Preserve native line endings in archived final review

Prescribe inspected and pressed Card C after reverse membership selection. A singleton C drop is unchanged while the group changes order; preserve prior evaluator scope and test the unchanged negative outcome explicitly.

crates/oa-core/examples/allocation_multiselect_native.rs

@@ -0,0 +1,768 @@
+//! Deterministic native fixture and literal complete-Project Allocation oracle.
+//! No desktop planner, inferred output delta, or GUI input is used by this oracle.
+use oa_core::{source_project::*, *};
+use std::{collections::BTreeMap, fs, io::Write, path::Path};
+type Result<T> = std::result::Result<T, Box<dyn std::error::Error>>;
+const MODES: [&str; 6] = [
+    "unchanged",
+    "oa-assigned",
+    "sa-assigned",
+    "oa-arranged",
+    "sa-arranged",
+    "oa-performers",
+];
+
+fn id(alias: &str) -> Id {
+    if alias == "oa_assign" {
+        return Id::from_u128(0x292609230001);
+    }
+    Id::new_v5(
+        &Id::from_u128(0xc1192026_0923_5000_8000_000000002931),
+        alias.as_bytes(),
+    )
+}
+fn xy(x: f32, y: f32) -> Position {
+    Position { x, y }
+}
+fn named(scope: &str, suffix: &str) -> String {
+    format!("{scope}_{suffix}")
+}
+fn need(ok: bool, message: impl Into<String>) -> Result<()> {
+    if ok {
+        Ok(())
+    } else {
+        Err(message.into().into())
+    }
+}
+fn element(p: &mut Project, alias: &str, name: &str, kind: Kind, layer: Layer) {
+    p.elements.insert(
+        id(alias),
+        Element {
+            id: id(alias),
+            alias: alias.into(),
+            name: name.into(),
+            description: format!("Preserve engineering record {alias}."),
+            parent: None,
+            body: ElementBody::new(kind, layer).unwrap(),
+        },
+    );
+}
+fn diagram(p: &mut Project, alias: &str, name: &str, layer: Layer, projection: ProjectionKind) {
+    p.diagrams.insert(
+        id(alias),
+        Diagram {
+            id: id(alias),
+            alias: alias.into(),
+            name: name.into(),
+            description: "Native group fixture; preserve unrelated records exactly.".into(),
+            layer,
+            projection,
+            layout: None,
+            view_options: Default::default(),
+            nodes: Default::default(),
+            routes: vec![],
+        },
+    );
+}
+fn place(p: &mut Project, scope: &str, suffix: &str, position: Position) {
+    let alias = named(scope, &format!("node_{suffix}"));
+    p.diagrams.get_mut(&id(scope)).unwrap().nodes.insert(
+        id(&alias),
+        NodePlacement {
+            id: id(&alias),
+            alias,
+            element: id(&named(scope, suffix)),
+            position,
+            size: Size {
+                width: 224.,
+                height: 94.,
+            },
+            collapsed: false,
+            port_anchors: vec![],
+        },
+    );
+}
+fn relation(
+    p: &mut Project,
+    scope: &str,
+    suffix: &str,
+    kind: RelationKind,
+    from: &str,
+    to: &str,
+) -> Result<()> {
+    let alias = named(scope, suffix);
+    let old = p.relate(
+        kind,
+        &format!("{scope} {suffix}"),
+        id(&named(scope, from)),
+        id(&named(scope, to)),
+    );
+    reidentify(p, old, id(&alias))?;
+    let r = p.relations.get_mut(&id(&alias)).unwrap();
+    r.alias = alias.clone();
+    r.description = format!("Reviewed identity and provenance {alias} must survive.");
+    // The actual constructor creates proper SA function contracts. Normalize
+    // every generated identity/alias; no random UUID can leak into the fixture.
+    let ports = match r.body {
+        RelationBody::FunctionalExchange {
+            source_port,
+            target_port,
+            ..
+        } => Some([source_port, target_port]),
+        _ => None,
+    };
+    if let Some(ports) = ports {
+        for (old_port, suffix) in ports.into_iter().zip(["output", "input"]) {
+            let alias = format!("{alias}_{suffix}");
+            reidentify(p, old_port, id(&alias))?;
+            let port = p.elements.get_mut(&id(&alias)).unwrap();
+            port.alias = alias.clone();
+            port.name = format!("{scope} {suffix}");
+            port.description = format!("Preserved typed endpoint {alias}.");
+        }
+    }
+    Ok(())
+}
+fn route(scope: &str, pins: [Position; 2]) -> EdgeRoute {
+    EdgeRoute {
+        edge: id(&named(scope, "exchange")),
+        waypoints: pins.to_vec(),
+        source_attachment: None,
+        target_attachment: None,
+        label: Some(EdgeLabel {
+            fraction: 0.45,
+            offset: xy(7., -19.),
+        }),
+    }
+}
+fn fixture() -> Result<Project> {
+    let mut p = Project::empty();
+    p.id = id("project");
+    p.alias = "allocation_multiselect_native".into();
+    p.name = "Allocation group native".into();
+    p.description = "Four independent compact OA/SA assignment and Arrange trials; ordinary performers use fresh OA assign baseline.".into();
+    for (layer, prefix, work, performer) in [
+        (Layer::Oa, "oa", Kind::Activity, Kind::Entity),
+        (Layer::Sa, "sa", Kind::Function, Kind::SystemActor),
+    ] {
+        for arrange in [false, true] {
+            let scope = format!("{prefix}_{}", if arrange { "arrange" } else { "assign" });
+            let number = match (prefix, arrange) {
+                ("oa", false) => "01",
+                ("sa", false) => "02",
+                ("oa", true) => "03",
+                _ => "04",
+            };
+            diagram(
+                &mut p,
+                &scope,
+                &format!(
+                    "{number} {} {}",
+                    prefix.to_uppercase(),
+                    if arrange { "arrange" } else { "assign" }
+                ),
+                layer,
+                ProjectionKind::Allocation,
+            );
+            let records: Vec<_> = if arrange {
+                vec![
+                    ("p", "P - team", performer, xy(40., 40.)),
+                    ("u", "U - contained work", work, xy(80., 140.)),
+                    ("v", "V - independent work", work, xy(440., 140.)),
+                ]
+            } else {
+                vec![
+                    ("a", "A - origin team", performer, xy(43., 47.)),
+                    // Leave room for SA Y's automatic top port stub below
+                    // B's 64-unit header plus 12-unit routing clearance.
+                    ("b", "B - other team", performer, xy(43., 337.)),
+                    ("c", "C - destination", performer, xy(500., 40.)),
+                    ("x", "X - receive", work, xy(80., 140.)),
+                    ("y", "Y - assess", work, xy(80., 440.)),
+                ]
+            };
+            for (suffix, label, kind, pos) in records {
+                // SA admits one System for the entire project, not one per view.
+                let kind = if layer == Layer::Sa && !arrange && suffix == "a" {
+                    Kind::System
+                } else {
+                    kind
+                };
+                element(&mut p, &named(&scope, suffix), label, kind, layer);
+                place(&mut p, &scope, suffix, pos);
+            }
+            let (from, to, pins) = if arrange {
+                relation(&mut p, &scope, "pu", RelationKind::Allocation, "p", "u")?;
+                ("u", "v", [xy(360., 180.), xy(360., 230.)])
+            } else {
+                p.diagrams
+                    .get_mut(&id(&scope))
+                    .unwrap()
+                    .nodes
+                    .get_mut(&id(&named(&scope, "node_c")))
+                    .unwrap()
+                    .size = Size {
+                    width: 360.,
+                    height: 600.,
+                };
+                relation(&mut p, &scope, "ax", RelationKind::Allocation, "a", "x")?;
+                relation(&mut p, &scope, "by", RelationKind::Allocation, "b", "y")?;
+                ("x", "y", [xy(340., 260.), xy(340., 400.)])
+            };
+            relation(
+                &mut p,
+                &scope,
+                "exchange",
+                if layer == Layer::Oa {
+                    RelationKind::Interaction
+                } else {
+                    RelationKind::FunctionalExchange
+                },
+                from,
+                to,
+            )?;
+            p.diagrams
+                .get_mut(&id(&scope))
+                .unwrap()
+                .routes
+                .push(route(&scope, pins));
+        }
+    }
+    diagram(
+        &mut p,
+        "other_view",
+        "05 Other saved view - preserve",
+        Layer::Oa,
+        ProjectionKind::Overview,
+    );
+    for (suffix, pos) in [("x", xy(40., 60.)), ("y", xy(410., 180.))] {
+        let alias = named("other_view", suffix);
+        p.diagrams.get_mut(&id("other_view")).unwrap().nodes.insert(
+            id(&alias),
+            NodePlacement {
+                id: id(&alias),
+                alias,
+                element: id(&named("oa_assign", suffix)),
+                position: pos,
+                size: Size {
+                    width: 224.,
+                    height: 94.,
+                },
+                collapsed: false,
+                port_anchors: vec![],
+            },
+        );
+    }
+    validate_candidate(&p)?;
+    Ok(p)
+}
+fn node_mut<'a>(p: &'a mut Project, scope: &str, suffix: &str) -> &'a mut NodePlacement {
+    p.diagrams
+        .get_mut(&id(scope))
+        .unwrap()
+        .nodes
+        .get_mut(&id(&named(scope, &format!("node_{suffix}"))))
+        .unwrap()
+}
+fn expected(before: &Project, mode: &str) -> Result<Project> {
+    let mut p = before.clone();
+    match mode {
+        "unchanged" => {}
+        "oa-assigned" | "sa-assigned" => {
+            let scope = if mode == "oa-assigned" {
+                "oa_assign"
+            } else {
+                "sa_assign"
+            };
+            for (rel, work) in [("ax", "x"), ("by", "y")] {
+                p.relations.get_mut(&id(&named(scope, rel))).unwrap().body =
+                    RelationBody::Allocation {
+                        source: id(&named(scope, "c")),
+                        target: id(&named(scope, work)),
+                    };
+            }
+            node_mut(&mut p, scope, "x").position = xy(560., 140.);
+            node_mut(&mut p, scope, "y").position = xy(560., 440.);
+            p.diagrams.get_mut(&id(scope)).unwrap().routes[0].waypoints =
+                vec![xy(820., 260.), xy(820., 400.)];
+        }
+        "oa-arranged" | "sa-arranged" => {
+            let scope = if mode == "oa-arranged" {
+                "oa_arrange"
+            } else {
+                "sa_arrange"
+            };
+            for (suffix, pos) in [
+                ("p", xy(40., 280.)),
+                ("u", xy(80., 380.)),
+                ("v", xy(440., 380.)),
+            ] {
+                node_mut(&mut p, scope, suffix).position = pos;
+            }
+            p.diagrams.get_mut(&id(scope)).unwrap().routes[0].waypoints =
+                vec![xy(360., 420.), xy(360., 470.)];
+        }
+        "oa-performers" => {
+            for (suffix, pos) in [
+                ("a", xy(120., 90.)),
+                ("b", xy(120., 380.)),
+                ("x", xy(157., 183.)),
+                ("y", xy(157., 483.)),
+            ] {
+                node_mut(&mut p, "oa_assign", suffix).position = pos;
+            }
+            p.diagrams.get_mut(&id("oa_assign")).unwrap().routes[0].waypoints =
+                vec![xy(417., 303.), xy(417., 443.)];
+        }
+        _ => return Err(format!("Unknown mode {mode}; expected {MODES:?}").into()),
+    }
+    Ok(p)
+}
+fn ancestor(view: &projection::ProjectedView, parent: Id, child: Id) -> bool {
+    let mut next = view
+        .nodes
+        .iter()
+        .find(|n| n.id == child)
+        .and_then(|n| n.visual_parent);
+    for _ in 0..view.nodes.len() {
+        let Some(current) = next else {
+            return false;
+        };
+        if current == parent {
+            return true;
+        }
+        next = view
+            .nodes
+            .iter()
+            .find(|n| n.id == current)
+            .and_then(|n| n.visual_parent);
+    }
+    false
+}
+/// Fixture-usability preflight only: never calculates expected mutations.
+fn preflight(p: &Project) -> Result<serde_json::Value> {
+    validate_candidate(p)?;
+    let mut scenes = Vec::new();
+    for scope in ["oa_assign", "sa_assign", "oa_arrange", "sa_arrange"] {
+        let d = &p.diagrams[&id(scope)];
+        let view = projection::project_view(p, d.id);
+        need(
+            view.nodes.len() == d.nodes.len(),
+            format!("{scope}: hidden/missing fixture placement"),
+        )?;
+        for n in &view.nodes {
+            need(
+                n.position == d.nodes[&n.id].position,
+                format!("{scope}: unexpectedly shifted projected origin {}", n.id),
+            )?;
+            need(
+                n.position.x >= 0.
+                    && n.position.y >= 0.
+                    && n.position.x + n.size.width <= 900.
+                    && n.position.y + n.size.height <= 750.,
+                format!("{scope}: fixture exceeds declared compact world envelope: {n:?}"),
+            )?;
+            if p.elements[&n.element].kind().is_work() {
+                let height = if d.layer == Layer::Sa { 132. } else { 94. };
+                need(
+                    n.size
+                        == Size {
+                            width: 224.,
+                            height,
+                        },
+                    format!("{scope}: unexpected work/port extent {n:?}"),
+                )?;
+            }
+        }
+        for (i, a) in view.nodes.iter().enumerate() {
+            for b in &view.nodes[i + 1..] {
+                if ancestor(&view, a.id, b.id) || ancestor(&view, b.id, a.id) {
+                    continue;
+                }
+                let width = (a.position.x + a.size.width).min(b.position.x + b.size.width)
+                    - a.position.x.max(b.position.x);
+                let height = (a.position.y + a.size.height).min(b.position.y + b.size.height)
+                    - a.position.y.max(b.position.y);
+                need(
+                    width <= 0. || height <= 0.,
+                    format!("{scope}: unrelated projected overlap {} {}", a.id, b.id),
+                )?;
+            }
+        }
+        let routed = routing::route_diagram(p, d, &view);
+        let edge = id(&named(scope, "exchange"));
+        let r = routed
+            .edges
+            .get(&edge)
+            .ok_or("Authored exchange route is missing")?;
+        need(
+            !r.custom_suspended && r.pins == d.routes[0].waypoints,
+            format!("{scope}: authored pins are not active"),
+        )?;
+        need(
+            r.warnings.is_empty(),
+            format!(
+                "{scope}: route warnings require fixture review: {:?}; ports={:?}; points={:?}; nodes={:?}",
+                r.warnings, view.ports, r.points, view.nodes
+            ),
+        )?;
+        need(
+            view.ports.len() == if d.layer == Layer::Sa { 2 } else { 0 },
+            format!("{scope}: unexpected visible typed ports"),
+        )?;
+        scenes.push(serde_json::json!({"diagram":scope,"nodes":view.nodes,"ports":view.ports,"active_pins":r.pins,"route_warnings":r.warnings.iter().map(ToString::to_string).collect::<Vec<_>>()}));
+    }
+    Ok(serde_json::json!(scenes))
+}
+fn load(path: &Path) -> Result<Project> {
+    if path
+        .extension()
+        .is_some_and(|ext| ext.eq_ignore_ascii_case("arcadia"))
+    {
+        let disk = source_files::load_project(path, ProjectLimits::default())?;
+        need(
+            !disk
+                .diagnostics
+                .iter()
+                .any(|d| d.diagnostic.severity == validation::Severity::Error),
+            format!("Source discovery errors: {:?}", disk.diagnostics),
+        )?;
+        let compiled = compile_bundle(&disk.reachable_bundle(), ProjectLimits::default())
+            .map_err(|e| format!("Source compile: {e:?}"))?;
+        Ok(compiled.decoded.project)
+    } else {
+        Ok(persistence::load(path)?)
+    }
+}
+fn equal(expected: &Project, actual: &Project) -> Result<()> {
+    if expected == actual {
+        return Ok(());
+    }
+    let e = serde_json::to_value(expected)?;
+    let a = serde_json::to_value(actual)?;
+    let fields: Vec<_> = e
+        .as_object()
+        .unwrap()
+        .keys()
+        .filter(|key| e[*key] != a[*key])
+        .cloned()
+        .collect();
+    Err(format!("Whole Project mismatch in {fields:?}; no partial PASS").into())
+}
+fn roundtrip(p: &Project) -> Result<SourceBundle> {
+    validate_candidate(p)?;
+    equal(p, &persistence::decode(&serde_json::to_vec(p)?)?)?;
+    let mut bundle = format_bundle(p);
+    for (path, text) in &mut bundle.files {
+        *text = format!("// Native preservation sentinel: {path}\n{text}");
+    }
+    let parsed = compile_bundle(&bundle, ProjectLimits::default())
+        .map_err(|e| format!("Source roundtrip: {e:?}"))?;
+    equal(p, &parsed.decoded.project)?;
+    Ok(bundle)
+}
+fn write_new(path: &Path, bytes: &[u8]) -> Result<()> {
+    fs::create_dir_all(path.parent().ok_or("Missing parent directory")?)?;
+    fs::OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .open(path)?
+        .write_all(bytes)?;
+    Ok(())
+}
+fn generate(out: &Path) -> Result<()> {
+    need(!out.exists(), "Output exists; choose a fresh directory")?;
+    let p = fixture()?;
+    let bundle = roundtrip(&p)?;
+    let mut geometry = BTreeMap::new();
+    // All literal candidates must satisfy the same compact-fixture prerequisites
+    // before any bytes are published for a native run.
+    for mode in MODES {
+        let candidate = expected(&p, mode)?;
+        roundtrip(&candidate)?;
+        geometry.insert(mode, preflight(&candidate)?);
+    }
+    let mut ids = BTreeMap::from([(p.alias.clone(), p.id)]);
+    ids.extend(p.elements.values().map(|v| (v.alias.clone(), v.id)));
+    ids.extend(p.relations.values().map(|v| (v.alias.clone(), v.id)));
+    ids.extend(p.diagrams.values().map(|v| (v.alias.clone(), v.id)));
+    ids.extend(
+        p.diagrams
+            .values()
+            .flat_map(|d| d.nodes.values().map(|v| (v.alias.clone(), v.id))),
+    );
+    write_new(&out.join("baseline.json"), &serde_json::to_vec_pretty(&p)?)?;
+    for (path, text) in &bundle.files {
+        write_new(&out.join("source").join(path), text.as_bytes())?;
+    }
+    let paths: BTreeMap<_, _> = ids
+        .iter()
+        .map(|(alias, id)| {
+            let needle = id.to_string();
+            let files: Vec<_> = bundle
+                .files
+                .iter()
+                .filter(|(_, text)| text.contains(&needle))
+                .map(|(path, _)| path.clone())
+                .collect();
+            (alias.clone(), files)
+        })
+        .collect();
+    write_new(
+        &out.join("manifest.json"),
+        &serde_json::to_vec_pretty(&serde_json::json!({
+            "fixture":"allocation-multiselect-native-20260923","source_entry":bundle.entry,"ids":ids,
+            "source_files":bundle.files.keys().collect::<Vec<_>>(),"id_text_occurrence_files":paths,
+            "modes":MODES,"geometry_preflight":geometry,
+            "literal_deltas":{"oa-assigned":[480,0],"sa-assigned":[480,0],"oa-arranged":[0,240],"sa-arranged":[0,240],"oa-performers":[77,43]},
+            "selection":{"assigned":["X","Y"],"arranged":["P","V"],"ordinary_performers":["A","B"]},
+            "ordinary_anchor_target":[120,90],
+            "evaluation":"Literal complete Project oracle, never inferred from saved geometry; baseline pinned to deterministic original",
+            "limits":"Geometry preflight is not GUI/planner admission. Source comments/history bytes, focus, exact selection, pointer delivery and one Undo/Redo require separate observation/checks. Each mode is one operation from baseline."
+        }))?,
+    )?;
+    equal(&p, &load(&out.join("baseline.json"))?)?;
+    equal(&p, &load(&out.join("source").join(&bundle.entry))?)?;
+    println!("PASS generated and reloaded fixture: {}", out.display());
+    Ok(())
+}
+fn check(mode: &str, baseline: &Path, saved: &Path) -> Result<()> {
+    let before = load(baseline)?;
+    equal(&fixture()?, &before).map_err(|e| format!("Baseline is not immutable original: {e}"))?;
+    let actual = load(saved)?;
+    validate_candidate(&actual)?;
+    equal(&expected(&before, mode)?, &actual)?;
+    roundtrip(&actual)?;
+    println!(
+        "{}",
+        serde_json::to_string_pretty(&serde_json::json!({
+            "result":"PASS","mode":mode,"baseline":baseline,"saved":saved,
+            "comparison":"complete Project equality; literal fixed record edits",
+            "limits":"No pointer, selection, source-byte preservation, focus, Undo/Redo, or native acceptance claim"
+        }))?
+    );
+    Ok(())
+}
+fn main() -> Result<()> {
+    let args: Vec<_> = std::env::args().skip(1).collect();
+    match args.as_slice() {
+        [command,out] if command=="generate" => generate(Path::new(out)),
+        [command,mode,baseline,saved] if command=="check" => check(mode,Path::new(baseline),Path::new(saved)),
+        _=>Err(format!("Usage: allocation_multiselect_native generate DIRECTORY | check MODE BASELINE SAVED; modes={MODES:?}").into()),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    fn through_json(mode: &str, before: &Project, actual: &Project) -> Result<()> {
+        validate_candidate(before).expect("baseline valid");
+        validate_candidate(actual).expect("falsifier must remain core-valid");
+        let dir = tempfile::tempdir()?;
+        let baseline = dir.path().join("baseline.json");
+        let saved = dir.path().join("saved.json");
+        persistence::save(&baseline, before)?;
+        persistence::save(&saved, actual)?;
+        check(mode, &baseline, &saved)
+    }
+    fn mismatch(mode: &str, before: &Project, actual: &Project) {
+        let error = through_json(mode, before, actual).unwrap_err().to_string();
+        assert!(
+            error.contains("Whole Project mismatch"),
+            "wrong failure cause: {error}"
+        );
+    }
+    #[test]
+    fn deterministic_create_only_generation_and_all_literal_modes() {
+        let p = fixture().unwrap();
+        assert_eq!(p, fixture().unwrap());
+        let dir = tempfile::tempdir().unwrap();
+        let out = dir.path().join("fixture");
+        generate(&out).unwrap();
+        let before = fs::read(out.join("baseline.json")).unwrap();
+        assert!(generate(&out).is_err());
+        assert_eq!(before, fs::read(out.join("baseline.json")).unwrap());
+        for mode in MODES {
+            let candidate = expected(&p, mode).unwrap();
+            preflight(&candidate).unwrap();
+            through_json(mode, &p, &candidate).unwrap();
+            if mode != "unchanged" {
+                mismatch(mode, &p, &p);
+            }
+        }
+        assert!(expected(&p, "invented").is_err());
+        let changed = expected(&p, "oa-assigned").unwrap();
+        assert!(
+            through_json("unchanged", &changed, &changed)
+                .unwrap_err()
+                .to_string()
+                .contains("immutable original")
+        );
+    }
+    #[test]
+    fn actual_core_assignment_batch_matches_literal_oracle_and_one_step_history() {
+        let before = fixture().unwrap();
+        for (mode, scope) in [("oa-assigned", "oa_assign"), ("sa-assigned", "sa_assign")] {
+            let mut commands = Vec::new();
+            for (alias, work) in [("ax", "x"), ("by", "y")] {
+                let relation = id(&named(scope, alias));
+                let mut value = before.relations[&relation].clone();
+                value.body = RelationBody::Allocation {
+                    source: id(&named(scope, "c")),
+                    target: id(&named(scope, work)),
+                };
+                commands.push(Command::EditRelation(relation, value));
+            }
+            for (suffix, position) in [("x", xy(560., 140.)), ("y", xy(560., 440.))] {
+                let original = id(&named(scope, &format!("node_{suffix}")));
+                let mut node = before.diagrams[&id(scope)].nodes[&original].clone();
+                node.position = position;
+                commands.push(Command::EditNode {
+                    diagram: id(scope),
+                    original,
+                    node,
+                });
+            }
+            let mut route = before.diagrams[&id(scope)].routes[0].clone();
+            route.waypoints = vec![xy(820., 260.), xy(820., 400.)];
+            commands.push(Command::SetEdgeRoute {
+                diagram: id(scope),
+                route,
+            });
+            let mut session = Session::new(before.clone());
+            session.execute(Command::Batch(commands)).unwrap();
+            through_json(mode, &before, session.project()).unwrap();
+            let after = session.project().clone();
+            session.undo();
+            assert_eq!(session.project(), &before);
+            assert!(!session.can_undo());
+            session.redo();
+            assert_eq!(session.project(), &after);
+            assert!(!session.can_redo());
+        }
+    }
+    #[test]
+    fn assignment_rejects_singleton_semantic_identity_and_route_drift() {
+        let before = fixture().unwrap();
+        for mode in ["oa-assigned", "sa-assigned"] {
+            let scope = if mode == "oa-assigned" {
+                "oa_assign"
+            } else {
+                "sa_assign"
+            };
+            let good = expected(&before, mode).unwrap();
+            let mut bad = good.clone();
+            node_mut(&mut bad, scope, "y").position = xy(80., 440.);
+            mismatch(mode, &before, &bad);
+            let mut bad = good.clone();
+            bad.relations.insert(
+                id(&named(scope, "by")),
+                before.relations[&id(&named(scope, "by"))].clone(),
+            );
+            mismatch(mode, &before, &bad);
+            let mut bad = good.clone();
+            reidentify(
+                &mut bad,
+                id(&named(scope, "ax")),
+                id("replacement_allocation"),
+            )
+            .unwrap();
+            mismatch(mode, &before, &bad);
+            let mut bad = good.clone();
+            bad.relations
+                .get_mut(&id(&named(scope, "ax")))
+                .unwrap()
+                .description
+                .push_str(" drift");
+            mismatch(mode, &before, &bad);
+            for pins in [
+                vec![xy(340., 260.), xy(340., 400.)],
+                vec![xy(1300., 260.), xy(1300., 400.)],
+            ] {
+                let mut bad = good.clone();
+                bad.diagrams.get_mut(&id(scope)).unwrap().routes[0].waypoints = pins;
+                mismatch(mode, &before, &bad);
+            }
+        }
+    }
+    #[test]
+    fn arrange_and_ordinary_closure_falsifiers_remain_core_valid() {
+        let before = fixture().unwrap();
+        for mode in ["oa-arranged", "sa-arranged"] {
+            let scope = if mode == "oa-arranged" {
+                "oa_arrange"
+            } else {
+                "sa_arrange"
+            };
+            let good = expected(&before, mode).unwrap();
+            for (suffix, pos) in [("u", xy(80., 140.)), ("v", xy(440., 140.))] {
+                let mut bad = good.clone();
+                node_mut(&mut bad, scope, suffix).position = pos;
+                mismatch(mode, &before, &bad);
+            }
+            let mut bad = good.clone();
+            bad.relations.remove(&id(&named(scope, "pu")));
+            mismatch(mode, &before, &bad);
+        }
+        let good = expected(&before, "oa-performers").unwrap();
+        let mut bad = good.clone();
+        node_mut(&mut bad, "oa_assign", "x").position = xy(80., 140.);
+        mismatch("oa-performers", &before, &bad);
+        let mut bad = good;
+        bad.relations.get_mut(&id("oa_assign_ax")).unwrap().body = RelationBody::Allocation {
+            source: id("oa_assign_c"),
+            target: id("oa_assign_x"),
+        };
+        mismatch("oa-performers", &before, &bad);
+    }
+    #[test]
+    fn whole_project_sentinels_and_real_saved_source_are_checked() {
+        let before = fixture().unwrap();
+        let dir = tempfile::tempdir().unwrap();
+        let baseline = dir.path().join("baseline.json");
+        persistence::save(&baseline, &before).unwrap();
+        for mode in MODES {
+            let good = expected(&before, mode).unwrap();
+            for corrupt in [false, true] {
+                let mut actual = good.clone();
+                if corrupt {
+                    actual
+                        .elements
+                        .get_mut(&id("sa_arrange_v"))
+                        .unwrap()
+                        .description
+                        .push_str(" drift");
+                }
+                let bundle = roundtrip(&actual).unwrap();
+                let folder = dir.path().join(format!("{mode}-{corrupt}"));
+                for (path, text) in &bundle.files {
+                    write_new(&folder.join(path), text.as_bytes()).unwrap();
+                }
+                let result = check(mode, &baseline, &folder.join(&bundle.entry));
+                if corrupt {
+                    assert!(
+                        result
+                            .unwrap_err()
+                            .to_string()
+                            .contains("Whole Project mismatch")
+                    );
+                } else {
+                    result.unwrap();
+                }
+            }
+            let mut bad = good;
+            bad.diagrams
+                .get_mut(&id("other_view"))
+                .unwrap()
+                .nodes
+                .get_mut(&id("other_view_x"))
+                .unwrap()
+                .position
+                .x += 10.;
+            mismatch(mode, &before, &bad);
+        }
+        let invalid = dir.path().join("invalid.arcadia");
+        write_new(&invalid, b"project {").unwrap();
+        assert!(load(&invalid).is_err());
+    }
+}

