+            2 => {
+                // A queued action must not apply a draft that became dirty
+                // after the menu was rendered, even when its context is valid.
+                app.draft
+                    .as_mut()
+                    .unwrap()
+                    .input("/name", "Unapplied name".into());
+                assert!(app.draft_dirty());
+            }
+            _ => unreachable!(),
+        }
+        let before = app.document.snapshot();
+        let raw = serde_json::to_value(app.draft.as_ref().unwrap().recovery_snapshot()).unwrap();
+        send(&mut app, action);
+        assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+        assert_eq!(app.selected, oa);
+        assert_eq!(
+            app.active_diagram,
+            Some(if refusal == 0 { system } else { mixed })
+        );
+        assert_eq!(
+            serde_json::to_value(app.draft.as_ref().unwrap().recovery_snapshot()).unwrap(),
+            raw
+        );
+        assert!(!app.document.can_undo());
+    }
+}

crates/oa-desktop/src/app/transition_context_tests.rs

@@ -49,11 +49,28 @@ fn fixture(layer: Layer, kind: Kind) -> (App, Id, Id, Id) {
     p.diagrams.get_mut(&view).unwrap().name = "Unrelated architecture".into();
     p.place(view, reused, Position { x: 873., y: 421. });
     let mut app = App::with_project(p);
-    app.layer = layer;
-    app.page = Page::Behavior;
-    app.selected = root;
-    app.behavior.active_owner = Some(root);
-    app.refresh_draft();
+    let accepted = app.document.snapshot();
+    // Enter through the actual navigation path: assigning Page/owner alone does
+    // not create the representation and live visit required by canvas events.
+    send(&mut app, Message::Select(root));
+    send(&mut app, Message::Page(Page::Behavior));
+    assert_eq!(app.layer, layer);
+    assert_eq!(app.page, Page::Behavior);
+    assert_eq!(app.selected, root);
+    assert_eq!(app.behavior.active_owner, Some(root));
+    if kind == Kind::Scenario {
+        let context = app.scenario_context().unwrap();
+        assert_eq!(context.document, app.canvas_document);
+        assert_eq!(context.scenario, root);
+        assert_eq!(
+            context.representation,
+            crate::behavior::scenario_layout::Representation::Derived { owner: root }
+        );
+        assert!(!context.visit.is_nil());
+    }
+    assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+    assert_eq!(app.source_workspace.bundle(), accepted.bundle);
+    assert!(!app.document.can_undo() && !app.document.can_redo());
     (app, root, work, reused)
 }
 

crates/oa-desktop/src/behavior.rs

@@ -21,6 +21,11 @@ pub(crate) mod creation;
 mod form_session;
 pub(crate) mod scenario;
 mod scenario_activation;
+#[cfg(test)]
+mod scenario_hit_tests;
+// Pure saved-geometry bridge; workspace integration is a separate checkpoint.
+#[allow(dead_code)]
+pub(crate) mod scenario_layout;
 mod scenario_lifecycle;
 pub(crate) mod source_draft;
 pub(crate) mod state_canvas;
@@ -59,9 +64,18 @@ mod scenario_scroll {
         process: bool,
         restore: Option<scenario::ScrollRestore>,
     }
-    type Report = Option<(bool, Id, Id, Vector)>;
+    type Identity = (Id, Id, scenario_layout::Representation, Id);
+    fn identity(context: scenario::Context) -> Identity {
+        (
+            context.document,
+            context.scenario,
+            context.representation,
+            context.visit,
+        )
+    }
+    type Report = Option<(bool, Identity, Vector)>;
     struct ObservedScroll {
-        identity: (Id, Id),
+        identity: Identity,
         report: Report,
         restored: Option<Id>,
     }
@@ -112,8 +126,12 @@ mod scenario_scroll {
         ) {
             let restore = self.restore.filter(|request| {
                 !self.process
-                    && (request.document, request.owner)
-                        == (self.context.document, self.context.scenario)
+                    && (
+                        request.document,
+                        request.owner,
+                        request.representation,
+                        request.visit,
+                    ) == identity(self.context)
                     && tree.state.downcast_ref::<ObservedScroll>().restored != Some(request.token)
             });
             let receipt = restore.and_then(|request| {
@@ -137,12 +155,7 @@ mod scenario_scroll {
                 &mut offset,
             );
             if let Some(offset) = offset.0 {
-                let next = Some((
-                    self.process,
-                    self.context.document,
-                    self.context.scenario,
-                    offset,
-                ));
+                let next = Some((self.process, identity(self.context), offset));
                 let state = tree.state.downcast_mut::<ObservedScroll>();
                 if let Some(token) = receipt {
                     state.restored = Some(token);
@@ -186,7 +199,7 @@ mod scenario_scroll {
         }
         fn state(&self) -> widget::tree::State {
             widget::tree::State::new(ObservedScroll {
-                identity: (self.context.document, self.context.scenario),
+                identity: identity(self.context),
                 report: None,
                 restored: None,
             })
@@ -195,9 +208,7 @@ mod scenario_scroll {
             vec![widget::Tree::new(self.content.as_widget())]
         }
         fn diff(&self, tree: &mut widget::Tree) {
-            if tree.state.downcast_ref::<ObservedScroll>().identity
-                != (self.context.document, self.context.scenario)
-            {
+            if tree.state.downcast_ref::<ObservedScroll>().identity != identity(self.context) {
                 // A new owner/document needs fresh real scroll state, not merely
                 // cleared mirrored offsets. Edits and tool/form changes retain it.
                 tree.state = self.state();
@@ -486,17 +497,25 @@ mod scenario_scroll {
         }
         #[test]
         fn direct_scenario_restore_cannot_scroll_another_document_owner_or_process_view() {
-            for mismatch in 0..3 {
+            for mismatch in 0..5 {
                 let context = scenario::direct_tests::context(Id::new_v4());
                 let mut request = scenario::ScrollRestore {
                     document: context.document,
                     owner: context.scenario,
+                    representation: context.representation,
+                    visit: context.visit,
                     token: Id::new_v4(),
                     offset: Vector::new(0., 180.),
                 };
                 match mismatch {
                     0 => request.document = Id::new_v4(),
                     1 => request.owner = Id::new_v4(),
+                    3 => {
+                        request.representation = scenario_layout::Representation::Saved {
+                            diagram: Id::new_v4(),
+                        }
+                    }
+                    4 => request.visit = Id::new_v4(),
                     _ => {}
                 }
                 let mut view = observer(600., context);
@@ -583,7 +602,7 @@ mod scenario_scroll {
             use widget::operation::scrollable::{AbsoluteOffset, scroll_to};
             for process in [false, true] {
                 let area = scenario::ScrollArea::Page;
-                for change in 0..4 {
+                for change in 0..6 {
                     let context = scenario::direct_tests::context(Id::new_v4());
                     let mut view = observer(600., context);
                     view.process = process;
@@ -612,6 +631,12 @@ mod scenario_scroll {
                             next.revision += 1;
                             next.epoch += 5;
                         }
+                        4 => {
+                            next.representation = scenario_layout::Representation::Saved {
+                                diagram: Id::new_v4(),
+                            }
+                        }
+                        5 => next.visit = Id::new_v4(),
                         _ => {}
                     }
                     view = observer(if change == 3 { 800. } else { 600. }, next);
@@ -659,7 +684,7 @@ mod scenario_scroll {
                         .collect::<Vec<_>>();
                     assert_eq!(
                         actual,
-                        vec![if change < 2 {
+                        vec![if !(2..4).contains(&change) {
                             Vector::ZERO
                         } else {
                             Vector::new(0., 180.)
@@ -973,6 +998,19 @@ pub fn view(app: &App) -> Element<'_, Message> {
             return container(out).padding(16).width(Fill).height(Fill).into();
         }
     }
+    // A requested saved view remains the destination even after its model is removed.
+    // The shared display adapter reports unavailable instead of choosing another behavior.
+    if matches!(
+        app.behavior.scenario.representation(),
+        Some(scenario_layout::Representation::Saved { .. })
+    ) && let Some(owner) = app.behavior.scenario.owner()
+        && !p
+            .elements
+            .get(&owner)
+            .is_some_and(|element| element.kind() == Kind::Scenario && element.layer() == app.layer)
+    {
+        return scenario::view(app, owner, column![].spacing(6));
+    }
     let choices = p
         .elements
         .values()
@@ -984,7 +1022,14 @@ pub fn view(app: &App) -> Element<'_, Message> {
             label: format!("{} · {}", e.kind(), e.name),
         })
         .collect::<Vec<_>>();
-    let owner = selected_owner(app);
+    let owner = if matches!(
+        app.behavior.scenario.representation(),
+        Some(scenario_layout::Representation::Saved { .. })
+    ) {
+        app.behavior.scenario.owner()
+    } else {
+        selected_owner(app)
+    };
     let selected = owner
         .and_then(|id| choices.iter().find(|c| c.id == id))
         .or(choices.first())
@@ -1118,8 +1163,27 @@ fn in_machine(p: &Project, id: Id, machine: Id) -> bool {
     false
 }
 
+/// Identifies the drawn primitive that won selection, not an authoring permission.
+/// In particular an activation and its message can share an occurrence UUID.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum SceneHitRole {
+    LifelineHeader,
+    MessageBody,
+    MessageLabel,
+    Activation,
+    LifecycleMarker,
+    LifelineGuide,
+    Box,
+    OtherLine,
+}
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+struct SceneHit {
+    id: Id,
+    role: SceneHitRole,
+}
 struct BoxItem {
     id: Id,
+    role: SceneHitRole,
     rect: Rectangle,
     title: String,
     detail: String,
@@ -1152,6 +1216,7 @@ fn box_text_clip(
 
 struct Line {
     id: Id,
+    role: SceneHitRole,
     points: Vec<Point>,
     label: String,
     label_at: Point,
@@ -1172,12 +1237,17 @@ struct Scene {
     boxes: Vec<BoxItem>,
     lines: Vec<Line>,
     size: Size,
+    layout_origin: Point,
     selected: Id,
     scale: f32,
     camera_pan: iced::Vector,
     interaction: Option<(scenario::Context, scenario::CanvasTool, bool)>,
+    spacing_stamp: Option<scenario::spacing::Stamp>,
+    coordinate_input: bool,
     pending_placement: Option<(scenario::Slot, Option<Id>)>,
     lanes: BTreeMap<Id, f32>,
+    // Exact render coordinates include unassigned lanes; do not derive from cards.
+    render_lanes: BTreeMap<Id, f32>,
     slots: Vec<SequenceSlot>,
     rows: BTreeMap<Id, (Id, f32)>,
     activations: Vec<scenario_activation::Segment>,
@@ -1201,6 +1271,10 @@ struct SequenceInput {
 }
 #[derive(Clone, Copy)]
 enum SequencePress {
+    Spacing {
+        stamp: scenario::spacing::Stamp,
+        token: Id,
+    },
     Occurrence {
         tool: scenario::Tool,
         slot: scenario::Slot,
@@ -1221,6 +1295,19 @@ enum SequencePress {
     },
 }
 impl SequenceInput {
+    fn cancel_spacing(&mut self) -> Option<Action<Message>> {
+        let cancel = match self.press {
+            Some(SequencePress::Spacing { stamp, token }) => Some(
+                Action::publish(Message::ScenarioCanvas(scenario::CanvasEvent::Spacing(
+                    scenario::spacing::Event::Cancel { stamp, token },
+                )))
+                .and_capture(),
+            ),
+            _ => None,
+        };
+        self.cancel();
+        cancel
+    }
     fn cancel(&mut self) {
         self.source = None;
         self.press = None;
@@ -1232,17 +1319,31 @@ impl Scene {
             && (self.boxes.iter().any(|item| item.id == id)
                 || self.lines.iter().any(|item| item.id == id))
     }
+    // The integrated removal guard also needs the derived semantic hit set.
     fn sequence(p: &Project, owner: Id, selected: Id) -> Self {
+        Self::sequence_geometry(p, owner, selected, None, None)
+    }
+    fn sequence_geometry(
+        p: &Project,
+        owner: Id,
+        selected: Id,
+        lane_override: Option<&BTreeMap<Id, f32>>,
+        plan: Option<&scenario_layout::Plan>,
+    ) -> Self {
         let mut scene = Self {
             scale: 1.,
             camera_pan: iced::Vector::ZERO,
             boxes: vec![],
             lines: vec![],
             size: Size::new(700., 200.),
+            layout_origin: Point::ORIGIN,
             selected,
             interaction: None,
+            spacing_stamp: None,
+            coordinate_input: true,
             pending_placement: None,
             lanes: BTreeMap::new(),
+            render_lanes: BTreeMap::new(),
             slots: vec![],
             rows: BTreeMap::new(),
             activations: vec![],
@@ -1313,12 +1414,32 @@ impl Scene {
                 })
                 .collect();
         }
-        let lane_x = lanes
+        let mut lane_x = lanes
             .iter()
             .enumerate()
             .map(|(i, (id, ..))| (*id, 160. + i as f32 * 240.))
             .collect::<BTreeMap<_, _>>();
+        if let Some(values) = lane_override {
+            for (id, x) in values {
+                if let Some(lane) = lane_x.get_mut(id) {
+                    *lane = *x;
+                }
+            }
+        }
+        scene.render_lanes = lane_x.clone();
         scene.size.width = (lanes.len() as f32 * 240. + 80.).max(680.);
+        let layout_left = if lane_override.is_some() {
+            lane_x.values().fold(0_f32, |left, x| left.min(*x - 160.))
+        } else {
+            0.
+        };
+        scene.layout_origin.x = layout_left;
+        if lane_override.is_some() {
+            scene.size.width = lane_x
+                .values()
+                .fold(scene.size.width, |right, x| right.max(*x + 240.))
+                - layout_left;
+        }
         if scenario {
             scene.lanes = lane_x
                 .iter()
@@ -1334,8 +1455,26 @@ impl Scene {
                 .collect();
         }
         let mut y = if scenario { 148. } else { 120. };
-        scene.occurrences(p, owner, scenario, &lane_x, &mut y, 0);
-        scene.size.height = (y + 45.).max(210.);
+        scene.occurrences(p, owner, scenario, &lane_x, &mut y, 0, plan);
+        if layout_left != 0. {
+            for item in &mut scene.boxes {
+                let body = scenario_layout::occurrence(p, item.id);
+                if matches!(
+                    body,
+                    Some(
+                        OccurrenceBody::Branch { .. }
+                            | OccurrenceBody::ScenarioUse { .. }
+                            | OccurrenceBody::Control { .. }
+                            | OccurrenceBody::SequenceReference { .. }
+                            | OccurrenceBody::Exchange { .. }
+                    )
+                ) || (plan.is_none() && matches!(body, Some(OccurrenceBody::Fragment { .. })))
+                {
+                    item.rect.x += layout_left;
+                }
+            }
+        }
+        scene.size.height = plan.map_or((y + 45.).max(210.), |plan| plan.height);
         if scenario {
             scene.lifecycle = scenario_lifecycle::render::Rendering::new(
                 p,
@@ -1346,6 +1485,9 @@ impl Scene {
                 scene.size.height,
             );
             scene.lifecycle.align_messages(&mut scene.lines);
+            if let Some(plan) = plan {
+                plan.align_message_anchors(&mut scene.lines);
+            }
             scene.layout_activations(p, &lane_x);
         }
         for (id, name, detail) in lanes {
@@ -1355,6 +1497,7 @@ impl Scene {
                     0,
                     Line {
                         id,
+                        role: SceneHitRole::LifelineGuide,
                         points: vec![Point::new(x, 85.), Point::new(x, scene.size.height - 20.)],
                         label: String::new(),
                         label_at: Point::ORIGIN,
@@ -1364,6 +1507,11 @@ impl Scene {
             }
             scene.boxes.push(BoxItem {
                 id,
+                role: if scenario {
+                    SceneHitRole::LifelineHeader
+                } else {
+                    SceneHitRole::Box
+                },
                 rect: Rectangle::new(Point::new(x - 102., 15.), Size::new(204., 70.)),
                 title: name,
                 detail,
@@ -1372,6 +1520,7 @@ impl Scene {
         }
         scene
     }
+    #[allow(clippy::too_many_arguments)] // Explicit complete plan replaces ambient geometry state.
     fn occurrences(
         &mut self,
         p: &Project,
@@ -1380,6 +1529,7 @@ impl Scene {
         lanes: &BTreeMap<Id, f32>,
         y: &mut f32,
         depth: usize,
+        plan: Option<&scenario_layout::Plan>,
     ) {
         let steps = p
             .elements
@@ -1419,6 +1569,9 @@ impl Scene {
             }
             #[cfg(test)]
             scenario_lifecycle::render::apply_test_row_offset(*id, y);
+            if let Some(plan) = plan {
+                *y = plan.anchors[id].y;
+            }
             if ordered {
                 let slot = scenario::Slot {
                     parent: owner,
@@ -1435,7 +1588,7 @@ impl Scene {
                 OccurrenceBody::Fragment { operator, .. } => {
                     let top = *y;
                     *y += 55.;
-                    self.occurrences(p, *id, scenario, lanes, y, depth + 1);
+                    self.occurrences(p, *id, scenario, lanes, y, depth + 1, plan);
                     let rect = Rectangle::new(
                         Point::new(18. + depth as f32 * 10., top),
                         Size::new(
@@ -1443,10 +1596,12 @@ impl Scene {
                             (*y - top).max(95.),
                         ),
                     );
+                    let rect = plan.map_or(rect, |plan| plan.frames[id]);
                     self.boxes.insert(
                         0,
                         BoxItem {
                             id: *id,
+                            role: SceneHitRole::Box,
                             rect,
                             title: format!("{operator:?} · {}", e.name),
                             detail: String::new(),
@@ -1458,6 +1613,7 @@ impl Scene {
                 OccurrenceBody::Branch { guard, .. } => {
                     self.boxes.push(BoxItem {
                         id: *id,
+                        role: SceneHitRole::Box,
                         rect: Rectangle::new(
                             Point::new(36. + depth as f32 * 10., *y),
                             Size::new(self.size.width - 85. - depth as f32 * 20., 43.),
@@ -1474,7 +1630,7 @@ impl Scene {
                         marker: Some(Kind::Occurrence),
                     });
                     *y += if scenario { 90. } else { 62. };
-                    self.occurrences(p, *id, scenario, lanes, y, depth + 1);
+                    self.occurrences(p, *id, scenario, lanes, y, depth + 1, plan);
                 }
                 OccurrenceBody::Exchange {
                     exchange,
@@ -1502,7 +1658,7 @@ impl Scene {
                         source.and_then(|id| lanes.get(&id)),
                         target.and_then(|id| lanes.get(&id)),
                     ) {
-                        let points = if a == b {
+                        let points = if source == target {
                             vec![
                                 Point::new(*a, *y),
                                 Point::new(a + 75., *y),
@@ -1541,6 +1697,7 @@ impl Scene {
                         }
                         self.lines.push(Line {
                             id: *id,
+                            role: SceneHitRole::MessageBody,
                             points,
                             label: format!("{}. {kind}{}", index + 1, message_label),
                             label_at: Point::new(a.min(*b) + 12., *y - 26.),
@@ -1549,6 +1706,7 @@ impl Scene {
                     } else {
                         self.boxes.push(BoxItem {
                             id: *id,
+                            role: SceneHitRole::Box,
                             rect: Rectangle::new(
                                 Point::new(65., *y - 20.),
                                 Size::new(self.size.width - 130., 65.),
@@ -1571,6 +1729,7 @@ impl Scene {
                         .unwrap_or(180.);
                     self.boxes.push(BoxItem {
                         id: *id,
+                        role: SceneHitRole::Box,
                         rect: Rectangle::new(Point::new(x - 110., *y - 20.), Size::new(220., 70.)),
                         title: e.name.clone(),
                         detail: action
@@ -1583,6 +1742,7 @@ impl Scene {
                 OccurrenceBody::Control { kind } => {
                     self.boxes.push(BoxItem {
                         id: *id,
+                        role: SceneHitRole::Box,
                         rect: Rectangle::new(Point::new(65., *y - 20.), Size::new(240., 70.)),
                         title: format!("{kind:?} · {}", e.name),
                         detail: "Contextual process control".into(),
@@ -1593,6 +1753,7 @@ impl Scene {
                 OccurrenceBody::SequenceReference { sequence } => {
                     self.boxes.push(BoxItem {
                         id: *id,
+                        role: SceneHitRole::Box,
                         rect: Rectangle::new(Point::new(65., *y - 20.), Size::new(280., 70.)),
                         title: e.name.clone(),
                         detail: sequence
@@ -1605,6 +1766,7 @@ impl Scene {
                 OccurrenceBody::ScenarioUse { scenario, bindings } => {
                     self.boxes.push(BoxItem {
                         id: *id,
+                        role: SceneHitRole::Box,
                         rect: Rectangle::new(
                             Point::new(65., *y - 20.),
                             Size::new(self.size.width - 130., 70.),
@@ -1627,6 +1789,10 @@ impl Scene {
         }
         if ordered {
             self.sequence_bounds.insert(owner, (sequence_top, *y - 42.));
+            if let Some(plan) = plan {
+                self.sequence_bounds.insert(owner, plan.scopes[&owner]);
+                *y = plan.scopes[&owner].1 + 42.;
+            }
             let slot = scenario::Slot {
                 parent: owner,
                 before: None,
@@ -1666,11 +1832,21 @@ impl Scene {
         ))
     }
     fn hit(&self, point: Point) -> Option<Id> {
+        self.hit_item(point).map(|hit| hit.id)
+    }
+
+    /// Preserve the semantic selection order and tolerance while retaining the
+    /// primitive's identity. Future spacing admission must also validate the
+    /// saved view, owner and core occurrence kind; a hit alone grants no edit.
+    fn hit_item(&self, point: Point) -> Option<SceneHit> {
         if !point.x.is_finite() || !point.y.is_finite() {
             return None;
         }
         if let Some(id) = self.lifecycle.marker_at(point) {
-            return Some(id);
+            return Some(SceneHit {
+                id,
+                role: SceneHitRole::LifecycleMarker,
+            });
         }
         self.boxes
             .iter()
@@ -1680,7 +1856,10 @@ impl Scene {
                     && b.rect.contains(point)
                     && (b.marker != Some(Kind::Occurrence) || point.y < b.rect.y + 38.)
             })
-            .map(|b| b.id)
+            .map(|b| SceneHit {
+                id: b.id,
+                role: b.role,
+            })
             .or_else(|| {
                 self.lines
                     .iter()
@@ -1690,26 +1869,51 @@ impl Scene {
                                 crate::diagram::distance_to_segment(point, p[0], p[1]) < 1.5
                             })
                     })
-                    .map(|line| line.id)
+                    .map(|line| SceneHit {
+                        id: line.id,
+                        role: line.role,
+                    })
             })
             .or_else(|| {
                 self.activations
                     .iter()
                     .rev()
                     .find(|b| b.rect.contains(point))
-                    .map(|b| b.call)
+                    .map(|b| SceneHit {
+                        id: b.call,
+                        role: SceneHitRole::Activation,
+                    })
             })
             .or_else(|| {
                 self.lines
                     .iter()
                     .find(|line| !line.label.is_empty() && line.label_bounds().contains(point))
-                    .map(|line| line.id)
+                    .map(|line| SceneHit {
+                        id: line.id,
+                        role: if line.role == SceneHitRole::MessageBody {
+                            SceneHitRole::MessageLabel
+                        } else {
+                            SceneHitRole::OtherLine
+                        },
+                    })
             })
             // The generous message tolerance must not steal the exposed
             // shoulder of another call's execution when the view is zoomed out.
             .or_else(|| self.near_sequence_item(point))
-            .or_else(|| self.lifecycle.lane_at(point, self.scale))
-            .or_else(|| self.lane_at(point))
+            .or_else(|| {
+                self.lifecycle
+                    .lane_at(point, self.scale)
+                    .map(|id| SceneHit {
+                        id,
+                        role: SceneHitRole::LifelineGuide,
+                    })
+            })
+            .or_else(|| {
+                self.lane_at(point).map(|id| SceneHit {
+                    id,
+                    role: SceneHitRole::LifelineGuide,
+                })
+            })
             .or_else(|| {
                 self.lines
                     .iter()
@@ -1720,11 +1924,14 @@ impl Scene {
                                     < 8. / self.scale
                             })
                     })
-                    .map(|line| line.id)
+                    .map(|line| SceneHit {
+                        id: line.id,
+                        role: line.role,
+                    })
             })
     }
 