crates/oa-core/examples/process_multiselect_native.rs

@@ -0,0 +1,548 @@
+//! Deterministic Process native fixture and independent complete-Project oracle.
+//! Expected order is literal; no desktop reorder/layout planner is used here.
+use oa_core::{source_project::*, *};
+use std::{fs, io::Write, path::Path};
+type Result<T> = std::result::Result<T, Box<dyn std::error::Error>>;
+
+fn id(alias: &str) -> Id {
+    Id::new_v5(
+        &Id::from_u128(0xc1192026_0923_5000_8000_000000002930),
+        alias.as_bytes(),
+    )
+}
+fn element(p: &mut Project, alias: &str, name: &str, kind: Kind, layer: Layer, parent: Option<Id>) {
+    p.elements.insert(
+        id(alias),
+        Element {
+            id: id(alias),
+            alias: alias.into(),
+            name: name.into(),
+            description: format!("Preserve engineering record {alias}."),
+            parent,
+            body: ElementBody::new(kind, layer).unwrap(),
+        },
+    );
+}
+fn occurrence(
+    p: &mut Project,
+    alias: &str,
+    name: &str,
+    layer: Layer,
+    owner: &str,
+    value: OccurrenceBody,
+) {
+    element(p, alias, name, Kind::Occurrence, layer, Some(id(owner)));
+    let Some(SharedBody::Occurrence { body, .. }) =
+        p.elements.get_mut(&id(alias)).unwrap().shared_mut()
+    else {
+        panic!("Occurrence body");
+    };
+    *body = value;
+}
+fn set_steps(p: &mut Project, owner: &str, aliases: &[&str]) {
+    *p.elements.get_mut(&id(owner)).unwrap().steps_mut().unwrap() =
+        aliases.iter().map(|alias| id(alias)).collect();
+}
+fn sequence_link(
+    p: &mut Project,
+    alias: &str,
+    name: &str,
+    source: &str,
+    target: &str,
+) -> Result<()> {
+    let old = p.relate(RelationKind::SequenceLink, name, id(source), id(target));
+    reidentify(p, old, id(alias))?;
+    let relation = p.relations.get_mut(&id(alias)).unwrap();
+    relation.alias = alias.into();
+    relation.description = format!("Preserve link {alias} exactly.");
+    if let RelationBody::SequenceLink { guard, .. } = &mut relation.body {
+        *guard = "ready".into();
+    }
+    Ok(())
+}
+fn fixture() -> Result<Project> {
+    let mut p = Project::empty();
+    p.id = id("project");
+    p.alias = "process_multiselect_native".into();
+    p.name = "Process group native".into();
+    p.description = "Select Card C then Shift-select Card A; drop after Card B. Other columns and reusable engineering records remain exact.".into();
+    for (layer, prefix, owner, name, owner_kind, work_kind) in [
+        (
+            Layer::Oa,
+            "oa",
+            "oa_process",
+            "01 OA group order",
+            Kind::Process,
+            Kind::Activity,
+        ),
+        (
+            Layer::Sa,
+            "sa",
+            "sa_chain",
+            "SA chain - preserve",
+            Kind::FunctionalChain,
+            Kind::Function,
+        ),
+    ] {
+        element(&mut p, owner, name, owner_kind, layer, None);
+        let shared = format!("{prefix}_shared_work");
+        let downstream = format!("{prefix}_downstream_work");
+        element(
+            &mut p,
+            &shared,
+            "Shared request work",
+            work_kind,
+            layer,
+            None,
+        );
+        element(
+            &mut p,
+            &downstream,
+            "Downstream verification",
+            work_kind,
+            layer,
+            None,
+        );
+        for (suffix, label) in [
+            ("a", "Card A"),
+            ("u", "Downstream U"),
+            ("b", "Card B"),
+            ("v", "Downstream V"),
+            ("c", "Card C"),
+        ] {
+            let body = if suffix == "b" {
+                OccurrenceBody::Control {
+                    kind: ControlKind::Choice,
+                }
+            } else {
+                OccurrenceBody::Action {
+                    action: Some(id(if suffix == "a" || suffix == "c" {
+                        &shared
+                    } else {
+                        &downstream
+                    })),
+                    lifeline: None,
+                }
+            };
+            occurrence(
+                &mut p,
+                &format!("{prefix}_{suffix}"),
+                label,
+                layer,
+                owner,
+                body,
+            );
+        }
+        let order: Vec<_> = ["a", "u", "b", "v", "c"]
+            .map(|suffix| format!("{prefix}_{suffix}"))
+            .into_iter()
+            .collect();
+        set_steps(
+            &mut p,
+            owner,
+            &order.iter().map(String::as_str).collect::<Vec<_>>(),
+        );
+        sequence_link(
+            &mut p,
+            &format!("{prefix}_a_u"),
+            "A to U",
+            &format!("{prefix}_a"),
+            &format!("{prefix}_u"),
+        )?;
+        sequence_link(
+            &mut p,
+            &format!("{prefix}_b_v"),
+            "B to V",
+            &format!("{prefix}_b"),
+            &format!("{prefix}_v"),
+        )?;
+    }
+    element(
+        &mut p,
+        "reusable",
+        "Reusable request detail",
+        Kind::Process,
+        Layer::Oa,
+        None,
+    );
+    occurrence(
+        &mut p,
+        "reused_leaf",
+        "Shared detail",
+        Layer::Oa,
+        "reusable",
+        OccurrenceBody::Action {
+            action: Some(id("oa_shared_work")),
+            lifeline: None,
+        },
+    );
+    set_steps(&mut p, "reusable", &["reused_leaf"]);
+    element(
+        &mut p,
+        "reuse_trial",
+        "02 Read-only preview trial",
+        Kind::Process,
+        Layer::Oa,
+        None,
+    );
+    for (alias, name) in [
+        ("reference_one", "First use"),
+        ("reference_two", "Second use"),
+    ] {
+        occurrence(
+            &mut p,
+            alias,
+            name,
+            Layer::Oa,
+            "reuse_trial",
+            OccurrenceBody::SequenceReference {
+                sequence: Some(id("reusable")),
+            },
+        );
+    }
+    set_steps(&mut p, "reuse_trial", &["reference_one", "reference_two"]);
+    p.traces.insert(
+        id("trace"),
+        Trace {
+            id: id("trace"),
+            alias: "preserved_work_refinement".into(),
+            name: "Shared request refinement".into(),
+            description: "Process arrangement must preserve cross-layer correspondence.".into(),
+            oa: id("oa_shared_work"),
+            sa: id("sa_shared_work"),
+            kind: TraceKind::Refinement,
+            baseline: Some(TraceBaseline {
+                oa: p.properties(id("oa_shared_work")).unwrap(),
+                sa: p.properties(id("sa_shared_work")).unwrap(),
+                semantic: None,
+            }),
+        },
+    );
+    validate_candidate(&p)?;
+    Ok(p)
+}
+fn load(path: &Path) -> Result<Project> {
+    if path
+        .extension()
+        .is_some_and(|ext| ext.eq_ignore_ascii_case("arcadia"))
+    {
+        let disk = source_files::load_project(path, ProjectLimits::default())?;
+        if disk
+            .diagnostics
+            .iter()
+            .any(|d| d.diagnostic.severity == validation::Severity::Error)
+        {
+            return Err(format!("Source discovery diagnostics: {:?}", disk.diagnostics).into());
+        }
+        let compiled = compile_bundle(&disk.reachable_bundle(), ProjectLimits::default())
+            .map_err(|e| format!("Source compile diagnostics: {e:?}"))?;
+        Ok(compiled.decoded.project)
+    } else {
+        Ok(persistence::load(path)?)
+    }
+}
+fn equal(expected: &Project, actual: &Project) -> Result<()> {
+    if expected == actual {
+        return Ok(());
+    }
+    let expected = serde_json::to_value(expected)?;
+    let actual = serde_json::to_value(actual)?;
+    let fields: Vec<_> = expected
+        .as_object()
+        .unwrap()
+        .keys()
+        .filter(|key| expected[*key] != actual[*key])
+        .cloned()
+        .collect();
+    Err(format!("Whole Project mismatch in {fields:?}; no partial PASS").into())
+}
+fn roundtrip(p: &Project) -> Result<SourceBundle> {
+    validate_candidate(p)?;
+    equal(p, &persistence::decode(&serde_json::to_vec(p)?)?)?;
+    let bundle = format_bundle(p);
+    let compiled = compile_bundle(&bundle, ProjectLimits::default())
+        .map_err(|e| format!("Roundtrip: {e:?}"))?;
+    equal(p, &compiled.decoded.project)?;
+    Ok(bundle)
+}
+fn write_new(path: &Path, bytes: &[u8]) -> Result<()> {
+    fs::create_dir_all(path.parent().ok_or("Missing parent directory")?)?;
+    fs::OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .open(path)?
+        .write_all(bytes)?;
+    Ok(())
+}
+fn generate(out: &Path) -> Result<()> {
+    if out.exists() {
+        return Err("Output directory already exists; choose a fresh path".into());
+    }
+    let p = fixture()?;
+    let bundle = roundtrip(&p)?;
+    write_new(&out.join("baseline.json"), &serde_json::to_vec_pretty(&p)?)?;
+    for (path, source) in &bundle.files {
+        write_new(&out.join("source").join(path), source.as_bytes())?;
+    }
+    let ids: std::collections::BTreeMap<_, _> = [
+        "project",
+        "oa_process",
+        "oa_a",
+        "oa_u",
+        "oa_b",
+        "oa_v",
+        "oa_c",
+        "oa_a_u",
+        "oa_b_v",
+        "oa_shared_work",
+        "oa_downstream_work",
+        "sa_chain",
+        "sa_shared_work",
+        "sa_downstream_work",
+        "sa_a",
+        "sa_u",
+        "sa_b",
+        "sa_v",
+        "sa_c",
+        "sa_a_u",
+        "sa_b_v",
+        "trace",
+        "reusable",
+        "reused_leaf",
+        "reuse_trial",
+        "reference_one",
+        "reference_two",
+    ]
+    .into_iter()
+    .map(|name| (name, id(name)))
+    .collect();
+    write_new(
+        &out.join("manifest.json"),
+        &serde_json::to_vec_pretty(&serde_json::json!({
+            "fixture": "process-multiselect-native-20260923", "ids": ids, "source_entry": bundle.entry,
+            "original_oa_steps": ["oa_a", "oa_u", "oa_b", "oa_v", "oa_c"],
+            "reordered_oa_steps": ["oa_b", "oa_u", "oa_a", "oa_v", "oa_c"],
+            "gesture": "Select Card C then add Card A; Inspect Card C without changing membership, then drag Card C to After Card B",
+            "fixed_slots": {"1": "oa_u", "3": "oa_v"},
+            "read_only_trial": "02 Read-only preview trial has two qualified tiles of reused_leaf through distinct references",
+            "receipt": "Pin baseline.json, manifest.json and generation command externally before interaction. Never replace baseline with a later saved snapshot.",
+            "evaluation": "Literal expected OA steps and complete Project equality; all SA/reuse/trace records exact",
+            "limits": "No pointer, focus, selection-paint, history or source-byte acceptance claim",
+        }))?,
+    )?;
+    equal(&p, &load(&out.join("baseline.json"))?)?;
+    equal(&p, &load(&out.join("source").join(&bundle.entry))?)?;
+    println!("PASS generated JSON and source bundle: {}", out.display());
+    Ok(())
+}
+fn check(mode: &str, baseline: &Path, saved: &Path) -> Result<()> {
+    let before = load(baseline)?;
+    let actual = load(saved)?;
+    validate_candidate(&before)?;
+    validate_candidate(&actual)?;
+    // Pin the exact deterministic original, not merely a reusable project UUID.
+    equal(&fixture()?, &before)
+        .map_err(|e| format!("Baseline is not the immutable original: {e}"))?;
+    let mut expected = before;
+    match mode {
+        "unchanged" => {}
+        "reordered" => set_steps(
+            &mut expected,
+            "oa_process",
+            &["oa_b", "oa_u", "oa_a", "oa_v", "oa_c"],
+        ),
+        _ => return Err("Mode must be reordered or unchanged".into()),
+    }
+    equal(&expected, &actual)?;
+    roundtrip(&actual)?;
+    println!(
+        "{}",
+        serde_json::to_string_pretty(&serde_json::json!({
+            "result": "PASS", "mode": mode, "baseline": baseline, "saved": saved,
+            "comparison": "complete Project equality; literal expected order",
+            "limits": "No pointer/action/focus/Undo/source-byte acceptance claim",
+        }))?
+    );
+    Ok(())
+}
+fn main() -> Result<()> {
+    let args: Vec<_> = std::env::args().skip(1).collect();
+    match args.as_slice() {
+        [command, out] if command == "generate" => generate(Path::new(out)),
+        [command, mode, baseline, saved] if command == "check" => check(mode, Path::new(baseline), Path::new(saved)),
+        _ => Err("Usage: process_multiselect_native generate DIRECTORY | check reordered|unchanged BASELINE SAVED".into()),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    fn reordered(before: &Project) -> Project {
+        let mut session = Session::new(before.clone());
+        session
+            .execute(Command::SetSteps(
+                id("oa_process"),
+                ["oa_b", "oa_u", "oa_a", "oa_v", "oa_c"].map(id).to_vec(),
+            ))
+            .unwrap();
+        session.project().clone()
+    }
+    fn through_json(mode: &str, baseline: &Project, actual: &Project) -> Result<()> {
+        validate_candidate(baseline).expect("Baseline must be valid");
+        validate_candidate(actual).expect("Corruption must remain semantically valid");
+        let dir = tempfile::tempdir()?;
+        let before = dir.path().join("before.json");
+        let saved = dir.path().join("saved.json");
+        persistence::save(&before, baseline)?;
+        persistence::save(&saved, actual)?;
+        check(mode, &before, &saved)
+    }
+    fn mismatch(before: &Project, actual: &Project) {
+        let error = through_json("reordered", before, actual)
+            .unwrap_err()
+            .to_string();
+        assert!(
+            error.contains("Whole Project mismatch"),
+            "Unexpected rejection: {error}"
+        );
+    }
+    #[test]
+    fn generate_is_deterministic_create_only_and_checks_real_source() {
+        equal(&fixture().unwrap(), &fixture().unwrap()).unwrap();
+        let dir = tempfile::tempdir().unwrap();
+        let out = dir.path().join("fixture");
+        generate(&out).unwrap();
+        let baseline = out.join("baseline.json");
+        let bytes = fs::read(&baseline).unwrap();
+        check("unchanged", &baseline, &out.join("source/project.arcadia")).unwrap();
+        assert!(generate(&out).is_err());
+        assert_eq!(fs::read(&baseline).unwrap(), bytes);
+        let invalid = dir.path().join("invalid.arcadia");
+        fs::write(&invalid, "project {").unwrap();
+        assert!(load(&invalid).is_err());
+    }
+    #[test]
+    fn real_set_steps_passes_but_unchanged_and_mutated_baseline_do_not() {
+        let before = fixture().unwrap();
+        let actual = reordered(&before);
+        through_json("reordered", &before, &actual).unwrap();
+        through_json("unchanged", &before, &before).unwrap();
+        mismatch(&before, &before);
+        assert!(through_json("unchanged", &before, &actual).is_err());
+        let error = through_json("unchanged", &actual, &actual)
+            .unwrap_err()
+            .to_string();
+        assert!(error.contains("immutable original"), "{error}");
+    }
+    #[test]
+    fn global_splice_reversed_block_and_singleton_c_results_are_rejected() {
+        let before = fixture().unwrap();
+        // Native primary/pressed C is already after B, so a singleton C move
+        // is unchanged. Group {C,A} instead puts B before both selected cards.
+        // If A were primary, its singleton result could equal the group result.
+        mismatch(&before, &before);
+        for order in [
+            ["oa_u", "oa_b", "oa_a", "oa_c", "oa_v"],
+            ["oa_b", "oa_u", "oa_c", "oa_v", "oa_a"],
+            ["oa_a", "oa_u", "oa_b", "oa_c", "oa_v"],
+        ] {
+            let mut actual = before.clone();
+            set_steps(&mut actual, "oa_process", &order);
+            mismatch(&before, &actual);
+        }
+    }
+    #[test]
+    fn semantic_link_work_sa_reuse_and_trace_changes_are_rejected() {
+        let before = fixture().unwrap();
+        let correct = reordered(&before);
+        let mutations: [fn(&mut Project); 7] = [
+            |p| {
+                if let RelationBody::SequenceLink { guard, .. } =
+                    &mut p.relations.get_mut(&id("oa_a_u")).unwrap().body
+                {
+                    *guard = "changed".into();
+                }
+            },
+            |p| {
+                if let RelationBody::SequenceLink { target, .. } =
+                    &mut p.relations.get_mut(&id("oa_a_u")).unwrap().body
+                {
+                    *target = id("oa_v");
+                }
+            },
+            |p| {
+                p.elements
+                    .get_mut(&id("oa_shared_work"))
+                    .unwrap()
+                    .name
+                    .push_str(" drift");
+            },
+            |p| {
+                p.elements
+                    .get_mut(&id("sa_shared_work"))
+                    .unwrap()
+                    .description
+                    .push_str(" drift");
+            },
+            |p| {
+                set_steps(p, "sa_chain", &["sa_b", "sa_u", "sa_a", "sa_v", "sa_c"]);
+            },
+            |p| {
+                p.elements
+                    .get_mut(&id("reused_leaf"))
+                    .unwrap()
+                    .description
+                    .push_str(" drift");
+            },
+            |p| {
+                p.traces.get_mut(&id("trace")).unwrap().baseline = None;
+            },
+        ];
+        for mutate in mutations {
+            let mut bad = correct.clone();
+            mutate(&mut bad);
+            mismatch(&before, &bad);
+        }
+    }
+    #[test]
+    fn changed_source_roundtrip_preserves_both_layers_and_checker_rejects_source_drift() {
+        let before = fixture().unwrap();
+        let actual = reordered(&before);
+        let dir = tempfile::tempdir().unwrap();
+        let baseline = dir.path().join("baseline.json");
+        persistence::save(&baseline, &before).unwrap();
+        for corrupt in [false, true] {
+            let mut saved = actual.clone();
+            if corrupt {
+                saved
+                    .elements
+                    .get_mut(&id("sa_c"))
+                    .unwrap()
+                    .name
+                    .push_str(" drift");
+            }
+            let bundle = roundtrip(&saved).unwrap();
+            let folder = dir.path().join(if corrupt { "corrupt" } else { "saved" });
+            for (path, text) in &bundle.files {
+                write_new(&folder.join(path), text.as_bytes()).unwrap();
+            }
+            let parsed = load(&folder.join(&bundle.entry)).unwrap();
+            assert_eq!(parsed.elements[&id("oa_process")].kind(), Kind::Process);
+            assert_eq!(
+                parsed.elements[&id("sa_chain")].kind(),
+                Kind::FunctionalChain
+            );
+            let result = check("reordered", &baseline, &folder.join(&bundle.entry));
+            if corrupt {
+                assert!(
+                    result
+                        .unwrap_err()
+                        .to_string()
+                        .contains("Whole Project mismatch")
+                );
+            } else {
+                result.unwrap();
+            }
+        }
+    }
+}

crates/oa-desktop/examples/allocation_policy_probe.rs

@@ -0,0 +1,14 @@
+//! Focused test harness for the production Allocation planner and Document.
+//! This does not exercise App input, painting, or native gestures.
+
+#[cfg(test)]
+#[allow(dead_code)] // App-facing entry points are intentionally absent here.
+#[path = "../src/allocation_drag.rs"]
+mod allocation_drag;
+
+#[cfg(test)]
+#[allow(dead_code, unused_imports)] // App-facing API and reexports are absent here.
+#[path = "../src/document.rs"]
+mod document;
+
+fn main() {}

crates/oa-desktop/src/allocation_drag.rs

@@ -13,6 +13,19 @@ use oa_core::{
 };
 use std::collections::{BTreeMap, BTreeSet};
 
+// The pure planner is verified before its App gesture adapter is connected.
+#[allow(dead_code)]
+#[path = "allocation_drag/arrange.rs"]
+pub mod arrange;
+
+#[path = "allocation_drag/geometry.rs"]
+mod geometry;
+
+// The combined semantic planner is verified before connecting its App adapter.
+#[allow(dead_code)]
+#[path = "allocation_drag/assignment.rs"]
+pub mod assignment;
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum Destination {
     LayoutOnly,
@@ -76,6 +89,11 @@ pub enum Refusal {
 
 pub fn capture(p: &Project, diagram: Id, work: Id, placement: Id) -> Result<Scope, Refusal> {
     validate_candidate(p).map_err(|e| Refusal::InvalidCandidate(e.to_string()))?;
+    capture_validated(p, diagram, work, placement)
+}
+
+/// Collect work facts after the caller's single complete Project validation.
+fn capture_validated(p: &Project, diagram: Id, work: Id, placement: Id) -> Result<Scope, Refusal> {
     let d = p.diagrams.get(&diagram).ok_or(Refusal::StaleScope)?;
     let root = p.elements.get(&work).ok_or(Refusal::StaleScope)?;
     if !root.kind().is_work()
@@ -232,8 +250,93 @@ pub fn plan_semantics(
     let same_performer =
         matches!(destination, Destination::Performer(id) if scope.uniform == Uniform::Assigned(id));
     let mut expected = p.clone();
-    let mut commands = Vec::new();
-    let mut deleted = BTreeSet::new();
+    let mut edits = IntendedEdits::default();
+    append_semantic_edits(
+        p,
+        scope,
+        destination,
+        allocation_ids,
+        &mut expected,
+        &mut edits,
+    )?;
+    // A route cannot survive the intentional deletion of its own edge, even in
+    // another diagram. No other saved-view cleanup is authorized by this drag.
+    for diagram in expected.diagrams.values_mut() {
+        diagram.routes.retain(|r| !edits.deleted.contains(&r.edge));
+    }
+    let actual = prepare_command(p, &Command::Batch(edits.commands.clone()))
+        .map_err(|e| Refusal::InvalidCandidate(e.to_string()))?
+        .project;
+    exact_project(&expected, &actual)?;
+    let retained_roles = scope
+        .leaves
+        .values()
+        .any(|l| !l.role_assignments.is_empty());
+    let label = match destination {
+        Destination::LayoutOnly => "Arrange only".into(),
+        Destination::Performer(id) if same_performer => format!("Arrange within {}", p.named(id)),
+        Destination::Performer(id) => format!(
+            "Assign {} leaf {} to {}{}",
+            scope.leaves.len(),
+            match (scope.diagram.layer, scope.leaves.len()) {
+                (Layer::Oa, 1) => "activity",
+                (Layer::Oa, _) => "activities",
+                (Layer::Sa, 1) => "function",
+                (Layer::Sa, _) => "functions",
+            },
+            p.named(id),
+            if retained_roles {
+                " — explicit assignment; role responsibility retained"
+            } else {
+                ""
+            }
+        ),
+        Destination::OutsidePerformers if edits.commands.is_empty() => {
+            "Arrange unassigned work — decomposition retained".into()
+        }
+        Destination::OutsidePerformers => "Remove assignment — decomposition retained".into(),
+    };
+    let warnings = validation::validate(&actual)
+        .into_iter()
+        .filter(|i| i.severity == Severity::Warning)
+        .collect();
+    let index = ViewIndex::new(&actual);
+    Ok(SemanticPlan {
+        scope: scope.clone(),
+        destination,
+        label,
+        warnings,
+        accepted: p.clone(),
+        candidate: actual,
+        index,
+        commands: edits.commands,
+        before_visible,
+        before_expanded,
+    })
+}
+
+#[derive(Default)]
+struct IntendedEdits {
+    commands: Vec<Command>,
+    deleted: BTreeSet<Id>,
+    changed: BTreeSet<Id>,
+}
+
+/// Read each root's accepted responsibility while accumulating one intended
+/// Project, reserving relation identities and aliases across every root.
+fn append_semantic_edits(
+    p: &Project,
+    scope: &Scope,
+    destination: Destination,
+    allocation_ids: &BTreeMap<Id, Id>,
+    expected: &mut Project,
+    edits: &mut IntendedEdits,
+) -> Result<(), Refusal> {
+    let same_performer =
+        matches!(destination, Destination::Performer(id) if scope.uniform == Uniform::Assigned(id));
+    let commands = &mut edits.commands;
+    let deleted = &mut edits.deleted;
+    let changed = &mut edits.changed;
     if destination != Destination::LayoutOnly && !same_performer {
         for (work, leaf) in &scope.leaves {
             match destination {
@@ -246,6 +349,7 @@ pub fn plan_semantics(
                                 target: *work,
                             };
                             expected.relations.insert(edited.id, edited.clone());
+                            changed.insert(*work);
                             commands.push(Command::EditRelation(edited.id, edited));
                         }
                     } else {
@@ -269,6 +373,7 @@ pub fn plan_semantics(
                             },
                         };
                         expected.relations.insert(id, relation.clone());
+                        changed.insert(*work);
                         commands.push(Command::CreateRelation(relation));
                     }
                 }
@@ -327,6 +432,7 @@ pub fn plan_semantics(
                     if let Some(existing) = &leaf.direct {
                         expected.relations.remove(&existing.id);
                         deleted.insert(existing.id);
+                        changed.insert(*work);
                         commands.push(Command::Delete(existing.id));
                     }
                 }
@@ -334,60 +440,7 @@ pub fn plan_semantics(
             }
         }
     }
-    // A route cannot survive the intentional deletion of its own edge, even in
-    // another diagram. No other saved-view cleanup is authorized by this drag.
-    for diagram in expected.diagrams.values_mut() {
-        diagram.routes.retain(|r| !deleted.contains(&r.edge));
-    }
-    let actual = prepare_command(p, &Command::Batch(commands.clone()))
-        .map_err(|e| Refusal::InvalidCandidate(e.to_string()))?
-        .project;
-    exact_project(&expected, &actual)?;
-    let retained_roles = scope
-        .leaves
-        .values()
-        .any(|l| !l.role_assignments.is_empty());
-    let label = match destination {
-        Destination::LayoutOnly => "Arrange only".into(),
-        Destination::Performer(id) if same_performer => format!("Arrange within {}", p.named(id)),
-        Destination::Performer(id) => format!(
-            "Assign {} leaf {} to {}{}",
-            scope.leaves.len(),
-            match (scope.diagram.layer, scope.leaves.len()) {
-                (Layer::Oa, 1) => "activity",
-                (Layer::Oa, _) => "activities",
-                (Layer::Sa, 1) => "function",
-                (Layer::Sa, _) => "functions",
-            },
-            p.named(id),
-            if retained_roles {
-                " — explicit assignment; role responsibility retained"
-            } else {
-                ""
-            }
-        ),
-        Destination::OutsidePerformers if commands.is_empty() => {
-            "Arrange unassigned work — decomposition retained".into()
-        }
-        Destination::OutsidePerformers => "Remove assignment — decomposition retained".into(),
-    };
-    let warnings = validation::validate(&actual)
-        .into_iter()
-        .filter(|i| i.severity == Severity::Warning)
-        .collect();
-    let index = ViewIndex::new(&actual);
-    Ok(SemanticPlan {
-        scope: scope.clone(),
-        destination,
-        label,
-        warnings,
-        accepted: p.clone(),
-        candidate: actual,
-        index,
-        commands,
-        before_visible,
-        before_expanded,
-    })
+    Ok(())
 }
 
 /// World-space rectangle in the gesture's frozen transform. The UI resolver
@@ -462,60 +515,18 @@ pub fn place(
             "Make room or adjust the view, then drag again.".into(),
         ));
     }
-    let root = &plan.scope.placements[&plan.scope.placement];
-    let delta = Position {
-        x: (requested.x / 10.).round() * 10. - root.position.x,
-        y: (requested.y / 10.).round() * 10. - root.position.y,
-    };
-    let mut diagram = plan.candidate.diagrams[&plan.scope.diagram.id].clone();
-    let mut commands = Vec::new();
-    let mut deltas = BTreeMap::new();
-    for (id, original) in &plan.scope.placements {
-        let node = diagram.nodes.get_mut(id).ok_or(Refusal::StaleScope)?;
-        node.position = Position {
-            x: original.position.x + delta.x,
-            y: original.position.y + delta.y,
-        };
-        if !(Rect {
-            position: node.position,
-            size: node.size,
-        })
-        .valid()
-        {
-            return Err(Refusal::InvalidCandidate(
-                "Moved coordinates exceed the model bounds.".into(),
-            ));
-        }
-        deltas.insert(*id, delta);
-        if node != original {
-            commands.push(Command::EditNode {
-                diagram: diagram.id,
-                original: *id,
-                node: node.clone(),
-            });
-        }
-    }
-    // Resolve endpoints using the captured accepted semantics, not a newly
-    // regrouped descendant walk. Own-edge deletions were removed above already.
-    for route in projection::translated_routes(&plan.accepted, &plan.scope.diagram, &deltas) {
-        if let Some(existing) = diagram.routes.iter_mut().find(|r| r.edge == route.edge) {
-            if route.waypoints.iter().any(|p| {
-                !p.x.is_finite()
-                    || !p.y.is_finite()
-                    || p.x.abs() > MAX_COORDINATE
-                    || p.y.abs() > MAX_COORDINATE
-            }) {
-                return Err(Refusal::InvalidCandidate(
-                    "Moved route exceeds the model bounds.".into(),
-                ));
-            }
-            *existing = route.clone();
-            commands.push(Command::SetEdgeRoute {
-                diagram: diagram.id,
-                route,
-            });
-        }
-    }
+    let geometry::Translation {
+        mut diagram,
+        mut commands,
+        delta,
+    } = geometry::translate(
+        &plan.accepted,
+        &plan.scope.diagram,
+        &plan.candidate.diagrams[&plan.scope.diagram.id],
+        &plan.scope.placements,
+        plan.scope.placement,
+        requested,
+    )?;
     let mut unfolded = None;
     if let Destination::Performer(performer) = plan.destination {
         let target = presentation.target.ok_or_else(|| {
@@ -833,4 +844,5 @@ fn exact_project(expected: &Project, actual: &Project) -> Result<(), Refusal> {
 }
 
 #[cfg(test)]
+#[path = "allocation_drag/tests.rs"]
 mod tests;

crates/oa-desktop/src/allocation_drag/arrange.rs

@@ -0,0 +1,232 @@
+//! Explicit, semantics-preserving arrangement of one or more Allocation cards.
+//!
+//! The App must admit the entire original typed selection before converting it
+//! to placement/element identities. These values do not grant input authority.
+use super::*;
+
+#[derive(Debug)]
+pub struct Plan {
+    accepted: Project,
+    diagram: Id,
+    selected: BTreeMap<Id, Id>,
+    anchor: Id,
+    placements: BTreeMap<Id, NodePlacement>,
+    expanded_ids: BTreeSet<Id>,
+    index: ViewIndex,
+    before_visible: ProjectedView,
+    before_expanded: ProjectedView,
+}
+
+impl Plan {
+    pub fn project(&self) -> &Project {
+        &self.accepted
+    }
+
+    pub fn index(&self) -> &ViewIndex {
+        &self.index
+    }
+
+    pub fn affected(&self) -> &BTreeMap<Id, NodePlacement> {
+        &self.placements
+    }
+
+    pub fn selected(&self) -> &BTreeMap<Id, Id> {
+        &self.selected
+    }
+
+    pub fn anchor(&self) -> Id {
+        self.anchor
+    }
+
+    pub fn diagram(&self) -> &Diagram {
+        &self.accepted.diagrams[&self.diagram]
+    }
+}
+
+/// Capture every original placement identity before normalizing semantic roots.
+/// Document/revision/selection-generation and clean-owner guards belong to App.
+pub fn capture(
+    p: &Project,
+    diagram: Id,
+    selected: &BTreeMap<Id, Id>,
+    anchor: Id,
+) -> Result<Plan, Refusal> {
+    validate_candidate(p).map_err(|e| Refusal::InvalidCandidate(e.to_string()))?;
+    let d = p.diagrams.get(&diagram).ok_or(Refusal::StaleScope)?;
+    if d.projection != ProjectionKind::Allocation
+        || selected.is_empty()
+        || !selected.contains_key(&anchor)
+    {
+        return Err(Refusal::Ineligible(
+            "Arrange requires selected placements and a selected anchor in an Allocation view."
+                .into(),
+        ));
+    }
+    let index = ViewIndex::new(p);
+    let before_visible = projection::project_diagram_with_index(p, d, &index);
+    let visible: BTreeMap<_, _> = before_visible
+        .nodes
+        .iter()
+        .map(|n| (n.id, n.element))
+        .collect();
+    let mut work = BTreeMap::new();
+    let mut performers = Vec::new();
+    for (placement, element) in selected {
+        let node = d.nodes.get(placement).ok_or(Refusal::StaleScope)?;
+        let record = p.elements.get(element).ok_or(Refusal::StaleScope)?;
+        if node.element != *element || visible.get(placement) != Some(element) {
+            return Err(Refusal::StaleScope);
+        }
+        if record.layer() != d.layer || !(record.kind().is_work() || record.kind().is_performer()) {
+            return Err(Refusal::Ineligible(
+                "Arrange requires only activities, functions or performers in this layer.".into(),
+            ));
+        }
+        if record.kind().is_work() {
+            work.insert(*element, *placement);
+        } else {
+            performers.push(*placement);
+        }
+    }
+
+    let mut placements = BTreeMap::new();
+    for (element, placement) in &work {
+        let root = &p.elements[element];
+        let mut ancestor = root.parent;
+        let mut covered = false;
+        let mut seen = BTreeSet::new();
+        while let Some(id) = ancestor {
+            if !seen.insert(id) {
+                return Err(Refusal::StaleScope);
+            }
+            let parent = p.elements.get(&id).ok_or(Refusal::StaleScope)?;
+            if parent.kind() != root.kind() {
+                break;
+            }
+            if work.contains_key(&id) {
+                covered = true;
+                break;
+            }
+            ancestor = parent.parent;
+        }
+        if !covered {
+            placements.extend(capture_validated(p, diagram, *element, *placement)?.placements);
+        }
+    }
+    for performer in performers {
+        for id in
+            std::iter::once(performer).chain(projection::descendant_nodes(p, diagram, performer))
+        {
+            placements.insert(id, d.nodes.get(&id).ok_or(Refusal::StaleScope)?.clone());
+        }
+    }
+
+    // Arrange preserves ancestry, so accepted diagnostic identities also apply
+    // to every translated candidate.
+    let expanded_ids = geometry::expansion_ids(p, d, &index, &placements)?;
+    let before_expanded = geometry::expanded_view(p, d, &index, &expanded_ids);
+    Ok(Plan {
+        accepted: p.clone(),
+        diagram,
+        selected: selected.clone(),
+        anchor,
+        placements,
+        expanded_ids,
+        index,
+        before_visible,
+        before_expanded,
+    })
+}
+
+/// Snap the captured anchor once; preview the complete union without cloning or
+/// validating a Project, rebuilding its semantic index, or expanding scope.
+pub fn place(
+    plan: &Plan,
+    requested: Position,
+    presentation: PresentationContext,
+) -> Result<PlacementPlan, Refusal> {
+    if presentation.target.is_some() {
+        return Err(Refusal::Ineligible(
+            "Arrange only has no performer destination.".into(),
+        ));
+    }
+    if !requested.x.is_finite()
+        || !requested.y.is_finite()
+        || !presentation.viewport.valid()
+        || !presentation.zoom.is_finite()
+        || presentation.zoom <= 0.
+    {
+        return Err(Refusal::LayoutRequired(
+            "Make room or adjust the view, then drag again.".into(),
+        ));
+    }
+    let geometry::Translation {
+        diagram,
+        commands,
+        delta,
+    } = geometry::translate(
+        &plan.accepted,
+        plan.diagram(),
+        plan.diagram(),
+        &plan.placements,
+        plan.anchor,
+        requested,
+    )?;
+    let view = projection::project_diagram_with_index(&plan.accepted, &diagram, &plan.index);
+    let expanded =
+        geometry::expanded_view(&plan.accepted, &diagram, &plan.index, &plan.expanded_ids);
+    // Preserve Arrange's refusal precedence: projected bounds, then rigidity,
+    // then overlap growth. The shared scene check combines bounds and overlaps.
+    let scenes = match geometry::check_scenes(
+        &plan.before_visible,
+        &plan.before_expanded,
+        &view,
+        &expanded,
+    ) {
+        Err(error @ Refusal::InvalidCandidate(_)) => return Err(error),
+        result => result,
+    };
+    geometry::check_rigid(&plan.before_expanded, &expanded, &plan.placements, delta)?;
+    scenes?;
+    geometry::check_headers(&view, &plan.selected, presentation.viewport)?;
+    Ok(PlacementPlan {
+        diagram,
+        view,
+        delta,
+        unfolded: None,
+        requested,
+        presentation,
+        commands,
+    })
+}
+
+/// Recompute the candidate and compare the complete expected Project before the
+/// caller performs one source-admitted transaction. None means no history entry.
+pub fn finish(
+    plan: &Plan,
+    live: &Project,
+    placement: &PlacementPlan,
+) -> Result<Option<Command>, Refusal> {
+    if live != &plan.accepted {
+        return Err(Refusal::StaleScope);
+    }
+    let checked = place(plan, placement.requested, placement.presentation)?;
+    if checked.diagram != placement.diagram
+        || checked.view != placement.view
+        || checked.delta != placement.delta
+        || checked.unfolded != placement.unfolded
+        || checked.commands != placement.commands
+    {
+        return Err(Refusal::StaleScope);
+    }
+    let mut expected = plan.accepted.clone();
+    expected
+        .diagrams
+        .insert(checked.diagram.id, checked.diagram);
+    let command = Command::Batch(checked.commands);
+    let actual = prepare_command(live, &command)
+        .map_err(|e| Refusal::InvalidCandidate(e.to_string()))?
+        .project;
+    exact_project(&expected, &actual)?;
+    Ok((actual != *live).then_some(command))
+}