-    fn near_sequence_item(&self, point: Point) -> Option<Id> {
+    fn near_sequence_item(&self, point: Point) -> Option<SceneHit> {
         if !self.scale.is_finite() || self.scale <= 0. {
             return None;
         }
@@ -1738,17 +1945,32 @@ impl Scene {
                     .windows(2)
                     .map(|p| crate::diagram::distance_to_segment(point, p[0], p[1]))
                     .fold(f32::INFINITY, f32::min);
-                (line.id, distance)
+                (
+                    SceneHit {
+                        id: line.id,
+                        role: line.role,
+                    },
+                    distance,
+                )
             });
         // Compare broad message and lifecycle-marker tolerance together after
         // exact shapes, so dense minimum-Fit rows choose the nearer item.
         self.lifecycle
             .nearest_marker(point)
+            .map(|(id, distance)| {
+                (
+                    SceneHit {
+                        id,
+                        role: SceneHitRole::LifecycleMarker,
+                    },
+                    distance,
+                )
+            })
             .into_iter()
             .chain(messages)
             .filter(|(_, distance)| *distance <= 8. / self.scale)
-            .min_by(|a, b| a.1.total_cmp(&b.1).then_with(|| a.0.cmp(&b.0)))
-            .map(|(id, _)| id)
+            .min_by(|a, b| a.1.total_cmp(&b.1).then_with(|| a.0.id.cmp(&b.0.id)))
+            .map(|(hit, _)| hit)
     }
 }
 impl canvas::Program<Message> for Scene {
@@ -1776,15 +1998,33 @@ impl canvas::Program<Message> for Scene {
         // captured insertion slot belongs to the previous view, even if the
         // pointer itself did not move and the semantic context is unchanged.
         if state.bounds.is_some_and(|previous| previous != bounds) {
-            state.cancel();
+            let cancelled = state.cancel_spacing();
             state.pointer = None;
+            state.bounds = Some(bounds);
+            if cancelled.is_some() {
+                return cancelled;
+            }
         }
         state.bounds = Some(bounds);
-        if !editable {
-            state.cancel();
+        if (!editable || !self.coordinate_input)
+            && let Some(cancelled) = state.cancel_spacing()
+        {
+            return Some(cancelled);
         }
         // The viewport masks input outside its visible canvas bounds.
         let visible = cursor.position().is_some();
+        if !visible
+            && matches!(state.press, Some(SequencePress::Spacing { .. }))
+            && matches!(
+                event,
+                canvas::Event::Mouse(
+                    mouse::Event::CursorMoved { .. }
+                        | mouse::Event::ButtonReleased(mouse::Button::Left)
+                )
+            )
+        {
+            return state.cancel_spacing();
+        }
         if !visible
             && matches!(
                 event,
@@ -1803,7 +2043,7 @@ impl canvas::Program<Message> for Scene {
                         | SequencePress::Reorder { start, moved, .. } => {
                             *moved |= position.distance(*start) >= 3.
                         }
-                        SequencePress::Occurrence { .. } => {}
+                        SequencePress::Occurrence { .. } | SequencePress::Spacing { .. } => {}
                     }
                 }
                 mouse::Cursor::Available(*position)
@@ -1812,9 +2052,9 @@ impl canvas::Program<Message> for Scene {
             | canvas::Event::Window(iced::window::Event::Resized(_))
             | canvas::Event::Mouse(mouse::Event::CursorLeft)
             | canvas::Event::Window(iced::window::Event::Unfocused) => {
-                state.cancel();
+                let cancelled = state.cancel_spacing();
                 state.pointer = None;
-                return Some(Action::request_redraw());
+                return cancelled.or_else(|| Some(Action::request_redraw()));
             }
             canvas::Event::Mouse(
                 mouse::Event::ButtonPressed(_) | mouse::Event::ButtonReleased(_),
@@ -1850,8 +2090,9 @@ impl canvas::Program<Message> for Scene {
                 key: iced::keyboard::Key::Named(iced::keyboard::key::Named::Escape),
                 ..
             }) if state.source.is_some() || state.press.is_some() => {
-                state.cancel();
-                return Some(Action::request_redraw().and_capture());
+                return state
+                    .cancel_spacing()
+                    .or_else(|| Some(Action::request_redraw().and_capture()));
             }
             _ => cursor,
         };
@@ -1871,6 +2112,14 @@ impl canvas::Program<Message> for Scene {
                     if !editable {
                         return None;
                     }
+                    if !self.coordinate_input {
+                        return self.hit(point).map(|id| {
+                            Action::publish(Message::ScenarioCanvas(CanvasEvent::Select(
+                                context, id,
+                            )))
+                            .and_capture()
+                        });
+                    }
                     if let CanvasTool::Message(_) = tool {
                         let first = state.source.is_none();
                         let (source, slot) = state.source.or_else(|| {
@@ -1897,6 +2146,48 @@ impl canvas::Program<Message> for Scene {
                         });
                         return Some(Action::request_redraw().and_capture());
                     }
+                    if matches!(
+                        context.representation,
+                        scenario_layout::Representation::Saved { .. }
+                    ) {
+                        let hit = self.hit_item(point)?;
+                        let target = match hit.role {
+                            SceneHitRole::LifelineHeader => {
+                                Some(scenario::spacing::Target::Lane(hit.id))
+                            }
+                            SceneHitRole::MessageBody | SceneHitRole::MessageLabel => {
+                                Some(scenario::spacing::Target::Message(hit.id))
+                            }
+                            _ => None,
+                        };
+                        if let Some((target, stamp)) = target.zip(self.spacing_stamp)
+                            && stamp.context == context
+                        {
+                            let token = Id::new_v4();
+                            state.press = Some(SequencePress::Spacing { stamp, token });
+                            return Some(
+                                Action::publish(Message::ScenarioCanvas(CanvasEvent::Spacing(
+                                    scenario::spacing::Event::Begin {
+                                        stamp,
+                                        token,
+                                        target,
+                                        press_screen: cursor.position()?,
+                                        canvas_bounds: bounds,
+                                        scale: self.scale,
+                                        pan: self.camera_pan,
+                                    },
+                                )))
+                                .and_capture(),
+                            );
+                        }
+                        // Saved spacing never silently changes the shared Scenario order.
+                        return Some(
+                            Action::publish(Message::ScenarioCanvas(CanvasEvent::Select(
+                                context, hit.id,
+                            )))
+                            .and_capture(),
+                        );
+                    }
                     if let Some(occurrence) = self
                         .hit(point)
                         .filter(|id| self.rows.contains_key(id))
@@ -1926,6 +2217,22 @@ impl canvas::Program<Message> for Scene {
                 let press = state.press.take()?;
                 let context = context?;
                 match press {
+                    SequencePress::Spacing { stamp, token } => {
+                        state.source = None;
+                        let event = if world.is_some() {
+                            scenario::spacing::Event::Finish {
+                                stamp,
+                                token,
+                                screen: cursor.position()?,
+                            }
+                        } else {
+                            scenario::spacing::Event::Cancel { stamp, token }
+                        };
+                        return Some(
+                            Action::publish(Message::ScenarioCanvas(CanvasEvent::Spacing(event)))
+                                .and_capture(),
+                        );
+                    }
                     SequencePress::Occurrence {
                         tool: captured,
                         slot,
@@ -2017,6 +2324,18 @@ impl canvas::Program<Message> for Scene {
                 Some(Action::request_redraw().and_capture())
             }
             canvas::Event::Mouse(mouse::Event::CursorMoved { .. }) if context.is_some() => {
+                if let Some(SequencePress::Spacing { stamp, token }) = state.press {
+                    return Some(
+                        Action::publish(Message::ScenarioCanvas(CanvasEvent::Spacing(
+                            scenario::spacing::Event::Move {
+                                stamp,
+                                token,
+                                screen: cursor.position()?,
+                            },
+                        )))
+                        .and_capture(),
+                    );
+                }
                 Some(Action::request_redraw())
             }
             _ => None,
@@ -2198,7 +2517,10 @@ impl canvas::Program<Message> for Scene {
         self.lifecycle
             .draw_markers(&mut f, self.selected, self.scale, self.camera_pan);
         if let Some((context, tool, editable)) = self.interaction {
-            let active = editable && state.context == Some(context) && state.tool == tool;
+            let active = editable
+                && self.coordinate_input
+                && state.context == Some(context)
+                && state.tool == tool;
             let point = cursor.position_in(bounds).map(|p| {
                 Point::new(
                     (p.x - self.camera_pan.x) / self.scale,
@@ -2214,7 +2536,12 @@ impl canvas::Program<Message> for Scene {
                 }
             });
             if editable
+                && self.coordinate_input
                 && tool == scenario::CanvasTool::Select
+                && matches!(
+                    context.representation,
+                    scenario_layout::Representation::Derived { .. }
+                )
                 && let Some(handle) = self.reorder_handle()
             {
                 f.fill_rectangle(handle.position(), handle.size(), style::TEAL);

crates/oa-desktop/src/behavior/canvas_workspace.rs

@@ -50,7 +50,7 @@ pub fn controls<'a>(
         control("Details", "Details", Some(details)),
         control("Fit", "Fit", Some(zoom(None))),
         control("ZoomOut", "−", Some(zoom(Some(scale / 1.25)))),
-        text(format!("{:.0}%", scale * 100.)).size(12),
+        text(zoom_label(scale)).size(12),
         control("ZoomIn", "+", Some(zoom(Some(scale * 1.25)))),
         control("ActualSize", "100%", Some(zoom(Some(1.)))),
     ]
@@ -65,6 +65,7 @@ pub fn controls<'a>(
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub struct Scope {
+    pub(crate) scenario_view: Option<(super::scenario_layout::Representation, Id)>,
     pub document: Id,
     pub owner: Id,
     pub revision: u64,
@@ -76,6 +77,7 @@ impl Scope {
             Some(Self {
                 document: context.document,
                 owner: context.scenario,
+                scenario_view: Some((context.representation, context.visit)),
                 revision: context.revision,
                 epoch: app.camera_epoch,
             })
@@ -84,6 +86,7 @@ impl Scope {
             Some(Self {
                 document: context.document,
                 owner: context.owner,
+                scenario_view: None,
                 revision: context.revision,
                 epoch: app.camera_epoch,
             })
@@ -103,8 +106,8 @@ impl Scope {
 
     pub fn control_id(self, name: &str) -> iced::advanced::widget::Id {
         iced::advanced::widget::Id::from(format!(
-            "behavior-control:{}:{}:{}:{name}",
-            self.document, self.owner, self.revision
+            "behavior-control:{}:{}:{}:{:?}:{name}",
+            self.document, self.owner, self.revision, self.scenario_view
         ))
     }
 }
@@ -137,6 +140,20 @@ pub enum Event {
 pub use focus::{focus_task, root as focus_root};
 /// Fold relative input in event order. The base scale is used only on leaving Fit.
 pub fn change(pan: &mut Vector, zoom: &mut Option<f32>, fit: &mut bool, event: Event) -> bool {
+    change_with_minimum(pan, zoom, fit, event, 0.05)
+}
+
+/// Scenario extents can require scales below the topology canvas's 5% floor.
+pub(super) fn change_with_minimum(
+    pan: &mut Vector,
+    zoom: &mut Option<f32>,
+    fit: &mut bool,
+    event: Event,
+    minimum: f32,
+) -> bool {
+    if !minimum.is_finite() || minimum <= 0. || minimum > 3. {
+        return false;
+    }
     match event {
         Event::Pan(delta) if delta.x.is_finite() && delta.y.is_finite() => {
             let next = *pan + delta;
@@ -156,7 +173,10 @@ pub fn change(pan: &mut Vector, zoom: &mut Option<f32>, fit: &mut bool, event: E
                 && at.y.is_finite() =>
         {
             let old = if *fit { base } else { zoom.unwrap_or(base) };
-            let next = (old * factor).clamp(0.05, 3.);
+            if !old.is_finite() || old <= 0. {
+                return false;
+            }
+            let next = (old * factor).clamp(minimum, 3.);
             if old == next {
                 return false;
             }
@@ -174,6 +194,51 @@ pub fn change(pan: &mut Vector, zoom: &mut Option<f32>, fit: &mut bool, event: E
     }
 }
 
+fn zoom_label(scale: f32) -> String {
+    let percent = f64::from(scale) * 100.;
+    if !percent.is_finite() || percent <= 0. {
+        return "—".into();
+    }
+    if percent >= 1. {
+        format!("{percent:.0}%")
+    } else if percent >= 0.01 {
+        format!("{percent:.3}%")
+    } else {
+        format!("{percent:.2e}%")
+    }
+}
+
+#[cfg(test)]
+mod camera_policy_tests {
+    use super::*;
+
+    #[test]
+    fn topology_retains_five_percent_floor() {
+        let (mut pan, mut zoom, mut fit) = (Vector::ZERO, Some(0.06), false);
+        assert!(change(
+            &mut pan,
+            &mut zoom,
+            &mut fit,
+            Event::Zoom {
+                factor: 0.1,
+                at: Point::ORIGIN,
+                base: 0.06,
+            }
+        ));
+        assert_eq!(zoom, Some(0.05));
+    }
+
+    #[test]
+    fn tiny_zoom_label_is_nonzero_and_changes_with_zoom() {
+        assert_eq!(zoom_label(1.), "100%");
+        assert_eq!(zoom_label(0.05), "5%");
+        assert_eq!(zoom_label(0.00034193), "0.034%");
+        assert_eq!(zoom_label(0.00034193 * 1.25), "0.043%");
+        assert_eq!(zoom_label(1e-7), "1.00e-5%");
+        assert_ne!(zoom_label(f32::from_bits(1)), "0%");
+    }
+}
+
 /// Constant-width labelled palette. Arming a tool never reallocates the canvas.
 pub fn palette<'a>(
     scope: Scope,

crates/oa-desktop/src/behavior/canvas_workspace/tests.rs

@@ -379,6 +379,7 @@ fn relative_camera_zoom_keeps_the_cursor_world_point_and_rejects_nonfinite_input
 fn viewport_ordered_batch_uses_each_event_position_and_cancels_before_camera_motion() {
     use iced::widget::Space;
     let scope = Scope {
+        scenario_view: None,
         document: Id::new_v4(),
         owner: Id::new_v4(),
         revision: 2,
@@ -438,6 +439,7 @@ pub(crate) fn scope(app: &App) -> Scope {
         Scope {
             document: context.document,
             owner: context.scenario,
+            scenario_view: Some((context.representation, context.visit)),
             revision: context.revision,
             epoch: app.camera_epoch,
         }
@@ -446,6 +448,7 @@ pub(crate) fn scope(app: &App) -> Scope {
         Scope {
             document: context.document,
             owner: context.owner,
+            scenario_view: None,
             revision: context.revision,
             epoch: app.camera_epoch,
         }

crates/oa-desktop/src/behavior/contextual_source_tests.rs

@@ -893,11 +893,14 @@ fn contextual_source_empty_palette_lifeline_cannot_open_a_previous_owner_or_laye
         .add_element(Kind::Scenario, Layer::Oa, "Second scenario", None)
         .unwrap();
     let mut app = App::with_project(p.clone());
-    app.page = Page::Behavior;
-    app.layer = Layer::Oa;
-    app.behavior.active_owner = Some(a);
-    app.selected = a;
+    // Capture the context created by actual navigation, including its visit.
+    // Merely assigning active_owner/selected does not mount a Scenario anymore.
+    let _ = app.update(Message::Select(a));
+    let _ = app.update(Message::Page(Page::Behavior));
     let context = app.scenario_context().unwrap();
+    assert_eq!(context.scenario, a);
+    assert!(!context.visit.is_nil());
+    let snapshot = app.document.snapshot();
     let source = app.document.bundle().clone();
     let begin = |context| scenario::CanvasEvent::BeginOccurrence {
         context,
@@ -908,23 +911,40 @@ fn contextual_source_empty_palette_lifeline_cannot_open_a_previous_owner_or_laye
         },
         lifeline: None,
     };
-    app.behavior.active_owner = Some(b);
-    app.selected = b;
+    let _ = app.update(Message::Select(b));
+    let second = app.scenario_context().unwrap();
+    assert_eq!(second.scenario, b);
+    assert_ne!(second.visit, context.visit);
     let _ = app.update(Message::ScenarioCanvas(begin(context)));
     assert!(!app.behavior.has_pending());
     assert_eq!(app.project(), &p);
-    app.behavior.active_owner = Some(a);
-    app.selected = a;
-    app.layer = Layer::Sa;
-    let _ = app.update(Message::ScenarioCanvas(begin(context)));
+
+    let _ = app.update(Message::Select(a));
+    let before_layer_change = app.scenario_context().unwrap();
+    assert_eq!(before_layer_change.scenario, a);
+    assert_ne!(before_layer_change.visit, context.visit);
+    let _ = app.update(Message::Layer(Layer::Sa));
+    assert_eq!(app.layer, Layer::Sa);
+    assert!(app.scenario_context().is_none());
+    let _ = app.update(Message::ScenarioCanvas(begin(before_layer_change)));
     assert!(!app.behavior.has_pending());
-    app.layer = Layer::Oa;
+
+    let _ = app.update(Message::Layer(Layer::Oa));
+    let _ = app.update(Message::Select(a));
     let current = app.scenario_context().unwrap();
+    assert_eq!(current.scenario, a);
+    assert_ne!(current.visit, before_layer_change.visit);
+    // Returning to the same owner/layer must not revive either retired packet.
+    for retired in [context, before_layer_change] {
+        let _ = app.update(Message::ScenarioCanvas(begin(retired)));
+        assert!(!app.behavior.has_pending());
+    }
+    assert!(std::sync::Arc::ptr_eq(&snapshot, &app.document.snapshot()));
     let _ = app.update(Message::ScenarioCanvas(begin(current)));
     assert_eq!(app.behavior.pending_owner(), Some(a));
     assert_eq!(app.project(), &p);
     assert_eq!(app.document.bundle(), &source);
-    assert!(!app.document.can_undo());
+    assert!(!app.document.can_undo() && !app.document.can_redo());
 }
 
 #[test]

crates/oa-desktop/src/behavior/creation.rs

@@ -10,32 +10,6 @@ use serde::{Deserialize, Serialize};
 const PAGE_SIZE: usize = 6;
 pub const NAME_INPUT: &str = "behavior-creation-name";
 
-// A focused text input consumes Escape. Preserve the application's modal
-// priority by emitting its ordinary Escape message from this narrow bridge.
-pub fn subscription(active: bool) -> iced::Subscription<()> {
-    if active {
-        iced::event::listen_with(captured_escape)
-    } else {
-        iced::Subscription::none()
-    }
-}
-
-fn captured_escape(
-    event: iced::Event,
-    status: iced::event::Status,
-    _: iced::window::Id,
-) -> Option<()> {
-    (status == iced::event::Status::Captured
-        && matches!(
-            event,
-            iced::Event::Keyboard(iced::keyboard::Event::KeyPressed {
-                key: iced::keyboard::Key::Named(iced::keyboard::key::Named::Escape),
-                ..
-            })
-        ))
-    .then_some(())
-}
-
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 pub enum Family {
     Sequence,

crates/oa-desktop/src/behavior/creation/app_tests.rs

@@ -18,59 +18,11 @@ fn begin(app: &mut App, layer: Layer, family: Family, name: &str) {
     send(app, Event::Name(name.into()));
 }
 
-fn focused_escape() -> Message {
-    use iced::advanced::{Layout, Shell, layout, widget};
-    use iced::keyboard::{self, key::Named};
-    let mut input: iced::Element<'_, (), iced::Theme, ()> = text_input("Name", "Unfinished name")
-        .id(NAME_INPUT)
-        .on_input(|_| ())
-        .into();
-    let mut tree = widget::Tree::new(input.as_widget());
-    let size = iced::Size::new(300., 40.);
-    let node =
-        input
-            .as_widget_mut()
-            .layout(&mut tree, &(), &layout::Limits::new(iced::Size::ZERO, size));
-    tree.state
-        .downcast_mut::<iced::widget::text_input::State<()>>()
-        .focus();
-    let event = iced::Event::Keyboard(keyboard::Event::KeyPressed {
-        key: keyboard::Key::Named(Named::Escape),
-        modified_key: keyboard::Key::Named(Named::Escape),
-        physical_key: keyboard::key::Physical::Code(keyboard::key::Code::Escape),
-        location: keyboard::Location::Standard,
-        modifiers: keyboard::Modifiers::empty(),
-        text: None,
-        repeat: false,
-    });
-    let mut messages = Vec::new();
-    let mut shell = Shell::new(&mut messages);
-    input.as_widget_mut().update(
-        &mut tree,
-        &event,
-        Layout::new(&node),
-        iced::mouse::Cursor::Unavailable,
-        &(),
-        &mut iced::advanced::clipboard::Null,
-        &mut shell,
-        &iced::Rectangle::new(iced::Point::ORIGIN, size),
-    );
-    assert!(shell.is_event_captured());
-    assert_eq!(
-        captured_escape(
-            event.clone(),
-            iced::event::Status::Ignored,
-            iced::window::Id::unique()
-        ),
-        None
-    );
-    captured_escape(
-        event,
-        iced::event::Status::Captured,
-        iced::window::Id::unique(),
-    )
-    .unwrap();
-    Message::Escape
+fn focused_escape(app: &App) -> Message {
+    let mut messages = crate::app::escape::tests::focused_input_messages(app);
+    assert_eq!(messages.len(), 1);
+    assert!(matches!(messages[0], Message::Escape));
+    messages.remove(0)
 }
 
 #[test]
@@ -94,12 +46,12 @@ fn app_first_captured_escape_dismisses_file_or_pending_overlay_before_creation()
         } else {
             app.pending = Some(Pending::Walkthrough);
         }
-        let _ = app.update(focused_escape());
+        let _ = app.update(focused_escape(&app));
         assert!(app.file_prompt.is_none());
         assert!(app.pending.is_none());
         assert_eq!(app.behavior.recovery_snapshot().unwrap(), raw);
         assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
-        let _ = app.update(focused_escape());
+        let _ = app.update(focused_escape(&app));
         assert!(!app.behavior.has_pending());
         assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
         assert!(!app.document.can_undo());

crates/oa-desktop/src/behavior/scenario.rs

@@ -4,12 +4,28 @@ use super::topology::{occurrence, unique_batch};
 use super::*;
 use iced::widget::{Column, column, text_input};
 use std::{cell::RefCell, collections::BTreeSet};
+mod camera;
 pub(crate) mod focus;
+pub(crate) mod spacing;
+use super::scenario_layout::{
+    Representation,
+    presentation::{self, ScenarioPresentation},
+};
+#[cfg(test)]
+mod presentation_tests;
 mod usage;
 mod workspace;
 pub(crate) use workspace::NAME_INPUT;
 pub use workspace::{Shelf, view};
 
+// A picker may select the Saved diagram record itself. Another view of the
+// same Scenario is not the property target of this displayed representation.
+pub(crate) fn properties_target(p: &Project, context: Context, id: Id) -> bool {
+    super::selected_behavior(p, id) == Some(context.scenario)
+        || matches!(context.representation, Representation::Saved { diagram } if diagram == id)
+            && presentation::checked_owner(p, context.representation) == Some(context.scenario)
+}
+
 #[cfg(test)]
 #[path = "scenario_operation_tests.rs"]
 mod operation_tests;
@@ -99,6 +115,8 @@ pub(crate) fn removal_target(p: &Project, owner: Id, id: Id) -> bool {
 pub struct Context {
     pub document: Id,
     pub scenario: Id,
+    pub representation: Representation,
+    pub visit: Id,
     pub revision: u64,
     pub epoch: u64,
 }
@@ -125,6 +143,7 @@ impl std::fmt::Display for CanvasTool {
 }
 #[derive(Debug, Clone)]
 pub enum CanvasEvent {
+    Spacing(spacing::Event),
     Scrolled(Context, ScrollArea, iced::Vector),
     Restored(Context, Id, ScrollArea, iced::Vector),
     Viewport(Context, Size),
@@ -132,9 +151,11 @@ pub enum CanvasEvent {
     Zoom(Context, Option<f32>),
     Camera(Context, u64, super::canvas_workspace::Event),
     Shelf(Context, Shelf),
+    Properties(Context, Id),
     OpenUse(Context, Id),
     Back(Context),
     Choose(Context, CanvasTool),
+    Representation(Context, Representation),
     Select(Context, Id),
     Remove(Context, Id),
     Begin {
@@ -164,6 +185,7 @@ pub enum ScrollArea {
 impl CanvasEvent {
     pub fn context(&self) -> Context {
         match self {
+            Self::Spacing(event) => event.stamp().context,
             Self::Scrolled(context, _, _)
             | Self::Restored(context, ..)
             | Self::Viewport(context, _)
@@ -171,9 +193,11 @@ impl CanvasEvent {
             | Self::Zoom(context, _)
             | Self::Camera(context, ..)
             | Self::Shelf(context, _)
+            | Self::Properties(context, _)
             | Self::OpenUse(context, _)
             | Self::Back(context)
             | Self::Choose(context, _)
+            | Self::Representation(context, _)
             | Self::Select(context, _)
             | Self::Remove(context, _)
             | Self::Begin { context, .. }
@@ -231,6 +255,7 @@ pub enum ValueSection {
 const VALUE_PAGE_SIZE: usize = 24;
 #[derive(Default)]
 pub struct State {
+    spacing: Option<spacing::controller::Session>,
     draft: Option<Draft>,
     form_session: Id,
     form_mount: Id,
@@ -246,6 +271,7 @@ const CALLER_LIMIT: usize = 32;
 pub(crate) struct Caller {
     document: Id,
     pub owner: Id,
+    pub representation: Representation,
     pub occurrence: Id,
     target: Id,
     tool: CanvasTool,
@@ -255,6 +281,8 @@ pub(crate) struct Caller {
 struct DetailsRestore {
     document: Id,
     owner: Id,
+    representation: Representation,
+    visit: Id,
     token: Id,
     offset: iced::Vector,
 }
@@ -262,6 +290,8 @@ struct DetailsRestore {
 pub(super) struct ScrollRestore {
     pub document: Id,
     pub owner: Id,
+    pub representation: Representation,
+    pub visit: Id,
     pub token: Id,
     pub offset: iced::Vector,
 }
@@ -354,46 +384,158 @@ impl State {
     }
 
     pub(crate) fn enter(&mut self, document: Id, owner: Id) {
-        if self.presentation.identity != Some((document, owner)) {
+        self.enter_representation(document, owner, Representation::Derived { owner });
+    }
+    /// App validates requested identity with checked_owner before entering.
+    pub(crate) fn enter_representation(
+        &mut self,
+        document: Id,
+        owner: Id,
+        representation: Representation,
+    ) -> bool {
+        if matches!(representation, Representation::Derived { owner: requested } if requested != owner)
+        {
+            return false;
+        }
+        let changed = self.presentation.identity != Some((document, owner))
+            || self.presentation.representation != Some(representation);
+        if changed {
             self.presentation = workspace::Presentation {
                 identity: Some((document, owner)),
+                representation: Some(representation),
+                fit: matches!(representation, Representation::Saved { .. }),
                 ..Default::default()
             };
             self.details_offset = iced::Vector::ZERO;
-            self.restore = None;
+            self.canvas_tool = Some((owner, CanvasTool::Select));
         }
+        if changed || self.presentation.visit.is_nil() {
+            self.spacing = None;
+            self.presentation.visit = Id::new_v4();
+            self.restore = None;
+            return true;
+        }
+        false
+    }
+    /// Suspend captured events while preserving this destination's camera state.
+    pub(crate) fn leave(&mut self) {
+        self.spacing = None;
+        self.presentation.visit = Id::nil();
+        self.restore = None;
+    }
+    pub(crate) fn forget_view(&mut self) {
+        self.spacing = None;
+        self.presentation.identity = None;
+        self.presentation.representation = None;
+        self.presentation.visit = Id::nil();
+        self.restore = None;
+    }
+    pub(crate) fn representation(&self) -> Option<Representation> {
+        self.presentation.representation
+    }
+    pub(crate) fn owner(&self) -> Option<Id> {
+        self.presentation.identity.map(|(_, owner)| owner)
+    }
+    pub(crate) fn context(
+        &self,
+        document: Id,
+        owner: Id,
+        revision: u64,
+        epoch: u64,
+    ) -> Option<Context> {
+        if self.presentation.identity != Some((document, owner)) || self.presentation.visit.is_nil()
+        {
+            return None;
+        }
+        Some(Context {
+            document,
+            scenario: owner,
+            representation: self.representation()?,
+            visit: self.presentation.visit,
+            revision,
+            epoch,
+        })
+    }
+    pub(crate) fn display(
+        &self,
+        p: &Project,
+        owner: Id,
+        selected: Id,
+    ) -> Option<ScenarioPresentation> {
+        let (_, current_owner) = self.presentation.identity?;
+        let representation = self.representation()?;
+        (current_owner == owner).then(|| presentation::present(p, representation, selected))
+    }
+    pub(crate) fn coordinate_input(&self, p: &Project, context: Context) -> bool {
+        self.context(
+            context.document,
+            context.scenario,
+            context.revision,
+            context.epoch,
+        ) == Some(context)
+            && self
+                .display(p, context.scenario, context.scenario)
+                .is_some_and(|shown| shown.capabilities().coordinate_input)
     }
     pub(crate) fn viewport(&mut self, size: Size) -> bool {
         self.presentation.viewport(size)
     }
-    pub(crate) fn camera(&mut self, event: super::canvas_workspace::Event) -> bool {
+    pub(crate) fn camera(
+        &mut self,
+        project: &Project,
+        owner: Id,
+        event: super::canvas_workspace::Event,
+    ) -> bool {
+        let Some(bounds) = self
+            .display(project, owner, owner)
+            .and_then(|shown| shown.bounds())
+        else {
+            return false;
+        };
         let p = &mut self.presentation;
-        super::canvas_workspace::change(&mut p.pan, &mut p.zoom, &mut p.fit, event)
+        camera::change(
+            &mut p.pan,
+            &mut p.zoom,
+            &mut p.fit,
+            p.viewport,
+            bounds,
+            event,
+        )
     }
     pub(crate) fn zoom(&mut self, scale: Option<f32>) -> bool {
         self.presentation.zoom(scale)
     }
     pub(crate) fn camera_zoom(&mut self, p: &Project, owner: Id, zoom: Option<f32>) -> bool {
-        let size = Scene::sequence(p, owner, owner).size;
-        let old = self.presentation.scale(size);
+        let Some(bounds) = self
+            .display(p, owner, owner)
+            .and_then(|shown| shown.bounds())
+        else {
+            return false;
+        };
         if let Some(next) = zoom {
+            let current = self.presentation.camera(bounds);
             let viewport = self.presentation.viewport.unwrap_or(Size::new(500., 300.));
-            self.camera(super::canvas_workspace::Event::Zoom {
-                factor: next / old,
-                at: Point::new(viewport.width / 2., viewport.height / 2.),
-                base: old,
-            })
+            self.camera(
+                p,
+                owner,
+                super::canvas_workspace::Event::Zoom {
+                    factor: next / current.scale,
+                    at: Point::new(viewport.width / 2., viewport.height / 2.),
+                    base: current.scale,
+                },
+            )
         } else {
-            self.zoom(None);
-            let fitted = self.presentation.scale(size);
-            self.zoom(Some(fitted));
-            self.presentation.pan = iced::Vector::ZERO;
-            true
+            self.zoom(None)
         }
     }
     pub(crate) fn toggle_shelf(&mut self, shelf: Shelf) {
         self.presentation.shelf = (self.presentation.shelf != Some(shelf)).then_some(shelf);
     }
+    pub(crate) fn show_properties(&mut self) {
+        // Panels remain available. Dismiss the competing outline without
+        // replacing this view or its camera.
+        self.presentation.shelf = None;
+    }
     pub(crate) fn open_use(
         &mut self,
         p: &Project,
@@ -410,6 +552,7 @@ impl State {
         self.return_to.push(Caller {
             document: context.document,
             owner: context.scenario,
+            representation: context.representation,
             occurrence,
             target,
             tool: self.canvas_tool(context.scenario),
@@ -424,6 +567,7 @@ impl State {
     fn valid_caller(p: &Project, context: Context, frame: &Caller) -> bool {
         frame.document == context.document
             && frame.target == context.scenario
+            && presentation::checked_owner(p, frame.representation) == Some(frame.owner)
             && referenced_scenario(p, frame.owner, frame.occurrence) == Some(frame.target)
     }
     pub(super) fn can_back(&self, p: &Project, context: Context) -> bool {
@@ -440,16 +584,23 @@ impl State {
         None
     }
     pub(crate) fn restore_caller(&mut self, context: Context, frame: Caller) {
-        if context.document != frame.document || context.scenario != frame.owner {
+        if context.document != frame.document
+            || context.scenario != frame.owner
+            || context.representation != frame.representation
+        {
             return;
         }
         self.canvas_tool = Some((frame.owner, frame.tool));
         self.details_offset = frame.details_offset;
         self.presentation = frame.presentation;
         self.presentation.identity = Some((context.document, context.scenario));
+        self.presentation.representation = Some(frame.representation);
+        self.presentation.visit = context.visit;
         self.restore = Some(DetailsRestore {
             document: context.document,
             owner: frame.owner,
+            representation: frame.representation,
+            visit: context.visit,
             token: Id::new_v4(),
             offset: frame.details_offset,
         });
@@ -459,13 +610,17 @@ impl State {
         context: Context,
         ScrollArea::Page: ScrollArea,
     ) -> Option<ScrollRestore> {
-        let restore = self
-            .restore
-            .as_ref()
-            .filter(|r| r.document == context.document && r.owner == context.scenario)?;
+        let restore = self.restore.as_ref().filter(|r| {
+            r.document == context.document
+                && r.owner == context.scenario
+                && r.representation == context.representation
+                && r.visit == context.visit
+        })?;
         Some(ScrollRestore {
             document: restore.document,
             owner: restore.owner,
+            representation: restore.representation,
+            visit: restore.visit,
             token: restore.token,
             offset: restore.offset,
         })
@@ -478,7 +633,11 @@ impl State {
         offset: iced::Vector,
     ) -> bool {
         if !self.restore.as_ref().is_some_and(|r| {
-            r.document == context.document && r.owner == context.scenario && r.token == token
+            r.document == context.document
+                && r.owner == context.scenario
+                && r.representation == context.representation
+                && r.visit == context.visit
+                && r.token == token
         }) {
             return false;
         }
@@ -1951,6 +2110,8 @@ pub(crate) mod direct_tests {
         Context {
             document: Id::new_v4(),
             scenario: owner,
+            representation: Representation::Derived { owner },
+            visit: Id::new_v4(),
             revision: 0,
             epoch: 0,
         }