crates/oa-desktop/src/allocation_drag/arrange_tests.rs

@@ -0,0 +1,443 @@
+use super::*;
+
+struct Distributed {
+    f: Fixture,
+    a: Id,
+    b: Id,
+    x: Id,
+    y: Id,
+    internal: Id,
+}
+
+fn distributed(layer: Layer, folded: bool) -> Distributed {
+    let mut f = fixture(layer);
+    let kind = f.p.elements[&f.w].kind();
+    let x = f.p.add_element(kind, layer, "X", Some(f.w)).unwrap();
+    let y = f.p.add_element(kind, layer, "Y", Some(f.w)).unwrap();
+    let outside = f.p.add_element(kind, layer, "Outside", None).unwrap();
+    let xn = f.p.place(f.d, x, xy(140., 200.));
+    let yn = f.p.place(f.d, y, xy(940., 200.));
+    f.p.place(f.d, outside, xy(1800., 800.));
+    f.p.relate(RelationKind::Allocation, "A owns X", f.a, x);
+    f.p.relate(RelationKind::Allocation, "B owns Y", f.b, y);
+    let exchange = match layer {
+        Layer::Oa => RelationKind::Interaction,
+        Layer::Sa => RelationKind::FunctionalExchange,
+    };
+    let internal = f.p.relate(exchange, "X to Y", x, y);
+    let external = f.p.relate(exchange, "Y to Outside", y, outside);
+    let d = f.p.diagrams.get_mut(&f.d).unwrap();
+    let a = d.nodes.values().find(|n| n.element == f.a).unwrap().id;
+    let b = d.nodes.values().find(|n| n.element == f.b).unwrap().id;
+    d.nodes.get_mut(&a).unwrap().collapsed = folded;
+    d.nodes.get_mut(&f.n).unwrap().position = xy(100., 800.);
+    d.routes = vec![route(internal), route(external)];
+    validate_candidate(&f.p).unwrap();
+    Distributed {
+        f,
+        a,
+        b,
+        x: xn,
+        y: yn,
+        internal,
+    }
+}
+
+fn identities(m: &Distributed, ids: &[Id]) -> BTreeMap<Id, Id> {
+    ids.iter()
+        .map(|id| (*id, m.f.p.diagrams[&m.f.d].nodes[id].element))
+        .collect()
+}
+
+fn expected(m: &Distributed, include_a: bool) -> Project {
+    let mut p = m.f.p.clone();
+    let d = p.diagrams.get_mut(&m.f.d).unwrap();
+    for (id, position) in [
+        (m.f.n, xy(500., 800.)),
+        (m.x, xy(540., 200.)),
+        (m.y, xy(1340., 200.)),
+    ] {
+        d.nodes.get_mut(&id).unwrap().position = position;
+    }
+    if include_a {
+        d.nodes.get_mut(&m.a).unwrap().position = xy(500., 100.);
+    }
+    d.routes
+        .iter_mut()
+        .find(|r| r.edge == m.internal)
+        .unwrap()
+        .waypoints = vec![xy(820., 400.), xy(820., 550.)];
+    p
+}
+
+#[test]
+fn explicit_arrange_distributed_oa_sa_exact_scope_routes_source_history_and_anchor() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        for folded in [false, true] {
+            for include_a in [false, true] {
+                let m = distributed(layer, folded);
+                let members = if include_a {
+                    vec![m.f.n, m.a]
+                } else {
+                    vec![m.f.n]
+                };
+                let selected = identities(&m, &members);
+                for anchor in selected.keys().copied() {
+                    let plan = arrange::capture(&m.f.p, m.f.d, &selected, anchor).unwrap();
+                    assert_eq!(plan.selected(), &selected);
+                    let mut affected = BTreeSet::from([m.f.n, m.x, m.y]);
+                    if include_a {
+                        affected.insert(m.a);
+                    }
+                    assert_eq!(
+                        plan.affected().keys().copied().collect::<BTreeSet<_>>(),
+                        affected
+                    );
+                    let requested = if anchor == m.a {
+                        xy(503., 102.)
+                    } else {
+                        xy(503., 802.)
+                    };
+                    let placed =
+                        arrange::place(&plan, requested, presentation(&m.f.p, m.f.d, None))
+                            .unwrap();
+                    assert_eq!(placed.delta, xy(400., 0.));
+                    assert_eq!(placed.unfolded, None);
+                    let command = arrange::finish(&plan, &m.f.p, &placed).unwrap().unwrap();
+                    assert_eq!(roundtrip(&m.f.p, command), expected(&m, include_a));
+                    // Explicit Arrange does not widen ordinary distributed assignment.
+                    assert!(matches!(
+                        plan_semantics(
+                            &m.f.p,
+                            &scope(&m.f),
+                            Destination::Performer(m.f.a),
+                            &BTreeMap::new()
+                        ),
+                        Err(Refusal::MixedLayoutRequired)
+                    ));
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn explicit_arrange_performer_closure_does_not_acquire_incidental_semantic_root() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let m = distributed(layer, true);
+        let selected = identities(&m, &[m.a]);
+        let plan = arrange::capture(&m.f.p, m.f.d, &selected, m.a).unwrap();
+        assert_eq!(
+            plan.affected().keys().copied().collect::<BTreeSet<_>>(),
+            BTreeSet::from([m.a, m.x])
+        );
+        let placed =
+            arrange::place(&plan, xy(500., 100.), presentation(&m.f.p, m.f.d, None)).unwrap();
+        let mut expected = m.f.p.clone();
+        let d = expected.diagrams.get_mut(&m.f.d).unwrap();
+        d.nodes.get_mut(&m.a).unwrap().position = xy(500., 100.);
+        d.nodes.get_mut(&m.x).unwrap().position = xy(540., 200.);
+        // X-to-Y is now one-ended; all saved pins remain byte-for-byte unchanged.
+        assert_eq!(
+            roundtrip(
+                &m.f.p,
+                arrange::finish(&plan, &m.f.p, &placed).unwrap().unwrap()
+            ),
+            expected
+        );
+    }
+}
+
+#[test]
+fn explicit_arrange_validates_all_original_members_before_normalizing() {
+    let mut m = distributed(Layer::Oa, false);
+    let selected = identities(&m, &[m.f.n, m.x]);
+    let plan = arrange::capture(&m.f.p, m.f.d, &selected, m.x).unwrap();
+    assert_eq!(plan.selected(), &selected);
+    assert_eq!(plan.affected().len(), 3);
+    let placed = arrange::place(&plan, xy(540., 200.), presentation(&m.f.p, m.f.d, None)).unwrap();
+    assert_eq!(
+        roundtrip(
+            &m.f.p,
+            arrange::finish(&plan, &m.f.p, &placed).unwrap().unwrap()
+        ),
+        expected(&m, false)
+    );
+    let mut stale = selected.clone();
+    stale.insert(m.x, m.f.w);
+    assert!(arrange::capture(&m.f.p, m.f.d, &stale, m.f.n).is_err());
+    m.f.p
+        .diagrams
+        .get_mut(&m.f.d)
+        .unwrap()
+        .nodes
+        .get_mut(&m.a)
+        .unwrap()
+        .collapsed = true;
+    assert!(
+        arrange::capture(&m.f.p, m.f.d, &selected, m.f.n).is_err(),
+        "covered selected X is hidden and cannot disappear in normalization"
+    );
+    assert!(arrange::capture(&m.f.p, m.f.d, &BTreeMap::new(), m.f.n).is_err());
+    assert!(arrange::capture(&m.f.p, m.f.d, &identities(&m, &[m.f.n]), m.a).is_err());
+    assert!(arrange::capture(&m.f.p, m.f.second, &identities(&m, &[m.f.n]), m.f.n).is_err());
+    let foreign = Id::new_v4();
+    assert!(
+        arrange::capture(
+            &m.f.p,
+            m.f.d,
+            &BTreeMap::from([(m.f.n, m.f.w), (foreign, m.f.w)]),
+            m.f.n
+        )
+        .is_err()
+    );
+    m.f.p.diagrams.get_mut(&m.f.d).unwrap().projection = ProjectionKind::Overview;
+    assert!(arrange::capture(&m.f.p, m.f.d, &identities(&m, &[m.f.n]), m.f.n).is_err());
+}
+
+#[test]
+fn explicit_arrange_simultaneous_roots_may_enter_each_others_vacated_bounds() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = fixture(layer);
+        let kind = f.p.elements[&f.w].kind();
+        let y = f.p.add_element(kind, layer, "Second root", None).unwrap();
+        let yn = f.p.place(f.d, y, xy(400., 500.));
+        let relation = f.p.relate(
+            if layer == Layer::Oa {
+                RelationKind::Interaction
+            } else {
+                RelationKind::FunctionalExchange
+            },
+            "Between roots",
+            f.w,
+            y,
+        );
+        f.p.diagrams.get_mut(&f.d).unwrap().routes = vec![route(relation)];
+        let context = presentation(&f.p, f.d, None);
+        let single = arrange::capture(&f.p, f.d, &BTreeMap::from([(f.n, f.w)]), f.n).unwrap();
+        assert!(
+            arrange::place(&single, xy(400., 500.), context).is_err(),
+            "singleton would collide with stationary Y"
+        );
+        let plan =
+            arrange::capture(&f.p, f.d, &BTreeMap::from([(f.n, f.w), (yn, y)]), f.n).unwrap();
+        let placed = arrange::place(&plan, xy(400., 500.), context).unwrap();
+        let mut expected = f.p.clone();
+        let d = expected.diagrams.get_mut(&f.d).unwrap();
+        d.nodes.get_mut(&f.n).unwrap().position = xy(400., 500.);
+        d.nodes.get_mut(&yn).unwrap().position = xy(700., 500.);
+        d.routes[0].waypoints = vec![xy(720., 400.), xy(720., 550.)];
+        assert_eq!(
+            roundtrip(
+                &f.p,
+                arrange::finish(&plan, &f.p, &placed).unwrap().unwrap()
+            ),
+            expected
+        );
+    }
+}
+
+#[test]
+fn explicit_arrange_preserves_roles_and_does_not_invent_unplaced_descendants() {
+    let mut f = fixture(Layer::Oa);
+    let a = f.a;
+    role(&mut f, Some(a));
+    f.p.diagrams
+        .get_mut(&f.d)
+        .unwrap()
+        .nodes
+        .get_mut(&f.n)
+        .unwrap()
+        .position = xy(150., 200.);
+    let plan = arrange::capture(&f.p, f.d, &BTreeMap::from([(f.n, f.w)]), f.n).unwrap();
+    let placed = arrange::place(&plan, xy(160., 210.), presentation(&f.p, f.d, None)).unwrap();
+    let mut role_expected = f.p.clone();
+    role_expected
+        .diagrams
+        .get_mut(&f.d)
+        .unwrap()
+        .nodes
+        .get_mut(&f.n)
+        .unwrap()
+        .position = xy(160., 210.);
+    assert_eq!(
+        roundtrip(
+            &f.p,
+            arrange::finish(&plan, &f.p, &placed).unwrap().unwrap()
+        ),
+        role_expected
+    );
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut m = distributed(layer, true);
+        let kind = m.f.p.elements[&m.f.w].kind();
+        m.f.p
+            .add_element(kind, layer, "Unplaced leaf", Some(m.f.w))
+            .unwrap();
+        let plan = arrange::capture(&m.f.p, m.f.d, &identities(&m, &[m.f.n]), m.f.n).unwrap();
+        assert_eq!(plan.affected().len(), 3);
+        let placed =
+            arrange::place(&plan, xy(500., 800.), presentation(&m.f.p, m.f.d, None)).unwrap();
+        assert_eq!(
+            roundtrip(
+                &m.f.p,
+                arrange::finish(&plan, &m.f.p, &placed).unwrap().unwrap()
+            ),
+            expected(&m, false)
+        );
+    }
+}
+
+#[test]
+fn explicit_arrange_detects_hidden_moved_child_and_stationary_enclosure_growth() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        for hidden in [false, true] {
+            let mut m = distributed(layer, hidden);
+            let kind = m.f.p.elements[&m.f.w].kind();
+            let z = m.f.p.add_element(kind, layer, "Obstacle", None).unwrap();
+            let zn = m.f.p.place(
+                m.f.d,
+                z,
+                if hidden {
+                    xy(550., 230.)
+                } else {
+                    xy(1200., 100.)
+                },
+            );
+            // The independent candidate differs only by literal admitted edits.
+            // Establish which geometric case the real planner must reject.
+            let candidate = expected(&m, true);
+            let before = projection::project_view(&m.f.p, m.f.d);
+            let after = projection::project_view(&candidate, m.f.d);
+            let find =
+                |view: &ProjectedView, id| view.nodes.iter().find(|n| n.id == id).unwrap().clone();
+            if hidden {
+                assert!(!overlaps(&before, &after));
+                assert!(!after.nodes.iter().any(|n| n.id == m.x));
+                let mut diagnostic = candidate.diagrams[&m.f.d].clone();
+                diagnostic.nodes.get_mut(&m.a).unwrap().collapsed = false;
+                let expanded = projection::project_diagram(&candidate, &diagnostic);
+                assert_eq!(
+                    overlap(&find(&expanded, m.x), &find(&expanded, zn)),
+                    if layer == Layer::Oa { 13696. } else { 20116. }
+                );
+            } else {
+                assert_eq!(overlap(&find(&before, m.b), &find(&before, zn)), 0.);
+                assert_eq!(overlap(&find(&after, m.b), &find(&after, zn)), 21056.);
+                for id in [m.a, m.f.n, m.x, m.y] {
+                    assert_eq!(overlap(&find(&after, id), &find(&after, zn)), 0.);
+                }
+                assert_eq!(
+                    candidate.diagrams[&m.f.d].nodes[&m.b],
+                    m.f.p.diagrams[&m.f.d].nodes[&m.b]
+                );
+            }
+            let plan =
+                arrange::capture(&m.f.p, m.f.d, &identities(&m, &[m.a, m.f.n]), m.f.n).unwrap();
+            assert!(matches!(
+                arrange::place(&plan, xy(500., 800.), presentation(&m.f.p, m.f.d, None)),
+                Err(Refusal::LayoutRequired(_))
+            ));
+        }
+    }
+}
+
+#[test]
+fn explicit_arrange_preserves_existing_overlap_but_refuses_its_growth() {
+    let mut f = fixture(Layer::Oa);
+    let y =
+        f.p.add_element(Kind::Activity, Layer::Oa, "Existing overlap", None)
+            .unwrap();
+    let yn = f.p.place(f.d, y, xy(250., 500.));
+    let context = presentation(&f.p, f.d, None);
+    let single = arrange::capture(&f.p, f.d, &BTreeMap::from([(f.n, f.w)]), f.n).unwrap();
+    assert!(arrange::place(&single, xy(110., 500.), context).is_err());
+    let plan = arrange::capture(&f.p, f.d, &BTreeMap::from([(f.n, f.w), (yn, y)]), f.n).unwrap();
+    let placed = arrange::place(&plan, xy(400., 500.), context).unwrap();
+    let mut expected = f.p.clone();
+    let d = expected.diagrams.get_mut(&f.d).unwrap();
+    d.nodes.get_mut(&f.n).unwrap().position = xy(400., 500.);
+    d.nodes.get_mut(&yn).unwrap().position = xy(550., 500.);
+    assert_eq!(
+        roundtrip(
+            &f.p,
+            arrange::finish(&plan, &f.p, &placed).unwrap().unwrap()
+        ),
+        expected
+    );
+}
+
+#[test]
+fn explicit_arrange_preserves_unrelated_folded_interior_diagnostic_boundary() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut m = distributed(layer, true);
+        let performer = if layer == Layer::Oa {
+            Kind::Actor
+        } else {
+            Kind::SystemActor
+        };
+        let d = m.f.p.add_element(performer, layer, "D", None).unwrap();
+        let z =
+            m.f.p
+                .add_element(m.f.p.elements[&m.f.w].kind(), layer, "Hidden Z", None)
+                .unwrap();
+        m.f.p.relate(RelationKind::Allocation, "D owns Z", d, z);
+        let dn = m.f.p.place(m.f.d, d, xy(2500., 100.));
+        m.f.p.place(m.f.d, z, xy(550., 230.));
+        m.f.p
+            .diagrams
+            .get_mut(&m.f.d)
+            .unwrap()
+            .nodes
+            .get_mut(&dn)
+            .unwrap()
+            .collapsed = true;
+        let plan = arrange::capture(&m.f.p, m.f.d, &identities(&m, &[m.a, m.f.n]), m.f.n).unwrap();
+        let placed =
+            arrange::place(&plan, xy(500., 800.), presentation(&m.f.p, m.f.d, None)).unwrap();
+        assert_eq!(
+            roundtrip(
+                &m.f.p,
+                arrange::finish(&plan, &m.f.p, &placed).unwrap().unwrap()
+            ),
+            expected(&m, true)
+        );
+    }
+}
+
+#[test]
+fn explicit_arrange_noop_stale_tamper_target_and_all_selected_headers() {
+    let m = distributed(Layer::Sa, false);
+    let selected = identities(&m, &[m.a, m.f.n]);
+    let plan = arrange::capture(&m.f.p, m.f.d, &selected, m.f.n).unwrap();
+    let context = presentation(&m.f.p, m.f.d, None);
+    let noop = arrange::place(&plan, xy(103., 802.), context).unwrap();
+    assert!(arrange::finish(&plan, &m.f.p, &noop).unwrap().is_none());
+    let mut placed = arrange::place(&plan, xy(500., 800.), context).unwrap();
+    let mut stale = m.f.p.clone();
+    stale.name.push_str(" changed");
+    assert!(matches!(
+        arrange::finish(&plan, &stale, &placed),
+        Err(Refusal::StaleScope)
+    ));
+    placed.diagram.nodes.get_mut(&m.b).unwrap().position.x += 1.;
+    assert!(matches!(
+        arrange::finish(&plan, &m.f.p, &placed),
+        Err(Refusal::StaleScope)
+    ));
+    assert!(
+        arrange::place(
+            &plan,
+            xy(500., 800.),
+            presentation(&m.f.p, m.f.d, Some(m.f.b))
+        )
+        .is_err()
+    );
+    let mut clipped = context;
+    clipped.viewport.position = xy(400., 700.);
+    assert!(
+        arrange::place(&plan, xy(500., 800.), clipped).is_err(),
+        "anchor C visible, other selected A header clipped"
+    );
+    assert!(arrange::place(&plan, xy(f32::NAN, 800.), context).is_err());
+    assert!(arrange::place(&plan, xy(MAX_COORDINATE, 800.), context).is_err());
+}

crates/oa-desktop/src/allocation_drag/assignment.rs

@@ -0,0 +1,444 @@
+//! Ordinary work-only group assignment, with one combined semantic/geometry plan.
+//! App retains authority over the complete typed selection and gesture lifetime.
+use super::*;
+use std::sync::Arc;
+
+#[derive(Debug)]
+struct Captured {
+    accepted: Project,
+    diagram: Id,
+    selected: BTreeMap<Id, Id>,
+    anchor: Id,
+    roots: Vec<super::Scope>,
+    placements: BTreeMap<Id, NodePlacement>,
+    leaves: BTreeMap<Id, Leaf>,
+    index: ViewIndex,
+    before_visible: ProjectedView,
+    before_expanded: ProjectedView,
+}
+
+/// Destination plans share one immutable accepted capture.
+#[derive(Debug, Clone)]
+pub struct Scope(Arc<Captured>);
+
+impl Scope {
+    pub fn project(&self) -> &Project {
+        &self.0.accepted
+    }
+
+    pub fn index(&self) -> &ViewIndex {
+        &self.0.index
+    }
+
+    pub fn diagram(&self) -> &Diagram {
+        &self.0.accepted.diagrams[&self.0.diagram]
+    }
+
+    pub fn selected(&self) -> &BTreeMap<Id, Id> {
+        &self.0.selected
+    }
+
+    pub fn affected(&self) -> &BTreeMap<Id, NodePlacement> {
+        &self.0.placements
+    }
+
+    pub fn anchor(&self) -> Id {
+        self.0.anchor
+    }
+
+    pub fn leaves(&self) -> &BTreeMap<Id, Leaf> {
+        &self.0.leaves
+    }
+}
+
+/// App must reject non-placement members before constructing this complete map.
+/// Every original identity is checked before redundant work roots are removed.
+pub fn capture(
+    p: &Project,
+    diagram: Id,
+    selected: &BTreeMap<Id, Id>,
+    anchor: Id,
+) -> Result<Scope, Refusal> {
+    validate_candidate(p).map_err(|e| Refusal::InvalidCandidate(e.to_string()))?;
+    let d = p.diagrams.get(&diagram).ok_or(Refusal::StaleScope)?;
+    if d.projection != ProjectionKind::Allocation
+        || selected.is_empty()
+        || !selected.contains_key(&anchor)
+    {
+        return Err(Refusal::Ineligible(
+            "Assignment requires selected work placements and a selected anchor in an Allocation view."
+                .into(),
+        ));
+    }
+    let index = ViewIndex::new(p);
+    let before_visible = projection::project_diagram_with_index(p, d, &index);
+    let visible: BTreeMap<_, _> = before_visible
+        .nodes
+        .iter()
+        .map(|node| (node.id, node.element))
+        .collect();
+    let mut work = BTreeMap::new();
+    for (placement, element) in selected {
+        let node = d.nodes.get(placement).ok_or(Refusal::StaleScope)?;
+        let record = p.elements.get(element).ok_or(Refusal::StaleScope)?;
+        if node.element != *element || visible.get(placement) != Some(element) {
+            return Err(Refusal::StaleScope);
+        }
+        if !record.kind().is_work() || record.layer() != d.layer {
+            return Err(Refusal::Ineligible(
+                "Assignment requires only activities or functions in this layer. Use Arrange only for a supported mixed selection."
+                    .into(),
+            ));
+        }
+        work.insert(*element, *placement);
+    }
+
+    let mut roots = Vec::new();
+    let mut placements = BTreeMap::new();
+    let mut leaves = BTreeMap::new();
+    for (element, placement) in &work {
+        let record = &p.elements[element];
+        let mut ancestor = record.parent;
+        let mut seen = BTreeSet::new();
+        let mut covered = false;
+        while let Some(id) = ancestor {
+            if !seen.insert(id) {
+                return Err(Refusal::StaleScope);
+            }
+            let parent = p.elements.get(&id).ok_or(Refusal::StaleScope)?;
+            if parent.kind() != record.kind() {
+                break;
+            }
+            if work.contains_key(&id) {
+                covered = true;
+                break;
+            }
+            ancestor = parent.parent;
+        }
+        if covered {
+            continue;
+        }
+        let root = capture_validated(p, diagram, *element, *placement)?;
+        if root.work_records.len() > 1 && root.uniform == Uniform::MixedOrUnresolved {
+            return Err(Refusal::MixedLayoutRequired);
+        }
+        for (id, leaf) in &root.leaves {
+            if leaves.insert(*id, leaf.clone()).is_some() {
+                return Err(Refusal::StaleScope);
+            }
+        }
+        placements.extend(root.placements.clone());
+        roots.push(root);
+    }
+    let expansion = geometry::expansion_ids(p, d, &index, &placements)?;
+    let before_expanded = geometry::expanded_view(p, d, &index, &expansion);
+    if roots
+        .iter()
+        .any(|root| root.work_records.len() > 1 && !coherent(root, &before_expanded))
+    {
+        return Err(Refusal::MixedLayoutRequired);
+    }
+    Ok(Scope(Arc::new(Captured {
+        accepted: p.clone(),
+        diagram,
+        selected: selected.clone(),
+        anchor,
+        roots,
+        placements,
+        leaves,
+        index,
+        before_visible,
+        before_expanded,
+    })))
+}
+
+#[derive(Debug)]
+pub struct SemanticPlan {
+    scope: Scope,
+    destination: Destination,
+    candidate: Project,
+    index: ViewIndex,
+    commands: Vec<Command>,
+    changed: BTreeSet<Id>,
+    expanded_ids: BTreeSet<Id>,
+    label: String,
+    warnings: Vec<Issue>,
+}
+
+impl SemanticPlan {
+    pub fn scope(&self) -> &Scope {
+        &self.scope
+    }
+
+    pub fn project(&self) -> &Project {
+        &self.candidate
+    }
+
+    pub fn index(&self) -> &ViewIndex {
+        &self.index
+    }
+
+    pub fn destination(&self) -> Destination {
+        self.destination
+    }
+
+    pub fn label(&self) -> &str {
+        &self.label
+    }
+
+    pub fn warnings(&self) -> &[Issue] {
+        &self.warnings
+    }
+
+    pub fn changed_count(&self) -> usize {
+        self.changed.len()
+    }
+
+    /// Already effective at the performer, or already unassigned for Outside.
+    pub fn already_correct_count(&self) -> usize {
+        self.scope.leaves().len() - self.changed.len()
+    }
+}
+
+/// Build one destination candidate. Per-root decisions read accepted facts;
+/// aliases and new identities are reserved in the combined expected Project.
+pub fn plan_semantics(
+    scope: &Scope,
+    destination: Destination,
+    allocation_ids: &BTreeMap<Id, Id>,
+) -> Result<SemanticPlan, Refusal> {
+    let accepted = scope.project();
+    match destination {
+        Destination::LayoutOnly => {
+            return Err(Refusal::Ineligible(
+                "Use the explicit Arrange only planner for presentation-only movement.".into(),
+            ));
+        }
+        Destination::Performer(id) => {
+            if !accepted.elements.get(&id).is_some_and(|element| {
+                element.kind().is_performer() && element.layer() == scope.diagram().layer
+            }) {
+                return Err(Refusal::Ineligible(
+                    "Choose a performer in this layer.".into(),
+                ));
+            }
+        }
+        Destination::OutsidePerformers => {}
+    }
+    let mut expected = accepted.clone();
+    let mut edits = IntendedEdits::default();
+    for root in &scope.0.roots {
+        append_semantic_edits(
+            accepted,
+            root,
+            destination,
+            allocation_ids,
+            &mut expected,
+            &mut edits,
+        )?;
+    }
+    for diagram in expected.diagrams.values_mut() {
+        diagram
+            .routes
+            .retain(|route| !edits.deleted.contains(&route.edge));
+    }
+    let candidate = prepare_command(accepted, &Command::Batch(edits.commands.clone()))
+        .map_err(|e| Refusal::InvalidCandidate(e.to_string()))?
+        .project;
+    exact_project(&expected, &candidate)?;
+    let warnings = validation::validate(&candidate)
+        .into_iter()
+        .filter(|issue| issue.severity == Severity::Warning)
+        .collect();
+    let index = ViewIndex::new(&candidate);
+    // Assignment may change visual ancestry: never reuse accepted expansion IDs.
+    let expanded_ids = geometry::expansion_ids(
+        &candidate,
+        &candidate.diagrams[&scope.0.diagram],
+        &index,
+        scope.affected(),
+    )?;
+    let total = scope.leaves().len();
+    let changed = edits.changed.len();
+    let already_correct = total - changed;
+    let noun = match (scope.diagram().layer, total) {
+        (Layer::Oa, 1) => "activity",
+        (Layer::Oa, _) => "activities",
+        (Layer::Sa, 1) => "function",
+        (Layer::Sa, _) => "functions",
+    };
+    let retained_roles = scope
+        .leaves()
+        .values()
+        .any(|leaf| !leaf.role_assignments.is_empty());
+    let label = match destination {
+        Destination::Performer(id) if changed == 0 => {
+            format!(
+                "Arrange within {} — all {total} leaf {noun} already assigned",
+                accepted.named(id)
+            )
+        }
+        Destination::Performer(id) => format!(
+            "Assign {changed} of {total} leaf {noun} to {}{}{}",
+            accepted.named(id),
+            if already_correct > 0 {
+                format!(" · {already_correct} already assigned")
+            } else {
+                String::new()
+            },
+            if retained_roles {
+                " — role responsibility retained"
+            } else {
+                ""
+            },
+        ),
+        Destination::OutsidePerformers if changed == 0 => {
+            "Arrange unassigned work — decomposition retained".into()
+        }
+        Destination::OutsidePerformers => format!(
+            "Remove assignments from {changed} of {total} leaf {noun} — decomposition retained"
+        ),
+        Destination::LayoutOnly => unreachable!(),
+    };
+    Ok(SemanticPlan {
+        scope: scope.clone(),
+        destination,
+        candidate,
+        index,
+        commands: edits.commands,
+        changed: edits.changed,
+        expanded_ids,
+        label,
+        warnings,
+    })
+}
+
+/// Translate the entire captured Q once, then evaluate the combined candidate.
+/// This path does not clone/validate a Project or rebuild semantic indexes.
+pub fn place(
+    plan: &SemanticPlan,
+    requested: Position,
+    presentation: PresentationContext,
+) -> Result<PlacementPlan, Refusal> {
+    if !requested.x.is_finite()
+        || !requested.y.is_finite()
+        || !presentation.viewport.valid()
+        || !presentation.zoom.is_finite()
+        || presentation.zoom <= 0.
+    {
+        return Err(Refusal::LayoutRequired(
+            "Make room or adjust the view, then drag again.".into(),
+        ));
+    }
+    let scope = &plan.scope;
+    let geometry::Translation {
+        mut diagram,
+        mut commands,
+        delta,
+    } = geometry::translate(
+        scope.project(),
+        scope.diagram(),
+        &plan.candidate.diagrams[&scope.0.diagram],
+        scope.affected(),
+        scope.anchor(),
+        requested,
+    )?;
+    let mut unfolded = None;
+    if let Destination::Performer(performer) = plan.destination {
+        let target = presentation.target.ok_or_else(|| {
+            Refusal::LayoutRequired("A visible accepted performer target is required.".into())
+        })?;
+        if !scope
+            .0
+            .before_visible
+            .nodes
+            .iter()
+            .any(|node| node.id == target.placement && node.element == performer)
+        {
+            return Err(Refusal::LayoutRequired(
+                "Make room or adjust the view, then drag again.".into(),
+            ));
+        }
+        let target_node = diagram
+            .nodes
+            .get_mut(&target.placement)
+            .ok_or(Refusal::StaleScope)?;
+        if target_node.element != performer {
+            return Err(Refusal::StaleScope);
+        }
+        if !plan.changed.is_empty() && target_node.collapsed {
+            target_node.collapsed = false;
+            unfolded = Some(target_node.id);
+            commands.push(Command::EditNode {
+                diagram: diagram.id,
+                original: target_node.id,
+                node: target_node.clone(),
+            });
+        }
+    } else if presentation.target.is_some() {
+        return Err(Refusal::Ineligible(
+            "An outside destination has no performer target.".into(),
+        ));
+    }
+    let view = projection::project_diagram_with_index(&plan.candidate, &diagram, &plan.index);
+    let expanded =
+        geometry::expanded_view(&plan.candidate, &diagram, &plan.index, &plan.expanded_ids);
+    if scope
+        .0
+        .roots
+        .iter()
+        .any(|root| root.work_records.len() > 1 && !coherent(root, &expanded))
+    {
+        return Err(Refusal::MixedLayoutRequired);
+    }
+    geometry::check_scenes(
+        &scope.0.before_visible,
+        &scope.0.before_expanded,
+        &view,
+        &expanded,
+    )?;
+    geometry::check_rigid(&scope.0.before_expanded, &expanded, scope.affected(), delta)?;
+    geometry::check_headers(&view, scope.selected(), presentation.viewport)?;
+    Ok(PlacementPlan {
+        diagram,
+        view,
+        delta,
+        unfolded,
+        requested,
+        presentation,
+        commands,
+    })
+}
+
+/// Recheck immutable facts and recompute geometry before one final source batch.
+/// Zero delta remains a transaction when assignment semantics changed.
+pub fn finish(
+    plan: &SemanticPlan,
+    live: &Project,
+    placement: &PlacementPlan,
+) -> Result<Option<Command>, Refusal> {
+    if live != plan.scope.project() {
+        return Err(Refusal::StaleScope);
+    }
+    let checked = place(plan, placement.requested, placement.presentation)?;
+    if checked.diagram != placement.diagram
+        || checked.view != placement.view
+        || checked.delta != placement.delta
+        || checked.unfolded != placement.unfolded
+        || checked.commands != placement.commands
+    {
+        return Err(Refusal::StaleScope);
+    }
+    let mut expected = plan.candidate.clone();
+    expected
+        .diagrams
+        .insert(checked.diagram.id, checked.diagram);
+    let mut commands = plan.commands.clone();
+    commands.extend(checked.commands);
+    let command = Command::Batch(commands);
+    let actual = prepare_command(live, &command)
+        .map_err(|e| Refusal::InvalidCandidate(e.to_string()))?
+        .project;
+    exact_project(&expected, &actual)?;
+    Ok((actual != *live).then_some(command))
+}

crates/oa-desktop/src/allocation_drag/assignment_boundary_tests.rs

@@ -0,0 +1,497 @@
+use super::*;
+
+struct Composite {
+    f: Fixture,
+    child: Id,
+    child_node: Id,
+    unplaced: Id,
+}
+
+fn composite(layer: Layer) -> Composite {
+    let mut f = fixture(layer);
+    let kind = f.p.elements[&f.w].kind();
+    let child =
+        f.p.add_element(kind, layer, "Placed child", Some(f.w))
+            .unwrap();
+    let unplaced =
+        f.p.add_element(kind, layer, "Unplaced leaf", Some(f.w))
+            .unwrap();
+    let child_node = f.p.place(f.d, child, xy(140., 600.));
+    validate_candidate(&f.p).unwrap();
+    Composite {
+        f,
+        child,
+        child_node,
+        unplaced,
+    }
+}
+
+fn expected_allocation(id: Id, alias: &str, name: &str, performer: Id, work: Id) -> Relation {
+    Relation {
+        id,
+        alias: alias.into(),
+        name: name.into(),
+        description: String::new(),
+        body: RelationBody::Allocation {
+            source: performer,
+            target: work,
+        },
+    }
+}
+
+#[test]
+fn group_assignment_checks_original_identity_and_visibility_before_normalization() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let c = composite(layer);
+        let valid = BTreeMap::from([(c.f.n, c.f.w), (c.child_node, c.child)]);
+        let admitted = assignment::capture(&c.f.p, c.f.d, &valid, c.f.n).unwrap();
+        assert_eq!(admitted.selected(), &valid);
+        let foreign = c.f.p.diagrams[&c.f.second]
+            .nodes
+            .values()
+            .find(|node| node.element == c.f.w)
+            .unwrap()
+            .id;
+        // Each extra member is semantically covered by the valid selected parent.
+        // Normalizing first would incorrectly hide its invalid original identity.
+        for invalid in [
+            BTreeMap::from([(c.f.n, c.f.w), (c.child_node, c.unplaced)]),
+            BTreeMap::from([(c.f.n, c.f.w), (Id::new_v4(), c.child)]),
+            BTreeMap::from([(c.f.n, c.f.w), (foreign, c.f.w)]),
+        ] {
+            assert!(matches!(
+                assignment::capture(&c.f.p, c.f.d, &invalid, c.f.n),
+                Err(Refusal::StaleScope)
+            ));
+        }
+        let mut folded = c.f.p.clone();
+        folded
+            .diagrams
+            .get_mut(&c.f.d)
+            .unwrap()
+            .nodes
+            .get_mut(&c.f.n)
+            .unwrap()
+            .collapsed = true;
+        validate_candidate(&folded).unwrap();
+        assert!(
+            !projection::project_view(&folded, c.f.d)
+                .nodes
+                .iter()
+                .any(|node| node.id == c.child_node)
+        );
+        // Hidden descendants remain in Q when only the visible parent is selected.
+        let parent_only =
+            assignment::capture(&folded, c.f.d, &BTreeMap::from([(c.f.n, c.f.w)]), c.f.n).unwrap();
+        assert!(parent_only.affected().contains_key(&c.child_node));
+        assert!(matches!(
+            assignment::capture(&folded, c.f.d, &valid, c.f.n),
+            Err(Refusal::StaleScope)
+        ));
+    }
+}
+
+#[test]
+fn group_assignment_normalizes_parent_child_and_assigns_unplaced_leaf_once() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let c = composite(layer);
+        let selected = BTreeMap::from([(c.f.n, c.f.w), (c.child_node, c.child)]);
+        let scope = assignment::capture(&c.f.p, c.f.d, &selected, c.f.n).unwrap();
+        assert_eq!(scope.selected(), &selected);
+        assert_eq!(
+            scope.affected().keys().copied().collect::<BTreeSet<_>>(),
+            BTreeSet::from([c.f.n, c.child_node])
+        );
+        assert_eq!(
+            scope.leaves().keys().copied().collect::<BTreeSet<_>>(),
+            BTreeSet::from([c.child, c.unplaced])
+        );
+        let child_allocation = Id::new_v4();
+        let unplaced_allocation = Id::new_v4();
+        let ids = BTreeMap::from([
+            (c.child, child_allocation),
+            (c.unplaced, unplaced_allocation),
+        ]);
+        let plan = assignment::plan_semantics(&scope, Destination::Performer(c.f.a), &ids).unwrap();
+        assert_eq!(plan.changed_count(), 2);
+        let mut expected = c.f.p.clone();
+        expected.relations.insert(
+            child_allocation,
+            expected_allocation(
+                child_allocation,
+                "a_performs_placed_child",
+                "A performs Placed child",
+                c.f.a,
+                c.child,
+            ),
+        );
+        expected.relations.insert(
+            unplaced_allocation,
+            expected_allocation(
+                unplaced_allocation,
+                "a_performs_unplaced_leaf",
+                "A performs Unplaced leaf",
+                c.f.a,
+                c.unplaced,
+            ),
+        );
+        assert_eq!(plan.project(), &expected);
+        let placed = assignment::place(
+            &plan,
+            xy(140., 200.),
+            presentation(&c.f.p, c.f.d, Some(c.f.a)),
+        )
+        .unwrap();
+        let mut clipped = presentation(&c.f.p, c.f.d, Some(c.f.a));
+        clipped.viewport.size.height = 450.; // bottom350: parent header fits; selected child ends362.
+        for (id, should_fit) in [(c.f.n, true), (c.child_node, false)] {
+            let node = placed.view.nodes.iter().find(|node| node.id == id).unwrap();
+            let header = Rect {
+                position: node.position,
+                size: Size {
+                    width: node.size.width,
+                    height: 62.,
+                },
+            };
+            assert_eq!(clipped.viewport.contains(header), should_fit);
+        }
+        assert!(
+            matches!(
+                assignment::place(&plan, xy(140., 200.), clipped),
+                Err(Refusal::LayoutRequired(_))
+            ),
+            "normalized-away selected child still requires its header"
+        );
+        let d = expected.diagrams.get_mut(&c.f.d).unwrap();
+        d.nodes.get_mut(&c.f.n).unwrap().position = xy(140., 200.);
+        d.nodes.get_mut(&c.child_node).unwrap().position = xy(180., 300.);
+        assert_eq!(placed.delta, xy(40., -300.));
+        assert_eq!(
+            roundtrip(
+                &c.f.p,
+                assignment::finish(&plan, &c.f.p, &placed).unwrap().unwrap()
+            ),
+            expected
+        );
+        assert_eq!(
+            expected.diagrams[&c.f.d].nodes.len(),
+            c.f.p.diagrams[&c.f.d].nodes.len()
+        );
+        assert!(
+            !expected.diagrams[&c.f.d]
+                .nodes
+                .values()
+                .any(|node| node.element == c.unplaced)
+        );
+        assert!(
+            !expected
+                .relations
+                .values()
+                .any(|relation| relation.kind() == RelationKind::Allocation
+                    && relation.target() == c.f.w)
+        );
+    }
+}
+
+#[test]
+fn group_assignment_distributed_parent_refuses_but_its_independent_leaves_can_reassign() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut c = composite(layer);
+        let second_node = c.f.p.place(c.f.d, c.unplaced, xy(940., 200.));
+        let performer =
+            c.f.p
+                .add_element(
+                    if layer == Layer::Oa {
+                        Kind::Actor
+                    } else {
+                        Kind::SystemActor
+                    },
+                    layer,
+                    "C",
+                    None,
+                )
+                .unwrap();
+        c.f.p.place(c.f.d, performer, xy(1700., 100.));
+        let d = c.f.p.diagrams.get_mut(&c.f.d).unwrap();
+        d.nodes.get_mut(&c.f.n).unwrap().position = xy(1700., 800.);
+        d.nodes.get_mut(&c.child_node).unwrap().position = xy(140., 200.);
+        let ax =
+            c.f.p
+                .relate(RelationKind::Allocation, "A child", c.f.a, c.child);
+        let by =
+            c.f.p
+                .relate(RelationKind::Allocation, "B child", c.f.b, c.unplaced);
+        validate_candidate(&c.f.p).unwrap();
+        let visible = projection::project_view(&c.f.p, c.f.d);
+        for id in [c.f.n, c.child_node, second_node] {
+            assert!(visible.nodes.iter().any(|node| node.id == id));
+        }
+        assert_eq!(scope(&c.f).uniform, Uniform::MixedOrUnresolved);
+        assert!(matches!(
+            assignment::capture(&c.f.p, c.f.d, &BTreeMap::from([(c.f.n, c.f.w)]), c.f.n,),
+            Err(Refusal::MixedLayoutRequired)
+        ));
+        let selected = BTreeMap::from([(c.child_node, c.child), (second_node, c.unplaced)]);
+        let captured = assignment::capture(&c.f.p, c.f.d, &selected, c.child_node).unwrap();
+        let plan = assignment::plan_semantics(
+            &captured,
+            Destination::Performer(performer),
+            &BTreeMap::new(),
+        )
+        .unwrap();
+        let mut expected = c.f.p.clone();
+        expected.relations.get_mut(&ax).unwrap().body = RelationBody::Allocation {
+            source: performer,
+            target: c.child,
+        };
+        expected.relations.get_mut(&by).unwrap().body = RelationBody::Allocation {
+            source: performer,
+            target: c.unplaced,
+        };
+        assert_eq!(plan.project(), &expected);
+        // One delta moves both leaves. The unselected semantic parent remains
+        // authored at (1700,800), while its derived enclosure may change.
+        let placed = assignment::place(
+            &plan,
+            xy(1740., 120.),
+            presentation(&c.f.p, c.f.d, Some(performer)),
+        )
+        .unwrap();
+        let d = expected.diagrams.get_mut(&c.f.d).unwrap();
+        d.nodes.get_mut(&c.child_node).unwrap().position = xy(1740., 120.);
+        d.nodes.get_mut(&second_node).unwrap().position = xy(2540., 120.);
+        assert_eq!(
+            roundtrip(
+                &c.f.p,
+                assignment::finish(&plan, &c.f.p, &placed).unwrap().unwrap()
+            ),
+            expected
+        );
+    }
+}
+
+fn separate_unassigned(layer: Layer) -> (Fixture, Id, Id) {
+    let mut f = fixture(layer);
+    let companion =
+        f.p.add_element(f.p.elements[&f.w].kind(), layer, "Companion", None)
+            .unwrap();
+    let companion_node = f.p.place(f.d, companion, xy(100., 1000.));
+    validate_candidate(&f.p).unwrap();
+    (f, companion, companion_node)
+}
+
+#[test]
+fn group_assignment_finish_rejects_stale_project_and_each_tampered_result() {
+    let (f, companion, companion_node) = separate_unassigned(Layer::Oa);
+    let selected = BTreeMap::from([(f.n, f.w), (companion_node, companion)]);
+    let captured = assignment::capture(&f.p, f.d, &selected, f.n).unwrap();
+    let plan =
+        assignment::plan_semantics(&captured, Destination::OutsidePerformers, &BTreeMap::new())
+            .unwrap();
+    let context = presentation(&f.p, f.d, None);
+    let valid = assignment::place(&plan, xy(500., 500.), context).unwrap();
+    let mut expected = f.p.clone();
+    expected
+        .diagrams
+        .get_mut(&f.d)
+        .unwrap()
+        .nodes
+        .get_mut(&f.n)
+        .unwrap()
+        .position = xy(500., 500.);
+    expected
+        .diagrams
+        .get_mut(&f.d)
+        .unwrap()
+        .nodes
+        .get_mut(&companion_node)
+        .unwrap()
+        .position = xy(500., 1000.);
+    assert_eq!(
+        roundtrip(
+            &f.p,
+            assignment::finish(&plan, &f.p, &valid).unwrap().unwrap()
+        ),
+        expected
+    );
+    let mut stale = f.p.clone();
+    stale.elements.get_mut(&f.b).unwrap().description = "Changed unrelated accepted record".into();
+    validate_candidate(&stale).unwrap();
+    assert!(matches!(
+        assignment::finish(&plan, &stale, &valid),
+        Err(Refusal::StaleScope)
+    ));
+    for field in 0..6 {
+        let mut altered = assignment::place(&plan, xy(500., 500.), context).unwrap();
+        match field {
+            0 => altered.diagram.nodes.get_mut(&f.n).unwrap().position.x += 20.,
+            1 => {
+                altered
+                    .view
+                    .nodes
+                    .iter_mut()
+                    .find(|node| node.id == f.n)
+                    .unwrap()
+                    .position
+                    .x += 20.
+            }
+            2 => altered.delta.x += 20.,
+            3 => altered.unfolded = Some(f.n),
+            4 => altered.commands.clear(),
+            5 => altered.requested.x += 10.,
+            _ => unreachable!(),
+        }
+        assert!(
+            matches!(
+                assignment::finish(&plan, &f.p, &altered),
+                Err(Refusal::StaleScope)
+            ),
+            "tampered result field {field}"
+        );
+    }
+}
+
+#[test]
+fn group_assignment_requires_non_anchor_selected_header_inside_viewport() {
+    let (f, companion, companion_node) = separate_unassigned(Layer::Oa);
+    let captured = assignment::capture(
+        &f.p,
+        f.d,
+        &BTreeMap::from([(f.n, f.w), (companion_node, companion)]),
+        f.n,
+    )
+    .unwrap();
+    let plan =
+        assignment::plan_semantics(&captured, Destination::OutsidePerformers, &BTreeMap::new())
+            .unwrap();
+    let wide = presentation(&f.p, f.d, None);
+    let placed = assignment::place(&plan, xy(500., 500.), wide).unwrap();
+    let mut narrow = wide;
+    narrow.viewport.size.height = 800.; // world bottom700: anchor header fits, companion does not.
+    let header = |id| {
+        let node = placed.view.nodes.iter().find(|node| node.id == id).unwrap();
+        Rect {
+            position: node.position,
+            size: Size {
+                width: node.size.width,
+                height: 62.,
+            },
+        }
+    };
+    assert!(narrow.viewport.contains(header(f.n)));
+    assert!(!narrow.viewport.contains(header(companion_node)));
+    // Only the viewport differs from the already admitted identical geometry.
+    assert!(matches!(
+        assignment::place(&plan, xy(500., 500.), narrow),
+        Err(Refusal::LayoutRequired(_))
+    ));
+}
+
+#[test]
+fn group_assignment_unresolved_oa_role_leaf_accepts_explicit_target_but_not_outside() {
+    for ambiguous in [false, true] {
+        let (mut f, companion, companion_node) = separate_unassigned(Layer::Oa);
+        let (role_id, role_assignment) = role(&mut f, None);
+        if ambiguous {
+            f.p.relate(
+                RelationKind::RoleRealization,
+                "A realizes responsibility",
+                f.a,
+                role_id,
+            );
+            f.p.relate(
+                RelationKind::RoleRealization,
+                "B realizes responsibility",
+                f.b,
+                role_id,
+            );
+        }
+        validate_candidate(&f.p).unwrap();
+        assert_eq!(validation::effective_performer(&f.p, f.w), None);
+        let captured = assignment::capture(
+            &f.p,
+            f.d,
+            &BTreeMap::from([(f.n, f.w), (companion_node, companion)]),
+            f.n,
+        )
+        .unwrap();
+        let Refusal::RoleExitRequired {
+            work,
+            roles,
+            performers,
+            ..
+        } = assignment::plan_semantics(&captured, Destination::OutsidePerformers, &BTreeMap::new())
+            .unwrap_err()
+        else {
+            panic!("unresolved role must produce its specific outward refusal");
+        };
+        assert_eq!(work, f.w);
+        assert_eq!(roles, vec![role_id]);
+        assert_eq!(
+            performers.into_iter().collect::<BTreeSet<_>>(),
+            if ambiguous {
+                BTreeSet::from([f.a, f.b])
+            } else {
+                BTreeSet::new()
+            }
+        );
+        let work_allocation = Id::new_v4();
+        let companion_allocation = Id::new_v4();
+        let ids = BTreeMap::from([(f.w, work_allocation), (companion, companion_allocation)]);
+        let plan =
+            assignment::plan_semantics(&captured, Destination::Performer(f.b), &ids).unwrap();
+        assert_eq!(plan.changed_count(), 2);
+        assert!(plan.label().contains("role responsibility retained"));
+        let mut expected = f.p.clone();
+        expected.relations.insert(
+            work_allocation,
+            expected_allocation(
+                work_allocation,
+                "b_performs_work",
+                "B performs Work",
+                f.b,
+                f.w,
+            ),
+        );
+        expected.relations.insert(
+            companion_allocation,
+            expected_allocation(
+                companion_allocation,
+                "b_performs_companion",
+                "B performs Companion",
+                f.b,
+                companion,
+            ),
+        );
+        assert_eq!(plan.project(), &expected);
+        assert_eq!(
+            plan.project().relations[&role_assignment],
+            f.p.relations[&role_assignment]
+        );
+        let placed =
+            assignment::place(&plan, xy(940., 200.), presentation(&f.p, f.d, Some(f.b))).unwrap();
+        expected
+            .diagrams
+            .get_mut(&f.d)
+            .unwrap()
+            .nodes
+            .get_mut(&f.n)
+            .unwrap()
+            .position = xy(940., 200.);
+        expected
+            .diagrams
+            .get_mut(&f.d)
+            .unwrap()
+            .nodes
+            .get_mut(&companion_node)
+            .unwrap()
+            .position = xy(940., 700.);
+        assert_eq!(
+            roundtrip(
+                &f.p,
+                assignment::finish(&plan, &f.p, &placed).unwrap().unwrap()
+            ),
+            expected
+        );
+    }
+}