crates/oa-desktop/src/behavior/scenario/camera.rs

@@ -0,0 +1,284 @@
+//! Scenario camera policy. Bounds are from the exact displayed presentation,
+//! including its origin and automatic fallback; no model geometry is authored.
+use crate::behavior::canvas_workspace::{self, Event};
+use iced::{Rectangle, Size, Vector};
+
+pub(super) const MIN_SCALE: f32 = f32::from_bits(1);
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(super) struct Camera {
+    pub(super) scale: f32,
+    pub(super) pan: Vector,
+}
+
+/// Fit never enlarges above 100%. Use f64 intermediates so a valid f32 origin
+/// and size cannot overflow while finding the center. Unrepresentable cameras
+/// are refused rather than silently clamped to an unrelated minimum scale.
+pub(super) fn fit(bounds: Rectangle, viewport: Size) -> Option<Camera> {
+    if [
+        bounds.x,
+        bounds.y,
+        bounds.width,
+        bounds.height,
+        viewport.width,
+        viewport.height,
+    ]
+    .iter()
+    .any(|n| !n.is_finite())
+        || bounds.width < 0.
+        || bounds.height < 0.
+        || viewport.width <= 0.
+        || viewport.height <= 0.
+    {
+        return None;
+    }
+    let width = f64::from(viewport.width);
+    let height = f64::from(viewport.height);
+    let scale = ((width - 2. * (width / 4.).min(8.)) / f64::from(bounds.width).max(1.))
+        .min((height - 2. * (height / 4.).min(8.)) / f64::from(bounds.height).max(1.))
+        .min(1.) as f32;
+    if !scale.is_finite() || scale <= 0. {
+        return None;
+    }
+    let x = width / 2. - (f64::from(bounds.x) + f64::from(bounds.width) / 2.) * f64::from(scale);
+    let y = height / 2. - (f64::from(bounds.y) + f64::from(bounds.height) / 2.) * f64::from(scale);
+    let pan = Vector::new(x as f32, y as f32);
+    (pan.x.is_finite() && pan.y.is_finite()).then_some(Camera { scale, pan })
+}
+
+pub(super) fn effective_camera(
+    pan: Vector,
+    zoom: Option<f32>,
+    fitting: bool,
+    viewport: Option<Size>,
+    bounds: Rectangle,
+) -> Camera {
+    if fitting && let Some(camera) = viewport.and_then(|size| fit(bounds, size)) {
+        return camera;
+    }
+    Camera {
+        scale: zoom.unwrap_or(1.),
+        pan,
+    }
+}
+
+/// None preserves Fit as a mode, including before the first viewport arrives.
+pub(super) fn set_zoom(
+    pan: &mut Vector,
+    zoom: &mut Option<f32>,
+    fitting: &mut bool,
+    scale: Option<f32>,
+) -> bool {
+    if scale.is_some_and(|value| !value.is_finite() || value <= 0.) {
+        return false;
+    }
+    let next = scale.map(|value| value.min(3.));
+    let next_pan = if scale.is_none() { Vector::ZERO } else { *pan };
+    let changed = *zoom != next || *fitting != scale.is_none() || *pan != next_pan;
+    *zoom = next;
+    *fitting = scale.is_none();
+    *pan = next_pan;
+    changed
+}
+
+/// Materialize the visible fitted camera only when a camera gesture succeeds.
+/// A zero-motion or rejected event preserves the original mode and fields.
+pub(super) fn change(
+    pan: &mut Vector,
+    zoom: &mut Option<f32>,
+    fitting: &mut bool,
+    viewport: Option<Size>,
+    bounds: Rectangle,
+    event: Event,
+) -> bool {
+    let camera = effective_camera(*pan, *zoom, *fitting, viewport, bounds);
+    let (mut next_pan, mut next_zoom, mut next_fit) = (camera.pan, Some(camera.scale), false);
+    let event = match event {
+        Event::Zoom { base, .. } if !base.is_finite() || base <= 0. => return false,
+        Event::Zoom { factor, at, .. } => Event::Zoom {
+            factor,
+            at,
+            base: camera.scale,
+        },
+        event => event,
+    };
+    if !canvas_workspace::change_with_minimum(
+        &mut next_pan,
+        &mut next_zoom,
+        &mut next_fit,
+        event,
+        MIN_SCALE,
+    ) {
+        return false;
+    }
+    *pan = next_pan;
+    *zoom = next_zoom;
+    *fitting = next_fit;
+    true
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use iced::Point;
+
+    fn bounds() -> Rectangle {
+        Rectangle {
+            x: -1_000_160.,
+            y: -200.,
+            width: 2_000_400.,
+            height: 1_000.,
+        }
+    }
+    fn near(actual: f32, expected: f32, tolerance: f32) {
+        assert!(
+            (actual - expected).abs() <= tolerance,
+            "{actual} != {expected}"
+        );
+    }
+    fn projected(camera: Camera, point: Point) -> Point {
+        Point::new(
+            point.x * camera.scale + camera.pan.x,
+            point.y * camera.scale + camera.pan.y,
+        )
+    }
+
+    #[test]
+    fn negative_origin_fit_contains_independently_known_extremes() {
+        let camera = fit(bounds(), Size::new(700., 500.)).unwrap();
+        near(camera.scale, 0.0003419316, 1e-10);
+        near(camera.pan.x, 349.98633, 0.0001);
+        near(
+            projected(camera, Point::new(-1_000_160., -200.)).x,
+            8.,
+            0.0001,
+        );
+        near(
+            projected(camera, Point::new(1_000_240., 800.)).x,
+            692.,
+            0.0001,
+        );
+        near(projected(camera, Point::new(40., 300.)).y, 250., 0.0001);
+    }
+
+    #[test]
+    fn fit_remains_active_across_first_and_changed_viewport() {
+        let (mut pan, mut zoom, mut fitting) = (Vector::new(50., 80.), Some(0.8), false);
+        assert!(set_zoom(&mut pan, &mut zoom, &mut fitting, None));
+        let retained = effective_camera(pan, zoom, fitting, Some(Size::new(1200., 500.)), bounds());
+        let actual = effective_camera(pan, zoom, fitting, Some(Size::new(500., 500.)), bounds());
+        assert!(actual.scale < retained.scale);
+        near(
+            projected(actual, Point::new(-1_000_160., -200.)).x,
+            8.,
+            0.0001,
+        );
+        near(
+            projected(actual, Point::new(1_000_240., 800.)).x,
+            492.,
+            0.0001,
+        );
+        assert_eq!((pan, zoom, fitting), (Vector::ZERO, None, true));
+    }
+
+    #[test]
+    fn tiny_fit_zoom_in_out_preserves_pointer_world_anchor_without_floor_jump() {
+        let size = Size::new(700., 500.);
+        let viewport = Some(size);
+        let start = fit(bounds(), size).unwrap();
+        let (mut pan, mut zoom, mut fitting) = (Vector::ZERO, None, true);
+        let at = Point::new(210., 180.);
+        let world = Point::new(
+            (at.x - start.pan.x) / start.scale,
+            (at.y - start.pan.y) / start.scale,
+        );
+        for factor in [1.25, 0.8] {
+            let prior_scale = zoom.unwrap_or(start.scale);
+            assert!(change(
+                &mut pan,
+                &mut zoom,
+                &mut fitting,
+                viewport,
+                bounds(),
+                Event::Zoom {
+                    factor,
+                    at,
+                    base: start.scale,
+                }
+            ));
+            let camera = effective_camera(pan, zoom, fitting, viewport, bounds());
+            near(camera.scale, prior_scale * factor, 1e-10);
+            assert!(camera.scale < 0.001);
+            near(projected(camera, world).x, at.x, 0.0001);
+            near(projected(camera, world).y, at.y, 0.0001);
+        }
+        near(zoom.unwrap(), start.scale, 1e-10);
+        near(pan.x, start.pan.x, 0.0001);
+        assert!(!fitting);
+    }
+
+    #[test]
+    fn pan_leaves_fit_from_displayed_position_and_zero_motion_preserves_fit() {
+        let size = Size::new(700., 500.);
+        let viewport = Some(size);
+        let (mut pan, mut zoom, mut fitting) = (Vector::ZERO, None, true);
+        for event in [
+            Event::Pan(Vector::ZERO),
+            Event::Zoom {
+                factor: 1.,
+                at: Point::ORIGIN,
+                base: 1.,
+            },
+        ] {
+            assert!(!change(
+                &mut pan,
+                &mut zoom,
+                &mut fitting,
+                viewport,
+                bounds(),
+                event
+            ));
+            assert_eq!((pan, zoom, fitting), (Vector::ZERO, None, true));
+        }
+        let start = fit(bounds(), size).unwrap();
+        assert!(change(
+            &mut pan,
+            &mut zoom,
+            &mut fitting,
+            viewport,
+            bounds(),
+            Event::Pan(Vector::new(20., -30.))
+        ));
+        assert_eq!(pan, start.pan + Vector::new(20., -30.));
+        assert_eq!(zoom, Some(start.scale));
+        assert!(!fitting);
+    }
+
+    #[test]
+    fn invalid_inputs_are_passive_and_large_finite_bounds_do_not_overflow_center() {
+        assert!(fit(bounds(), Size::new(f32::NAN, 500.)).is_none());
+        let extreme = Rectangle {
+            x: f32::MAX,
+            y: 0.,
+            width: f32::MAX,
+            height: 100.,
+        };
+        let camera = fit(extreme, Size::new(700., 500.)).unwrap();
+        assert!(camera.scale > 0. && camera.scale < 1e-30 && camera.pan.x.is_finite());
+        let (mut pan, mut zoom, mut fitting) = (Vector::ZERO, None, true);
+        assert!(!set_zoom(&mut pan, &mut zoom, &mut fitting, Some(f32::NAN)));
+        assert!(!change(
+            &mut pan,
+            &mut zoom,
+            &mut fitting,
+            Some(Size::new(700., 500.)),
+            bounds(),
+            Event::Zoom {
+                factor: 1.25,
+                at: Point::ORIGIN,
+                base: f32::NAN
+            }
+        ));
+        assert_eq!((pan, zoom, fitting), (Vector::ZERO, None, true));
+    }
+}

crates/oa-desktop/src/behavior/scenario/focus.rs

@@ -11,6 +11,8 @@ use std::collections::BTreeMap;
 pub(crate) struct Stamp {
     document: ModelId,
     owner: ModelId,
+    representation: super::Representation,
+    visit: ModelId,
     revision: u64,
     session: ModelId,
     mount: ModelId,
@@ -20,6 +22,8 @@ impl Stamp {
         Self {
             document: context.document,
             owner: context.scenario,
+            representation: context.representation,
+            visit: context.visit,
             revision: context.revision,
             session,
             mount,
@@ -28,10 +32,12 @@ impl Stamp {
 }
 pub(crate) fn name_id(stamp: Stamp) -> Id {
     Id::from(format!(
-        "{}:{}:{}:{}:{}:{}",
+        "{}:{}:{}:{:?}:{}:{}:{}:{}",
         super::NAME_INPUT,
         stamp.document,
         stamp.owner,
+        stamp.representation,
+        stamp.visit,
         stamp.revision,
         stamp.session,
         stamp.mount

crates/oa-desktop/src/behavior/scenario/presentation_tests.rs

@@ -0,0 +1,348 @@
+//! Controller identity and actual presentation input, independent of App routing.
+use super::*;
+use oa_core::{Diagram, DiagramLayout, ProjectionKind, ScenarioLanePosition, ScenarioLayout};
+
+fn saved(p: &mut Project, owner: Id, lanes: &[(Id, f32)]) -> Representation {
+    let id = Id::new_v4();
+    p.diagrams.insert(
+        id,
+        Diagram {
+            id,
+            alias: format!("saved_{}", p.diagrams.len()),
+            name: "Saved scenario".into(),
+            description: String::new(),
+            layer: p.elements[&owner].layer(),
+            projection: ProjectionKind::Scenario { scenario: owner },
+            view_options: Default::default(),
+            nodes: Default::default(),
+            routes: vec![],
+            layout: Some(DiagramLayout::Scenario(ScenarioLayout {
+                lanes: lanes
+                    .iter()
+                    .map(|&(lifeline, x)| ScenarioLanePosition { lifeline, x })
+                    .collect(),
+                messages: vec![],
+            })),
+        },
+    );
+    let errors: Vec<_> = oa_core::validation::validate(p)
+        .into_iter()
+        .filter(|issue| issue.severity == oa_core::validation::Severity::Error)
+        .collect();
+    assert!(errors.is_empty(), "{errors:?}");
+    Representation::Saved { diagram: id }
+}
+
+#[test]
+fn saved_visits_distinguish_same_owner_roundtrips_and_suspended_return_without_editing() {
+    let mut f = direct_tests::fixture();
+    let a = saved(&mut f.project, f.owner, &[(f.sender, -500.)]);
+    let b = saved(&mut f.project, f.owner, &[(f.sender, 900.)]);
+    let original = f.project.clone();
+    let document = Id::new_v4();
+    let mut state = State::default();
+    assert!(state.enter_representation(document, f.owner, a));
+    let first = state.context(document, f.owner, 7, 9).unwrap();
+    assert!(!state.enter_representation(document, f.owner, a));
+    assert_eq!(state.context(document, f.owner, 7, 9), Some(first));
+    state.presentation.pan = iced::Vector::new(23., -17.);
+    state.leave();
+    assert_eq!(state.representation(), Some(a));
+    assert_eq!(state.owner(), Some(f.owner));
+    assert!(state.context(document, f.owner, 7, 9).is_none());
+    assert!(state.enter_representation(document, f.owner, a));
+    let returned = state.context(document, f.owner, 7, 9).unwrap();
+    assert_ne!(returned.visit, first.visit);
+    assert_eq!(state.presentation.pan, iced::Vector::new(23., -17.));
+    assert!(state.enter_representation(document, f.owner, b));
+    let middle = state.context(document, f.owner, 7, 9).unwrap();
+    assert!(state.enter_representation(document, f.owner, a));
+    let last = state.context(document, f.owner, 7, 9).unwrap();
+    assert_ne!(last.visit, returned.visit);
+    assert_ne!(last.visit, middle.visit);
+    assert!(!state.coordinate_input(&f.project, first));
+    assert!(state.coordinate_input(&f.project, last));
+    let session = Id::new_v4();
+    let mount = Id::new_v4();
+    assert_ne!(
+        focus::Stamp::new(first, session, mount),
+        focus::Stamp::new(last, session, mount)
+    );
+    assert_eq!(f.project, original);
+    state.forget_view();
+    assert_eq!(state.representation(), None);
+    assert_eq!(state.owner(), None);
+    assert!(state.context(document, f.owner, 7, 9).is_none());
+}
+
+#[test]
+fn saved_caller_restores_exact_representation_with_fresh_visit_and_rejects_deleted_view() {
+    let (mut project, [a, b, _], [reference, _, _]) = direct_tests::navigation_fixture();
+    let view = saved(&mut project, a, &[]);
+    let original = project.clone();
+    let document = Id::new_v4();
+    let mut state = State::default();
+    state.enter_representation(document, a, view);
+    let initial = state.context(document, a, 0, 0).unwrap();
+    state.presentation.pan = iced::Vector::new(11., 29.);
+    state.details_offset = iced::Vector::new(0., 71.);
+    assert_eq!(state.open_use(&project, initial, reference).unwrap(), b);
+    state.enter(document, b);
+    let callee = state.context(document, b, 0, 0).unwrap();
+    let frame = state.back(&project, callee).unwrap();
+    assert_eq!(frame.representation, view);
+    state.enter_representation(document, a, frame.representation);
+    let returned = state.context(document, a, 0, 0).unwrap();
+    state.restore_caller(returned, frame);
+    assert_ne!(returned.visit, initial.visit);
+    assert_eq!(state.representation(), Some(view));
+    assert_eq!(state.presentation.pan, iced::Vector::new(11., 29.));
+    assert!(state.scroll_restore(initial, ScrollArea::Page).is_none());
+    assert_eq!(
+        state
+            .scroll_restore(returned, ScrollArea::Page)
+            .unwrap()
+            .offset,
+        iced::Vector::new(0., 71.)
+    );
+    assert_eq!(project, original);
+    state.open_use(&project, returned, reference).unwrap();
+    state.enter(document, b);
+    let Representation::Saved { diagram } = view else {
+        unreachable!()
+    };
+    project.diagrams.remove(&diagram);
+    let callee = state.context(document, b, 0, 0).unwrap();
+    assert!(state.back(&project, callee).is_none());
+}
+
+#[test]
+fn complete_fallback_scene_selects_but_cannot_capture_or_finish_coordinate_gestures() {
+    let mut f = direct_tests::fixture();
+    // Equal authored lane centers are structurally valid, but cannot render a distinct-endpoint call.
+    let rep = saved(
+        &mut f.project,
+        f.owner,
+        &[(f.sender, 900.), (f.receiver, 900.)],
+    );
+    let original = f.project.clone();
+    let mut state = State::default();
+    state.enter_representation(Id::new_v4(), f.owner, rep);
+    let document = state.presentation.identity.unwrap().0;
+    let context = state.context(document, f.owner, 0, 0).unwrap();
+    let shown = state.display(&f.project, f.owner, f.call).unwrap();
+    assert!(matches!(
+        shown.status(),
+        presentation::PresentationStatus::Fallback { .. }
+    ));
+    assert!(!state.coordinate_input(&f.project, context));
+    let automatic = presentation::present(
+        &f.project,
+        Representation::Derived { owner: f.owner },
+        f.call,
+    );
+    let automatic = automatic.scene().unwrap();
+    assert_eq!(shown.scene().unwrap().render_lanes, automatic.render_lanes);
+    assert_eq!(shown.scene().unwrap().activations, automatic.activations);
+    assert!(!automatic.activations.is_empty());
+    let mut scene = shown.into_scene().unwrap();
+    scene.coordinate_input = false;
+    let line = scene.lines.iter().find(|line| line.id == f.call).unwrap();
+    let point = Point::new(
+        (line.points[0].x + line.points.last().unwrap().x) / 2.,
+        line.points[0].y,
+    );
+    assert_eq!(scene.hit(point), Some(f.call));
+    let bounds = Rectangle::with_size(Size::new(1600., 1000.));
+    for tool in [
+        CanvasTool::Select,
+        CanvasTool::Message(MessageStyle::CallReply),
+        CanvasTool::Add(Tool::Reuse),
+    ] {
+        scene.interaction = Some((context, tool, true));
+        let mut input = SequenceInput::default();
+        let mut messages = vec![];
+        for event in [
+            mouse::Event::CursorMoved { position: point },
+            mouse::Event::ButtonPressed(mouse::Button::Left),
+            mouse::Event::CursorMoved {
+                position: Point::new(point.x, point.y + 100.),
+            },
+            mouse::Event::ButtonReleased(mouse::Button::Left),
+        ] {
+            if let Some(message) = canvas::Program::update(
+                &scene,
+                &mut input,
+                &canvas::Event::Mouse(event),
+                bounds,
+                mouse::Cursor::Available(point),
+            )
+            .and_then(|action| action.into_inner().0)
+            {
+                messages.push(message);
+            }
+        }
+        assert_eq!(messages.len(), 1);
+        assert!(
+            matches!(messages[0], Message::ScenarioCanvas(CanvasEvent::Select(c, id)) if c == context && id == f.call)
+        );
+        assert!(input.press.is_none() && input.source.is_none());
+    }
+    // Capture from an actual Ready presentation, then revoke coordinate input
+    // with the complete fallback frame of the same Saved representation.
+    let Representation::Saved { diagram } = rep else {
+        unreachable!()
+    };
+    let mut ready_project = f.project.clone();
+    ready_project.diagrams.get_mut(&diagram).unwrap().layout =
+        Some(DiagramLayout::Scenario(ScenarioLayout::default()));
+    let ready_original = ready_project.clone();
+    let ready = state.display(&ready_project, f.owner, f.call).unwrap();
+    assert!(matches!(
+        ready.status(),
+        presentation::PresentationStatus::Ready
+    ));
+    let mut ready_scene = ready.into_scene().unwrap();
+    let line = ready_scene
+        .lines
+        .iter()
+        .find(|line| line.id == f.call)
+        .unwrap();
+    let ready_point = Point::new(
+        (line.points[0].x + line.points.last().unwrap().x) / 2.,
+        line.points[0].y,
+    );
+    let hit = ready_scene.hit_item(ready_point).unwrap();
+    assert_eq!(hit.id, f.call);
+    assert_eq!(hit.role, SceneHitRole::MessageBody);
+    let stamp = spacing::Stamp {
+        context,
+        camera_epoch: 17,
+    };
+    ready_scene.coordinate_input = true;
+    ready_scene.interaction = Some((context, CanvasTool::Select, true));
+    ready_scene.spacing_stamp = Some(stamp);
+    let mut input = SequenceInput::default();
+    let begin = canvas::Program::update(
+        &ready_scene,
+        &mut input,
+        &canvas::Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
+        bounds,
+        mouse::Cursor::Available(ready_point),
+    )
+    .and_then(|action| action.into_inner().0)
+    .unwrap();
+    let Message::ScenarioCanvas(CanvasEvent::Spacing(spacing::Event::Begin {
+        stamp: captured_stamp,
+        token,
+        target: spacing::Target::Message(target),
+        ..
+    })) = begin
+    else {
+        panic!("Ready Saved message must begin a stamped spacing gesture");
+    };
+    assert_eq!(captured_stamp, stamp);
+    assert_eq!(target, f.call);
+    assert!(matches!(input.press, Some(SequencePress::Spacing {
+        stamp: held_stamp, token: held_token
+    }) if held_stamp == stamp && held_token == token));
+    scene.interaction = Some((context, CanvasTool::Select, true));
+    assert!(!scene.coordinate_input && scene.spacing_stamp.is_none());
+    let release = canvas::Event::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left));
+    let result = canvas::Program::update(
+        &scene,
+        &mut input,
+        &release,
+        bounds,
+        mouse::Cursor::Available(ready_point),
+    )
+    .and_then(|action| action.into_inner().0);
+    assert!(
+        matches!(result, Some(Message::ScenarioCanvas(CanvasEvent::Spacing(
+        spacing::Event::Cancel { stamp: cancelled_stamp, token: cancelled_token }
+    ))) if cancelled_stamp == stamp && cancelled_token == token)
+    );
+    assert!(input.press.is_none() && input.source.is_none());
+    assert!(
+        canvas::Program::update(
+            &scene,
+            &mut input,
+            &release,
+            bounds,
+            mouse::Cursor::Available(ready_point),
+        )
+        .and_then(|action| action.into_inner().0)
+        .is_none()
+    );
+    assert_eq!(ready_project, ready_original);
+    assert_eq!(f.project, original);
+}
+
+#[test]
+fn saved_camera_fits_actual_negative_origin_and_tiny_scale_without_authored_mutation() {
+    let mut f = direct_tests::fixture();
+    let rep = saved(
+        &mut f.project,
+        f.owner,
+        &[(f.sender, -1_000_000.), (f.receiver, 1_000_000.)],
+    );
+    let original = f.project.clone();
+    let mut state = State::default();
+    state.enter_representation(Id::new_v4(), f.owner, rep);
+    state.viewport(Size::new(700., 500.));
+    assert!(
+        state.presentation.fit,
+        "new saved views await their real viewport in Fit mode"
+    );
+    assert!(
+        !state.camera_zoom(&f.project, f.owner, None),
+        "already-active Fit is idempotent"
+    );
+    let shown = state.display(&f.project, f.owner, f.owner).unwrap();
+    assert!(matches!(
+        shown.status(),
+        presentation::PresentationStatus::Ready
+    ));
+    let bounds = shown.bounds().unwrap();
+    assert!(bounds.x < -1_000_000. && bounds.x + bounds.width > 1_000_000.);
+    let fitted = state.presentation.camera(bounds);
+    assert!(fitted.scale > 0. && fitted.scale < 0.001);
+    let left = bounds.x * fitted.scale + fitted.pan.x;
+    let right = (bounds.x + bounds.width) * fitted.scale + fitted.pan.x;
+    assert!((left - 8.).abs() < 0.001 && (right - 692.).abs() < 0.001);
+    assert!(state.camera(
+        &f.project,
+        f.owner,
+        super::super::canvas_workspace::Event::Pan(iced::Vector::new(13., -7.))
+    ));
+    let moved = state.presentation.camera(bounds);
+    assert_eq!(moved.scale, fitted.scale);
+    assert_eq!(moved.pan, fitted.pan + iced::Vector::new(13., -7.));
+    assert!(!state.presentation.fit);
+    assert_eq!(f.project, original);
+}
+
+#[test]
+fn deleted_saved_identity_remains_unavailable_and_never_falls_into_derived_geometry() {
+    let mut f = direct_tests::fixture();
+    let rep = saved(&mut f.project, f.owner, &[]);
+    let mut state = State::default();
+    let document = Id::new_v4();
+    state.enter_representation(document, f.owner, rep);
+    let Representation::Saved { diagram } = rep else {
+        unreachable!()
+    };
+    f.project.diagrams.remove(&diagram);
+    let original = f.project.clone();
+    let shown = state.display(&f.project, f.owner, f.owner).unwrap();
+    assert_eq!(shown.requested(), rep);
+    assert!(matches!(
+        shown.status(),
+        presentation::PresentationStatus::Unavailable { .. }
+    ));
+    assert!(shown.scene().is_none() && shown.bounds().is_none());
+    assert_eq!(state.owner(), Some(f.owner));
+    assert!(state.context(document, f.owner, 0, 0).is_some());
+    assert!(!state.camera_zoom(&f.project, f.owner, None));
+    assert_eq!(f.project, original);
+}