crates/oa-desktop/src/allocation_drag/assignment_tests.rs

@@ -0,0 +1,606 @@
+use super::*;
+
+struct Roots {
+    f: Fixture,
+    c: Id,
+    cn: Id,
+    y: Id,
+    yn: Id,
+    z: Id,
+    zn: Id,
+    ax: Id,
+    by: Id,
+}
+
+fn roots(layer: Layer) -> Roots {
+    let mut f = fixture(layer);
+    let kind = f.p.elements[&f.w].kind();
+    let c =
+        f.p.add_element(
+            if layer == Layer::Oa {
+                Kind::Actor
+            } else {
+                Kind::SystemActor
+            },
+            layer,
+            "C",
+            None,
+        )
+        .unwrap();
+    let y = f.p.add_element(kind, layer, "Y", None).unwrap();
+    let z = f.p.add_element(kind, layer, "Z", None).unwrap();
+    let cn = f.p.place(f.d, c, xy(1500., 100.));
+    let yn = f.p.place(f.d, y, xy(140., 800.));
+    let zn = f.p.place(f.d, z, xy(1540., 1400.));
+    let d = f.p.diagrams.get_mut(&f.d).unwrap();
+    d.nodes.get_mut(&f.n).unwrap().position = xy(140., 200.);
+    d.nodes
+        .values_mut()
+        .find(|n| n.element == f.b)
+        .unwrap()
+        .position = xy(100., 700.);
+    let ax = f.p.relate(
+        RelationKind::Allocation,
+        "Original X responsibility",
+        f.a,
+        f.w,
+    );
+    let by = f.p.relate(
+        RelationKind::Allocation,
+        "Original Y responsibility",
+        f.b,
+        y,
+    );
+    f.p.relations.get_mut(&ax).unwrap().description = "Reviewed X identity must survive".into();
+    f.p.relations.get_mut(&by).unwrap().description = "Reviewed Y identity must survive".into();
+    if layer == Layer::Oa {
+        let r =
+            f.p.add_element(Kind::Role, layer, "Responsibility", None)
+                .unwrap();
+        f.p.relate(RelationKind::RoleAssignment, "Z role", r, z);
+        f.p.relate(RelationKind::RoleRealization, "C role", c, r);
+    } else {
+        f.p.relate(RelationKind::Allocation, "Z already assigned", c, z);
+    }
+    validate_candidate(&f.p).unwrap();
+    Roots {
+        f,
+        c,
+        cn,
+        y,
+        yn,
+        z,
+        zn,
+        ax,
+        by,
+    }
+}
+
+fn wide(p: &Project, d: Id, target: Option<Id>) -> PresentationContext {
+    let mut context = presentation(p, d, target);
+    context.viewport.size = Size {
+        width: 5000.,
+        height: 3000.,
+    };
+    context
+}
+
+fn selected(r: &Roots, with_z: bool) -> BTreeMap<Id, Id> {
+    let mut ids = BTreeMap::from([(r.f.n, r.f.w), (r.yn, r.y)]);
+    if with_z {
+        ids.insert(r.zn, r.z);
+    }
+    ids
+}
+
+fn retarget(p: &mut Project, relation: Id, target: Id) {
+    let r = p.relations.get_mut(&relation).unwrap();
+    r.body = RelationBody::Allocation {
+        source: target,
+        target: r.target(),
+    };
+}
+
+#[test]
+fn group_assignment_independent_performers_preserves_already_correct_provenance() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let r = roots(layer);
+        let selected = selected(&r, true);
+        let scope = assignment::capture(&r.f.p, r.f.d, &selected, r.f.n).unwrap();
+        let plan =
+            assignment::plan_semantics(&scope, Destination::Performer(r.c), &BTreeMap::new())
+                .unwrap();
+        assert_eq!(plan.changed_count(), 2);
+        assert_eq!(plan.already_correct_count(), 1);
+        let placed =
+            assignment::place(&plan, xy(1540., 200.), wide(&r.f.p, r.f.d, Some(r.c))).unwrap();
+        let mut expected = r.f.p.clone();
+        retarget(&mut expected, r.ax, r.c);
+        retarget(&mut expected, r.by, r.c);
+        let d = expected.diagrams.get_mut(&r.f.d).unwrap();
+        d.nodes.get_mut(&r.f.n).unwrap().position = xy(1540., 200.);
+        d.nodes.get_mut(&r.yn).unwrap().position = xy(1540., 800.);
+        d.nodes.get_mut(&r.zn).unwrap().position = xy(2940., 1400.);
+        assert_eq!(
+            roundtrip(
+                &r.f.p,
+                assignment::finish(&plan, &r.f.p, &placed).unwrap().unwrap()
+            ),
+            expected
+        );
+        if layer == Layer::Oa {
+            assert!(
+                !plan
+                    .project()
+                    .relations
+                    .values()
+                    .any(|relation| relation.kind() == RelationKind::Allocation
+                        && relation.target() == r.z)
+            );
+            assert!(matches!(
+                assignment::plan_semantics(
+                    &scope,
+                    Destination::OutsidePerformers,
+                    &BTreeMap::new()
+                ),
+                Err(Refusal::RoleExitRequired { .. })
+            ));
+        }
+        assert!(
+            assignment::plan_semantics(&scope, Destination::LayoutOnly, &BTreeMap::new()).is_err()
+        );
+    }
+}
+
+#[test]
+fn group_assignment_zero_delta_changes_semantics_once_and_then_is_noop() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = fixture(layer);
+        let d = f.p.diagrams.get_mut(&f.d).unwrap();
+        d.nodes
+            .values_mut()
+            .find(|n| n.element == f.a)
+            .unwrap()
+            .size = Size {
+            width: 600.,
+            height: 400.,
+        };
+        d.nodes.get_mut(&f.n).unwrap().position = xy(140., 200.);
+        let scope = assignment::capture(&f.p, f.d, &BTreeMap::from([(f.n, f.w)]), f.n).unwrap();
+        let id = Id::new_v4();
+        let plan = assignment::plan_semantics(
+            &scope,
+            Destination::Performer(f.a),
+            &BTreeMap::from([(f.w, id)]),
+        )
+        .unwrap();
+        let placed = assignment::place(&plan, xy(140., 200.), wide(&f.p, f.d, Some(f.a))).unwrap();
+        assert_eq!(placed.delta, xy(0., 0.));
+        let mut expected = f.p.clone();
+        expected.relations.insert(
+            id,
+            Relation {
+                id,
+                alias: "a_performs_work".into(),
+                name: "A performs Work".into(),
+                description: String::new(),
+                body: RelationBody::Allocation {
+                    source: f.a,
+                    target: f.w,
+                },
+            },
+        );
+        assert_eq!(
+            roundtrip(
+                &f.p,
+                assignment::finish(&plan, &f.p, &placed).unwrap().unwrap()
+            ),
+            expected
+        );
+        let scope =
+            assignment::capture(&expected, f.d, &BTreeMap::from([(f.n, f.w)]), f.n).unwrap();
+        let noop =
+            assignment::plan_semantics(&scope, Destination::Performer(f.a), &BTreeMap::new())
+                .unwrap();
+        let placed =
+            assignment::place(&noop, xy(140., 200.), wide(&expected, f.d, Some(f.a))).unwrap();
+        assert!(
+            assignment::finish(&noop, &expected, &placed)
+                .unwrap()
+                .is_none()
+        );
+    }
+}
+
+#[test]
+fn group_assignment_unfolds_only_changed_destination_and_refuses_newly_exposed_overlap() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        for obstacle in [false, true] {
+            let mut r = roots(layer);
+            let d = r.f.p.diagrams.get_mut(&r.f.d).unwrap();
+            d.nodes
+                .values_mut()
+                .find(|n| n.element == r.f.b)
+                .unwrap()
+                .position = xy(100., 400.);
+            d.nodes.get_mut(&r.yn).unwrap().position = xy(140., 500.);
+            d.nodes.get_mut(&r.zn).unwrap().position = xy(1540., 800.);
+            d.nodes.get_mut(&r.cn).unwrap().collapsed = true;
+            if obstacle {
+                let k =
+                    r.f.p
+                        .add_element(r.f.p.elements[&r.f.w].kind(), layer, "Hidden overlap", None)
+                        .unwrap();
+                r.f.p
+                    .relate(RelationKind::Allocation, "C also owns K", r.c, k);
+                r.f.p.place(r.f.d, k, xy(1540., 800.));
+            }
+            assert!(
+                !projection::project_view(&r.f.p, r.f.d)
+                    .nodes
+                    .iter()
+                    .any(|n| n.id == r.zn)
+            );
+            assert!(
+                assignment::capture(&r.f.p, r.f.d, &selected(&r, true), r.f.n).is_err(),
+                "hidden selected member is not normalized away"
+            );
+            let scope = assignment::capture(&r.f.p, r.f.d, &selected(&r, false), r.f.n).unwrap();
+            let plan =
+                assignment::plan_semantics(&scope, Destination::Performer(r.c), &BTreeMap::new())
+                    .unwrap();
+            let placed = assignment::place(&plan, xy(1540., 120.), wide(&r.f.p, r.f.d, Some(r.c)));
+            if obstacle {
+                assert!(matches!(placed, Err(Refusal::LayoutRequired(_))));
+                continue;
+            }
+            let placed = placed.unwrap();
+            assert_eq!(placed.unfolded, Some(r.cn));
+            let mut expected = r.f.p.clone();
+            retarget(&mut expected, r.ax, r.c);
+            retarget(&mut expected, r.by, r.c);
+            let d = expected.diagrams.get_mut(&r.f.d).unwrap();
+            d.nodes.get_mut(&r.cn).unwrap().collapsed = false;
+            d.nodes.get_mut(&r.f.n).unwrap().position = xy(1540., 120.);
+            d.nodes.get_mut(&r.yn).unwrap().position = xy(1540., 420.);
+            assert_eq!(
+                roundtrip(
+                    &r.f.p,
+                    assignment::finish(&plan, &r.f.p, &placed).unwrap().unwrap()
+                ),
+                expected
+            );
+        }
+    }
+}
+
+#[test]
+fn group_assignment_accumulates_stable_ids_and_aliases_without_partial_reuse() {
+    let mut f = fixture(Layer::Oa);
+    let y =
+        f.p.add_element(Kind::Activity, Layer::Oa, "Work", None)
+            .unwrap();
+    let yn = f.p.place(f.d, y, xy(400., 500.));
+    let selected = BTreeMap::from([(f.n, f.w), (yn, y)]);
+    let scope = assignment::capture(&f.p, f.d, &selected, f.n).unwrap();
+    let ids = BTreeMap::from([(f.w, Id::new_v4()), (y, Id::new_v4())]);
+    let first = assignment::plan_semantics(&scope, Destination::Performer(f.a), &ids).unwrap();
+    let other = assignment::plan_semantics(&scope, Destination::Performer(f.b), &ids).unwrap();
+    let repeated = assignment::plan_semantics(&scope, Destination::Performer(f.a), &ids).unwrap();
+    assert_eq!(first.project(), repeated.project());
+    assert_eq!(first.changed_count(), 2);
+    let mut expected = f.p.clone();
+    let aliases: BTreeSet<_> = ids
+        .values()
+        .map(|id| first.project().relations[id].alias.clone())
+        .collect();
+    assert_eq!(aliases.len(), 2);
+    assert!(aliases.contains("a_performs_work"));
+    for (ordinal, (work, id)) in ids.iter().enumerate() {
+        let relation = &first.project().relations[id];
+        let expected_relation = Relation {
+            id: *id,
+            alias: if ordinal == 0 {
+                "a_performs_work".into()
+            } else {
+                format!("a_performs_work_{}", &id.simple().to_string()[..8])
+            },
+            name: "A performs Work".into(),
+            description: String::new(),
+            body: RelationBody::Allocation {
+                source: f.a,
+                target: *work,
+            },
+        };
+        assert_eq!(relation, &expected_relation);
+        assert_eq!(
+            other.project().relations[id].body,
+            RelationBody::Allocation {
+                source: f.b,
+                target: *work
+            }
+        );
+        expected.relations.insert(*id, expected_relation);
+    }
+    assert_eq!(first.project(), &expected);
+    let duplicate = Id::new_v4();
+    for bad in [
+        BTreeMap::from([(f.w, duplicate), (y, duplicate)]),
+        BTreeMap::from([(f.w, Id::nil()), (y, ids[&y])]),
+        BTreeMap::from([(f.w, f.a), (y, ids[&y])]),
+    ] {
+        assert!(assignment::plan_semantics(&scope, Destination::Performer(f.a), &bad).is_err());
+    }
+}
+
+#[test]
+fn group_assignment_source_failure_preserves_existing_history_and_retry_ids() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = fixture(layer);
+        let y =
+            f.p.add_element(f.p.elements[&f.w].kind(), layer, "Y", None)
+                .unwrap();
+        let yn = f.p.place(f.d, y, xy(400., 800.));
+        let mut bundle = format_bundle(&f.p);
+        bundle
+            .files
+            .get_mut(&bundle.entry.clone())
+            .unwrap()
+            .insert_str(
+                0,
+                "// Keep reviewed source through a refused group assignment.\n",
+            );
+        let mut limits = ProjectLimits::default();
+        limits.model.max_source_bytes = bundle.files.values().map(String::len).sum::<usize>() + 128;
+        let mut document = Document::from_bundle(bundle, limits).unwrap();
+        document
+            .execute(Command::Describe(f.w, "Reviewed".into()))
+            .unwrap();
+        document
+            .execute(Command::Rename(y, "Future Y".into()))
+            .unwrap();
+        let redo_project = document.project().clone();
+        let redo_source = document.bundle().clone();
+        assert!(document.undo());
+        assert!(document.can_undo() && document.can_redo());
+        let accepted = document.project().clone();
+        let source = document.bundle().clone();
+        let revision = document.revision();
+        let ids = BTreeMap::from([(f.w, Id::new_v4()), (y, Id::new_v4())]);
+        let scope =
+            assignment::capture(&accepted, f.d, &BTreeMap::from([(f.n, f.w), (yn, y)]), f.n)
+                .unwrap();
+        let plan = assignment::plan_semantics(&scope, Destination::Performer(f.a), &ids).unwrap();
+        let placed =
+            assignment::place(&plan, xy(150., 200.), wide(&accepted, f.d, Some(f.a))).unwrap();
+        let command = assignment::finish(&plan, &accepted, &placed)
+            .unwrap()
+            .unwrap();
+        assert!(matches!(
+            document.execute(command.clone()),
+            Err(crate::document::DocumentError::Source(_))
+        ));
+        assert_eq!(document.project(), &accepted);
+        assert_eq!(document.bundle(), &source);
+        assert_eq!(document.revision(), revision);
+        assert!(document.can_undo() && document.can_redo());
+        assert!(document.redo());
+        assert_eq!(document.project(), &redo_project);
+        assert_eq!(document.bundle(), &redo_source);
+        assert!(document.undo());
+        assert_eq!(document.project(), &accepted);
+        assert_eq!(document.bundle(), &source);
+        let mut expected = accepted.clone();
+        for (work, name, alias) in [
+            (f.w, "A performs Work", "a_performs_work"),
+            (y, "A performs Y", "a_performs_y"),
+        ] {
+            expected.relations.insert(
+                ids[&work],
+                Relation {
+                    id: ids[&work],
+                    alias: alias.into(),
+                    name: name.into(),
+                    description: String::new(),
+                    body: RelationBody::Allocation {
+                        source: f.a,
+                        target: work,
+                    },
+                },
+            );
+        }
+        let d = expected.diagrams.get_mut(&f.d).unwrap();
+        d.nodes.get_mut(&f.n).unwrap().position = xy(150., 200.);
+        d.nodes.get_mut(&yn).unwrap().position = xy(450., 500.);
+        assert_eq!(roundtrip(&accepted, command), expected);
+    }
+}
+
+#[test]
+fn group_assignment_collateral_surviving_constraint_refuses_whole_semantic_candidate() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut r = roots(layer);
+        let k =
+            r.f.p
+                .add_element(Kind::Constraint, layer, "Keep reviewed assignment", None)
+                .unwrap();
+        *r.f.p.elements.get_mut(&k).unwrap().shared_mut().unwrap() = SharedBody::Constraint {
+            expression: "reviewed assignment".into(),
+            constrained: vec![r.ax, r.f.w],
+        };
+        let core = prepare_command(&r.f.p, &Command::Delete(r.ax))
+            .unwrap()
+            .project;
+        validate_candidate(&core).unwrap();
+        assert!(core.elements.contains_key(&k));
+        assert_ne!(core.elements[&k], r.f.p.elements[&k]);
+        let scope = assignment::capture(&r.f.p, r.f.d, &selected(&r, false), r.f.n).unwrap();
+        let Err(Refusal::CollateralChangeRequired(changed)) =
+            assignment::plan_semantics(&scope, Destination::OutsidePerformers, &BTreeMap::new())
+        else {
+            panic!("surviving constraint edit must refuse the entire plan");
+        };
+        assert!(changed.iter().any(|record| record.id == k));
+    }
+}
+
+#[test]
+fn group_assignment_uses_vacated_space_and_one_complete_route_owner_map() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = fixture(layer);
+        let kind = f.p.elements[&f.w].kind();
+        let y = f.p.add_element(kind, layer, "Y", None).unwrap();
+        let outside = f.p.add_element(kind, layer, "Outside", None).unwrap();
+        let yn = f.p.place(f.d, y, xy(400., 500.));
+        f.p.place(f.d, outside, xy(1600., 500.));
+        let d = f.p.diagrams.get_mut(&f.d).unwrap();
+        let a = d.nodes.values_mut().find(|n| n.element == f.a).unwrap();
+        a.position = xy(350., 350.);
+        a.size = Size {
+            width: 1000.,
+            height: 600.,
+        };
+        let edge_kind = if layer == Layer::Oa {
+            RelationKind::Interaction
+        } else {
+            RelationKind::FunctionalExchange
+        };
+        let internal = f.p.relate(edge_kind, "Internal", f.w, y);
+        let external = f.p.relate(edge_kind, "External", y, outside);
+        let mut internal_route = route(internal);
+        internal_route.waypoints = vec![xy(370., 550.), xy(370., 650.)];
+        internal_route.source_attachment = Some(EdgeAttachment {
+            side: PortAnchorSide::Bottom,
+            offset: 0.3,
+        });
+        internal_route.target_attachment = Some(EdgeAttachment {
+            side: PortAnchorSide::Top,
+            offset: 0.7,
+        });
+        let mut external_route = internal_route.clone();
+        external_route.edge = external;
+        external_route.waypoints = vec![xy(1200., 550.), xy(1300., 650.)];
+        for diagram in [f.d, f.second] {
+            f.p.diagrams.get_mut(&diagram).unwrap().routes =
+                vec![internal_route.clone(), external_route.clone()];
+        }
+        if let RelationBody::FunctionalExchange { source_port, .. } = f.p.relations[&internal].body
+        {
+            f.p.diagrams
+                .get_mut(&f.d)
+                .unwrap()
+                .nodes
+                .get_mut(&f.n)
+                .unwrap()
+                .port_anchors
+                .push(PortAnchor {
+                    port: source_port,
+                    side: PortAnchorSide::Bottom,
+                    offset: 0.4,
+                });
+        }
+        validate_candidate(&f.p).unwrap();
+        let ids = BTreeMap::from([(f.w, Id::new_v4()), (y, Id::new_v4())]);
+        // The singleton candidate really occupies stationary Y's card. The
+        // combined candidate must not inherit that sequential-planning veto.
+        let mut singleton = f.p.clone();
+        singleton
+            .diagrams
+            .get_mut(&f.d)
+            .unwrap()
+            .nodes
+            .get_mut(&f.n)
+            .unwrap()
+            .position = xy(400., 500.);
+        let projected = projection::project_view(&singleton, f.d);
+        let x_card = projected.nodes.iter().find(|n| n.id == f.n).unwrap();
+        let y_card = projected.nodes.iter().find(|n| n.id == yn).unwrap();
+        assert_eq!(
+            overlap(x_card, y_card),
+            if layer == Layer::Oa { 21056. } else { 29568. }
+        );
+        let single = assignment::capture(&f.p, f.d, &BTreeMap::from([(f.n, f.w)]), f.n).unwrap();
+        let single =
+            assignment::plan_semantics(&single, Destination::Performer(f.a), &ids).unwrap();
+        assert!(matches!(
+            assignment::place(&single, xy(400., 500.), wide(&f.p, f.d, Some(f.a))),
+            Err(Refusal::LayoutRequired(_))
+        ));
+        let scope =
+            assignment::capture(&f.p, f.d, &BTreeMap::from([(f.n, f.w), (yn, y)]), f.n).unwrap();
+        let plan = assignment::plan_semantics(&scope, Destination::Performer(f.a), &ids).unwrap();
+        let placed = assignment::place(&plan, xy(400., 500.), wide(&f.p, f.d, Some(f.a))).unwrap();
+        let mut expected = f.p.clone();
+        for (work, name, alias) in [
+            (f.w, "A performs Work", "a_performs_work"),
+            (y, "A performs Y", "a_performs_y"),
+        ] {
+            expected.relations.insert(
+                ids[&work],
+                Relation {
+                    id: ids[&work],
+                    alias: alias.into(),
+                    name: name.into(),
+                    description: String::new(),
+                    body: RelationBody::Allocation {
+                        source: f.a,
+                        target: work,
+                    },
+                },
+            );
+        }
+        let d = expected.diagrams.get_mut(&f.d).unwrap();
+        d.nodes.get_mut(&f.n).unwrap().position = xy(400., 500.);
+        d.nodes.get_mut(&yn).unwrap().position = xy(700., 500.);
+        d.routes[0].waypoints = vec![xy(670., 550.), xy(670., 650.)];
+        assert_eq!(placed.diagram.routes[1], external_route);
+        assert_eq!(
+            roundtrip(
+                &f.p,
+                assignment::finish(&plan, &f.p, &placed).unwrap().unwrap()
+            ),
+            expected
+        );
+    }
+}
+
+#[test]
+fn group_assignment_deletes_only_own_routes_across_views_and_keeps_internal_flow() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut r = roots(layer);
+        let kind = if layer == Layer::Oa {
+            RelationKind::Interaction
+        } else {
+            RelationKind::FunctionalExchange
+        };
+        let internal = r.f.p.relate(kind, "Keep internal flow", r.f.w, r.y);
+        for diagram in [r.f.d, r.f.second] {
+            r.f.p.diagrams.get_mut(&diagram).unwrap().routes =
+                vec![route(r.ax), route(internal), route(r.by)];
+        }
+        validate_candidate(&r.f.p).unwrap();
+        let scope = assignment::capture(&r.f.p, r.f.d, &selected(&r, false), r.f.n).unwrap();
+        let plan =
+            assignment::plan_semantics(&scope, Destination::OutsidePerformers, &BTreeMap::new())
+                .unwrap();
+        assert_eq!(plan.changed_count(), 2);
+        let placed = assignment::place(&plan, xy(640., 200.), wide(&r.f.p, r.f.d, None)).unwrap();
+        let mut expected = r.f.p.clone();
+        expected.relations.remove(&r.ax);
+        expected.relations.remove(&r.by);
+        for diagram in [r.f.d, r.f.second] {
+            expected.diagrams.get_mut(&diagram).unwrap().routes = vec![route(internal)];
+        }
+        let d = expected.diagrams.get_mut(&r.f.d).unwrap();
+        d.nodes.get_mut(&r.f.n).unwrap().position = xy(640., 200.);
+        d.nodes.get_mut(&r.yn).unwrap().position = xy(640., 800.);
+        d.routes[0].waypoints = vec![xy(920., 400.), xy(920., 550.)];
+        assert_eq!(
+            roundtrip(
+                &r.f.p,
+                assignment::finish(&plan, &r.f.p, &placed).unwrap().unwrap()
+            ),
+            expected
+        );
+    }
+}