crates/oa-desktop/src/behavior/scenario/spacing.rs

@@ -0,0 +1,160 @@
+//! Pure Saved-only spacing preparation. Delta is measured from the original
+//! pointer in the captured camera's world coordinates, never from the last
+//! preview. The controller must own document/revision/visit, camera and hit-role
+//! admission; this module neither dispatches commands nor changes selection.
+use crate::behavior::scenario_layout::{
+    GeometryIssue, Representation, ResolvedScenarioPlan, presentation::checked_owner, resolve,
+};
+use oa_core::{
+    Command, Id, Kind, OccurrenceBody, OccurrenceEndpoint, Project, ScenarioLanePosition,
+    ScenarioMessagePosition, SharedBody, execute_batch,
+};
+
+pub(crate) mod controller;
+#[cfg(test)]
+mod tests;
+pub(crate) use controller::{Event, Stamp};
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Target {
+    Lane(Id),
+    Message(Id),
+}
+impl Target {
+    pub(crate) fn id(self) -> Id {
+        match self {
+            Self::Lane(id) | Self::Message(id) => id,
+        }
+    }
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub(crate) enum Refusal {
+    InvalidSavedView(Id),
+    TargetNotRendered(Target),
+    InvalidDelta,
+    InvalidGesture,
+    CameraChanged,
+    TargetNotHit(Target),
+    Command(String),
+    Geometry(Vec<GeometryIssue>),
+}
+
+pub(super) struct Drag {
+    original: Project,
+    diagram: Id,
+    target: Target,
+    origin: f32,
+    original_geometry: ResolvedScenarioPlan,
+}
+
+pub(super) struct Preview {
+    pub(super) command: Command,
+    #[cfg(test)]
+    pub(super) project: Project,
+    pub(super) geometry: ResolvedScenarioPlan,
+}
+
+/// Capture an accepted, actually drawn target. A Saved view displaying automatic
+/// fallback is not an editable original, even if the target appears in fallback.
+pub(super) fn capture(project: &Project, diagram: Id, target: Target) -> Result<Drag, Refusal> {
+    let representation = Representation::Saved { diagram };
+    let owner = checked_owner(project, representation).ok_or(Refusal::InvalidSavedView(diagram))?;
+    let geometry = resolve(project, representation, target.id()).map_err(Refusal::Geometry)?;
+    let element = project.elements.get(&target.id());
+    let origin = match target {
+        Target::Lane(id)
+            if element.is_some_and(|e| e.kind() == Kind::Lifeline && e.parent == Some(owner)) =>
+        {
+            // Unassigned lifelines still have drawn headers. `scene.lanes`
+            // excludes them only from semantic message-endpoint hit testing.
+            geometry.scene.render_lanes.get(&id).copied()
+        }
+        Target::Message(id)
+            if element.is_some_and(|e| {
+                matches!(
+                    e.shared(),
+                    Some(SharedBody::Occurrence {
+                        body: OccurrenceBody::Exchange { .. },
+                        ..
+                    })
+                )
+            }) =>
+        {
+            // A lifecycle row can denote receive y; the public position means
+            // send y. Read the actual outgoing endpoint, including self calls.
+            geometry
+                .scene
+                .lines
+                .iter()
+                .find(|line| line.id == id)
+                .and_then(|line| line.points.first())
+                .map(|point| point.y)
+        }
+        _ => None,
+    }
+    .ok_or(Refusal::TargetNotRendered(target))?;
+    if !origin.is_finite() {
+        return Err(Refusal::TargetNotRendered(target));
+    }
+    Ok(Drag {
+        original: project.clone(),
+        diagram,
+        target,
+        origin,
+        original_geometry: geometry,
+    })
+}
+
+impl Drag {
+    /// None means there is no command to commit. In particular +0/-0, return to
+    /// start, and sub-precision motion never materialize a missing override or
+    /// normalize an existing explicit value. Document/redo are never touched.
+    pub(super) fn prepare(&self, original_delta: f32) -> Result<Option<Preview>, Refusal> {
+        if !original_delta.is_finite() {
+            return Err(Refusal::InvalidDelta);
+        }
+        if original_delta == 0. {
+            return Ok(None);
+        }
+        let position = (f64::from(self.origin) + f64::from(original_delta)) as f32;
+        if position == self.origin {
+            return Ok(None);
+        }
+        let command = match self.target {
+            Target::Lane(lifeline) => Command::SetScenarioLanePosition {
+                diagram: self.diagram,
+                position: ScenarioLanePosition {
+                    lifeline,
+                    x: position,
+                },
+            },
+            Target::Message(occurrence) => Command::SetScenarioMessagePosition {
+                diagram: self.diagram,
+                position: ScenarioMessagePosition {
+                    address: OccurrenceEndpoint {
+                        references: vec![],
+                        occurrence,
+                    },
+                    send_y: position,
+                },
+            },
+        };
+        let project = execute_batch(&self.original, std::slice::from_ref(&command))
+            .map_err(|error| Refusal::Command(error.to_string()))?;
+        let geometry = resolve(
+            &project,
+            Representation::Saved {
+                diagram: self.diagram,
+            },
+            self.target.id(),
+        )
+        .map_err(Refusal::Geometry)?;
+        Ok(Some(Preview {
+            command,
+            #[cfg(test)]
+            project,
+            geometry,
+        }))
+    }
+}

crates/oa-desktop/src/behavior/scenario/spacing/controller.rs

@@ -0,0 +1,300 @@
+//! One press owns one immutable accepted Project and one frozen display camera.
+use super::*;
+use crate::behavior::{
+    Scene, SceneHitRole,
+    scenario::{CanvasTool, Context, State},
+    scenario_layout::Diagnostic,
+};
+use iced::{Point, Rectangle, Vector};
+
+#[cfg(test)]
+pub(crate) mod tests;
+#[cfg(test)]
+mod timing_tests;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Stamp {
+    pub(crate) context: Context,
+    pub(crate) camera_epoch: u64,
+}
+
+#[derive(Clone, Copy, Debug)]
+pub enum Event {
+    Begin {
+        stamp: Stamp,
+        token: Id,
+        target: Target,
+        press_screen: Point,
+        canvas_bounds: Rectangle,
+        scale: f32,
+        pan: Vector,
+    },
+    Move {
+        stamp: Stamp,
+        token: Id,
+        screen: Point,
+    },
+    Finish {
+        stamp: Stamp,
+        token: Id,
+        screen: Point,
+    },
+    Cancel {
+        stamp: Stamp,
+        token: Id,
+    },
+}
+impl Event {
+    pub(crate) fn stamp(self) -> Stamp {
+        match self {
+            Self::Begin { stamp, .. }
+            | Self::Move { stamp, .. }
+            | Self::Finish { stamp, .. }
+            | Self::Cancel { stamp, .. } => stamp,
+        }
+    }
+    pub(crate) fn token(self) -> Id {
+        match self {
+            Self::Begin { token, .. }
+            | Self::Move { token, .. }
+            | Self::Finish { token, .. }
+            | Self::Cancel { token, .. } => token,
+        }
+    }
+}
+
+pub(crate) struct Session {
+    stamp: Stamp,
+    token: Id,
+    press_screen: Point,
+    scale: f32,
+    pan: Vector,
+    drag: Drag,
+    preview: Option<Preview>,
+    refusal: Option<Refusal>,
+    ever_crossed: bool,
+}
+
+pub(in crate::behavior) struct Paint<'a> {
+    pub(in crate::behavior) scene: &'a Scene,
+    #[cfg(test)]
+    pub(in crate::behavior) bounds: Rectangle,
+    pub(in crate::behavior) refusal: Option<&'a Refusal>,
+    pub(in crate::behavior) original_diagnostics: &'a [Diagnostic],
+    pub(in crate::behavior) original_latent: &'a [Id],
+    pub(in crate::behavior) diagnostics: &'a [Diagnostic],
+}
+
+pub(crate) enum Finish {
+    Click(Id),
+    Noop,
+    Commit {
+        command: Box<Command>,
+        selected: Id,
+        scale: f32,
+        pan: Vector,
+    },
+}
+
+impl Session {
+    fn configure(&self, scene: &mut Scene) {
+        scene.selected = self.drag.target.id();
+        scene.scale = self.scale;
+        scene.camera_pan = self.pan;
+        scene.interaction = Some((self.stamp.context, CanvasTool::Select, true));
+        scene.spacing_stamp = Some(self.stamp);
+        scene.coordinate_input = true;
+        scene.pending_placement = None;
+    }
+    fn update(&mut self, screen: Point) {
+        self.preview = None;
+        self.refusal = None;
+        if !screen.x.is_finite() || !screen.y.is_finite() {
+            self.refusal = Some(Refusal::InvalidDelta);
+            return;
+        }
+        let distance = match self.drag.target {
+            Target::Lane(_) => screen.x - self.press_screen.x,
+            Target::Message(_) => screen.y - self.press_screen.y,
+        };
+        self.ever_crossed |= distance.abs() >= 3.;
+        if !self.ever_crossed {
+            return;
+        }
+        match self.drag.prepare(distance / self.scale) {
+            Ok(Some(mut preview)) => {
+                self.configure(&mut preview.geometry.scene);
+                self.preview = Some(preview);
+            }
+            Ok(None) => {}
+            Err(error) => self.refusal = Some(error),
+        }
+    }
+}
+
+impl State {
+    pub(crate) fn spacing_token(&self) -> Option<Id> {
+        self.spacing.as_ref().map(|s| s.token)
+    }
+    pub(crate) fn spacing_stamp(&self) -> Option<Stamp> {
+        self.spacing.as_ref().map(|s| s.stamp)
+    }
+    pub(crate) fn cancel_spacing(&mut self) -> bool {
+        self.spacing.take().is_some()
+    }
+
+    pub(in crate::behavior) fn spacing_paint(
+        &self,
+        context: Context,
+        camera_epoch: u64,
+    ) -> Option<Paint<'_>> {
+        let session = self.spacing.as_ref()?;
+        if session.stamp
+            != (Stamp {
+                context,
+                camera_epoch,
+            })
+        {
+            return None;
+        }
+        let original = &session.drag.original_geometry;
+        let shown = session.preview.as_ref().map_or(original, |p| &p.geometry);
+        Some(Paint {
+            scene: &shown.scene,
+            #[cfg(test)]
+            bounds: shown.bounds,
+            refusal: session.refusal.as_ref(),
+            original_diagnostics: &original.plan.diagnostics,
+            original_latent: &original.latent_messages,
+            diagnostics: &shown.plan.diagnostics,
+        })
+    }
+
+    pub(crate) fn begin_spacing(&mut self, project: &Project, event: Event) -> Result<(), Refusal> {
+        let Event::Begin {
+            stamp,
+            token,
+            target,
+            press_screen,
+            canvas_bounds,
+            scale,
+            pan,
+        } = event
+        else {
+            return Err(Refusal::InvalidGesture);
+        };
+        let context = stamp.context;
+        if self.spacing.is_some()
+            || token.is_nil()
+            || self.context(
+                context.document,
+                context.scenario,
+                context.revision,
+                context.epoch,
+            ) != Some(context)
+            || self.canvas_tool(context.scenario) != CanvasTool::Select
+            || ![
+                press_screen.x,
+                press_screen.y,
+                canvas_bounds.x,
+                canvas_bounds.y,
+                canvas_bounds.width,
+                canvas_bounds.height,
+                scale,
+                pan.x,
+                pan.y,
+            ]
+            .into_iter()
+            .all(f32::is_finite)
+            || scale <= 0.
+            || canvas_bounds.width <= 0.
+            || canvas_bounds.height <= 0.
+            || !canvas_bounds.contains(press_screen)
+        {
+            return Err(Refusal::InvalidGesture);
+        }
+        let Representation::Saved { diagram } = context.representation else {
+            return Err(Refusal::InvalidGesture);
+        };
+        let mut drag = capture(project, diagram, target)?;
+        let camera = self.presentation.camera(drag.original_geometry.bounds);
+        if self.presentation.viewport != Some(canvas_bounds.size())
+            || camera.scale != scale
+            || camera.pan != pan
+        {
+            return Err(Refusal::CameraChanged);
+        }
+        let world = Point::new(
+            (press_screen.x - canvas_bounds.x - pan.x) / scale,
+            (press_screen.y - canvas_bounds.y - pan.y) / scale,
+        );
+        // Hit tolerance is measured in displayed pixels, just like the widget.
+        drag.original_geometry.scene.scale = scale;
+        drag.original_geometry.scene.camera_pan = pan;
+        let hit = drag.original_geometry.scene.hit_item(world);
+        if !hit.is_some_and(|hit| {
+            hit.id == target.id()
+                && match target {
+                    Target::Lane(_) => hit.role == SceneHitRole::LifelineHeader,
+                    Target::Message(_) => matches!(
+                        hit.role,
+                        SceneHitRole::MessageBody | SceneHitRole::MessageLabel
+                    ),
+                }
+        }) {
+            return Err(Refusal::TargetNotHit(target));
+        }
+        // Configure baseline without changing the persistent camera or selection.
+        let scene = &mut drag.original_geometry.scene;
+        scene.selected = target.id();
+        scene.scale = scale;
+        scene.camera_pan = pan;
+        scene.interaction = Some((context, CanvasTool::Select, true));
+        scene.spacing_stamp = Some(stamp);
+        scene.coordinate_input = true;
+        scene.pending_placement = None;
+        self.spacing = Some(Session {
+            stamp,
+            token,
+            press_screen,
+            scale,
+            pan,
+            drag,
+            preview: None,
+            refusal: None,
+            ever_crossed: false,
+        });
+        Ok(())
+    }
+    pub(crate) fn move_spacing(&mut self, screen: Point) {
+        if let Some(session) = &mut self.spacing {
+            session.update(screen);
+        }
+    }
+    pub(crate) fn finish_spacing(&mut self, screen: Point) -> Result<Finish, Refusal> {
+        let Some(mut session) = self.spacing.take() else {
+            return Err(Refusal::InvalidGesture);
+        };
+        session.update(screen);
+        if let Some(error) = session.refusal {
+            return Err(error);
+        }
+        if !session.ever_crossed {
+            return Ok(Finish::Click(session.drag.target.id()));
+        }
+        Ok(match session.preview {
+            None => Finish::Noop,
+            Some(preview) => Finish::Commit {
+                command: Box::new(preview.command),
+                selected: session.drag.target.id(),
+                scale: session.scale,
+                pan: session.pan,
+            },
+        })
+    }
+    pub(crate) fn accept_spacing_camera(&mut self, scale: f32, pan: Vector) {
+        self.presentation.zoom = Some(scale);
+        self.presentation.pan = pan;
+        self.presentation.fit = false;
+    }
+}

crates/oa-desktop/src/behavior/scenario/spacing/controller/tests.rs

@@ -0,0 +1,421 @@
+use super::*;
+use crate::document::Document;
+use iced::Size;
+use oa_core::{Diagram, Layer, ProjectionKind, language, source_project::ProjectLimits};
+
+pub(crate) fn fixture() -> (Document, Id, Id, Id, Id) {
+    let mut p = language::parse(r#"arcadia 7;
+project spacing "Spacing" {
+ oa_activity work "Work" {}
+ oa_activity response "Response" {}
+ oa_scenario incident "Incident" { viewpoint OperationalActivity; steps [@first, @second]; }
+ oa_lifeline reporter "Reporter" { parent @incident; represented @work; }
+ oa_lifeline operator "Operator" { parent @incident; represented @response; }
+ oa_occurrence first "First" { parent @incident; body { Exchange { exchange none; sender @reporter; receiver @operator; message_kind Asynchronous; }; }; }
+ oa_occurrence second "Second" { parent @incident; body { Exchange { exchange none; sender @operator; receiver @reporter; message_kind Asynchronous; }; }; }
+}"#).unwrap();
+    let id = |name: &str| {
+        p.identities()
+            .into_iter()
+            .find(|(_, alias)| *alias == name)
+            .unwrap()
+            .0
+    };
+    let (owner, lane, message) = (id("incident"), id("reporter"), id("first"));
+    let diagram = Id::new_v4();
+    p.diagrams.insert(
+        diagram,
+        Diagram {
+            id: diagram,
+            alias: "saved".into(),
+            name: "Saved".into(),
+            description: String::new(),
+            layer: Layer::Oa,
+            projection: ProjectionKind::Scenario { scenario: owner },
+            nodes: Default::default(),
+            routes: vec![],
+            view_options: Default::default(),
+            layout: None,
+        },
+    );
+    (
+        Document::from_project(p, ProjectLimits::default()).unwrap(),
+        owner,
+        diagram,
+        lane,
+        message,
+    )
+}
+
+pub(crate) fn expected(p: &Project, diagram: Id, target: Target, delta: f32) -> Project {
+    capture(p, diagram, target)
+        .unwrap()
+        .prepare(delta)
+        .unwrap()
+        .unwrap()
+        .project
+}
+
+pub(crate) fn packet(
+    p: &Project,
+    state: &State,
+    context: Context,
+    camera_epoch: u64,
+    target: Target,
+) -> Event {
+    let geometry = resolve(p, context.representation, target.id()).unwrap();
+    let world = match target {
+        Target::Lane(id) => geometry
+            .scene
+            .boxes
+            .iter()
+            .find(|item| item.id == id && item.role == SceneHitRole::LifelineHeader)
+            .unwrap()
+            .rect
+            .center(),
+        Target::Message(id) => {
+            let line = geometry
+                .scene
+                .lines
+                .iter()
+                .find(|line| line.id == id)
+                .unwrap();
+            Point::new((line.points[0].x + line.points[1].x) / 2., line.points[0].y)
+        }
+    };
+    assert!(
+        geometry
+            .scene
+            .hit_item(world)
+            .is_some_and(|hit| hit.id == target.id())
+    );
+    let camera = state.presentation.camera(geometry.bounds);
+    let canvas_bounds = Rectangle::new(Point::new(17., 23.), state.presentation.viewport.unwrap());
+    Event::Begin {
+        stamp: Stamp {
+            context,
+            camera_epoch,
+        },
+        token: Id::new_v4(),
+        target,
+        press_screen: Point::new(
+            canvas_bounds.x + world.x * camera.scale + camera.pan.x,
+            canvas_bounds.y + world.y * camera.scale + camera.pan.y,
+        ),
+        canvas_bounds,
+        scale: camera.scale,
+        pan: camera.pan,
+    }
+}
+fn setup(target_message: bool) -> (Document, State, Event) {
+    let (doc, owner, diagram, lane, message) = fixture();
+    let mut state = State::default();
+    state.enter_representation(Id::new_v4(), owner, Representation::Saved { diagram });
+    state.presentation.viewport = Some(Size::new(900., 600.));
+    let context = state
+        .context(
+            state.presentation.identity.unwrap().0,
+            owner,
+            doc.revision(),
+            4,
+        )
+        .unwrap();
+    let target = if target_message {
+        Target::Message(message)
+    } else {
+        Target::Lane(lane)
+    };
+    let event = packet(doc.project(), &state, context, 9, target);
+    (doc, state, event)
+}
+fn press(event: Event) -> Point {
+    let Event::Begin { press_screen, .. } = event else {
+        unreachable!()
+    };
+    press_screen
+}
+
+#[test]
+fn real_preview_moves_only_active_axis_from_original_and_never_changes_document() {
+    for message in [false, true] {
+        let (doc, mut state, begin) = setup(message);
+        let original = doc.snapshot();
+        let camera = state.camera_boundary();
+        let start = press(begin);
+        state.begin_spacing(doc.project(), begin).unwrap();
+        let first = if message {
+            Vector::new(500., 30.)
+        } else {
+            Vector::new(30., 500.)
+        };
+        state.move_spacing(start + first);
+        let session = state.spacing.as_ref().unwrap();
+        let candidate = session.preview.as_ref().unwrap();
+        let delta = 30. / session.scale;
+        let actual_anchor = match session.drag.target {
+            Target::Lane(id) => candidate.geometry.scene.render_lanes[&id],
+            Target::Message(id) => {
+                candidate
+                    .geometry
+                    .scene
+                    .lines
+                    .iter()
+                    .find(|line| line.id == id)
+                    .unwrap()
+                    .points[0]
+                    .y
+            }
+        };
+        let wanted = (f64::from(session.drag.origin) + f64::from(delta)) as f32;
+        assert_eq!(actual_anchor.to_bits(), wanted.to_bits());
+        let expected = session.drag.prepare(delta).unwrap().unwrap();
+        assert_eq!(candidate.project, expected.project);
+        assert_eq!(candidate.geometry.scene.rows, expected.geometry.scene.rows);
+        assert_eq!(
+            candidate.geometry.scene.render_lanes,
+            expected.geometry.scene.render_lanes
+        );
+        state.move_spacing(start + first * 2.);
+        let session = state.spacing.as_ref().unwrap();
+        assert_eq!(
+            session.preview.as_ref().unwrap().project,
+            session.drag.prepare(delta * 2.).unwrap().unwrap().project
+        );
+        assert_eq!(doc.project(), &original.decoded.project);
+        assert_eq!(doc.compiled().bundle, original.bundle);
+        assert!(!doc.dirty() && !doc.can_undo() && !doc.can_redo());
+        assert!(camera == state.camera_boundary());
+    }
+}
+
+#[test]
+fn click_threshold_is_active_axis_and_return_to_zero_is_not_a_click() {
+    let (doc, mut state, begin) = setup(false);
+    let start = press(begin);
+    state.begin_spacing(doc.project(), begin).unwrap();
+    state.move_spacing(start + Vector::new(2., 100.));
+    assert!(matches!(
+        state.finish_spacing(start).unwrap(),
+        Finish::Click(_)
+    ));
+    state.begin_spacing(doc.project(), begin).unwrap();
+    state.move_spacing(start + Vector::new(4., 0.));
+    assert!(matches!(state.finish_spacing(start).unwrap(), Finish::Noop));
+    assert!(!doc.can_undo());
+}
+
+#[test]
+fn invalid_move_discards_prior_candidate_and_finish_rechecks_final_pointer() {
+    let (doc, mut state, begin) = setup(false);
+    let start = press(begin);
+    state.begin_spacing(doc.project(), begin).unwrap();
+    state.move_spacing(start + Vector::new(20., 0.));
+    state.move_spacing(Point::new(f32::NAN, start.y));
+    let paint = state.spacing_paint(begin.stamp().context, 9).unwrap();
+    assert!(matches!(paint.refusal, Some(Refusal::InvalidDelta)));
+    assert_eq!(
+        paint.scene.render_lanes,
+        state
+            .spacing
+            .as_ref()
+            .unwrap()
+            .drag
+            .original_geometry
+            .scene
+            .render_lanes
+    );
+    assert!(matches!(
+        state.finish_spacing(Point::new(f32::NAN, start.y)),
+        Err(Refusal::InvalidDelta)
+    ));
+    assert!(state.spacing_token().is_none());
+}
+
+#[test]
+fn forged_camera_hit_role_and_retired_visit_cannot_capture() {
+    let (doc, mut state, begin) = setup(false);
+    let Event::Begin {
+        stamp,
+        token,
+        target,
+        press_screen,
+        canvas_bounds,
+        scale,
+        pan,
+    } = begin
+    else {
+        unreachable!()
+    };
+    assert!(matches!(
+        state.begin_spacing(
+            doc.project(),
+            Event::Begin {
+                stamp,
+                token,
+                target,
+                press_screen,
+                canvas_bounds,
+                scale: scale * 2.,
+                pan
+            }
+        ),
+        Err(Refusal::CameraChanged)
+    ));
+    assert!(matches!(
+        state.begin_spacing(
+            doc.project(),
+            Event::Begin {
+                stamp,
+                token,
+                target,
+                press_screen: canvas_bounds.center(),
+                canvas_bounds,
+                scale,
+                pan
+            }
+        ),
+        Err(Refusal::TargetNotHit(_))
+    ));
+    state.leave();
+    assert!(matches!(
+        state.begin_spacing(doc.project(), begin),
+        Err(Refusal::InvalidGesture)
+    ));
+}
+
+#[test]
+fn zoomed_out_message_tolerance_matches_actual_canvas_hit() {
+    let (doc, mut state, _) = setup(true);
+    state.presentation.fit = false;
+    state.presentation.zoom = Some(0.25);
+    state.presentation.pan = Vector::ZERO;
+    let context = state
+        .context(
+            state.presentation.identity.unwrap().0,
+            state.owner().unwrap(),
+            doc.revision(),
+            4,
+        )
+        .unwrap();
+    let message = doc
+        .project()
+        .identities()
+        .into_iter()
+        .find(|(_, alias)| *alias == "first")
+        .map(|(id, _)| id)
+        .unwrap();
+    let Event::Begin {
+        stamp,
+        token,
+        target,
+        press_screen,
+        canvas_bounds,
+        scale,
+        pan,
+    } = packet(doc.project(), &state, context, 9, Target::Message(message))
+    else {
+        unreachable!()
+    };
+    let event = Event::Begin {
+        stamp,
+        token,
+        target,
+        press_screen: press_screen + Vector::new(0., 3.),
+        canvas_bounds,
+        scale,
+        pan,
+    };
+    state.begin_spacing(doc.project(), event).unwrap();
+    assert_eq!(state.spacing_token(), Some(token));
+}
+
+#[test]
+fn fractional_screen_packet_preserves_subpixel_motion_in_preview_and_finish() {
+    let (doc, owner, diagram, _, message) = fixture();
+    let original = doc.snapshot();
+    assert!(doc.project().diagrams[&diagram].layout.is_none());
+    let mut state = State::default();
+    let document = Id::new_v4();
+    state.enter_representation(document, owner, Representation::Saved { diagram });
+    state.presentation.viewport = Some(Size::new(900., 600.));
+    state.presentation.fit = false;
+    state.presentation.zoom = Some(0.5);
+    // 406 + 2^-15 puts the press just below the 512 screen-coordinate boundary.
+    state.presentation.pan = Vector::new(0., f32::from_bits(0x43cb_0001));
+    let camera = state.camera_boundary();
+    let context = state.context(document, owner, doc.revision(), 4).unwrap();
+    let baseline = resolve(doc.project(), context.representation, message).unwrap();
+    let line = baseline
+        .scene
+        .lines
+        .iter()
+        .find(|line| line.id == message)
+        .unwrap();
+    assert_eq!(line.points[0].y, 148.);
+    let begin = packet(doc.project(), &state, context, 9, Target::Message(message));
+    let Event::Begin {
+        press_screen,
+        canvas_bounds,
+        scale,
+        pan,
+        ..
+    } = begin
+    else {
+        unreachable!()
+    };
+    assert_eq!(canvas_bounds.y, 23.);
+    assert_eq!(scale, 0.5);
+    assert_eq!(pan.y.to_bits(), 0x43cb_0001);
+    assert_eq!(press_screen.y.to_bits(), 0x43fb_8001); // 503 + 2^-15.
+    let end = press_screen + Vector::new(0., 10.);
+    assert_eq!(end.y, 513.);
+    assert!(canvas_bounds.contains(press_screen) && canvas_bounds.contains(end));
+    // The submitted f32 displacement is 10 - 2^-15, not exactly 10.
+    assert_eq!((end.y - press_screen.y).to_bits(), 0x411f_ffe0);
+    assert_eq!(((end.y - press_screen.y) / scale).to_bits(), 0x419f_ffe0);
+    // Independent oracle: 148 + (10 - 2^-15) / .5 = 168 - 2^-14.
+    let expected_y = f32::from_bits(0x4327_fffc);
+    let mut expected = original.decoded.project.clone();
+    expected.diagrams.get_mut(&diagram).unwrap().layout =
+        Some(oa_core::DiagramLayout::Scenario(oa_core::ScenarioLayout {
+            lanes: vec![],
+            messages: vec![oa_core::ScenarioMessagePosition {
+                address: oa_core::OccurrenceEndpoint {
+                    references: vec![],
+                    occurrence: message,
+                },
+                send_y: expected_y,
+            }],
+        }));
+    state.begin_spacing(doc.project(), begin).unwrap();
+    state.move_spacing(end);
+    let preview = state.spacing.as_ref().unwrap().preview.as_ref().unwrap();
+    assert_eq!(preview.project, expected);
+    let line = preview
+        .geometry
+        .scene
+        .lines
+        .iter()
+        .find(|line| line.id == message)
+        .unwrap();
+    assert_eq!(line.points[0].y.to_bits(), expected_y.to_bits());
+    let Finish::Commit {
+        command,
+        selected,
+        scale,
+        pan,
+    } = state.finish_spacing(end).unwrap()
+    else {
+        panic!("fractional motion must remain a commit")
+    };
+    assert_eq!(selected, message);
+    assert_eq!(scale, 0.5);
+    assert_eq!(pan.y.to_bits(), 0x43cb_0001);
+    let committed = oa_core::execute_batch(doc.project(), &[*command]).unwrap();
+    assert_eq!(committed, expected);
+    assert!(state.spacing_token().is_none());
+    assert_eq!(doc.project(), &original.decoded.project);
+    assert_eq!(doc.compiled().bundle, original.bundle);
+    assert!(!doc.dirty() && !doc.can_undo() && !doc.can_redo());
+    assert!(camera == state.camera_boundary());
+}