crates/oa-desktop/src/allocation_drag/geometry.rs

@@ -0,0 +1,195 @@
+//! Geometry operations over an explicitly captured placement set.
+use super::*;
+
+pub(super) struct Translation {
+    pub diagram: Diagram,
+    pub commands: Vec<Command>,
+    pub delta: Position,
+}
+
+/// Translate exactly `placements` using one snapped anchor delta. `base` must
+/// come from an exact, validated semantic candidate; absent routes are permitted
+/// only because that candidate has already admitted their semantic deletion.
+pub(super) fn translate(
+    accepted: &Project,
+    original: &Diagram,
+    base: &Diagram,
+    placements: &BTreeMap<Id, NodePlacement>,
+    anchor: Id,
+    requested: Position,
+) -> Result<Translation, Refusal> {
+    let anchor = placements.get(&anchor).ok_or(Refusal::StaleScope)?;
+    let delta = Position {
+        x: (requested.x / 10.).round() * 10. - anchor.position.x,
+        y: (requested.y / 10.).round() * 10. - anchor.position.y,
+    };
+    let mut diagram = base.clone();
+    let mut commands = Vec::new();
+    let mut deltas = BTreeMap::new();
+    for (id, captured) in placements {
+        let node = diagram.nodes.get_mut(id).ok_or(Refusal::StaleScope)?;
+        node.position = Position {
+            x: captured.position.x + delta.x,
+            y: captured.position.y + delta.y,
+        };
+        if !(Rect {
+            position: node.position,
+            size: node.size,
+        })
+        .valid()
+        {
+            return Err(Refusal::InvalidCandidate(
+                "Moved coordinates exceed the model bounds.".into(),
+            ));
+        }
+        deltas.insert(*id, delta);
+        if node != captured {
+            commands.push(Command::EditNode {
+                diagram: diagram.id,
+                original: *id,
+                node: node.clone(),
+            });
+        }
+    }
+    // Resolve actual endpoint owners once against accepted semantics and the
+    // complete delta map. Never reinsert a semantically deleted saved route.
+    for route in projection::translated_routes(accepted, original, &deltas) {
+        if let Some(stored) = diagram.routes.iter_mut().find(|r| r.edge == route.edge) {
+            if route.waypoints.iter().any(|point| {
+                !point.x.is_finite()
+                    || !point.y.is_finite()
+                    || point.x.abs() > MAX_COORDINATE
+                    || point.y.abs() > MAX_COORDINATE
+            }) {
+                return Err(Refusal::InvalidCandidate(
+                    "Moved route exceeds the model bounds.".into(),
+                ));
+            }
+            *stored = route.clone();
+            commands.push(Command::SetEdgeRoute {
+                diagram: diagram.id,
+                route,
+            });
+        }
+    }
+    Ok(Translation {
+        diagram,
+        commands,
+        delta,
+    })
+}
+
+/// Recover hidden ancestry for identity lookup only. The all-unfolded scene is
+/// never used for collision admission; only affected nodes and their ancestors
+/// enter the required diagnostic expansion.
+pub(super) fn expansion_ids(
+    p: &Project,
+    d: &Diagram,
+    index: &ViewIndex,
+    placements: &BTreeMap<Id, NodePlacement>,
+) -> Result<BTreeSet<Id>, Refusal> {
+    let mut all_unfolded = d.clone();
+    for node in all_unfolded.nodes.values_mut() {
+        node.collapsed = false;
+    }
+    let all_view = projection::project_diagram_with_index(p, &all_unfolded, index);
+    let ancestry = ancestors(&all_view);
+    let mut ids: BTreeSet<_> = placements.keys().copied().collect();
+    for id in placements.keys() {
+        ids.extend(ancestry.get(id).ok_or(Refusal::StaleScope)?.iter().copied());
+    }
+    Ok(ids)
+}
+
+pub(super) fn expanded_view(
+    p: &Project,
+    d: &Diagram,
+    index: &ViewIndex,
+    ids: &BTreeSet<Id>,
+) -> ProjectedView {
+    let mut expanded = d.clone();
+    for id in ids {
+        if let Some(node) = expanded.nodes.get_mut(id) {
+            node.collapsed = false;
+        }
+    }
+    projection::project_diagram_with_index(p, &expanded, index)
+}
+
+pub(super) fn check_scenes(
+    before_visible: &ProjectedView,
+    before_expanded: &ProjectedView,
+    visible: &ProjectedView,
+    expanded: &ProjectedView,
+) -> Result<(), Refusal> {
+    if visible.nodes.iter().chain(&expanded.nodes).any(|node| {
+        !(Rect {
+            position: node.position,
+            size: node.size,
+        })
+        .valid()
+    }) {
+        return Err(Refusal::InvalidCandidate(
+            "The projected enclosure exceeds the model bounds.".into(),
+        ));
+    }
+    if overlaps(before_visible, visible) || overlaps(before_expanded, expanded) {
+        return Err(Refusal::LayoutRequired(
+            "Make room before arranging: the candidate would introduce or enlarge overlapping cards."
+                .into(),
+        ));
+    }
+    Ok(())
+}
+
+pub(super) fn check_rigid(
+    before: &ProjectedView,
+    after: &ProjectedView,
+    placements: &BTreeMap<Id, NodePlacement>,
+    delta: Position,
+) -> Result<(), Refusal> {
+    let before: BTreeMap<_, _> = before.nodes.iter().map(|n| (n.id, n)).collect();
+    let after: BTreeMap<_, _> = after.nodes.iter().map(|n| (n.id, n)).collect();
+    for id in placements.keys() {
+        let old = before.get(id).ok_or(Refusal::StaleScope)?;
+        let new = after.get(id).ok_or(Refusal::StaleScope)?;
+        if (new.position.x - old.position.x - delta.x).abs() > 0.01
+            || (new.position.y - old.position.y - delta.y).abs() > 0.01
+            || (new.size.width - old.size.width).abs() > 0.01
+            || (new.size.height - old.size.height).abs() > 0.01
+        {
+            return Err(Refusal::LayoutRequired(
+                "This selection requires an explicit layout; its footprint cannot be translated unchanged."
+                    .into(),
+            ));
+        }
+    }
+    Ok(())
+}
+
+pub(super) fn check_headers(
+    view: &ProjectedView,
+    selected: &BTreeMap<Id, Id>,
+    viewport: Rect,
+) -> Result<(), Refusal> {
+    for (id, element) in selected {
+        let node = view
+            .nodes
+            .iter()
+            .find(|node| node.id == *id && node.element == *element)
+            .ok_or_else(|| Refusal::LayoutRequired("A selected header would be hidden.".into()))?;
+        let header = Rect {
+            position: node.position,
+            size: Size {
+                width: node.size.width,
+                height: node.size.height.min(62.),
+            },
+        };
+        if !viewport.contains(header) {
+            return Err(Refusal::LayoutRequired(
+                "Make room or adjust the view, then drag again.".into(),
+            ));
+        }
+    }
+    Ok(())
+}

crates/oa-desktop/src/allocation_drag/group_arrange_experiment.rs

@@ -0,0 +1,450 @@
+//! Reviewed policy experiment using the production projection and translator.
+//! No production admission or atomic-refusal behavior is tested here.
+use super::*;
+
+struct Mixed {
+    f: Fixture,
+    an: Id,
+    xn: Id,
+    yn: Id,
+    internal: Id,
+    include_performer: bool,
+}
+
+fn mixed(layer: Layer, collapsed: bool, obstacle: bool, include_performer: bool) -> Mixed {
+    let mut f = fixture(layer);
+    let work = f.p.elements[&f.w].kind();
+    let exchange = match layer {
+        Layer::Oa => RelationKind::Interaction,
+        Layer::Sa => RelationKind::FunctionalExchange,
+    };
+    let x = f.p.add_element(work, layer, "X", Some(f.w)).unwrap();
+    let y = f.p.add_element(work, layer, "Y", Some(f.w)).unwrap();
+    let outside = f.p.add_element(work, layer, "Outside", None).unwrap();
+    let xn = f.p.place(f.d, x, xy(140., 200.));
+    let yn = f.p.place(f.d, y, xy(940., 200.));
+    f.p.place(f.d, outside, xy(1800., 800.));
+    f.p.relate(RelationKind::Allocation, "A owns X", f.a, x);
+    f.p.relate(RelationKind::Allocation, "B owns Y", f.b, y);
+    // FunctionalExchange's actual builder creates valid function input/output
+    // ports; do not manufacture Interaction records between SA Functions.
+    let internal = f.p.relate(exchange, "X to Y", x, y);
+    let external = f.p.relate(exchange, "Y to Outside", y, outside);
+    let an = f.p.diagrams[&f.d]
+        .nodes
+        .values()
+        .find(|n| n.element == f.a)
+        .unwrap()
+        .id;
+    let d = f.p.diagrams.get_mut(&f.d).unwrap();
+    d.nodes.get_mut(&f.n).unwrap().position = xy(100., 800.);
+    d.nodes.get_mut(&an).unwrap().collapsed = collapsed;
+    d.routes = vec![route(internal), route(external)];
+    if obstacle {
+        let id =
+            f.p.add_element(work, layer, "Stationary obstacle", None)
+                .unwrap();
+        f.p.place(f.d, id, xy(550., 230.));
+    }
+    validate_candidate(&f.p).unwrap();
+    let captured = scope(&f);
+    assert_eq!(captured.uniform, Uniform::MixedOrUnresolved);
+    assert_eq!(
+        captured.placements.keys().copied().collect::<BTreeSet<_>>(),
+        BTreeSet::from([f.n, xn, yn])
+    );
+    // Explicit control: the real current API still refuses Arrange for this root.
+    assert!(matches!(
+        plan_semantics(&f.p, &captured, Destination::LayoutOnly, &BTreeMap::new()),
+        Err(Refusal::MixedLayoutRequired)
+    ));
+    assert!(matches!(
+        plan_semantics(
+            &f.p,
+            &captured,
+            Destination::Performer(f.a),
+            &BTreeMap::new()
+        ),
+        Err(Refusal::MixedLayoutRequired)
+    ));
+    Mixed {
+        f,
+        an,
+        xn,
+        yn,
+        internal,
+        include_performer,
+    }
+}
+
+fn affected(m: &Mixed) -> BTreeSet<Id> {
+    let mut ids: BTreeSet<_> = scope(&m.f).placements.keys().copied().collect();
+    let mut expected = BTreeSet::from([m.f.n, m.xn, m.yn]);
+    if m.include_performer {
+        ids.insert(m.an);
+        ids.extend(projection::descendant_nodes(&m.f.p, m.f.d, m.an));
+        expected.insert(m.an);
+    }
+    assert_eq!(ids, expected);
+    ids
+}
+
+// Diagnostic expansion changes only a temporary Diagram. Include affected
+// descendants and ancestors even when the normal projection hides them.
+// Unrelated folded interiors are intentionally OUTSIDE this diagnostic domain.
+fn diagnostic(p: &Project, diagram: Id, ids: &BTreeSet<Id>) -> ProjectedView {
+    let mut d = p.diagrams[&diagram].clone();
+    for (id, node) in &mut d.nodes {
+        if ids.contains(id)
+            || projection::descendant_nodes(p, diagram, *id)
+                .iter()
+                .any(|n| ids.contains(n))
+        {
+            node.collapsed = false;
+        }
+    }
+    projection::project_diagram(p, &d)
+}
+
+fn rigid(before: &ProjectedView, after: &ProjectedView, ids: &BTreeSet<Id>) {
+    for id in ids {
+        let old = before.nodes.iter().find(|n| n.id == *id).unwrap();
+        let new = after.nodes.iter().find(|n| n.id == *id).unwrap();
+        assert_eq!(new.position, xy(old.position.x + 400., old.position.y));
+        assert_eq!(new.size, old.size, "no reflow of an affected footprint");
+    }
+}
+
+// The only experimental bypass: use the pure general geometry command instead
+// of plan_semantics(LayoutOnly), whose mixed-root pre-veto is asserted above.
+// This is not a fabricated Scope or a call to singleton check_geometry with a
+// falsely enlarged Scope. The combined scene uses the real overlap predicate.
+fn candidate(m: &Mixed) -> (Command, Project) {
+    let ids = affected(m);
+    let command =
+        oa_core::diagram_edit::translate_placements(&m.f.p, m.f.d, &ids, xy(400., 0.)).unwrap();
+    let actual = prepare_command(&m.f.p, &command).unwrap().project;
+    validate_candidate(&actual).unwrap();
+    // Independent literal expected Project: no planner or route helper oracle.
+    let mut expected = m.f.p.clone();
+    let d = expected.diagrams.get_mut(&m.f.d).unwrap();
+    for (id, position) in [
+        (m.f.n, xy(500., 800.)),
+        (m.xn, xy(540., 200.)),
+        (m.yn, xy(1340., 200.)),
+    ] {
+        d.nodes.get_mut(&id).unwrap().position = position;
+    }
+    if m.include_performer {
+        d.nodes.get_mut(&m.an).unwrap().position = xy(500., 100.);
+    }
+    let internal = d.routes.iter_mut().find(|r| r.edge == m.internal).unwrap();
+    internal.waypoints = vec![xy(820., 400.), xy(820., 550.)];
+    assert_eq!(
+        actual, expected,
+        "complete records, including folds, routes, other view and relations"
+    );
+    (command, actual)
+}
+
+#[test]
+fn mixed_arrange_experiment_distributed_root_and_performer_can_translate_rigidly() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let enclosure_height = match layer {
+            Layer::Oa => 218.,
+            Layer::Sa => 256.,
+        };
+        for include_performer in [false, true] {
+            for collapsed in [false, true] {
+                let m = mixed(layer, collapsed, false, include_performer);
+                let accepted = m.f.p.clone();
+                let (command, actual) = candidate(&m);
+                let ids = affected(&m);
+                let before = projection::project_view(&accepted, m.f.d);
+                let after = projection::project_view(&actual, m.f.d);
+                let before_expanded = diagnostic(&accepted, m.f.d, &ids);
+                let after_expanded = diagnostic(&actual, m.f.d, &ids);
+                assert!(
+                    !overlaps(&before, &after),
+                    "visible scene must admit the combined move"
+                );
+                assert!(
+                    !overlaps(&before_expanded, &after_expanded),
+                    "expanded scene must admit the combined move"
+                );
+                rigid(&before_expanded, &after_expanded, &ids);
+                for node in after.nodes.iter().chain(&after_expanded.nodes) {
+                    assert!(
+                        (Rect {
+                            position: node.position,
+                            size: node.size
+                        })
+                        .valid()
+                    );
+                }
+                // Explicit selected headers remain visible. Native clipping/readability
+                // and complete group gesture admission are intentionally not claimed.
+                assert!(after.nodes.iter().any(|n| n.id == m.f.n));
+                if include_performer {
+                    assert!(after.nodes.iter().any(|n| n.id == m.an));
+                } else {
+                    assert_eq!(
+                        actual.diagrams[&m.f.d].nodes[&m.an],
+                        accepted.diagrams[&m.f.d].nodes[&m.an]
+                    );
+                    assert_eq!(node(&before_expanded, m.an).position, xy(100., 100.));
+                    assert_eq!(
+                        node(&before_expanded, m.an).size,
+                        Size {
+                            width: 288.,
+                            height: enclosure_height
+                        }
+                    );
+                    assert_eq!(node(&after_expanded, m.an).position, xy(100., 100.));
+                    assert_eq!(
+                        node(&after_expanded, m.an).size,
+                        Size {
+                            width: 688.,
+                            height: enclosure_height
+                        }
+                    );
+                }
+                assert_eq!(roundtrip(&accepted, command), actual);
+                assert_eq!(m.f.p, accepted);
+            }
+        }
+    }
+}
+
+#[test]
+fn mixed_arrange_experiment_detects_moved_folded_child_collision() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let expected_overlap = match layer {
+            Layer::Oa => 13696.,
+            Layer::Sa => 20116.,
+        };
+        let m = mixed(layer, true, true, true);
+        let accepted = m.f.p.clone();
+        let (_, actual) = candidate(&m);
+        let ids = affected(&m);
+        let before = projection::project_view(&accepted, m.f.d);
+        let after = projection::project_view(&actual, m.f.d);
+        assert!(!before.nodes.iter().any(|n| n.id == m.xn));
+        assert!(!after.nodes.iter().any(|n| n.id == m.xn));
+        assert!(
+            !overlaps(&before, &after),
+            "must distinguish hidden collision from ordinary visible refusal"
+        );
+        let before_expanded = diagnostic(&accepted, m.f.d, &ids);
+        let after_expanded = diagnostic(&actual, m.f.d, &ids);
+        rigid(&before_expanded, &after_expanded, &ids);
+        let obstacle = before_expanded
+            .nodes
+            .iter()
+            .find(|n| n.position == xy(550., 230.))
+            .unwrap()
+            .id;
+        assert_eq!(
+            overlap(
+                node(&before_expanded, m.xn),
+                node(&before_expanded, obstacle)
+            ),
+            0.
+        );
+        assert_eq!(
+            overlap(node(&after_expanded, m.xn), node(&after_expanded, obstacle)),
+            expected_overlap
+        );
+        assert!(
+            overlaps(&before_expanded, &after_expanded),
+            "combined diagnostic scene must refuse"
+        );
+        // Detection only: there is no production group admission/commit API here.
+        assert_eq!(m.f.p, accepted);
+    }
+}
+
+fn node(view: &ProjectedView, id: Id) -> &ProjectedNode {
+    view.nodes.iter().find(|n| n.id == id).unwrap()
+}
+
+#[test]
+fn mixed_arrange_experiment_detects_stationary_enclosure_growth_collision() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let enclosure_height = match layer {
+            Layer::Oa => 218.,
+            Layer::Sa => 256.,
+        };
+        let mut m = mixed(layer, false, false, true);
+        let kind = m.f.p.elements[&m.f.w].kind();
+        let z =
+            m.f.p
+                .add_element(kind, layer, "Stationary Z", None)
+                .unwrap();
+        let zn = m.f.p.place(m.f.d, z, xy(1200., 100.));
+        validate_candidate(&m.f.p).unwrap();
+        let accepted = m.f.p.clone();
+        let (_, actual) = candidate(&m);
+        let bn = accepted.diagrams[&m.f.d]
+            .nodes
+            .values()
+            .find(|n| n.element == m.f.b)
+            .unwrap()
+            .id;
+        let before = projection::project_view(&accepted, m.f.d);
+        let after = projection::project_view(&actual, m.f.d);
+        assert_eq!(node(&before, bn).position, xy(900., 100.));
+        assert_eq!(
+            node(&before, bn).size,
+            Size {
+                width: 288.,
+                height: enclosure_height
+            }
+        );
+        assert_eq!(node(&after, bn).position, xy(900., 100.));
+        assert_eq!(
+            node(&after, bn).size,
+            Size {
+                width: 688.,
+                height: enclosure_height
+            }
+        );
+        assert_eq!(node(&after, zn).position, xy(1200., 100.));
+        assert_eq!(
+            node(&after, zn).size,
+            Size {
+                width: 224.,
+                height: 94.
+            }
+        );
+        assert_eq!(overlap(node(&before, bn), node(&before, zn)), 0.);
+        assert_eq!(overlap(node(&after, bn), node(&after, zn)), 21056.);
+        assert_eq!(node(&after, m.yn).position, xy(1340., 200.));
+        assert_eq!(
+            node(&after, m.yn).position.y
+                - (node(&after, zn).position.y + node(&after, zn).size.height),
+            6.
+        );
+        for id in affected(&m) {
+            assert_eq!(overlap(node(&before, id), node(&before, zn)), 0.);
+            assert_eq!(overlap(node(&after, id), node(&after, zn)), 0.);
+        }
+        assert_eq!(
+            actual.diagrams[&m.f.d].nodes[&bn],
+            accepted.diagrams[&m.f.d].nodes[&bn]
+        );
+        assert_eq!(
+            actual.diagrams[&m.f.d].nodes[&zn],
+            accepted.diagrams[&m.f.d].nodes[&zn]
+        );
+        assert!(
+            overlaps(&before, &after),
+            "complete scene must detect stationary enclosure growth"
+        );
+        let ids = affected(&m);
+        assert!(overlaps(
+            &diagnostic(&accepted, m.f.d, &ids),
+            &diagnostic(&actual, m.f.d, &ids)
+        ));
+        assert_eq!(m.f.p, accepted);
+    }
+}
+
+#[test]
+fn mixed_arrange_experiment_unrelated_folded_interiors_are_outside_diagnostic_domain() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        // Independent source-derived literals: SA's auto-created function ports
+        // raise projected X/Y height to 76 + 28 * (1 + 1), while Z is port-free.
+        let (work_height, expected_overlap) = match layer {
+            Layer::Oa => (94., 13696.),
+            Layer::Sa => (132., 20116.),
+        };
+        let mut m = mixed(layer, true, false, true);
+        let performer = match layer {
+            Layer::Oa => Kind::Actor,
+            Layer::Sa => Kind::SystemActor,
+        };
+        let kind = m.f.p.elements[&m.f.w].kind();
+        let d =
+            m.f.p
+                .add_element(performer, layer, "Unrelated D", None)
+                .unwrap();
+        let z =
+            m.f.p
+                .add_element(kind, layer, "Unrelated hidden Z", None)
+                .unwrap();
+        m.f.p.relate(RelationKind::Allocation, "D owns Z", d, z);
+        let dn = m.f.p.place(m.f.d, d, xy(2500., 100.));
+        let zn = m.f.p.place(m.f.d, z, xy(550., 230.));
+        m.f.p
+            .diagrams
+            .get_mut(&m.f.d)
+            .unwrap()
+            .nodes
+            .get_mut(&dn)
+            .unwrap()
+            .collapsed = true;
+        validate_candidate(&m.f.p).unwrap();
+        let accepted = m.f.p.clone();
+        let (_, actual) = candidate(&m);
+        let ids = affected(&m);
+        let before = diagnostic(&accepted, m.f.d, &ids);
+        let after = diagnostic(&actual, m.f.d, &ids);
+        assert!(!before.nodes.iter().any(|n| n.id == zn));
+        assert!(!after.nodes.iter().any(|n| n.id == zn));
+        assert!(
+            !overlaps(&before, &after),
+            "chosen diagnostic domain excludes unrelated folded contents"
+        );
+        assert!(!overlaps(
+            &projection::project_view(&accepted, m.f.d),
+            &projection::project_view(&actual, m.f.d)
+        ));
+        let all_unfolded = |p: &Project| {
+            let mut diagram = p.diagrams[&m.f.d].clone();
+            for n in diagram.nodes.values_mut() {
+                n.collapsed = false;
+            }
+            projection::project_diagram(p, &diagram)
+        };
+        let broad_before = all_unfolded(&accepted);
+        let broad_after = all_unfolded(&actual);
+        assert_eq!(node(&broad_before, m.xn).position, xy(140., 200.));
+        assert_eq!(node(&broad_after, m.xn).position, xy(540., 200.));
+        assert_eq!(
+            node(&broad_after, m.xn).size,
+            Size {
+                width: 224.,
+                height: work_height
+            }
+        );
+        assert_eq!(node(&broad_before, zn).position, xy(550., 230.));
+        assert_eq!(node(&broad_after, zn).position, xy(550., 230.));
+        assert_eq!(
+            node(&broad_after, zn).size,
+            Size {
+                width: 224.,
+                height: 94.
+            }
+        );
+        assert_eq!(
+            overlap(node(&broad_before, m.xn), node(&broad_before, zn)),
+            0.
+        );
+        assert_eq!(
+            overlap(node(&broad_after, m.xn), node(&broad_after, zn)),
+            expected_overlap
+        );
+        // Other newly exposed enclosure pairs may also overlap. X/Z is a
+        // concrete discriminator, not a claim that it is the only cause.
+        assert!(overlaps(&broad_before, &broad_after));
+        for id in [dn, zn] {
+            assert_eq!(
+                actual.diagrams[&m.f.d].nodes[&id],
+                accepted.diagrams[&m.f.d].nodes[&id]
+            );
+        }
+        assert!(actual.diagrams[&m.f.d].nodes[&dn].collapsed);
+        assert_eq!(m.f.p, accepted);
+    }
+}

crates/oa-desktop/src/allocation_drag/tests.rs

@@ -2,6 +2,18 @@ use super::*;
 use crate::document::Document;
 use oa_core::source_project::{ProjectLimits, compile_bundle, format_bundle};
 