crates/oa-desktop/src/behavior/scenario/spacing/controller/timing_tests.rs

@@ -0,0 +1,304 @@
+//! Diagnostic only: production capture/prepare, excluding fixture construction,
+//! oracle work, App source writes, widget rebuilds, text shaping and GPU paint.
+use super::*;
+use crate::document::Document;
+use oa_core::{
+    DiagramLayout, Layer, MessageKind, RelationKind, ScenarioLayout, source_project::ProjectLimits,
+};
+use serde_json::{Value, json};
+use std::{collections::BTreeSet, sync::Arc, time::Instant};
+
+const MESSAGE_COUNT: usize = 1000;
+const TARGET_INDEX: usize = 500;
+
+fn large_fixture() -> (Document, Id, [Id; 3], Vec<Id>, Vec<Id>) {
+    let (seed, owner, a, reporter, first) = super::tests::fixture();
+    let mut p = seed.project().clone();
+    let old_steps = p.elements[&owner].steps().unwrap().clone();
+    let template = p.elements[&first].clone();
+    let work = |alias: &str| {
+        p.identities()
+            .into_iter()
+            .find(|(_, name)| *name == alias)
+            .unwrap()
+            .0
+    };
+    let (source, target) = (work("work"), work("response"));
+    let operator = work("operator");
+    let relation = p.relate(
+        RelationKind::Interaction,
+        "Repeated incident report",
+        source,
+        target,
+    );
+    let mut lanes = vec![];
+    for index in 0..20 {
+        let original = if index < 10 { reporter } else { operator };
+        let mut lane = p.elements[&original].clone();
+        lane.id = Id::new_v4();
+        lane.alias = format!("timing_lane_{index:02}");
+        lane.name = format!("Review participant {index:02}");
+        lanes.push(lane.id);
+        p.elements.insert(lane.id, lane);
+    }
+    p.elements.remove(&reporter);
+    p.elements.remove(&operator);
+    for id in old_steps {
+        p.elements.remove(&id);
+    }
+    let mut messages = vec![];
+    for index in 0..MESSAGE_COUNT {
+        let mut occurrence = template.clone();
+        occurrence.id = Id::new_v4();
+        occurrence.alias = format!("timing_message_{index:04}");
+        occurrence.name = format!("Validate incident report {index:04}");
+        *occurrence.shared_mut().unwrap() = SharedBody::Occurrence {
+            body: OccurrenceBody::Exchange {
+                exchange: Some(relation),
+                sender: Some(lanes[index % 10]),
+                receiver: Some(lanes[10 + index % 10]),
+                message_kind: MessageKind::Asynchronous,
+                operation: None,
+                reply_to: None,
+                values: vec![],
+            },
+            precondition: String::new(),
+            postcondition: String::new(),
+        };
+        messages.push(occurrence.id);
+        p.elements.insert(occurrence.id, occurrence);
+    }
+    *p.elements.get_mut(&owner).unwrap().steps_mut().unwrap() = messages.clone();
+    p.diagrams.get_mut(&a).unwrap().layout = Some(DiagramLayout::Scenario(ScenarioLayout {
+        lanes: lanes
+            .iter()
+            .enumerate()
+            .map(|(i, &lifeline)| ScenarioLanePosition {
+                lifeline,
+                x: 160. + i as f32 * 240.,
+            })
+            .collect(),
+        messages: vec![],
+    }));
+    let mut views = [a, Id::nil(), Id::nil()];
+    for (index, x, offset) in [(1, -500., 12.), (2, 6500., -12.)] {
+        let mut view = p.diagrams[&a].clone();
+        view.id = Id::new_v4();
+        view.alias = format!("timing_saved_{index}");
+        view.name = format!("Review arrangement {index}");
+        view.layout = Some(DiagramLayout::Scenario(ScenarioLayout {
+            lanes: vec![ScenarioLanePosition {
+                lifeline: lanes[0],
+                x,
+            }],
+            messages: vec![ScenarioMessagePosition {
+                address: OccurrenceEndpoint {
+                    references: vec![],
+                    occurrence: messages[TARGET_INDEX],
+                },
+                send_y: 148. + TARGET_INDEX as f32 * 92. + offset,
+            }],
+        }));
+        views[index] = view.id;
+        p.diagrams.insert(view.id, view);
+    }
+    let document = Document::from_project(p, ProjectLimits::default()).unwrap();
+    assert_eq!(
+        document
+            .project()
+            .children(owner)
+            .filter(|e| e.kind() == Kind::Lifeline)
+            .count(),
+        20
+    );
+    assert_eq!(document.project().elements[&owner].layer(), Layer::Oa);
+    assert_eq!(document.project().diagrams.len(), 3);
+    (document, owner, views, lanes, messages)
+}
+
+fn assert_scene(
+    scene: &Scene,
+    lanes: &[Id],
+    messages: &[Id],
+    moved_message: Option<(Id, f32)>,
+    moved_lane: Option<(Id, f32)>,
+) {
+    assert_eq!(scene.render_lanes.len(), 20);
+    assert_eq!(
+        scene
+            .boxes
+            .iter()
+            .filter(|b| b.role == SceneHitRole::LifelineHeader)
+            .count(),
+        20
+    );
+    assert_eq!(scene.lines.len(), MESSAGE_COUNT);
+    assert_eq!(
+        scene
+            .lines
+            .iter()
+            .map(|line| line.id)
+            .collect::<BTreeSet<_>>(),
+        messages.iter().copied().collect::<BTreeSet<_>>()
+    );
+    assert!(scene.activations.is_empty() && scene.open_calls.is_empty());
+    let x = |index: usize| {
+        160. + index as f32 * 240.
+            + moved_lane
+                .filter(|(id, _)| *id == lanes[index])
+                .map_or(0., |(_, delta)| delta)
+    };
+    for (index, &lane) in lanes.iter().enumerate() {
+        assert_eq!(scene.render_lanes[&lane], x(index));
+    }
+    for (index, (line, &id)) in scene.lines.iter().zip(messages).enumerate() {
+        let y = 148.
+            + index as f32 * 92.
+            + moved_message
+                .filter(|(target, _)| *target == id)
+                .map_or(0., |(_, delta)| delta);
+        assert_eq!(line.id, id);
+        assert_eq!(
+            line.points,
+            vec![
+                Point::new(x(index % 10), y),
+                Point::new(x(10 + index % 10), y)
+            ]
+        );
+    }
+}
+
+fn summary(samples: &[Value], phase: &str) -> Value {
+    let mut times: Vec<u64> = samples
+        .iter()
+        .filter(|sample| sample["phase"] == phase)
+        .map(|sample| sample["elapsed_ns"].as_u64().unwrap())
+        .collect();
+    times.sort_unstable();
+    let n = times.len();
+    let median = if n.is_multiple_of(2) {
+        ((u128::from(times[n / 2 - 1]) + u128::from(times[n / 2])) / 2) as u64
+    } else {
+        times[n / 2]
+    };
+    json!({"samples": n, "min_ns": times[0], "median_ns": median, "max_ns": times[n-1]})
+}
+
+#[test]
+#[ignore = "Diagnostic timing only; run alone with --exact --ignored --nocapture after correctness gates; no latency acceptance threshold"]
+fn saved_spacing_capture_prepare_20_lanes_1000_messages_3_views() {
+    let (document, owner, views, lanes, messages) = large_fixture();
+    let original = document.snapshot();
+    let target = messages[TARGET_INDEX];
+    let mut samples = vec![];
+    let mut retained = None;
+    for iteration in 0..4 {
+        let start = Instant::now();
+        let result = capture(document.project(), views[0], Target::Message(target));
+        let elapsed_ns = u64::try_from(start.elapsed().as_nanos()).unwrap();
+        let drag = result.expect("complete asynchronous fixture must resolve");
+        samples.push(json!({"phase":"capture_message", "iteration":iteration,
+            "first_in_probe":iteration==0, "elapsed_ns":elapsed_ns, "outcome":"captured"}));
+        assert_scene(&drag.original_geometry.scene, &lanes, &messages, None, None);
+        if iteration == 0 {
+            retained = Some(drag);
+        }
+    }
+    let drag = retained.unwrap();
+    // Every sample is relative to the original press, including duplicate,
+    // reverse and return-to-start samples. Oracle work is outside each timer.
+    let deltas = [
+        4., 8., 12., 16., 20., 24., 28., 32., 32., 28., 24., 20., 16., 12., 8., 4., -4., -8., -4.,
+        0.,
+    ];
+    for (iteration, delta) in deltas.into_iter().enumerate() {
+        let start = Instant::now();
+        let result = drag.prepare(delta);
+        let elapsed_ns = u64::try_from(start.elapsed().as_nanos()).unwrap();
+        let candidate = result.expect("these isolated asynchronous offsets are feasible");
+        samples.push(json!({"phase":"prepare_message", "iteration":iteration,
+            "delta_world":delta, "elapsed_ns":elapsed_ns, "outcome":if candidate.is_some(){"preview"}else{"noop"}}));
+        if delta == 0. {
+            assert!(candidate.is_none());
+        } else {
+            let candidate = candidate.unwrap();
+            let mut expected = original.decoded.project.clone();
+            let Some(DiagramLayout::Scenario(layout)) =
+                &mut expected.diagrams.get_mut(&views[0]).unwrap().layout
+            else {
+                panic!()
+            };
+            layout.messages.push(ScenarioMessagePosition {
+                address: OccurrenceEndpoint {
+                    references: vec![],
+                    occurrence: target,
+                },
+                send_y: 148. + TARGET_INDEX as f32 * 92. + delta,
+            });
+            assert_eq!(candidate.project, expected);
+            assert_scene(
+                &candidate.geometry.scene,
+                &lanes,
+                &messages,
+                Some((target, delta)),
+                None,
+            );
+        }
+        assert_eq!(
+            document.project().elements[&owner].steps().unwrap(),
+            &messages
+        );
+        assert_eq!(document.project(), &original.decoded.project);
+        assert!(Arc::ptr_eq(&original, &document.snapshot()));
+    }
+    let lane = lanes[10];
+    let start = Instant::now();
+    let result = capture(document.project(), views[0], Target::Lane(lane));
+    let elapsed_ns = u64::try_from(start.elapsed().as_nanos()).unwrap();
+    let drag = result.unwrap();
+    samples.push(json!({"phase":"capture_lane", "iteration":0, "elapsed_ns":elapsed_ns, "outcome":"captured"}));
+    for (iteration, delta) in [20., 40., -20.].into_iter().enumerate() {
+        let start = Instant::now();
+        let result = drag.prepare(delta);
+        let elapsed_ns = u64::try_from(start.elapsed().as_nanos()).unwrap();
+        let candidate = result.unwrap().unwrap();
+        samples.push(json!({"phase":"prepare_lane", "iteration":iteration,
+            "delta_world":delta, "elapsed_ns":elapsed_ns, "outcome":"preview"}));
+        let mut expected = original.decoded.project.clone();
+        let Some(DiagramLayout::Scenario(layout)) =
+            &mut expected.diagrams.get_mut(&views[0]).unwrap().layout
+        else {
+            panic!()
+        };
+        layout.lanes[10].x = 2560. + delta;
+        assert_eq!(candidate.project, expected);
+        assert_scene(
+            &candidate.geometry.scene,
+            &lanes,
+            &messages,
+            None,
+            Some((lane, delta)),
+        );
+    }
+    assert_eq!(document.project(), &original.decoded.project);
+    assert_eq!(document.bundle(), &original.bundle);
+    for view in views {
+        assert_eq!(
+            document.project().diagrams[&view],
+            original.decoded.project.diagrams[&view]
+        );
+    }
+    assert_eq!(document.revision(), 0);
+    assert!(!document.dirty() && !document.can_undo() && !document.can_redo());
+    let report = json!({
+        "schema":"scenario_spacing_timing_v1",
+        "fixture":{"lanes":20,"messages":MESSAGE_COUNT,"saved_views":3,"target_index":TARGET_INDEX,"distinct_message_ids":messages.iter().copied().collect::<BTreeSet<_>>().len()},
+        "profile_context":{"debug_assertions":cfg!(debug_assertions),"os":std::env::consts::OS,"arch":std::env::consts::ARCH,
+            "source_pin_from_runner":std::env::var("SCENARIO_SPACING_SOURCE_PIN").ok(),"source_binary_toolchain_binding":"external gate receipt required"},
+        "summaries":{"capture_message":summary(&samples,"capture_message"),"prepare_message":summary(&samples,"prepare_message"),"capture_lane":summary(&samples,"capture_lane"),"prepare_lane":summary(&samples,"prepare_lane")},
+        "samples":samples,
+        "invariant_status":"passed",
+        "limits":"First capture is first in this probe, not cold OS caches. Timers exclude construction/oracles, prior-preview disposal, source write/history, widget rebuild, label shaping, GPU paint and queued input; no responsiveness acceptance or latency threshold. All messages asynchronous; no nested frame/lifecycle stress."
+    });
+    println!("SPACING_TIMING_JSON={report}");
+}

crates/oa-desktop/src/behavior/scenario/spacing/tests.rs

@@ -0,0 +1,522 @@
+use super::*;
+use crate::behavior::scenario_layout::Diagnostic;
+use crate::document::Document;
+use oa_core::{
+    Diagram, DiagramLayout, ProjectionKind, ScenarioLayout, language, source_project::ProjectLimits,
+};
+
+fn id(project: &Project, alias: &str) -> Id {
+    project
+        .identities()
+        .into_iter()
+        .find(|(_, name)| *name == alias)
+        .unwrap()
+        .0
+}
+
+fn fixture(layout: Option<ScenarioLayout>) -> (Document, Id, Id) {
+    let mut project = language::parse(FIXTURE).unwrap();
+    let owner = id(&project, "conversation");
+    let mut add = |alias: &str, layout: Option<ScenarioLayout>| {
+        let diagram = Id::new_v4();
+        project.diagrams.insert(
+            diagram,
+            Diagram {
+                id: diagram,
+                alias: alias.into(),
+                name: alias.into(),
+                description: String::new(),
+                layer: oa_core::Layer::Oa,
+                projection: ProjectionKind::Scenario { scenario: owner },
+                nodes: Default::default(),
+                routes: vec![],
+                view_options: Default::default(),
+                layout: layout.map(DiagramLayout::Scenario),
+            },
+        );
+        diagram
+    };
+    let a = add("saved_a", layout);
+    let b = add("saved_b", Some(ScenarioLayout::default()));
+    let document = Document::from_project(project, ProjectLimits::default()).unwrap();
+    (document, a, b)
+}
+
+fn resolved(project: &Project, diagram: Id, selected: Id) -> ResolvedScenarioPlan {
+    resolve(project, Representation::Saved { diagram }, selected).unwrap()
+}
+
+fn same_geometry(a: &ResolvedScenarioPlan, b: &ResolvedScenarioPlan) {
+    assert_eq!(a.bounds, b.bounds);
+    assert_eq!(a.lanes, b.lanes);
+    assert_eq!(a.plan.frames, b.plan.frames);
+    assert_eq!(a.plan.scopes, b.plan.scopes);
+    let (a, b) = (&a.scene, &b.scene);
+    assert_eq!(a.rows, b.rows);
+    assert_eq!(a.sequence_bounds, b.sequence_bounds);
+    assert_eq!(a.size, b.size);
+    assert_eq!(a.layout_origin, b.layout_origin);
+    assert_eq!(a.lanes, b.lanes);
+    assert_eq!(a.render_lanes, b.render_lanes);
+    assert_eq!(a.activations, b.activations);
+    assert_eq!(a.lifecycle, b.lifecycle);
+    assert_eq!(a.open_calls, b.open_calls);
+    let slots = |scene: &crate::behavior::Scene| {
+        scene
+            .slots
+            .iter()
+            .map(|item| {
+                (
+                    item.slot.parent,
+                    item.slot.before,
+                    item.y,
+                    item.label.clone(),
+                )
+            })
+            .collect::<Vec<_>>()
+    };
+    assert_eq!(slots(a), slots(b));
+    let lines = |scene: &crate::behavior::Scene| {
+        scene
+            .lines
+            .iter()
+            .map(|line| {
+                (
+                    line.id,
+                    line.points.clone(),
+                    line.label_at,
+                    line.label.clone(),
+                    line.dashed,
+                )
+            })
+            .collect::<Vec<_>>()
+    };
+    let boxes = |scene: &crate::behavior::Scene| {
+        scene
+            .boxes
+            .iter()
+            .map(|item| {
+                (
+                    item.id,
+                    item.rect,
+                    item.title.clone(),
+                    item.detail.clone(),
+                    item.marker,
+                )
+            })
+            .collect::<Vec<_>>()
+    };
+    assert_eq!(lines(a), lines(b));
+    assert_eq!(boxes(a), boxes(b));
+}
+
+fn expected_message(project: &Project, diagram: Id, occurrence: Id, y: f32) -> Project {
+    // Independent expected mutation: tests begin with no message overrides.
+    let mut expected = project.clone();
+    expected.diagrams.get_mut(&diagram).unwrap().layout =
+        Some(DiagramLayout::Scenario(ScenarioLayout {
+            lanes: vec![],
+            messages: vec![ScenarioMessagePosition {
+                address: OccurrenceEndpoint {
+                    references: vec![],
+                    occurrence,
+                },
+                send_y: y,
+            }],
+        }));
+    expected
+}
+
+#[test]
+fn one_repeated_message_moves_in_one_view_with_exact_document_undo_redo_and_reopen() {
+    let (mut document, a, b) = fixture(None);
+    let original = document.snapshot();
+    let before = document.project().clone();
+    let first = id(&before, "first");
+    let second = id(&before, "second");
+    let baseline = resolved(&before, a, second);
+    assert_eq!(baseline.scene.rows[&first].1, 148.);
+    assert_eq!(baseline.scene.rows[&second].1, 240.);
+    let untouched = resolved(&before, b, second);
+    let drag = capture(&before, a, Target::Message(second)).unwrap();
+    let preview = drag.prepare(-40.).unwrap().unwrap();
+    let expected = expected_message(&before, a, second, 200.);
+    assert_eq!(preview.project, expected);
+    assert_eq!(preview.geometry.scene.rows[&first].1, 148.);
+    assert_eq!(preview.geometry.scene.rows[&second].1, 200.);
+    let line = preview
+        .geometry
+        .scene
+        .lines
+        .iter()
+        .find(|line| line.id == second)
+        .unwrap();
+    assert_eq!(line.points.first().unwrap().y, 200.);
+    assert_eq!(line.points.last().unwrap().y, 200.);
+    assert_eq!(
+        preview.geometry.scene.activations,
+        baseline.scene.activations
+    );
+    assert_eq!(preview.geometry.scene.lifecycle, baseline.scene.lifecycle);
+    same_geometry(&resolved(&preview.project, b, second), &untouched);
+    assert_eq!(drag.original, before);
+    assert!(std::sync::Arc::ptr_eq(&original, &document.snapshot()));
+    assert!(!document.can_undo());
+
+    let returned_selection = document.execute(preview.command).unwrap();
+    assert_eq!(
+        returned_selection,
+        Some(a),
+        "controller must preserve the dragged semantic selection separately"
+    );
+    assert_eq!(document.project(), &expected);
+    assert_eq!(document.revision(), 1);
+    let accepted = document.bundle().clone();
+    same_geometry(&resolved(document.project(), a, second), &preview.geometry);
+    assert!(document.undo());
+    assert_eq!(document.project(), &before);
+    assert_eq!(document.bundle(), &original.bundle);
+    assert!(!document.can_undo());
+    assert!(document.redo());
+    assert_eq!(document.project(), &expected);
+    assert_eq!(document.bundle(), &accepted);
+    let reopened = Document::from_bundle(accepted, ProjectLimits::default()).unwrap();
+    assert_eq!(reopened.project(), &expected);
+    same_geometry(&resolved(reopened.project(), a, second), &preview.geometry);
+    assert!(!reopened.dirty() && !reopened.can_undo());
+}
+
+#[test]
+fn horizontal_lane_move_changes_actual_header_and_attached_endpoints_only_in_selected_view() {
+    let (document, a, b) = fixture(None);
+    let before = document.project();
+    let right = id(before, "right");
+    let first = id(before, "first");
+    let other = resolved(before, b, right);
+    let preview = capture(before, a, Target::Lane(right))
+        .unwrap()
+        .prepare(100.)
+        .unwrap()
+        .unwrap();
+    let mut expected = before.clone();
+    expected.diagrams.get_mut(&a).unwrap().layout = Some(DiagramLayout::Scenario(ScenarioLayout {
+        lanes: vec![ScenarioLanePosition {
+            lifeline: right,
+            x: 500.,
+        }],
+        messages: vec![],
+    }));
+    assert_eq!(preview.project, expected);
+    assert_eq!(preview.geometry.scene.lanes[&right], 500.);
+    let header = preview
+        .geometry
+        .scene
+        .boxes
+        .iter()
+        .find(|item| item.id == right)
+        .unwrap();
+    assert_eq!(header.rect.center_x(), 500.);
+    let line = preview
+        .geometry
+        .scene
+        .lines
+        .iter()
+        .find(|line| line.id == first)
+        .unwrap();
+    assert_eq!(line.points.first().unwrap().x, 160.);
+    assert_eq!(line.points.last().unwrap().x, 500.);
+    assert!(line.points.iter().all(|point| point.y == 148.));
+    same_geometry(&resolved(&preview.project, b, right), &other);
+    assert_eq!(document.project(), before);
+    assert!(!document.dirty() && !document.can_undo());
+}
+
+#[test]
+fn drawn_unassigned_lifeline_can_move_without_assigning_a_semantic_participant() {
+    let (document, a, _) = fixture(None);
+    let mut project = document.project().clone();
+    let owner = id(&project, "conversation");
+    let lane = project
+        .add_element(
+            Kind::Lifeline,
+            oa_core::Layer::Oa,
+            "Unassigned header",
+            Some(owner),
+        )
+        .unwrap();
+    let document = Document::from_project(project, ProjectLimits::default()).unwrap();
+    let baseline = resolved(document.project(), a, lane);
+    assert!(!baseline.scene.lanes.contains_key(&lane));
+    let before_header = baseline
+        .scene
+        .boxes
+        .iter()
+        .find(|item| item.id == lane)
+        .unwrap()
+        .rect;
+    let preview = capture(document.project(), a, Target::Lane(lane))
+        .unwrap()
+        .prepare(70.)
+        .unwrap()
+        .unwrap();
+    let after_header = preview
+        .geometry
+        .scene
+        .boxes
+        .iter()
+        .find(|item| item.id == lane)
+        .unwrap()
+        .rect;
+    assert_eq!(after_header.x, before_header.x + 70.);
+    assert_eq!(after_header.y, before_header.y);
+    assert_eq!(after_header.size(), before_header.size());
+    assert_eq!(preview.project.elements, document.project().elements);
+    assert_eq!(preview.project.relations, document.project().relations);
+    assert!(!document.can_undo());
+}
+
+#[test]
+fn self_call_spacing_uses_send_y_and_preserves_reply_and_actual_activation_finish() {
+    let (document, a, _) = fixture(None);
+    let before = document.project();
+    let call = id(before, "call");
+    let reply = id(before, "reply");
+    let baseline = resolved(before, a, call);
+    let preview = capture(before, a, Target::Message(call))
+        .unwrap()
+        .prepare(-22.)
+        .unwrap()
+        .unwrap();
+    assert_eq!(preview.project, expected_message(before, a, call, 310.));
+    let line = preview
+        .geometry
+        .scene
+        .lines
+        .iter()
+        .find(|line| line.id == call)
+        .unwrap();
+    assert_eq!(line.points.first().unwrap().y, 310.);
+    assert_eq!(line.points.last().unwrap().y, 334.);
+    assert_eq!(preview.geometry.scene.rows[&reply].1, 424.);
+    assert_eq!(preview.geometry.scene.activations.len(), 1);
+    let mut expected_activation = baseline.scene.activations.clone();
+    expected_activation[0].rect.y = 334.;
+    expected_activation[0].rect.height = 90.;
+    assert_eq!(preview.geometry.scene.activations, expected_activation);
+    assert_eq!(preview.geometry.scene.lifecycle, baseline.scene.lifecycle);
+}
+
+#[test]
+fn feasible_spacing_crossing_remains_authored_with_diagnostic_and_unchanged_steps() {
+    let (document, a, _) = fixture(None);
+    let before = document.project();
+    let first = id(before, "first");
+    let second = id(before, "second");
+    let owner = id(before, "conversation");
+    let preview = capture(before, a, Target::Message(second))
+        .unwrap()
+        .prepare(-120.)
+        .unwrap()
+        .unwrap();
+    assert_eq!(preview.project, expected_message(before, a, second, 120.));
+    assert_eq!(preview.geometry.scene.rows[&second].1, 120.);
+    assert_eq!(preview.geometry.scene.rows[&first].1, 148.);
+    assert_eq!(
+        preview.project.elements[&owner].steps(),
+        before.elements[&owner].steps()
+    );
+    let shown = crate::behavior::scenario_layout::presentation::present(
+        &preview.project,
+        Representation::Saved { diagram: a },
+        second,
+    );
+    assert!(shown.capabilities().coordinate_input);
+    assert!(
+        shown
+            .diagnostics()
+            .contains(&Diagnostic::SourceOrderCrossing {
+                scope: owner,
+                before: first,
+                after: second
+            })
+    );
+}
+
+#[test]
+fn unsupported_self_call_move_is_refused_and_automatic_fallback_is_not_editable_capture() {
+    let (document, a, _) = fixture(None);
+    let before = document.project();
+    let call = id(before, "call");
+    let drag = capture(before, a, Target::Message(call)).unwrap();
+    let Err(Refusal::Geometry(issues)) = drag.prepare(118.) else {
+        panic!("send450 / receive474 after reply424 must be refused")
+    };
+    assert!(issues.iter().any(|issue| matches!(issue, GeometryIssue::TypedActivationCrossingNotSupported { call: id, .. } if *id == call)));
+    assert_eq!(&drag.original, before);
+    let invalid_geometry = expected_message(before, a, call, 450.);
+    let shown = crate::behavior::scenario_layout::presentation::present(
+        &invalid_geometry,
+        Representation::Saved { diagram: a },
+        call,
+    );
+    assert!(shown.capabilities().geometry_navigation && !shown.capabilities().coordinate_input);
+    assert!(matches!(
+        capture(&invalid_geometry, a, Target::Message(call)),
+        Err(Refusal::Geometry(_))
+    ));
+    assert!(!document.dirty() && !document.can_undo());
+}
+
+#[test]
+fn invalid_view_foreign_identity_and_latent_message_are_not_spacing_targets() {
+    let (document, a, b) = fixture(None);
+    let p = document.project();
+    let unfinished = id(p, "unfinished");
+    let source = id(p, "source");
+    assert!(matches!(
+        capture(p, Id::nil(), Target::Lane(source)),
+        Err(Refusal::InvalidSavedView(_))
+    ));
+    for target in [
+        Target::Lane(source),
+        Target::Lane(b),
+        Target::Message(source),
+        Target::Message(unfinished),
+    ] {
+        assert!(
+            matches!(capture(p, a, target), Err(Refusal::TargetNotRendered(found)) if found == target)
+        );
+    }
+    // A stored latent coordinate is not permission to fabricate a painted arrow.
+    let mut latent = expected_message(p, a, unfinished, 2000.);
+    let foreign_owner = latent
+        .add_element(Kind::Scenario, oa_core::Layer::Oa, "Foreign", None)
+        .unwrap();
+    let foreign_lane = latent
+        .add_element(
+            Kind::Lifeline,
+            oa_core::Layer::Oa,
+            "Foreign lane",
+            Some(foreign_owner),
+        )
+        .unwrap();
+    *latent
+        .elements
+        .get_mut(&foreign_lane)
+        .unwrap()
+        .shared_mut()
+        .unwrap() = SharedBody::Lifeline {
+        represented: Some(source),
+    };
+    let latent_document = Document::from_project(latent, ProjectLimits::default()).unwrap();
+    assert!(matches!(
+        capture(latent_document.project(), a, Target::Message(unfinished)),
+        Err(Refusal::TargetNotRendered(_))
+    ));
+    assert!(matches!(
+        capture(latent_document.project(), a, Target::Lane(foreign_lane)),
+        Err(Refusal::TargetNotRendered(_))
+    ));
+}
+
+#[test]
+fn zero_motion_return_to_start_and_subprecision_preserve_sparse_intent_and_real_redo() {
+    let parsed = language::parse(FIXTURE).unwrap();
+    let left = id(&parsed, "left");
+    let second = id(&parsed, "second");
+    let layouts = [
+        None,
+        Some(ScenarioLayout::default()),
+        Some(ScenarioLayout {
+            lanes: vec![],
+            messages: vec![ScenarioMessagePosition {
+                address: OccurrenceEndpoint {
+                    references: vec![],
+                    occurrence: second,
+                },
+                send_y: 240.,
+            }],
+        }),
+        Some(ScenarioLayout {
+            lanes: vec![ScenarioLanePosition {
+                lifeline: left,
+                x: -0.,
+            }],
+            messages: vec![],
+        }),
+    ];
+    for (index, layout) in layouts.into_iter().enumerate() {
+        let (mut document, a, _) = fixture(layout);
+        let owner = id(document.project(), "conversation");
+        document
+            .execute(Command::Rename(owner, "A real redo entry".into()))
+            .unwrap();
+        let redo = document.snapshot();
+        assert!(document.undo());
+        let before = document.snapshot();
+        let revision = document.revision();
+        let target = if index == 3 {
+            Target::Lane(left)
+        } else {
+            Target::Message(second)
+        };
+        let drag = capture(document.project(), a, target).unwrap();
+        if index == 3 {
+            let Some(DiagramLayout::Scenario(layout)) = &drag.original.diagrams[&a].layout else {
+                panic!()
+            };
+            assert_eq!(layout.lanes[0].x.to_bits(), (-0_f32).to_bits());
+        }
+        assert!(drag.prepare(10.).unwrap().is_some());
+        for delta in [0., -0.] {
+            assert!(drag.prepare(delta).unwrap().is_none());
+        }
+        if index != 3 {
+            assert!(drag.prepare(f32::from_bits(1)).unwrap().is_none());
+        }
+        assert_eq!(
+            serde_json::to_vec(&drag.original).unwrap(),
+            serde_json::to_vec(document.project()).unwrap()
+        );
+        assert!(std::sync::Arc::ptr_eq(&before, &document.snapshot()));
+        assert_eq!(document.bundle(), &before.bundle);
+        assert_eq!(document.revision(), revision);
+        assert!(document.can_redo());
+        assert!(document.redo());
+        assert_eq!(document.project(), &redo.decoded.project);
+        assert_eq!(document.bundle(), &redo.bundle);
+    }
+}
+
+#[test]
+fn malformed_or_out_of_range_motion_cannot_mutate_original() {
+    let (document, a, _) = fixture(None);
+    let drag = capture(
+        document.project(),
+        a,
+        Target::Message(id(document.project(), "second")),
+    )
+    .unwrap();
+    for delta in [f32::NAN, f32::INFINITY, f32::NEG_INFINITY] {
+        assert!(matches!(drag.prepare(delta), Err(Refusal::InvalidDelta)));
+    }
+    assert!(matches!(drag.prepare(f32::MAX), Err(Refusal::Command(_))));
+    assert_eq!(&drag.original, document.project());
+    assert!(!document.dirty() && !document.can_undo());
+}
+
+const FIXTURE: &str = r#"arcadia 7;
+project spacing_probe "Saved spacing probe" id "71000000-0000-4000-8000-000000000001" {
+ oa_activity source "Source" id "71000000-0000-4000-8000-000000000002" {}
+ oa_activity target "Target" id "71000000-0000-4000-8000-000000000003" {}
+ interaction exchange "Repeated exchange" id "71000000-0000-4000-8000-000000000004" { source @source; target @target; }
+ oa_scenario conversation "Conversation" id "71000000-0000-4000-8000-000000000005" { viewpoint OperationalActivity; steps [@first, @second, @call, @reply, @unfinished]; }
+ oa_lifeline left "Left" id "71000000-0000-4000-8000-000000000006" { parent @conversation; represented @source; }
+ oa_lifeline right "Right" id "71000000-0000-4000-8000-000000000007" { parent @conversation; represented @target; }
+ oa_occurrence first "First" id "71000000-0000-4000-8000-000000000008" { parent @conversation; body { Exchange { exchange @exchange; sender @left; receiver @right; message_kind Asynchronous; }; }; }
+ oa_occurrence second "Second" id "71000000-0000-4000-8000-000000000009" { parent @conversation; body { Exchange { exchange @exchange; sender @left; receiver @right; message_kind Asynchronous; }; }; }
+ oa_occurrence call "Call" id "71000000-0000-4000-8000-00000000000a" { parent @conversation; body { Exchange { exchange none; sender @right; receiver @right; message_kind Call; }; }; }
+ oa_occurrence reply "Reply" id "71000000-0000-4000-8000-00000000000b" { parent @conversation; body { Exchange { exchange none; sender @right; receiver @right; message_kind Reply; reply_to @call; }; }; }
+ oa_occurrence unfinished "Unfinished" id "71000000-0000-4000-8000-00000000000c" { parent @conversation; body { Exchange { exchange @exchange; sender @left; receiver none; message_kind Asynchronous; }; }; }
+}
+"#;

crates/oa-desktop/src/behavior/scenario/usage.rs

@@ -1,5 +1,6 @@
 //! Navigation is derived from the same opaque-reference scene that is painted.
 use super::*;
+use crate::behavior::scenario_layout::{Representation, presentation};
 use crate::diagram_usage::{Surface, Target, Usage};
 
 /// The renderer collapses whitespace before shortening. Require at least one
@@ -22,7 +23,14 @@ fn label_field_visible(full: &str, prefix: &str, value: &str) -> bool {
     start < retained
 }
 
-fn usages(p: &Project, owner: Id, subject: Id, scene: &Scene) -> Vec<Usage> {
+fn usages(
+    p: &Project,
+    owner: Id,
+    subject: Id,
+    surface: Surface,
+    bounds: Rectangle,
+    scene: &Scene,
+) -> Vec<Usage> {
     let mut result = Vec::new();
     let mut add = |id, bounds, role: &str| {
         // Activation bars share the occurrence identity with a labelled message;
@@ -33,7 +41,7 @@ fn usages(p: &Project, owner: Id, subject: Id, scene: &Scene) -> Vec<Usage> {
         {
             result.push(Usage {
                 subject,
-                surface: Surface::Scenario(owner),
+                surface,
                 target: Target::ScenarioObject(id),
                 role: role.into(),
                 bounds,
@@ -137,15 +145,15 @@ fn usages(p: &Project, owner: Id, subject: Id, scene: &Scene) -> Vec<Usage> {
             }
         }
     }
-    if subject == owner {
+    if subject == owner || subject == surface.id() {
         result.insert(
             0,
             Usage {
                 subject,
-                surface: Surface::Scenario(owner),
+                surface,
                 target: Target::Whole,
                 role: "scenario".into(),
-                bounds: Rectangle::new(Point::ORIGIN, scene.size),
+                bounds,
             },
         );
     }
@@ -153,15 +161,29 @@ fn usages(p: &Project, owner: Id, subject: Id, scene: &Scene) -> Vec<Usage> {
 }
 
 impl State {
-    pub(crate) fn diagram_usages(&self, p: &Project, owner: Id, subject: Id) -> Vec<Usage> {
-        if !p
-            .elements
-            .get(&owner)
-            .is_some_and(|e| e.kind() == Kind::Scenario)
-        {
+    /// Membership comes from the complete presentation chosen for this exact view,
+    /// including automatic fallback geometry while retaining its Saved identity.
+    pub(crate) fn representation_usages(
+        &self,
+        p: &Project,
+        representation: Representation,
+        subject: Id,
+    ) -> Vec<Usage> {
+        let shown = presentation::present(p, representation, subject);
+        let (Some(owner), Some(bounds), Some(scene)) =
+            (shown.owner(), shown.bounds(), shown.scene())
+        else {
             return vec![];
-        }
-        usages(p, owner, subject, &Scene::sequence(p, owner, subject))
+        };
+        let surface = match representation {
+            Representation::Derived { owner } => Surface::Scenario(owner),
+            Representation::Saved { diagram } => Surface::Saved(diagram),
+        };
+        usages(p, owner, subject, surface, bounds, scene)
+    }
+
+    pub(crate) fn diagram_usages(&self, p: &Project, owner: Id, subject: Id) -> Vec<Usage> {
+        self.representation_usages(p, Representation::Derived { owner }, subject)
     }
 
     pub(crate) fn reveal_usage(
@@ -171,12 +193,24 @@ impl State {
         owner: Id,
         target: &Target,
     ) -> bool {
-        if self.draft.is_some()
-            || !p
-                .elements
-                .get(&owner)
-                .is_some_and(|e| e.kind() == Kind::Scenario)
-        {
+        self.reveal_representation_usage(
+            p,
+            document,
+            owner,
+            Representation::Derived { owner },
+            target,
+        )
+    }
+
+    pub(crate) fn reveal_representation_usage(
+        &mut self,
+        p: &Project,
+        document: Id,
+        owner: Id,
+        representation: Representation,
+        target: &Target,
+    ) -> bool {
+        if self.draft.is_some() || presentation::checked_owner(p, representation) != Some(owner) {
             return false;
         }
         let id = match target {
@@ -185,7 +219,7 @@ impl State {
             _ => return false,
         };
         let Some(usage) = self
-            .diagram_usages(p, owner, id)
+            .representation_usages(p, representation, id)
             .into_iter()
             .find(|u| &u.target == target)
         else {
@@ -193,11 +227,29 @@ impl State {
         };
         // Preserve an existing mounted viewport across enter's owner reset.
         let viewport = self.presentation.viewport.unwrap_or(Size::new(500., 300.));
-        self.enter(document, owner);
+        if !viewport.width.is_finite()
+            || !viewport.height.is_finite()
+            || viewport.width <= 0.
+            || viewport.height <= 0.
+        {
+            return false;
+        }
+        let (zoom, pan) = if matches!(target, Target::Whole) {
+            let Some(camera) = super::camera::fit(usage.bounds, viewport) else {
+                return false;
+            };
+            (None, camera.pan)
+        } else {
+            let (zoom, pan) = crate::diagram_usage::camera_for(target, usage.bounds, viewport);
+            if !zoom.is_finite() || !pan.x.is_finite() || !pan.y.is_finite() {
+                return false;
+            }
+            (Some(zoom), pan)
+        };
+        self.enter_representation(document, owner, representation);
         self.presentation.viewport = Some(viewport);
         self.canvas_tool = Some((owner, CanvasTool::Select));
-        let (zoom, pan) = crate::diagram_usage::camera_for(target, usage.bounds, viewport);
-        self.presentation.zoom(Some(zoom));
+        self.presentation.zoom(zoom);
         self.presentation.pan = pan;
         true
     }

crates/oa-desktop/src/behavior/scenario/workspace.rs

@@ -13,13 +13,14 @@ pub enum Shelf {
 #[derive(Clone, Default)]
 pub(super) struct Presentation {
     pub(super) identity: Option<(Id, Id)>,
+    pub(super) representation: Option<Representation>,
+    pub(super) visit: Id,
     pub(super) viewport: Option<Size>,
     pub(super) shelf: Option<Shelf>,
     pub(super) pan: iced::Vector,
     pub(super) zoom: Option<f32>,
     pub(super) fit: bool,
 }
-const MIN_SCALE: f32 = 0.05;
 impl Presentation {
     pub(super) fn viewport(&mut self, size: Size) -> bool {
         if !size.width.is_finite()
@@ -34,29 +35,26 @@ impl Presentation {
         true
     }
     pub(super) fn zoom(&mut self, scale: Option<f32>) -> bool {
-        if scale.is_some_and(|value| !value.is_finite() || value <= 0.) {
-            return false;
-        }
-        let next = scale.map(|value| value.clamp(MIN_SCALE, 3.));
-        let changed = self.zoom != next || self.fit != scale.is_none();
-        self.zoom = next;
-        self.fit = scale.is_none();
-        changed
+        camera::set_zoom(&mut self.pan, &mut self.zoom, &mut self.fit, scale)
     }
-    fn fit_scale(&self, scene: Size) -> Option<f32> {
-        let viewport = self.viewport?;
-        // Fit uses the actual mounted viewport with a small visual gutter.
-        Some(
-            ((viewport.width - 16.).max(1.) / scene.width.max(1.))
-                .min((viewport.height - 16.).max(1.) / scene.height.max(1.)),
-        )
+    pub(super) fn camera(&self, bounds: Rectangle) -> camera::Camera {
+        camera::effective_camera(self.pan, self.zoom, self.fit, self.viewport, bounds)
     }
-    pub(super) fn scale(&self, scene: Size) -> f32 {
-        if self.fit {
-            self.fit_scale(scene).unwrap_or(1.).clamp(MIN_SCALE, 1.)
-        } else {
-            self.zoom.unwrap_or(1.)
-        }
+    // Legacy tests call size-only scale; actual display always passes full bounds.
+    #[cfg(test)]
+    pub(super) fn scale(&self, size: Size) -> f32 {
+        self.camera(Rectangle::new(Point::ORIGIN, size)).scale
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+struct ArrangementChoice {
+    representation: Representation,
+    label: String,
+}
+impl std::fmt::Display for ArrangementChoice {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.label)
     }
 }
 
@@ -68,43 +66,136 @@ pub fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Element<'a
         .draft
         .as_ref()
         .is_some_and(|draft| draft.owner == owner);
-    let context = app.scenario_context().expect("visible scenario context");
+    let Some(context) = app.scenario_context() else {
+        return column![
+            out,
+            text("Scenario view is unavailable."),
+            button("Open selected source").on_press(Message::SourceForSelection)
+        ]
+        .spacing(8)
+        .into();
+    };
     let tool = state.canvas_tool(owner);
     let clean = !app.behavior.has_pending() && !app.draft_dirty() && !app.source_dirty();
-    let mut scene = Scene::sequence(p, owner, app.selected);
-    let scale = presentation.scale(scene.size);
-    scene.scale = scale;
-    scene.camera_pan = presentation.pan;
-    scene.interaction = Some((context, tool, clean));
-    scene.pending_placement = state.pending_placement(owner);
+    // Resolve once per accepted view. An active spacing session owns its exact
+    // prepared geometry; borrowing it also retains the canvas input state.
+    let preview = state.spacing_paint(context, app.camera_epoch);
+    let shown = preview
+        .is_none()
+        .then(|| presentation::present(p, context.representation, app.selected));
+    let capabilities = shown.as_ref().map_or(
+        presentation::PresentationCapabilities {
+            geometry_navigation: true,
+            coordinate_input: true,
+        },
+        ScenarioPresentation::capabilities,
+    );
+    let coordinate_input = clean && capabilities.coordinate_input;
+    let notice = if let Some(paint) = &preview {
+        display_notice_parts(
+            p,
+            context.representation,
+            &presentation::PresentationStatus::Ready,
+            paint.original_diagnostics,
+            paint.original_latent,
+        )
+    } else {
+        display_notice(p, shown.as_ref().expect("normal presentation"))
+    };
+    let camera_state = preview
+        .as_ref()
+        .map(|paint| camera::Camera {
+            scale: paint.scene.scale,
+            pan: paint.scene.camera_pan,
+        })
+        .or_else(|| {
+            shown
+                .as_ref()
+                .and_then(ScenarioPresentation::bounds)
+                .map(|bounds| presentation.camera(bounds))
+        });
+    let scale = camera_state.map_or(1., |camera| camera.scale);
     let scope = super::super::canvas_workspace::Scope {
         document: context.document,
         owner,
         revision: context.revision,
         epoch: app.camera_epoch,
+        scenario_view: Some((context.representation, context.visit)),
     };
-    let keyboard = clean && super::super::canvas_workspace::keyboard_enabled(app);
+    let keyboard = clean
+        && capabilities.geometry_navigation
+        && super::super::canvas_workspace::keyboard_enabled(app);
     let camera = move |e| Message::ScenarioCanvas(CanvasEvent::Camera(context, scope.epoch, e));
-    let canvas = container(
-        sensor(
-            super::super::canvas_workspace::Viewport::new(
-                canvas::Canvas::new(scene).width(Fill).height(Fill),
-                scope,
-                scale,
-                keyboard,
-                camera,
-            )
-            .pan_background(tool == CanvasTool::Select),
+    let raw_canvas: Option<Element<'a, Message>> = if let Some(paint) = &preview {
+        Some(
+            canvas::Canvas::new(paint.scene)
+                .width(Fill)
+                .height(Fill)
+                .into(),
         )
-        .key((context.document, owner))
-        .on_show(move |size| Message::ScenarioCanvas(CanvasEvent::Viewport(context, size)))
-        .on_resize(move |size| Message::ScenarioCanvas(CanvasEvent::Viewport(context, size))),
-    )
-    .id("scenario-viewport")
-    .width(Fill)
-    .height(Fill)
-    .style(style::card)
-    .into();
+    } else if let Some(mut scene) = shown.and_then(ScenarioPresentation::into_scene) {
+        let camera_state = camera_state.expect("displayed Scene has complete bounds");
+        scene.scale = camera_state.scale;
+        scene.camera_pan = camera_state.pan;
+        scene.interaction = Some((context, tool, clean));
+        scene.spacing_stamp = (coordinate_input
+            && !app.source_rename.open()
+            && keyboard
+            && matches!(context.representation, Representation::Saved { .. }))
+        .then_some(spacing::Stamp {
+            context,
+            camera_epoch: app.camera_epoch,
+        });
+        scene.coordinate_input = capabilities.coordinate_input;
+        scene.pending_placement = coordinate_input
+            .then(|| state.pending_placement(owner))
+            .flatten();
+        Some(canvas::Canvas::new(scene).width(Fill).height(Fill).into())
+    } else {
+        None
+    };
+    let canvas: Element<'a, Message> = if let Some(raw_canvas) = raw_canvas {
+        // Keep this Stack in both branches: replacing the Canvas with a wrapper
+        // on Begin would discard its pointer capture before Move/Finish.
+        let mut layers = iced::widget::stack![raw_canvas];
+        if let Some(paint) = &preview {
+            let feedback = spacing_feedback(p, paint.refusal, paint.diagnostics);
+            layers = layers.push(
+                container(
+                    container(text(feedback).size(12))
+                        .padding(6)
+                        .width(Fill)
+                        .style(style::card),
+                )
+                .width(Fill)
+                .align_bottom(Fill)
+                .padding(8),
+            );
+        }
+        container(
+            sensor(
+                super::super::canvas_workspace::Viewport::new(
+                    layers, scope, scale, keyboard, camera,
+                )
+                .pan_background(tool == CanvasTool::Select || !capabilities.coordinate_input),
+            )
+            .key((
+                context.document,
+                format!("{:?}", context.representation),
+                context.visit,
+            ))
+            .on_show(move |size| Message::ScenarioCanvas(CanvasEvent::Viewport(context, size)))
+            .on_resize(move |size| Message::ScenarioCanvas(CanvasEvent::Viewport(context, size))),
+        )
+        .id("scenario-viewport")
+        .width(Fill)
+        .height(Fill)
+        .style(style::card)
+        .into()
+    } else {
+        container(text("No supported canvas geometry is available. Inspect the model or open its source to repair this view."))
+            .id("scenario-viewport-unavailable").padding(16).width(Fill).height(Fill).style(style::card).into()
+    };
     let mut navigation = row![out.width(Fill)].spacing(6);
     if state.can_back(p, context) {
         navigation =
@@ -112,20 +203,72 @@ pub fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Element<'a
                 clean.then_some(Message::ScenarioCanvas(CanvasEvent::Back(context))),
             ));
     }
-    let header = column![
-        navigation,
-        super::super::canvas_workspace::controls(
+    let mut header = column![navigation, notice].spacing(4);
+    let saved_views = p
+        .diagrams
+        .values()
+        .filter(|diagram| {
+            presentation::checked_owner(
+                p,
+                Representation::Saved {
+                    diagram: diagram.id,
+                },
+            ) == Some(owner)
+        })
+        .map(|diagram| ArrangementChoice {
+            representation: Representation::Saved {
+                diagram: diagram.id,
+            },
+            label: short(&diagram.name, 64),
+        })
+        .collect::<Vec<_>>();
+    if !saved_views.is_empty() {
+        let mut choices = vec![ArrangementChoice {
+            representation: Representation::Derived { owner },
+            label: "Automatic arrangement".into(),
+        }];
+        choices.extend(saved_views);
+        let selected = choices
+            .iter()
+            .find(|choice| choice.representation == context.representation)
+            .cloned();
+        header = header.push(
+            container(
+                pick_list(choices, selected, move |choice: ArrangementChoice| {
+                    Message::ScenarioCanvas(CanvasEvent::Representation(
+                        context,
+                        choice.representation,
+                    ))
+                })
+                .placeholder("Choose arrangement")
+                .text_size(12)
+                .padding(5)
+                .width(Fill),
+            )
+            .width(Fill)
+            .id("scenario-arrangement-picker"),
+        );
+    }
+    if capabilities.geometry_navigation {
+        header = header.push(super::super::canvas_workspace::controls(
             scope,
             keyboard,
             scale,
             Message::ScenarioCanvas(CanvasEvent::Shelf(context, Shelf::Selection)),
             move |zoom| Message::ScenarioCanvas(CanvasEvent::Zoom(context, zoom)),
-            camera
-        )
-    ]
-    .spacing(4);
+            camera,
+        ));
+    }
     let entries = [
-        ("S", "Select / reorder occurrences", CanvasTool::Select),
+        (
+            "S",
+            if matches!(context.representation, Representation::Saved { .. }) {
+                "Select / move messages and lifelines"
+            } else {
+                "Select / reorder occurrences"
+            },
+            CanvasTool::Select,
+        ),
         (
             "L",
             "Lifeline: click to choose represented work or participant",
@@ -192,16 +335,21 @@ pub fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Element<'a
                 glyph,
                 label,
                 choice == tool,
-                clean.then_some(Message::ScenarioCanvas(CanvasEvent::Choose(
-                    context, choice,
-                ))),
+                (clean && (choice == CanvasTool::Select || capabilities.coordinate_input))
+                    .then_some(Message::ScenarioCanvas(CanvasEvent::Choose(
+                        context, choice,
+                    ))),
             )
         }),
     );
     let mut details = column![
         text(format!("Selected: {}", p.named(app.selected))).size(12),
-        button(text("Properties").size(12))
-            .on_press_maybe(clean.then_some(Message::EditProperties(app.selected)))
+        container(button(text("Properties").size(12)).on_press_maybe(
+            (clean && properties_target(p, context, app.selected)).then_some(
+                Message::ScenarioCanvas(CanvasEvent::Properties(context, app.selected)),
+            ),
+        ))
+        .id("scenario-properties")
     ]
     .spacing(6);
     if referenced_scenario(p, owner, app.selected).is_some() {
@@ -212,6 +360,10 @@ pub fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Element<'a
             ))),
         ));
     }
+    details = details.push(text("Scenario order").size(13));
+    if matches!(context.representation, Representation::Saved { .. }) {
+        details = details.push(text("↑ and ↓ change the shared Scenario order. Saved message positions are retained; automatically placed items may move.").size(11));
+    }
     let details = details_pane(
         context,
         state.scroll_restore(context, ScrollArea::Page),
@@ -541,6 +693,153 @@ pub fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Element<'a
     super::super::canvas_workspace::host(header.into(), palette, canvas, editor)
 }
 
+fn display_notice<'a>(p: &Project, shown: &ScenarioPresentation) -> Element<'a, Message> {
+    display_notice_parts(
+        p,
+        shown.requested(),
+        shown.status(),
+        shown.diagnostics(),
+        shown.latent_messages(),
+    )
+}
+
+fn display_notice_parts<'a>(
+    p: &Project,
+    requested: Representation,
+    status: &presentation::PresentationStatus,
+    diagnostics: &[super::super::scenario_layout::Diagnostic],
+    latent_messages: &[Id],
+) -> Element<'a, Message> {
+    use super::super::scenario_layout::{Diagnostic, presentation::PresentationStatus};
+    let title = match requested {
+        Representation::Saved { diagram } => p.diagrams.get(&diagram).map_or_else(
+            || "Unavailable saved Scenario view".into(),
+            |view| format!("Saved view · {}", view.name),
+        ),
+        Representation::Derived { owner } => format!("Automatic view · {}", p.named(owner)),
+    };
+    let mut notice = column![text(title).size(14)].spacing(4);
+    match status {
+        PresentationStatus::Ready => {
+            for diagnostic in diagnostics.iter().take(3) {
+                let explanation = match diagnostic {
+                    Diagnostic::SourceOrderCrossing { before, after, .. } => format!(
+                        "Saved spacing places '{}' below '{}'. The Scenario order is unchanged.",
+                        p.named(*before),
+                        p.named(*after)
+                    ),
+                    Diagnostic::FrameExtendsPastFollowingAnchor { frame, following } => format!(
+                        "Saved spacing makes '{}' overlap '{}'. Both keep their saved positions.",
+                        p.named(*frame),
+                        p.named(*following)
+                    ),
+                };
+                notice = notice.push(text(explanation).size(12));
+            }
+            if diagnostics.len() > 3 {
+                notice = notice.push(
+                    text(format!(
+                        "{} additional spacing notices are retained.",
+                        diagnostics.len() - 3
+                    ))
+                    .size(12),
+                );
+            }
+        }
+        PresentationStatus::Fallback { requested_issues } => {
+            notice = notice.push(text("Showing the complete automatic arrangement because the saved positions cannot currently be displayed. Saved positions are preserved.").size(12));
+            if let Some(issue) = requested_issues.first() {
+                notice = notice.push(text(geometry_problem(p, issue)).size(12));
+            }
+            notice = notice.push(text("Selection, navigation and Fit remain available. Canvas insertion and reordering are unavailable until the saved positions are repaired.").size(12));
+        }
+        PresentationStatus::Unavailable { .. } => {
+            notice = notice.push(text("This view is unavailable. Its identity or automatic geometry cannot be resolved; the model and source remain available for inspection and repair.").size(12));
+        }
+    }
+    if !latent_messages.is_empty() {
+        notice = notice.push(text(format!("{} unfinished message position(s) are retained until their endpoints are complete.", latent_messages.len())).size(12));
+    }
+    notice = notice.push(button("Open selected source").on_press(Message::SourceForSelection));
+    container(notice)
+        .id("scenario-display-notice")
+        .padding(6)
+        .width(Fill)
+        .into()
+}
+
+fn spacing_feedback(
+    p: &Project,
+    refusal: Option<&spacing::Refusal>,
+    diagnostics: &[super::super::scenario_layout::Diagnostic],
+) -> String {
+    if let Some(refusal) = refusal {
+        let reason = match refusal {
+            spacing::Refusal::Geometry(issues) => issues
+                .first()
+                .map(|issue| geometry_problem(p, issue))
+                .unwrap_or_else(|| "This position cannot be displayed.".into()),
+            spacing::Refusal::Command(error) => error.clone(),
+            _ => "This position is unavailable in the current view.".into(),
+        };
+        return format!(
+            "Position unavailable · {reason} Move back to a supported position, or release to cancel."
+        );
+    }
+    let explanation = match diagnostics.first() {
+        Some(super::super::scenario_layout::Diagnostic::SourceOrderCrossing {
+            before,
+            after,
+            ..
+        }) => format!(
+            " '{}' is below '{}'; Scenario order stays unchanged.",
+            p.named(*before),
+            p.named(*after)
+        ),
+        Some(super::super::scenario_layout::Diagnostic::FrameExtendsPastFollowingAnchor {
+            frame,
+            following,
+        }) => format!(" '{}' overlaps '{}'.", p.named(*frame), p.named(*following)),
+        None => " Scenario order stays unchanged.".into(),
+    };
+    format!("Spacing preview · Release to finish; Escape cancels.{explanation}")
+}
+
+fn geometry_problem(p: &Project, issue: &super::super::scenario_layout::GeometryIssue) -> String {
+    use super::super::scenario_layout::GeometryIssue;
+    match issue {
+        GeometryIssue::TypedActivationCrossingNotSupported { call, event } => format!(
+            "The position of '{}' conflicts with the execution of '{}'.",
+            p.named(*event),
+            p.named(*call)
+        ),
+        GeometryIssue::CoincidentDistinctEndpoints(message) => format!(
+            "The distinct endpoints of '{}' have the same horizontal position.",
+            p.named(*message)
+        ),
+        GeometryIssue::TypedActivationOutsideLifetime { call, .. }
+        | GeometryIssue::TypedActivationOutsideScope { call, .. } => format!(
+            "The position of '{}' falls outside its supported execution interval.",
+            p.named(*call)
+        ),
+        GeometryIssue::FixedFrameHeaderWouldMove { frame } => format!(
+            "The saved spacing would move the fixed header of '{}'.",
+            p.named(*frame)
+        ),
+        GeometryIssue::OperandScopeOutsideEnclosingInterval { operand, .. } => format!(
+            "The spacing of '{}' extends outside its enclosing frame.",
+            p.named(*operand)
+        ),
+        GeometryIssue::LifecycleGeometryNotSupported { .. }
+        | GeometryIssue::LifecycleAnchorOutsideRenderScope { .. }
+        | GeometryIssue::LifetimeInversionNotSupported { .. } => {
+            "The saved spacing cannot preserve the participant lifetime geometry.".into()
+        }
+        _ => "These saved positions are outside the geometry currently supported by the canvas."
+            .into(),
+    }
+}
+
 fn sequence_action<'a>(
     title: &str,
     message: Message,
@@ -597,6 +896,12 @@ fn editor_panel<'a, R: iced::advanced::text::Renderer + 'a>(
 #[cfg(all(test, debug_assertions))]
 mod tests;
 
+#[cfg(all(test, debug_assertions))]
+mod spacing_tests;
+
+#[cfg(all(test, debug_assertions))]
+mod details_tests;
+
 fn sequence_rows<'a>(
     p: &'a Project,
     context: Context,

crates/oa-desktop/src/behavior/scenario/workspace/details_tests.rs

@@ -0,0 +1,445 @@
+//! Mounted Scenario Details → inspector regression and retained-intent guards.
+use super::*;
+use crate::behavior::canvas_workspace::tests::Mounted;
+use crate::behavior::scenario_layout::resolve;
+use iced::advanced::widget;
+use iced::{Vector, keyboard};
+use std::sync::Arc;
+
+const FIXTURE: &str = include_str!("../../../app/diagram_usages/tests/saved_scenario.arcadia");
+
+fn id(app: &App, alias: &str) -> Id {
+    app.project()
+        .identities()
+        .into_iter()
+        .find(|(_, name)| *name == alias)
+        .unwrap()
+        .0
+}
+fn send(app: &mut App, event: impl FnOnce(Context) -> CanvasEvent) {
+    let context = app.scenario_context().unwrap();
+    let _ = app.update(Message::ScenarioCanvas(event(context)));
+}
+fn setup() -> (App, Id, Id) {
+    let mut app = App::with_project(oa_core::language::parse(FIXTURE).unwrap());
+    let owner = id(&app, "incident_response");
+    let diagram = id(&app, "incident_readable");
+    let message = id(&app, "initial_report");
+    let _ = app.update(Message::Select(owner));
+    let _ = app.update(Message::Diagram(crate::app::Choice {
+        id: diagram,
+        label: "A".into(),
+    }));
+    send(&mut app, |c| CanvasEvent::Select(c, message));
+    app.window_size = Size::new(1440., 1000.);
+    (app, diagram, message)
+}
+fn open_details(app: &mut App) {
+    if app.behavior.scenario.presentation.shelf.is_none() {
+        send(app, |c| CanvasEvent::Shelf(c, Shelf::Selection));
+    }
+}
+fn stored_camera(app: &App) -> (Vector, Option<f32>, bool) {
+    let p = &app.behavior.scenario.presentation;
+    (p.pan, p.zoom, p.fit)
+}
+
+#[tokio::test]
+async fn saved_details_opens_real_editable_inspector_and_returns_to_same_view() {
+    let (mut app, diagram, message) = setup();
+    let _ = app.update(Message::InspectorTab(
+        crate::navigation::InspectorTab::Connections,
+    ));
+    let mut mounted = Mounted::new(&mut app).await;
+    open_details(&mut app);
+    mounted.settle(&mut app).await;
+    let before = mounted.geometry(&app);
+    assert_eq!(
+        app.inspector_tab,
+        crate::navigation::InspectorTab::Connections
+    );
+    assert!(!before.scrolls.contains_key(&widget::Id::new("inspector")));
+    let (details, offset) = before.scrolls[&widget::Id::new("scenario-details")];
+    let button = before.bounds("scenario-properties").center() - offset;
+    assert!(
+        details.contains(button),
+        "Properties must be actually visible"
+    );
+    let context = app.scenario_context().unwrap();
+    let camera = stored_camera(&app);
+    let original = app.document.snapshot();
+    let bundle = app.document.bundle().clone();
+    let messages = mounted.click(&mut app, button).await;
+    assert!(messages.iter().any(|event| matches!(event,
+        Message::ScenarioCanvas(CanvasEvent::Properties(c, selected))
+        if *c == context && *selected == message)));
+    mounted.settle(&mut app).await;
+    assert!(app.behavior.scenario.presentation.shelf.is_none());
+    assert_eq!(
+        app.inspector_tab,
+        crate::navigation::InspectorTab::Properties
+    );
+    assert_eq!(app.selected, message);
+    assert_eq!(app.active_diagram, Some(diagram));
+    assert_eq!(app.page, crate::app::Page::Behavior);
+    let current = app.scenario_context().unwrap();
+    assert_eq!(current.representation, context.representation);
+    assert_eq!(current.visit, context.visit);
+    assert_eq!(
+        stored_camera(&app),
+        camera,
+        "opening Properties retains camera intent"
+    );
+    assert!(Arc::ptr_eq(&original, &app.document.snapshot()));
+    assert_eq!(app.document.bundle(), &bundle);
+    assert!(!app.document.can_undo() && !app.document.can_redo());
+
+    let shown = mounted.geometry(&app);
+    assert!(
+        !shown
+            .scrolls
+            .contains_key(&widget::Id::new("scenario-details"))
+    );
+    let (inspector, offset) = shown.scrolls[&widget::Id::new("inspector")];
+    assert!(inspector.width > 250. && inspector.height > 500.);
+    // Production Properties places Name before the other scalar text inputs.
+    // Account for the retained inspector scroll, rather than clicking content coordinates.
+    let input = shown
+        .text_inputs
+        .iter()
+        .map(|bounds| bounds.center() - offset)
+        .filter(|point| inspector.contains(*point))
+        .min_by(|a, b| a.y.total_cmp(&b.y))
+        .expect("visible editable property");
+    mounted.click(&mut app, input).await;
+    let typed = mounted
+        .batch(
+            &mut app,
+            &[iced::Event::Keyboard(keyboard::Event::KeyPressed {
+                key: keyboard::Key::Character("x".into()),
+                modified_key: keyboard::Key::Character("x".into()),
+                physical_key: keyboard::key::Physical::Unidentified(
+                    keyboard::key::NativeCode::Unidentified,
+                ),
+                location: keyboard::Location::Standard,
+                modifiers: keyboard::Modifiers::empty(),
+                text: Some("x".into()),
+                repeat: false,
+            })],
+            mouse::Cursor::Available(input),
+        )
+        .await;
+    assert!(
+        typed
+            .iter()
+            .any(|message| matches!(message, Message::Field(path, _) if path == "/name")),
+        "real Name editor must publish its edit: {typed:?}"
+    );
+    assert!(app.draft_dirty());
+    assert!(
+        Arc::ptr_eq(&original, &app.document.snapshot()),
+        "typing is only a draft"
+    );
+    let _ = app.update(Message::RevertProperties);
+    assert!(!app.draft_dirty());
+    mounted.settle(&mut app).await;
+    let returned = mounted.geometry(&app);
+    assert!(returned.scrolls.contains_key(&widget::Id::new("inspector")));
+    let viewport = returned.bounds("scenario-viewport");
+    assert_eq!(app.selected, message);
+    assert_eq!(app.scenario_context().unwrap().visit, context.visit);
+    assert_eq!(
+        app.scenario_context().unwrap().representation,
+        context.representation
+    );
+    assert_eq!(stored_camera(&app), camera);
+    let geometry = resolve(app.project(), context.representation, message).unwrap();
+    let line = geometry
+        .scene
+        .lines
+        .iter()
+        .find(|line| line.id == message)
+        .unwrap();
+    let effective = app.behavior.scenario.presentation.camera(geometry.bounds);
+    let point = viewport.position()
+        + effective.pan
+        + Vector::new(line.points[0].x, line.points[0].y) * effective.scale;
+    assert!(
+        viewport.contains(point),
+        "the same selected message remains in fitted view"
+    );
+    assert!(Arc::ptr_eq(&original, &app.document.snapshot()));
+    assert_eq!(app.document.bundle(), &bundle);
+    assert!(!app.document.can_undo() && !app.document.can_redo());
+}
+
+#[test]
+fn details_properties_refuses_pending_property_source_and_behavior_drafts_without_apply() {
+    for kind in 0..3 {
+        let (mut app, _, message) = setup();
+        open_details(&mut app);
+        match kind {
+            0 => {
+                let _ = app.update(Message::Field(
+                    "/name".into(),
+                    "Retained property draft".into(),
+                ));
+                assert!(app.draft_dirty());
+            }
+            1 => {
+                let _ = app.update(Message::SourceEdit(
+                    iced::widget::text_editor::Action::Edit(
+                        iced::widget::text_editor::Edit::Insert('x'),
+                    ),
+                ));
+                assert!(app.source_dirty());
+            }
+            _ => {
+                let owner = app.scenario_context().unwrap().scenario;
+                let _ = app.update(Message::Behavior(super::super::super::Event::Scenario(
+                    Event::Start(owner, Tool::Lifeline),
+                )));
+                assert!(app.behavior.has_pending());
+            }
+        }
+        let snapshot = app.document.snapshot();
+        let bundle = app.document.bundle().clone();
+        let property = app.draft.as_ref().unwrap().materialize();
+        let source = app.source_editor.text();
+        let behavior = app.behavior.recovery_snapshot();
+        let camera = app.behavior.scenario.camera_boundary();
+        let context = app.scenario_context().unwrap();
+        let epochs = (app.canvas_epoch, app.camera_epoch);
+        let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Properties(
+            context, message,
+        )));
+        assert!(app.behavior.scenario.camera_boundary() == camera);
+        assert_eq!(app.scenario_context(), Some(context));
+        assert_eq!((app.canvas_epoch, app.camera_epoch), epochs);
+        assert_eq!(app.draft.as_ref().unwrap().materialize(), property);
+        assert_eq!(app.source_editor.text(), source);
+        assert_eq!(app.behavior.recovery_snapshot(), behavior);
+        assert_eq!(app.selected, message);
+        assert!(Arc::ptr_eq(&snapshot, &app.document.snapshot()));
+        assert_eq!(app.document.bundle(), &bundle);
+        assert!(!app.document.can_undo() && !app.document.can_redo());
+    }
+}
+
+#[tokio::test]
+async fn details_opens_current_saved_view_properties_after_following_diagram_picker() {
+    let (mut app, a, _) = setup();
+    let b = id(&app, "incident_wide");
+    // Selecting the current view record makes the real picker follow that
+    // record selection to B. Do not seed selected=B or its property draft.
+    let _ = app.update(Message::Select(a));
+    assert_eq!(app.selected, a);
+    let _ = app.update(Message::Diagram(crate::app::Choice {
+        id: b,
+        label: "B".into(),
+    }));
+    assert_eq!(app.selected, b);
+    assert_eq!(app.draft.as_ref().unwrap().original, b);
+    assert_eq!(
+        app.scenario_context().unwrap().representation,
+        Representation::Saved { diagram: b }
+    );
+    let _ = app.update(Message::InspectorTab(
+        crate::navigation::InspectorTab::Connections,
+    ));
+    let mut mounted = Mounted::new(&mut app).await;
+    open_details(&mut app);
+    mounted.settle(&mut app).await;
+    let context = app.scenario_context().unwrap();
+    let camera = stored_camera(&app);
+    let snapshot = app.document.snapshot();
+    let bundle = app.document.bundle().clone();
+    let before = mounted.geometry(&app);
+    assert_eq!(
+        app.inspector_tab,
+        crate::navigation::InspectorTab::Connections
+    );
+    assert!(!before.scrolls.contains_key(&widget::Id::new("inspector")));
+    let (details, offset) = before.scrolls[&widget::Id::new("scenario-details")];
+    let point = before.bounds("scenario-properties").center() - offset;
+    assert!(details.contains(point));
+    let events = mounted.click(&mut app, point).await;
+    assert!(events.iter().any(|event| matches!(event,
+        Message::ScenarioCanvas(CanvasEvent::Properties(c, selected))
+        if *c == context && *selected == b)));
+    mounted.settle(&mut app).await;
+    let shown = mounted.geometry(&app);
+    assert!(
+        !shown
+            .scrolls
+            .contains_key(&widget::Id::new("scenario-details"))
+    );
+    let (inspector, offset) = shown.scrolls[&widget::Id::new("inspector")];
+    assert!(
+        shown
+            .text_inputs
+            .iter()
+            .any(|bounds| inspector.contains(bounds.center() - offset)),
+        "current Saved diagram has a visible editable inspector"
+    );
+    assert_eq!(
+        app.inspector_tab,
+        crate::navigation::InspectorTab::Properties
+    );
+    assert_eq!(app.selected, b);
+    assert_eq!(app.draft.as_ref().unwrap().original, b);
+    assert_eq!(app.active_diagram, Some(b));
+    assert_eq!(app.page, crate::app::Page::Behavior);
+    assert_eq!(
+        app.scenario_context().unwrap().representation,
+        context.representation
+    );
+    assert_eq!(app.scenario_context().unwrap().visit, context.visit);
+    assert_eq!(stored_camera(&app), camera);
+    assert!(Arc::ptr_eq(&snapshot, &app.document.snapshot()));
+    assert_eq!(app.document.bundle(), &bundle);
+    assert!(!app.document.can_undo() && !app.document.can_redo());
+}
+
+#[test]
+fn details_properties_refuses_another_saved_view_even_with_the_same_scenario_owner() {
+    let (mut app, a, _) = setup();
+    let b = id(&app, "incident_wide");
+    let _ = app.update(Message::Diagram(crate::app::Choice {
+        id: b,
+        label: "B".into(),
+    }));
+    let _ = app.update(Message::Select(a));
+    assert_eq!(app.selected, a);
+    open_details(&mut app);
+    let context = app.scenario_context().unwrap();
+    assert_eq!(context.representation, Representation::Saved { diagram: b });
+    assert_eq!(
+        presentation::checked_owner(app.project(), Representation::Saved { diagram: a }),
+        Some(context.scenario)
+    );
+    assert!(!properties_target(app.project(), context, a));
+    let camera = app.behavior.scenario.camera_boundary();
+    let epochs = (app.canvas_epoch, app.camera_epoch);
+    let snapshot = app.document.snapshot();
+    let bundle = app.document.bundle().clone();
+    let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Properties(context, a)));
+    assert!(app.behavior.scenario.camera_boundary() == camera);
+    assert_eq!((app.canvas_epoch, app.camera_epoch), epochs);
+    assert_eq!(app.scenario_context(), Some(context));
+    assert_eq!(app.selected, a);
+    assert_eq!(app.draft.as_ref().unwrap().original, a);
+    assert!(Arc::ptr_eq(&snapshot, &app.document.snapshot()));
+    assert_eq!(app.document.bundle(), &bundle);
+    assert!(!app.document.can_undo() && !app.document.can_redo());
+}
+
+#[test]
+fn details_properties_rejects_retired_view_selection_and_epoch_without_changing_panels() {
+    for kind in 0..3 {
+        let (mut app, diagram, message) = setup();
+        open_details(&mut app);
+        let captured = app.scenario_context().unwrap();
+        match kind {
+            0 => {
+                let other = id(&app, "incident_wide");
+                for view in [other, diagram] {
+                    let _ = app.update(Message::Diagram(crate::app::Choice {
+                        id: view,
+                        label: "view".into(),
+                    }));
+                }
+                open_details(&mut app);
+                assert_ne!(app.scenario_context().unwrap().visit, captured.visit);
+            }
+            1 => {
+                let other = id(&app, "updated_report");
+                send(&mut app, |c| CanvasEvent::Select(c, other));
+            }
+            _ => {
+                send(&mut app, |c| CanvasEvent::Zoom(c, Some(0.5)));
+            }
+        }
+        let camera = app.behavior.scenario.camera_boundary();
+        let context = app.scenario_context();
+        let selected = app.selected;
+        let tab = app.inspector_tab;
+        let epochs = (app.canvas_epoch, app.camera_epoch);
+        let snapshot = app.document.snapshot();
+        let bundle = app.document.bundle().clone();
+        let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Properties(
+            captured, message,
+        )));
+        assert!(app.behavior.scenario.camera_boundary() == camera);
+        assert_eq!(app.scenario_context(), context);
+        assert_eq!(app.selected, selected);
+        assert_eq!(app.inspector_tab, tab);
+        assert_eq!((app.canvas_epoch, app.camera_epoch), epochs);
+        assert!(Arc::ptr_eq(&snapshot, &app.document.snapshot()));
+        assert_eq!(app.document.bundle(), &bundle);
+    }
+}
+
+#[test]
+fn opening_scenario_properties_cancels_held_spacing_and_rejects_its_late_finish() {
+    use super::super::spacing::{Event as Spacing, Target, controller::tests::packet};
+    let (mut app, _, message) = setup();
+    send(&mut app, |c| {
+        CanvasEvent::Viewport(c, Size::new(900., 600.))
+    });
+    open_details(&mut app);
+    let begin = packet(
+        app.project(),
+        &app.behavior.scenario,
+        app.scenario_context().unwrap(),
+        app.camera_epoch,
+        Target::Message(message),
+    );
+    let Spacing::Begin { press_screen, .. } = begin else {
+        panic!()
+    };
+    let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Spacing(begin)));
+    assert_eq!(app.behavior.scenario.spacing_token(), Some(begin.token()));
+    let snapshot = app.document.snapshot();
+    let end = press_screen + Vector::new(0., 12.);
+    let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Spacing(
+        Spacing::Move {
+            stamp: begin.stamp(),
+            token: begin.token(),
+            screen: end,
+        },
+    )));
+    let paint = app
+        .behavior
+        .scenario
+        .spacing_paint(begin.stamp().context, begin.stamp().camera_epoch)
+        .unwrap();
+    assert!(paint.refusal.is_none());
+    let line = paint
+        .scene
+        .lines
+        .iter()
+        .find(|line| line.id == message)
+        .unwrap();
+    assert!(
+        line.points[0].y > 160.,
+        "a real proposed scene moved the first message"
+    );
+    assert!(
+        Arc::ptr_eq(&snapshot, &app.document.snapshot()),
+        "preview is not authored"
+    );
+    let camera = stored_camera(&app);
+    send(&mut app, |c| CanvasEvent::Properties(c, message));
+    assert!(app.behavior.scenario.spacing_token().is_none());
+    assert_eq!(stored_camera(&app), camera);
+    let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Spacing(
+        Spacing::Finish {
+            stamp: begin.stamp(),
+            token: begin.token(),
+            screen: end,
+        },
+    )));
+    assert!(Arc::ptr_eq(&snapshot, &app.document.snapshot()));
+    assert!(!app.document.can_undo() && !app.document.can_redo());
+}

crates/oa-desktop/src/behavior/scenario/workspace/spacing_tests.rs

@@ -0,0 +1,438 @@
+//! Real mounted widgets dispatch the gesture; expectations name authored fields
+//! and actual displayed anchors independently of controller command results.
+use super::*;
+use crate::behavior::canvas_workspace::tests::{Mounted, key};
+use crate::behavior::scenario_layout::{ResolvedScenarioPlan, resolve};
+use crate::document::Document;
+use iced::Vector;
+use std::sync::Arc;
+
+const FIXTURE: &str = include_str!("../../../app/diagram_usages/tests/saved_scenario.arcadia");
+
+fn id(app: &App, alias: &str) -> Id {
+    app.project()
+        .identities()
+        .into_iter()
+        .find(|(_, name)| *name == alias)
+        .unwrap()
+        .0
+}
+
+async fn setup(fit: bool) -> (App, Mounted, Id) {
+    let mut app = App::with_project(oa_core::language::parse(FIXTURE).unwrap());
+    let owner = id(&app, "incident_response");
+    let diagram = id(&app, "incident_readable");
+    let _ = app.update(Message::Select(owner));
+    let _ = app.update(Message::Diagram(crate::app::Choice {
+        id: diagram,
+        label: "A - Incident review readable".into(),
+    }));
+    app.window_size = Size::new(1440., 900.);
+    let mut mounted = Mounted::new(&mut app).await;
+    if !fit {
+        let context = app.scenario_context().unwrap();
+        let task = app.update(Message::ScenarioCanvas(CanvasEvent::Zoom(
+            context,
+            Some(0.5),
+        )));
+        mounted.perform(&mut app, task).await;
+        mounted.settle(&mut app).await;
+    }
+    assert_eq!(
+        app.scenario_context().unwrap().representation,
+        Representation::Saved { diagram }
+    );
+    assert!(!app.document.can_undo() && !app.document.can_redo());
+    (app, mounted, diagram)
+}
+
+fn resolved(app: &App) -> ResolvedScenarioPlan {
+    resolve(
+        app.project(),
+        app.scenario_context().unwrap().representation,
+        app.selected,
+    )
+    .unwrap()
+}
+
+fn stored_camera(app: &App) -> (Vector, Option<f32>, bool) {
+    let p = &app.behavior.scenario.presentation;
+    (p.pan, p.zoom, p.fit)
+}
+
+fn screen(mounted: &mut Mounted, app: &App, world: Point) -> Point {
+    let bounds = mounted.geometry(app).bounds("scenario-viewport");
+    let geometry = resolved(app);
+    let camera = app.behavior.scenario.presentation.camera(geometry.bounds);
+    let point = bounds.position() + camera.pan + Vector::new(world.x, world.y) * camera.scale;
+    assert!(
+        bounds.contains(point),
+        "actual visible world {world:?}: {point:?} in {bounds:?}"
+    );
+    point
+}
+
+fn mouse_event(event: mouse::Event) -> iced::Event {
+    iced::Event::Mouse(event)
+}
+
+async fn press(mounted: &mut Mounted, app: &mut App, point: Point) -> Vec<Message> {
+    mounted
+        .batch(
+            app,
+            &[
+                mouse_event(mouse::Event::CursorMoved { position: point }),
+                mouse_event(mouse::Event::ButtonPressed(mouse::Button::Left)),
+            ],
+            mouse::Cursor::Available(point),
+        )
+        .await
+}
+
+async fn move_to(mounted: &mut Mounted, app: &mut App, point: Point) -> Vec<Message> {
+    mounted
+        .batch(
+            app,
+            &[mouse_event(mouse::Event::CursorMoved { position: point })],
+            mouse::Cursor::Available(point),
+        )
+        .await
+}
+
+async fn release(mounted: &mut Mounted, app: &mut App, point: Point) -> Vec<Message> {
+    mounted
+        .batch(
+            app,
+            &[mouse_event(mouse::Event::ButtonReleased(
+                mouse::Button::Left,
+            ))],
+            mouse::Cursor::Available(point),
+        )
+        .await
+}
+
+fn set_expected_message(project: &mut oa_core::Project, diagram: Id, occurrence: Id, y: f32) {
+    let Some(oa_core::DiagramLayout::Scenario(layout)) =
+        &mut project.diagrams.get_mut(&diagram).unwrap().layout
+    else {
+        panic!()
+    };
+    layout
+        .messages
+        .iter_mut()
+        .find(|m| m.address.occurrence == occurrence)
+        .unwrap()
+        .send_y = y;
+}
+
+fn set_expected_lane(project: &mut oa_core::Project, diagram: Id, lifeline: Id, x: f32) {
+    let Some(oa_core::DiagramLayout::Scenario(layout)) =
+        &mut project.diagrams.get_mut(&diagram).unwrap().layout
+    else {
+        panic!()
+    };
+    layout
+        .lanes
+        .iter_mut()
+        .find(|lane| lane.lifeline == lifeline)
+        .unwrap()
+        .x = x;
+}
+
+fn assert_reopens_exactly(app: &App) {
+    let reopened = Document::from_bundle(
+        app.document.bundle().clone(),
+        oa_core::source_project::ProjectLimits::default(),
+    )
+    .unwrap();
+    assert_eq!(reopened.project(), app.project());
+    assert_eq!(reopened.bundle(), app.document.bundle());
+}
+
+#[tokio::test]
+async fn saved_message_same_batch_pointer_events_commit_once_and_one_undo_redo_restores_exact_source()
+ {
+    let (mut app, mut mounted, diagram) = setup(false).await;
+    let target = id(&app, "updated_report");
+    let before = app.document.snapshot();
+    let revision = app.document.revision();
+    let projected = screen(&mut mounted, &app, Point::new(400., 252.));
+    // This fixture asks for exactly +20 world units. A fractional start near a
+    // screen-coordinate exponent boundary need not retain an exact +10 delta.
+    let start = Point::new(projected.x.round(), projected.y.round());
+    let mut geometry = resolved(&app);
+    let camera = app.behavior.scenario.presentation.camera(geometry.bounds);
+    assert_eq!(camera.scale, 0.5);
+    let bounds = mounted.geometry(&app).bounds("scenario-viewport");
+    let world = Point::new(
+        (start.x - bounds.x - camera.pan.x) / camera.scale,
+        (start.y - bounds.y - camera.pan.y) / camera.scale,
+    );
+    geometry.scene.scale = camera.scale;
+    geometry.scene.camera_pan = camera.pan;
+    let hit = geometry.scene.hit_item(world).unwrap();
+    assert_eq!(hit.id, target);
+    assert_eq!(hit.role, crate::behavior::SceneHitRole::MessageBody);
+    let end = start + Vector::new(0., 10.); // .5 display scale: +20 authored y.
+    assert_eq!(end.y - start.y, 10.);
+    assert!(bounds.contains(start) && bounds.contains(end));
+    let messages = mounted
+        .batch(
+            &mut app,
+            &[
+                mouse_event(mouse::Event::CursorMoved { position: start }),
+                mouse_event(mouse::Event::ButtonPressed(mouse::Button::Left)),
+                mouse_event(mouse::Event::CursorMoved { position: end }),
+                mouse_event(mouse::Event::ButtonReleased(mouse::Button::Left)),
+            ],
+            mouse::Cursor::Available(end),
+        )
+        .await;
+    assert_eq!(
+        messages
+            .iter()
+            .filter(|m| matches!(
+                m,
+                Message::ScenarioCanvas(CanvasEvent::Spacing(spacing::Event::Begin { .. }))
+            ))
+            .count(),
+        1
+    );
+    assert_eq!(
+        messages
+            .iter()
+            .filter(|m| matches!(
+                m,
+                Message::ScenarioCanvas(CanvasEvent::Spacing(spacing::Event::Finish { .. }))
+            ))
+            .count(),
+        1
+    );
+    let mut expected = before.decoded.project.clone();
+    set_expected_message(&mut expected, diagram, target, 272.);
+    assert_eq!(
+        app.project(),
+        &expected,
+        "Only Saved A's addressed y changes; steps, other occurrences and B/C are exact"
+    );
+    assert_eq!(app.document.revision(), revision + 1);
+    assert_eq!(app.selected, target);
+    assert!(app.behavior.scenario.spacing_token().is_none());
+    assert_reopens_exactly(&app);
+    let after = app.document.snapshot();
+    let task = app.update(Message::Undo);
+    mounted.perform(&mut app, task).await;
+    assert_eq!(app.project(), &before.decoded.project);
+    assert_eq!(app.document.bundle(), &before.bundle);
+    assert!(!app.document.can_undo() && app.document.can_redo());
+    let task = app.update(Message::Redo);
+    mounted.perform(&mut app, task).await;
+    assert_eq!(app.project(), &after.decoded.project);
+    assert_eq!(app.document.bundle(), &after.bundle);
+}
+
+#[tokio::test]
+async fn saved_header_preview_survives_frames_and_freezes_fit_while_actual_bounds_expand() {
+    let (mut app, mut mounted, diagram) = setup(true).await;
+    let assessor = id(&app, "assessor");
+    let before = app.document.snapshot();
+    let original = resolved(&app);
+    let original_camera = app.behavior.scenario.presentation.camera(original.bounds);
+    let stored = stored_camera(&app);
+    assert!(stored.2, "test must exercise original Fit");
+    let start = screen(&mut mounted, &app, Point::new(640., 45.));
+    press(&mut mounted, &mut app, start).await;
+    let token = app
+        .behavior
+        .scenario
+        .spacing_token()
+        .expect("actual header press begins");
+    for x in [670., 700.] {
+        let end = start + Vector::new((x - 640.) * original_camera.scale, 0.);
+        move_to(&mut mounted, &mut app, end).await;
+        mounted.settle(&mut app).await; // Actual borrowed Scene/Stack tree is rebuilt.
+        assert_eq!(app.behavior.scenario.spacing_token(), Some(token));
+        assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+        assert_eq!(stored_camera(&app), stored);
+        let paint = app
+            .behavior
+            .scenario
+            .spacing_paint(app.scenario_context().unwrap(), app.camera_epoch)
+            .unwrap();
+        assert!(paint.refusal.is_none());
+        assert!((paint.scene.render_lanes[&assessor] - x).abs() < 0.001);
+        assert!(paint.bounds.width > original.bounds.width);
+        assert_eq!(paint.scene.scale, original_camera.scale);
+        assert_eq!(paint.scene.camera_pan, original_camera.pan);
+        let header = paint.scene.boxes.iter().find(|b| b.id == assessor).unwrap();
+        let displayed = Vector::new(header.rect.center().x, header.rect.center().y)
+            * paint.scene.scale
+            + paint.scene.camera_pan;
+        let baseline = Vector::new(640., 50.) * original_camera.scale + original_camera.pan;
+        assert!((displayed.x - baseline.x - (x - 640.) * original_camera.scale).abs() < 0.001);
+        assert_eq!(displayed.y, baseline.y);
+    }
+    let end = start + Vector::new(60. * original_camera.scale, 0.);
+    release(&mut mounted, &mut app, end).await;
+    let final_geometry = resolved(&app);
+    let actual_x = final_geometry.scene.render_lanes[&assessor];
+    assert!((actual_x - 700.).abs() < 0.001);
+    let mut expected = before.decoded.project.clone();
+    set_expected_lane(&mut expected, diagram, assessor, actual_x);
+    assert_eq!(app.project(), &expected);
+    let final_camera = app
+        .behavior
+        .scenario
+        .presentation
+        .camera(final_geometry.bounds);
+    assert_eq!(
+        final_camera, original_camera,
+        "commit must not refit underneath pointer"
+    );
+    assert!(!app.behavior.scenario.presentation.fit);
+    assert_eq!(app.selected, assessor);
+    assert_reopens_exactly(&app);
+}
+
+#[tokio::test]
+async fn saved_body_and_header_clicks_select_without_materializing_spacing() {
+    let (mut app, mut mounted, _) = setup(false).await;
+    let before = app.document.snapshot();
+    let original_camera = stored_camera(&app);
+    for (alias, world) in [
+        ("updated_report", Point::new(400., 252.)),
+        ("assessor", Point::new(640., 45.)),
+    ] {
+        let target = id(&app, alias);
+        let point = screen(&mut mounted, &app, world);
+        mounted.click(&mut app, point).await;
+        assert_eq!(app.selected, target);
+        assert!(app.behavior.scenario.spacing_token().is_none());
+        assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+        assert_eq!(stored_camera(&app), original_camera);
+    }
+    assert!(!app.document.can_undo() && !app.document.can_redo());
+}
+
+#[tokio::test]
+async fn saved_valid_preview_then_refused_self_call_never_commits_last_valid_candidate() {
+    let (mut app, mut mounted, _) = setup(false).await;
+    let target = id(&app, "assess_call");
+    let before = app.document.snapshot();
+    let camera = stored_camera(&app);
+    let start = screen(&mut mounted, &app, Point::new(680., 344.));
+    press(&mut mounted, &mut app, start).await;
+    let valid = start + Vector::new(0., -10.); // send324, receive348, reply436 unchanged.
+    move_to(&mut mounted, &mut app, valid).await;
+    mounted.settle(&mut app).await;
+    let paint = app
+        .behavior
+        .scenario
+        .spacing_paint(app.scenario_context().unwrap(), app.camera_epoch)
+        .unwrap();
+    assert!(paint.refusal.is_none());
+    let line = paint.scene.lines.iter().find(|l| l.id == target).unwrap();
+    assert_eq!(line.points[0].y, 324.);
+    assert_eq!(line.points.last().unwrap().y, 348.);
+    let refused = start + Vector::new(0., 53.); // send450, receive474 would follow reply436.
+    move_to(&mut mounted, &mut app, refused).await;
+    mounted.settle(&mut app).await;
+    let paint = app
+        .behavior
+        .scenario
+        .spacing_paint(app.scenario_context().unwrap(), app.camera_epoch)
+        .unwrap();
+    assert!(paint.refusal.is_some());
+    assert_eq!(
+        paint
+            .scene
+            .lines
+            .iter()
+            .find(|l| l.id == target)
+            .unwrap()
+            .points[0]
+            .y,
+        344.
+    );
+    assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+    release(&mut mounted, &mut app, refused).await;
+    assert!(app.behavior.scenario.spacing_token().is_none());
+    assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+    assert_eq!(stored_camera(&app), camera);
+    assert!(!app.document.can_undo() && !app.document.can_redo());
+}
+
+#[tokio::test]
+async fn saved_escape_and_outside_pointer_cancel_actual_held_preview() {
+    for escape in [true, false] {
+        let (mut app, mut mounted, _) = setup(false).await;
+        let before = app.document.snapshot();
+        let camera = stored_camera(&app);
+        let start = screen(&mut mounted, &app, Point::new(400., 252.));
+        let end = start + Vector::new(0., 10.);
+        press(&mut mounted, &mut app, start).await;
+        move_to(&mut mounted, &mut app, end).await;
+        mounted.settle(&mut app).await;
+        assert!(app.behavior.scenario.spacing_token().is_some());
+        let release_at = if escape {
+            mounted
+                .batch(
+                    &mut app,
+                    &[key(iced::keyboard::key::Named::Escape)],
+                    mouse::Cursor::Available(end),
+                )
+                .await;
+            end
+        } else {
+            let bounds = mounted.geometry(&app).bounds("scenario-viewport");
+            let outside = Point::new(bounds.x - 5., bounds.y + 100.);
+            move_to(&mut mounted, &mut app, outside).await;
+            outside
+        };
+        assert!(app.behavior.scenario.spacing_token().is_none());
+        release(&mut mounted, &mut app, release_at).await;
+        assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+        assert_eq!(stored_camera(&app), camera);
+        assert!(!app.document.can_undo() && !app.document.can_redo());
+    }
+}
+
+#[tokio::test]
+async fn saved_drag_return_to_origin_preserves_redo_selection_and_original_fit_camera() {
+    let (mut app, mut mounted, _) = setup(true).await;
+    let owner = id(&app, "incident_response");
+    app.document
+        .execute(oa_core::Command::Rename(
+            owner,
+            "Previously edited owner".into(),
+        ))
+        .unwrap();
+    let redo = app.document.snapshot();
+    let task = app.update(Message::Undo);
+    mounted.perform(&mut app, task).await;
+    mounted.settle(&mut app).await;
+    assert!(app.document.can_redo());
+    let before = app.document.snapshot();
+    let camera = stored_camera(&app);
+    let selected = app.selected;
+    let revision = app.document.revision();
+    let start = screen(&mut mounted, &app, Point::new(400., 252.));
+    press(&mut mounted, &mut app, start).await;
+    move_to(&mut mounted, &mut app, start + Vector::new(0., 12.)).await;
+    mounted.settle(&mut app).await;
+    assert!(app.behavior.scenario.spacing_token().is_some());
+    move_to(&mut mounted, &mut app, start).await;
+    mounted.settle(&mut app).await;
+    release(&mut mounted, &mut app, start).await;
+    assert!(app.behavior.scenario.spacing_token().is_none());
+    assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+    assert_eq!(app.document.bundle(), &before.bundle);
+    assert_eq!(app.document.revision(), revision);
+    assert_eq!(stored_camera(&app), camera);
+    assert_eq!(app.selected, selected);
+    assert!(app.document.can_redo());
+    let task = app.update(Message::Redo);
+    mounted.perform(&mut app, task).await;
+    assert_eq!(app.project(), &redo.decoded.project);
+    assert_eq!(app.document.bundle(), &redo.bundle);
+}

crates/oa-desktop/src/behavior/scenario/workspace/tests.rs

@@ -109,8 +109,28 @@ async fn production_scenario_canvas_keeps_bounds_draft_identity_and_camera_throu
             mounted.pan(&mut app, start, start + delta).await;
             let diff = app.behavior.scenario.presentation.pan - next_pan;
             assert!(diff.x.hypot(diff.y) < 0.01);
-            let tool = mounted.geometry(&app).bounds("behavior-tool:A").center();
-            mounted.click(&mut app, tool).await;
+            // Iced operations report palette children in content coordinates.
+            // The preceding Action focus may have scrolled this retained palette.
+            let geometry = mounted.geometry(&app);
+            let scope = canvas_workspace::Scope::current(&app).unwrap();
+            let (palette, offset) = geometry.scrolls[&scope.control_id("palette-scroll")];
+            let tool = geometry.bounds("behavior-tool:A").center() - offset;
+            assert!(
+                palette.contains(tool),
+                "visible Action at {tool:?}: {palette:?}"
+            );
+            let chosen = mounted.click(&mut app, tool).await;
+            assert!(
+                chosen.iter().any(|message| matches!(
+                    canvas_workspace::tests::intent_action(message),
+                    Message::ScenarioCanvas(CanvasEvent::Choose(_, CanvasTool::Add(Tool::Action)))
+                )),
+                "Action palette click at scale {scale}, offset {offset:?}: {chosen:?}"
+            );
+            assert_eq!(
+                app.behavior.scenario.canvas_tool(f.owner),
+                CanvasTool::Add(Tool::Action)
+            );
             let messages = mounted.click(&mut app, bounds.position() + desired).await;
             assert!(
                 messages.iter().any(
@@ -118,7 +138,7 @@ async fn production_scenario_canvas_keeps_bounds_draft_identity_and_camera_throu
                 tool: Tool::Action, slot, lifeline: Some(line), ..
             }) if *slot == expected && *line == f.sender)
                 ),
-                "scale {scale}: {messages:?}"
+                "scale {scale}, expected slot {expected:?}: {messages:?}"
             );
             let session = app.behavior.scenario.form_session().unwrap();
             let invocation = app.behavior.scenario.draft.as_ref().unwrap().invocation;
@@ -1400,7 +1420,18 @@ async fn production_scenario_camera_external_controls_bounds_and_retained_deltas
         let bounds = mounted.geometry(&app).bounds("scenario-viewport");
         let point = bounds.position() + iced::Vector::new(95., 90.);
         let lifetime = app.camera_epoch;
-        let pan = app.behavior.scenario.presentation.pan;
+        // Fit stores no pan offset. A real drag starts from the displayed fitted
+        // camera, then materializes it before applying its ordered screen deltas.
+        let shown = app
+            .behavior
+            .scenario
+            .display(app.project(), f.owner, app.selected)
+            .unwrap();
+        let before_camera = app
+            .behavior
+            .scenario
+            .presentation
+            .camera(shown.bounds().unwrap());
         let first = point + iced::Vector::new(13., 9.);
         let last = first + iced::Vector::new(17., -3.);
         let emitted = mounted
@@ -1415,7 +1446,21 @@ async fn production_scenario_camera_external_controls_bounds_and_retained_deltas
                 mouse::Cursor::Available(last),
             )
             .await;
-        assert_eq!(app.behavior.scenario.presentation.pan, pan + (last - point));
+        let expected_pan = before_camera.pan + (last - point);
+        let actual_pan = app.behavior.scenario.presentation.pan;
+        let difference = actual_pan - expected_pan;
+        assert!(
+            difference.x.hypot(difference.y) < 0.001,
+            "{boundary}: displayed pan {actual_pan:?} must follow {expected_pan:?}"
+        );
+        assert_eq!(
+            app.behavior.scenario.presentation.zoom,
+            Some(before_camera.scale)
+        );
+        assert!(
+            !app.behavior.scenario.presentation.fit,
+            "drag materializes the visible Fit camera"
+        );
         assert_eq!(
             app.camera_epoch, lifetime,
             "own ordered deltas retain their lifetime"
@@ -1820,14 +1865,19 @@ fn scenario_workspace_fit_uses_measured_inner_viewport_and_rejects_nonfinite_inp
     assert!(!presentation.viewport(Size::new(484., 204.)));
     let scale = presentation.scale(graph);
     assert!(graph.width * scale <= 468. && graph.height * scale <= 188.);
-    assert!(scale > MIN_SCALE);
+    assert!(scale > camera::MIN_SCALE);
     for bad in [f32::NAN, f32::INFINITY, 0., -1.] {
         assert!(!presentation.zoom(Some(bad)));
         assert!(!presentation.viewport(Size::new(bad, 100.)));
         assert!(!presentation.viewport(Size::new(100., bad)));
         assert_eq!(presentation.scale(graph), scale);
     }
-    assert_eq!(presentation.scale(Size::new(900., 10000.)), MIN_SCALE);
+    let tall = Rectangle::with_size(Size::new(900., 10000.));
+    let camera = presentation.camera(tall);
+    assert!(camera.scale < 0.05 && camera.scale > 0.);
+    assert!((camera.scale - 188. / 10000.).abs() < 1e-8);
+    assert!((tall.height * camera.scale + camera.pan.y - 196.).abs() < 1e-4);
+    assert!((camera.pan.y - 8.).abs() < 1e-4);
     assert!(presentation.zoom(Some(1.25)));
     presentation.viewport(Size::new(200., 100.));
     assert_eq!(

crates/oa-desktop/src/behavior/scenario_hit_tests.rs

@@ -0,0 +1,386 @@
+//! Actual Scene primitives, with independently chosen points and semantic IDs.
+//! These preserve the existing label hit band; they do not establish ink bounds
+//! or authoring eligibility, and do not dispatch a spacing gesture.
+use super::*;
+use crate::document::Document;
+
+struct Fixture {
+    project: Project,
+    owner: Id,
+    sender: Id,
+    receiver: Id,
+    call: Id,
+    reply: Id,
+    exchange: Id,
+}
+
+fn fixture() -> Fixture {
+    let project = language::parse(r#"arcadia 7;
+project hits "Hit roles" {
+ oa_activity source "Source" {}
+ oa_activity target "Target" {}
+ interaction exchange "Contract" { source @source; target @target; }
+ oa_scenario conversation "Conversation" { viewpoint OperationalActivity; steps [@call, @reply]; }
+ oa_lifeline left "Left" { parent @conversation; represented @source; }
+ oa_lifeline right "Right" { parent @conversation; represented @target; }
+ oa_occurrence call "Call" { parent @conversation; body { Exchange { exchange @exchange; sender @left; receiver @right; message_kind Call; }; }; }
+ oa_occurrence reply "Reply" { parent @conversation; body { Exchange { exchange @exchange; sender @right; receiver @left; message_kind Reply; reply_to @call; }; }; }
+}
+"#).unwrap();
+    let id = |alias: &str| {
+        project
+            .identities()
+            .into_iter()
+            .find(|(_, name)| *name == alias)
+            .unwrap()
+            .0
+    };
+    Fixture {
+        owner: id("conversation"),
+        sender: id("left"),
+        receiver: id("right"),
+        call: id("call"),
+        reply: id("reply"),
+        exchange: id("exchange"),
+        project,
+    }
+}
+
+fn scene(f: &Fixture) -> Scene {
+    let document =
+        Document::from_project(f.project.clone(), source_project::ProjectLimits::default())
+            .unwrap();
+    let before = document.snapshot();
+    let result = Scene::sequence_geometry(
+        document.project(),
+        f.owner,
+        f.call,
+        Some(&BTreeMap::from([(f.sender, 160.), (f.receiver, 400.)])),
+        None,
+    );
+    assert_eq!(document.project(), &before.decoded.project);
+    assert_eq!(document.bundle(), &before.bundle);
+    assert_eq!(document.revision(), 0);
+    assert!(!document.can_undo() && !document.can_redo() && !document.dirty());
+    result
+}
+
+fn hit(scene: &Scene, point: Point, id: Id, role: SceneHitRole) {
+    assert_eq!(scene.hit_item(point), Some(SceneHit { id, role }));
+    assert_eq!(scene.hit(point), Some(id));
+}
+
+fn occurrence(p: &mut Project, parent: Id, body: OccurrenceBody) -> Id {
+    let mut element = p
+        .make_element(Kind::Occurrence, Layer::Oa, "Hit target", Some(parent))
+        .unwrap();
+    let id = element.id;
+    *element.shared_mut().unwrap() = SharedBody::Occurrence {
+        body,
+        precondition: String::new(),
+        postcondition: String::new(),
+    };
+    p.elements.insert(id, element);
+    p.elements
+        .get_mut(&parent)
+        .unwrap()
+        .steps_mut()
+        .unwrap()
+        .push(id);
+    id
+}
+
+fn exchange_mut(p: &mut Project, id: Id) -> &mut OccurrenceBody {
+    let SharedBody::Occurrence { body, .. } =
+        p.elements.get_mut(&id).unwrap().shared_mut().unwrap()
+    else {
+        panic!("expected occurrence")
+    };
+    body
+}
+
+#[test]
+fn exact_headers_include_unassigned_lifelines_but_guides_are_not_headers() {
+    let mut f = fixture();
+    *f.project
+        .elements
+        .get_mut(&f.receiver)
+        .unwrap()
+        .shared_mut()
+        .unwrap() = SharedBody::Lifeline { represented: None };
+    let s = scene(&f);
+    assert!(!s.lanes.contains_key(&f.receiver));
+    assert_eq!(s.render_lanes[&f.receiver], 400.);
+    for (id, x) in [(f.sender, 160.), (f.receiver, 400.)] {
+        // The actual header is x-102..x+102, y15..85, including its padding.
+        for point in [Point::new(x - 101., 16.), Point::new(x + 101., 84.)] {
+            hit(&s, point, id, SceneHitRole::LifelineHeader);
+        }
+        hit(&s, Point::new(x, 95.), id, SceneHitRole::LifelineGuide);
+    }
+}
+
+#[test]
+fn repeated_exchange_occurrences_keep_distinct_message_body_and_label_hits() {
+    let f = fixture();
+    let s = scene(&f);
+    assert_eq!(s.rows[&f.call].1, 148.);
+    assert_eq!(s.rows[&f.reply].1, 240.);
+    for (id, y) in [(f.call, 148.), (f.reply, 240.)] {
+        hit(&s, Point::new(280., y), id, SceneHitRole::MessageBody);
+        hit(
+            &s,
+            Point::new(180., y - 16.),
+            id,
+            SceneHitRole::MessageLabel,
+        );
+        assert_ne!(id, f.exchange);
+    }
+}
+
+#[test]
+fn self_call_elbow_and_receive_endpoint_are_messages_not_execution_hits() {
+    let mut f = fixture();
+    for id in [f.call, f.reply] {
+        let OccurrenceBody::Exchange {
+            sender,
+            receiver,
+            exchange,
+            ..
+        } = exchange_mut(&mut f.project, id)
+        else {
+            unreachable!()
+        };
+        *sender = Some(f.sender);
+        *receiver = Some(f.sender);
+        *exchange = None;
+    }
+    let s = scene(&f);
+    let call = s.lines.iter().find(|l| l.id == f.call).unwrap();
+    assert_eq!(call.points.len(), 4);
+    assert_eq!(call.points[0].y, 148.);
+    assert_eq!(call.points[3].y, 172.);
+    hit(
+        &s,
+        Point::new(call.points[1].x, 160.),
+        f.call,
+        SceneHitRole::MessageBody,
+    );
+    hit(&s, call.points[3], f.call, SceneHitRole::MessageBody);
+    hit(
+        &s,
+        Point::new(180., 132.),
+        f.call,
+        SceneHitRole::MessageLabel,
+    );
+    let bar = s.activations.iter().find(|a| a.call == f.call).unwrap();
+    hit(
+        &s,
+        Point::new(bar.rect.x + 2., 190.),
+        f.call,
+        SceneHitRole::Activation,
+    );
+}
+
+#[test]
+fn activation_shoulder_beats_another_calls_label_and_broad_message_tolerance() {
+    let mut f = fixture();
+    let mut inner = f.project.elements[&f.call].clone();
+    inner.id = Id::new_v4();
+    inner.alias = "inner_call_hit".into();
+    inner.name = "Pressure verification with a descriptive operation label".into();
+    let inner_id = inner.id;
+    f.project.elements.insert(inner_id, inner);
+    let mut inner_reply = f.project.elements[&f.reply].clone();
+    inner_reply.id = Id::new_v4();
+    inner_reply.alias = "inner_reply_hit".into();
+    let reply_id = inner_reply.id;
+    f.project.elements.insert(reply_id, inner_reply);
+    let OccurrenceBody::Exchange { reply_to, .. } = exchange_mut(&mut f.project, reply_id) else {
+        unreachable!()
+    };
+    *reply_to = Some(inner_id);
+    *f.project
+        .elements
+        .get_mut(&f.owner)
+        .unwrap()
+        .steps_mut()
+        .unwrap() = vec![f.call, inner_id, reply_id, f.reply];
+    let mut s = scene(&f);
+    let inner = s.lines.iter().find(|l| l.id == inner_id).unwrap();
+    let outer = s.activations.iter().find(|a| a.call == f.call).unwrap();
+    let shoulder = Point::new(outer.rect.x + 1., 225.);
+    assert!(outer.rect.contains(shoulder));
+    assert!(inner.label_bounds().contains(shoulder));
+    let endpoint = *inner.points.last().unwrap();
+    for scale in [1., 0.05, 0.0003] {
+        s.scale = scale;
+        hit(&s, shoulder, f.call, SceneHitRole::Activation);
+        hit(&s, endpoint, inner_id, SceneHitRole::MessageBody);
+        hit(
+            &s,
+            Point::new(180., 225.),
+            inner_id,
+            SceneHitRole::MessageLabel,
+        );
+    }
+}
+
+#[test]
+fn create_delete_markers_are_distinct_from_their_own_message_body_and_label() {
+    let mut f = fixture();
+    for (id, kind) in [
+        (f.call, MessageKind::Create),
+        (f.reply, MessageKind::Delete),
+    ] {
+        let OccurrenceBody::Exchange {
+            sender,
+            receiver,
+            message_kind,
+            reply_to,
+            ..
+        } = exchange_mut(&mut f.project, id)
+        else {
+            unreachable!()
+        };
+        *sender = Some(f.sender);
+        *receiver = Some(f.receiver);
+        *message_kind = kind;
+        *reply_to = None;
+    }
+    let s = scene(&f);
+    for (id, y, label_y) in [(f.call, 148., 118.), (f.reply, 240., 224.)] {
+        hit(&s, Point::new(400., y), id, SceneHitRole::LifecycleMarker);
+        hit(&s, Point::new(280., y), id, SceneHitRole::MessageBody);
+        hit(
+            &s,
+            Point::new(180., label_y),
+            id,
+            SceneHitRole::MessageLabel,
+        );
+    }
+    // Capsule boundary owns its contact with the incoming Create arrow.
+    hit(
+        &s,
+        Point::new(330., 148.),
+        f.call,
+        SceneHitRole::LifecycleMarker,
+    );
+}
+
+#[test]
+fn tiny_scale_nearest_hit_retains_the_winning_marker_or_message_role() {
+    let mut f = fixture();
+    let OccurrenceBody::Exchange {
+        sender,
+        receiver,
+        message_kind,
+        reply_to,
+        ..
+    } = exchange_mut(&mut f.project, f.reply)
+    else {
+        unreachable!()
+    };
+    *sender = Some(f.sender);
+    *receiver = Some(f.receiver);
+    *message_kind = MessageKind::Delete;
+    *reply_to = None;
+    let mut s = scene(&f);
+    s.scale = 0.0003;
+    // Both are outside exact strokes/labels. Comparing all broad candidates
+    // chooses the actual nearer shape, even when their UUID is identical.
+    hit(
+        &s,
+        Point::new(280., 246.),
+        f.reply,
+        SceneHitRole::MessageBody,
+    );
+    hit(
+        &s,
+        Point::new(400., 265.),
+        f.reply,
+        SceneHitRole::LifecycleMarker,
+    );
+    hit(
+        &s,
+        Point::new(280., 154.),
+        f.call,
+        SceneHitRole::MessageBody,
+    );
+}
+
+#[test]
+fn action_frame_and_use_boxes_do_not_advertise_message_or_header_roles() {
+    for body in [
+        OccurrenceBody::Action {
+            action: None,
+            lifeline: None,
+        },
+        OccurrenceBody::Fragment {
+            operator: FragmentOperator::Alternative,
+            branches: vec![],
+        },
+        OccurrenceBody::ScenarioUse {
+            scenario: None,
+            bindings: vec![],
+        },
+        OccurrenceBody::Exchange {
+            exchange: None,
+            sender: None,
+            receiver: None,
+            message_kind: MessageKind::Asynchronous,
+            operation: None,
+            reply_to: None,
+            values: vec![],
+        },
+    ] {
+        let mut f = fixture();
+        let id = occurrence(&mut f.project, f.owner, body);
+        let s = scene(&f);
+        let item = s.boxes.iter().find(|b| b.id == id).unwrap();
+        hit(
+            &s,
+            item.rect.position() + iced::Vector::new(15., 15.),
+            id,
+            SceneHitRole::Box,
+        );
+    }
+}
+
+#[test]
+fn winning_primitive_role_does_not_come_from_its_shared_uuid() {
+    let f = fixture();
+    let mut s = scene(&f);
+    // A controlled overlapping primitive verifies reverse box order without
+    // inventing a core alias. Its ID intentionally equals a real header's ID.
+    s.boxes.push(BoxItem {
+        id: f.sender,
+        role: SceneHitRole::Box,
+        rect: Rectangle::new(Point::new(150., 20.), Size::new(20., 20.)),
+        title: "Overlay control".into(),
+        detail: String::new(),
+        marker: None,
+    });
+    hit(&s, Point::new(160., 30.), f.sender, SceneHitRole::Box);
+    hit(
+        &s,
+        Point::new(180., 30.),
+        f.sender,
+        SceneHitRole::LifelineHeader,
+    );
+}
+
+#[test]
+fn invalid_points_never_produce_a_semantic_or_spacing_hit() {
+    let f = fixture();
+    let s = scene(&f);
+    for point in [
+        Point::new(f32::NAN, 148.),
+        Point::new(280., f32::NAN),
+        Point::new(f32::INFINITY, 148.),
+        Point::new(280., f32::NEG_INFINITY),
+    ] {
+        assert_eq!(s.hit_item(point), None);
+        assert_eq!(s.hit(point), None);
+    }
+}