+#[path = "group_arrange_experiment.rs"]
+mod group_arrange_experiment;
+
+#[path = "arrange_tests.rs"]
+mod arrange_tests;
+
+#[path = "assignment_tests.rs"]
+mod assignment_tests;
+
+#[path = "assignment_boundary_tests.rs"]
+mod assignment_boundary_tests;
+
 struct Fixture {
     p: Project,
     d: Id,

crates/oa-desktop/src/app.rs

@@ -6,6 +6,8 @@ mod architecture_authoring_tests;
 mod behavior_removal_tests;
 mod checkpoints;
 #[cfg(test)]
+mod context_help_tests;
+#[cfg(test)]
 mod diagram_focus_tests;
 pub(crate) mod diagram_removal;
 #[cfg(test)]
@@ -14,6 +16,7 @@ mod diagram_reveal;
 #[cfg(test)]
 mod diagram_selection_tests;
 mod diagram_usages;
+pub(crate) mod escape;
 mod hosted;
 pub(crate) mod multiselect;
 #[cfg(test)]
@@ -35,6 +38,8 @@ mod state_multiselect_focus_tests;
 mod state_multiselect_tests;
 pub(crate) mod text_workspace;
 #[cfg(test)]
+mod traceability_navigation_tests;
+#[cfg(test)]
 mod transition_context_tests;
 #[cfg(test)]
 mod view_copy_tests;
@@ -275,6 +280,7 @@ mod direct_scenario_tests {
 #[cfg(test)]
 mod behavior_lifecycle_tests;
 mod process_canvas;
+mod process_multiselect;
 mod state_diagram;
 #[cfg(test)]
 mod state_diagram_tests;
@@ -372,7 +378,12 @@ pub enum Message {
     ExactStrings(bool),
     Page(Page),
     Guide(crate::guide::Event),
+    ContextHelp(crate::guide::Topic),
+    CloseContextHelp,
+    ContextHelpScroll(crate::guide::ContextScroll),
+    Help,
     Traceability(crate::views::traceability::Event),
+    ReviewLayerTraces,
     Behavior(crate::behavior::Event),
     Layer(Layer),
     Select(Id),
@@ -516,6 +527,7 @@ pub struct App {
     /// Home resumes this page; explicit Architecture navigation remains separate.
     last_workspace_page: Page,
     pub guide: crate::guide::State,
+    pub context_help: bool,
     pub traceability: crate::views::traceability::State,
     pub behavior: crate::behavior::State,
     pub data_state: crate::data_view::State,
@@ -638,6 +650,7 @@ impl App {
             page: Page::Diagram,
             last_workspace_page: Page::Diagram,
             guide: crate::guide::State::default(),
+            context_help: false,
             traceability: Default::default(),
             behavior: Default::default(),
             data_state: Default::default(),
@@ -829,6 +842,9 @@ impl App {
                 .map(|n| n.id);
         }
         self.draft = Draft::from_project(self.project(), self.selected);
+        if self.process_preview_primary().is_some() {
+            self.draft = None;
+        }
         if self.exact_strings
             && let Some(d) = &mut self.draft
         {
@@ -1157,10 +1173,13 @@ impl App {
         previous != (self.layer, self.active_diagram)
     }
     fn select(&mut self, id: Id) {
+        // An exact Process preview and its defining object share a semantic ID,
+        // but ordinary Explorer/property navigation must still leave the use.
+        let process_preview = self.process_preview_primary().is_some();
         if id != self.selected {
             self.selected_attachment = None;
         }
-        if self.selected == id {
+        if self.selected == id && !process_preview {
             return;
         }
         if !self.apply() {
@@ -1169,6 +1188,10 @@ impl App {
         if !self.project().contains(id) {
             return;
         }
+        self.behavior.topology.clear_context();
+        if process_preview {
+            self.diagram_navigation_focus = None;
+        }
         let previous_state_view = self.state_view_identity();
         self.selected = id;
         self.selected_node = None;
@@ -1224,7 +1247,7 @@ impl App {
             crate::model_menu::popup(self).or_else(|| self.text_workspace_menu()),
         )
         .into();
-        crate::source_navigation::interaction::observe(
+        let content = crate::source_navigation::interaction::observe(
             crate::behavior::scenario::focus::root(
                 behavior::canvas_workspace::focus_root(
                     crate::hosted::view::overlay(
@@ -1236,7 +1259,8 @@ impl App {
                 self.scenario_focus_owner(),
             ),
             self.source_symbols.raw_interaction.clone(),
-        )
+        );
+        escape::root(self, content)
     }
     pub fn subscription(&self) -> Subscription<Message> {
         Subscription::batch([
@@ -1278,7 +1302,11 @@ impl App {
             iced::time::every(std::time::Duration::from_secs(10)).map(|_| Message::CheckpointTick),
             window::close_requests().map(|id| Message::Request(Pending::Close(id))),
             window::resize_events().map(|(_, size)| Message::WindowResized(size)),
-            architecture_authoring::subscription(self),
+            if self.context_help {
+                iced::event::listen_with(crate::guide::context_scroll_key)
+            } else {
+                Subscription::none()
+            },
             iced::event::listen_with(|event, _, _| {
                 matches!(
                     event,
@@ -1286,20 +1314,6 @@ impl App {
                 )
                 .then_some(Message::WorkDrag(allocation_drag::Event::KeyboardBoundary))
             }),
-            // Use one captured-Escape bridge: a focused Find input consumes
-            // Escape, while modal priority remains in the ordinary handler.
-            behavior::creation::subscription(
-                self.text_workspace.menu().is_none()
-                    && (self.behavior.creation.has_pending()
-                        || self.diagram_usages.is_some()
-                        || self.behavior.source_active()
-                        || (self.page == Page::Text
-                            && (self.text_workspace.drawer().is_some()
-                                || self.source_navigation.open
-                                || self.source_rename.open())
-                            && self.architecture.is_none())),
-            )
-            .map(|()| Message::Escape),
             iced::event::listen_with(|event, status, _| {
                 if matches!(event, iced::Event::Window(window::Event::Unfocused)) {
                     return Some(Message::WorkDrag(allocation_drag::Event::Unfocused));
@@ -1319,7 +1333,7 @@ impl App {
                     return Some(Message::Escape);
                 }
                 if key == keyboard::Key::Named(keyboard::key::Named::F1) {
-                    return Some(Message::Page(Page::Guide));
+                    return Some(Message::Help);
                 }
                 if key == keyboard::Key::Named(keyboard::key::Named::F3) {
                     return Some(Message::SourceNavigation(
@@ -1347,8 +1361,79 @@ impl App {
         ])
     }
     pub fn update(&mut self, message: Message) -> Task<Message> {
+        if let Message::ContextHelpScroll(scroll) = message {
+            return if self.context_help {
+                crate::guide::context_scroll_task(scroll)
+            } else {
+                Task::none()
+            };
+        }
+        // Help owns user input before any canvas/reference fast path can act.
+        // Passive results may finish; they retain their normal lifetime checks.
+        if self.context_help
+            && !matches!(
+                message,
+                Message::Guide(_)
+                    | Message::CloseContextHelp
+                    | Message::Escape
+                    | Message::Request(Pending::Close(_))
+                    | Message::CheckpointWritten(..)
+                    | Message::CheckpointTick
+                    | Message::CheckpointLoaded(..)
+                    | Message::WindowResized(_)
+                    | Message::CanvasResized(_)
+                    | Message::DiagramRevealViewport(..)
+                    | Message::SourceViewport(_)
+                    | Message::Lint(_)
+                    | Message::Linted(..)
+                    | Message::Saved(_)
+                    | Message::Hosted(crate::hosted::Event::Completed(..))
+                    | Message::Loaded(_)
+                    | Message::IncludesLoaded(..)
+                    | Message::SavePath(_)
+                    | Message::SourceRecovered(_)
+                    | Message::Exported(_)
+                    | Message::SourceSymbolsReady(_)
+                    | Message::SourceRenameReady(_)
+                    | Message::DiagramUsagesReady(_)
+                    | Message::ScenarioCanvas(
+                        behavior::scenario::CanvasEvent::Scrolled(..)
+                            | behavior::scenario::CanvasEvent::Restored(..)
+                            | behavior::scenario::CanvasEvent::Viewport(..)
+                    )
+                    | Message::TopologyCanvas(
+                        behavior::topology::CanvasEvent::Scrolled(..)
+                            | behavior::topology::CanvasEvent::Viewport(..)
+                    )
+                    | Message::StateDiagram(behavior::state_edit::Event::Viewport(..))
+            )
+        {
+            return Task::none();
+        }
+        let preview_read_only = self.process_preview_primary().is_some();
         let selection_boundary = self.multiselect_boundary();
         // Reject delayed gestures before they can retire newer input ownership.
+        if let Message::Connection(
+            crate::connection_edit::Event::Endpoint(captured, _)
+            | crate::connection_edit::Event::Restart(captured),
+        ) = &message
+            && (self.route_context() != Some(*captured)
+                || self
+                    .connection
+                    .as_ref()
+                    .is_none_or(|session| session.context != *captured))
+        {
+            return Task::none();
+        }
+        // Selection can change without advancing the captured canvas context.
+        if let Message::Route(
+            crate::route_edit::Event::Commit(captured, changed, ..)
+            | crate::route_edit::Event::CommitAttachment(captured, changed, ..),
+        ) = &message
+            && (self.route_context() != Some(*captured) || changed.edge != self.selected)
+        {
+            return Task::none();
+        }
         if let Message::DiagramSelection(event)
         | Message::StateDiagram(crate::behavior::state_edit::Event::Selection(event)) = &message
             && !self.multiselect_envelope(event)
@@ -1379,11 +1464,62 @@ impl App {
             // or allocation ownership before its edit is refused.
             return Task::none();
         }
+        if let Message::TopologyCanvas(event) = &message {
+            use crate::behavior::topology::CanvasEvent;
+            if !matches!(
+                event,
+                CanvasEvent::Camera(..) | CanvasEvent::Scrolled(..) | CanvasEvent::Viewport(..)
+            ) && self.topology_context() != Some(event.context())
+            {
+                return Task::none();
+            }
+            if matches!(
+                event,
+                CanvasEvent::Select(..)
+                    | CanvasEvent::SelectQualified(..)
+                    | CanvasEvent::Remove(..)
+                    | CanvasEvent::Reorder { .. }
+                    | CanvasEvent::Reconnect { .. }
+            ) && self
+                .multiselect_snapshot()
+                .is_some_and(|s| s.targets().len() > 1)
+            {
+                return Task::none();
+            }
+        }
+        if self.process_order_noop(&message) {
+            return Task::none();
+        }
+        if self.process_preview_primary().is_some()
+            && matches!(
+                &message,
+                Message::Field(..)
+                    | Message::FieldText(..)
+                    | Message::FieldShape(..)
+                    | Message::FieldAppend(..)
+                    | Message::FieldValuePath(..)
+                    | Message::FieldVariant(..)
+                    | Message::FieldArray(..)
+                    | Message::ElementKind(_)
+                    | Message::RelationKind(_)
+                    | Message::Apply
+                    | Message::Delete
+                    | Message::DiagramRemove(_)
+            )
+        {
+            self.status = "Open the referenced definition to edit its contents.".into();
+            return Task::none();
+        }
         // Captured Text commands validate their origin before they can
         // invalidate that same origin or pass into existing command handlers.
         if let Message::TextWorkspace(event) = message {
             return self.text_workspace_event(event);
         }
+        // Allocation placement movement requires its captured Press/Active
+        // lifetime, even after cancellation. A bare queued move has no epoch.
+        if self.allocation_legacy_move(&message) {
+            return Task::none();
+        }
         // These handlers reject old owners/tokens without changing state. Apply
         // the same admission before shared camera and allocation boundaries.
         if !self.source_input_envelope(&message)
@@ -1531,6 +1667,9 @@ impl App {
         {
             self.reconcile_multiselect();
         }
+        if preview_read_only && self.process_preview_primary().is_none() && self.draft.is_none() {
+            self.refresh_draft();
+        }
         task
     }
     fn behavior_control(&mut self, intent: behavior::canvas_workspace::Intent) -> Task<Message> {
@@ -1823,6 +1962,10 @@ impl App {
             message,
             Message::Escape | Message::Request(Pending::Close(_))
         ) {
+            if self.context_help {
+                self.context_help = false;
+                return Task::none();
+            }
             if self.hosted.visible {
                 self.hosted.visible = false;
                 return Task::none();
@@ -2014,6 +2157,7 @@ impl App {
     }
     pub(crate) fn scenario_focus_owner(&self) -> Option<crate::behavior::scenario::focus::Stamp> {
         if self.busy
+            || self.context_help
             || self.hosted.visible
             || self.workflow.is_some()
             || self.architecture.is_some()
@@ -2586,6 +2730,9 @@ impl App {
                         self.route_context()
                     };
                 }
+                if request.process.is_some() {
+                    request.process = self.topology_context().map(Box::new);
+                }
                 self.model_menu = crate::model_menu::Opened::new(self, request, self.menu_sequence);
             }
             Message::Menu(crate::model_menu::Event::Close) => {
@@ -2615,10 +2762,36 @@ impl App {
                         "Apply or revert pending edits before using modeling actions.".into();
                     return Task::none();
                 }
-                if matches!(*action, Message::DiagramSelection(_)) {
+                if matches!(*action, Message::DiagramSelection(_))
+                    || (menu.request.process.is_some()
+                        && matches!(*action, Message::TopologyCanvas(_)))
+                {
                     return self.update(*action);
                 }
-                self.select(menu.request.object);
+                // Show acts on the diagram captured by the validated menu.
+                // Ordinary cross-layer selection would switch to that element's
+                // preferred same-layer view before the placement command runs.
+                let show_in_mixed_view = matches!(&*action, Message::PlaceSelected)
+                    && self
+                        .active_diagram
+                        .and_then(|id| self.project().diagrams.get(&id))
+                        .is_some_and(|d| {
+                            d.projection == ProjectionKind::Traceability
+                                && self
+                                    .project()
+                                    .elements
+                                    .get(&menu.request.object)
+                                    .is_some_and(|e| {
+                                        e.kind() != Kind::Port && d.projection.includes(e.kind())
+                                    })
+                        });
+                if show_in_mixed_view {
+                    self.selected = menu.request.object;
+                    self.selected_attachment = None;
+                    self.refresh_draft();
+                } else {
+                    self.select(menu.request.object);
+                }
                 if self.page == Page::Behavior && menu.request.canvas.is_some() {
                     self.behavior.diagram.placement = menu.request.placement;
                     self.selected_node = None;
@@ -2681,6 +2854,35 @@ impl App {
                     );
                 }
             }
+            Message::ContextHelp(topic) => {
+                self.guide.update(crate::guide::Event::Topic(topic));
+                self.context_help = true;
+                return iced::widget::operation::snap_to(
+                    crate::guide::ARTICLE_SCROLL_ID,
+                    iced::widget::scrollable::RelativeOffset::START,
+                );
+            }
+            Message::CloseContextHelp => {
+                self.context_help = false;
+            }
+            Message::ContextHelpScroll(_) => {}
+            Message::Help => {
+                let topic = match self.page {
+                    Page::Diagram => Some(crate::guide::Topic::Nesting),
+                    Page::Behavior => self.behavior.active_owner.and_then(|id| {
+                        self.project()
+                            .elements
+                            .get(&id)
+                            .map(|element| match element.kind() {
+                                Kind::StateMachine => crate::guide::Topic::States,
+                                Kind::Scenario => crate::guide::Topic::Scenarios,
+                                _ => crate::guide::Topic::Chains,
+                            })
+                    }),
+                    _ => None,
+                };
+                return self.update(topic.map_or(Message::Page(Page::Guide), Message::ContextHelp));
+            }
             Message::ExactStrings(enabled) => {
                 if let Some(d) = &mut self.draft {
                     match d.set_exact(enabled) {
@@ -2823,6 +3025,23 @@ impl App {
                     iced::widget::scrollable::RelativeOffset::START,
                 );
             }
+            Message::ReviewLayerTraces => {
+                // Reuse Page navigation so modal, placement and behavior-form
+                // guards run before changing the transient inventory filter.
+                let navigation = self.update(Message::Page(Page::Traces));
+                if self.page == Page::Traces && !self.behavior.has_pending() {
+                    self.traceability.filter = crate::views::traceability::Filter::Traces;
+                    self.traceability.query.clear();
+                    return Task::batch([
+                        navigation,
+                        iced::widget::operation::snap_to(
+                            "traceability-list",
+                            iced::widget::scrollable::RelativeOffset::START,
+                        ),
+                    ]);
+                }
+                return navigation;
+            }
             Message::Search(value) => {
                 self.search = value;
                 self.explorer_page = 0;
@@ -3484,7 +3703,11 @@ impl App {
                     .multiselect_snapshot()
                     .is_some_and(|s| s.targets().len() > 1)
                 {
-                    self.status = "Group model-deletion review is not available yet. Select one element or use Hide selected.".into();
+                    self.status = if self.topology_context().is_some() {
+                        "Group removal needs an aggregate review. Select one contribution to remove it individually."
+                    } else {
+                        "Group model-deletion review is not available yet. Select one element or use Hide selected."
+                    }.into();
                     return Task::none();
                 }
                 if self.selected != self.project().id && self.apply() {
@@ -4881,6 +5104,14 @@ impl App {
                 if !crate::connection_tool::Tool::for_layer(self.layer).contains(&tool) {
                     return;
                 }
+                if tool == crate::connection_tool::Tool::Allocation
+                    && !tool.available_in(
+                        self.layer,
+                        self.project().diagrams[&context.diagram].projection,
+                    )
+                {
+                    return;
+                }
                 self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
                 let context = self.route_context().unwrap();
                 self.connection = Some(Session::new(
@@ -4911,14 +5142,32 @@ impl App {
                 if let Some(source) = session.source {
                     match session.tool.command(self.project(), source, id) {
                         Ok(command) => {
+                            let previous_layer = self.layer;
+                            if session.tool == crate::connection_tool::Tool::Allocation {
+                                // Accepted edits belong to the captured view. A
+                                // retained mixed view can differ from the current
+                                // perspective; sync must not choose another view.
+                                self.layer = self.project().diagrams[&context.diagram].layer;
+                            }
                             if self.execute(command) {
                                 self.selected_node = None;
                                 self.inspector_tab = Default::default();
-                                self.status = format!(
-                                    "{} created · edit its name and carried items in Properties · Undo restores the complete operation",
-                                    session.tool.label()
-                                );
+                                self.status = if session.tool
+                                    == crate::connection_tool::Tool::Allocation
+                                {
+                                    format!(
+                                        "Allocated {} to {} · view filters are unchanged · Undo restores the complete operation",
+                                        self.project().named(id),
+                                        self.project().named(source)
+                                    )
+                                } else {
+                                    format!(
+                                        "{} created · edit its name and carried items in Properties · Undo restores the complete operation",
+                                        session.tool.label()
+                                    )
+                                };
                             } else {
+                                self.layer = previous_layer;
                                 self.connection = Some(session);
                             }
                         }
@@ -4933,7 +5182,18 @@ impl App {
                         &project_view(self.project(), context.diagram),
                         id,
                     );
-                    self.select(id);
+                    if session.tool == crate::connection_tool::Tool::Allocation
+                        && self.project().diagrams[&context.diagram].projection
+                            == ProjectionKind::Traceability
+                    {
+                        // Mixed views can allocate either perspective. Choosing
+                        // a visible source must not navigate to its preferred view.
+                        self.selected = id;
+                        self.selected_attachment = None;
+                        self.refresh_draft();
+                    } else {
+                        self.select(id);
+                    }
                     self.status = if session.candidates.is_empty() {
                         "No compatible targets are visible. Expand containers or show a compatible endpoint in this view; Esc cancels drawing.".into()
                     } else {
@@ -5157,11 +5417,17 @@ impl App {
             self.pan = iced::Vector::new(30., 30.);
             return;
         }
-        let geometry = oa_core::routing::route_diagram(
+        let mut geometry = oa_core::routing::route_diagram(
             self.project(),
             &self.project().diagrams[&self.active_diagram.unwrap()],
             &view,
         );
+        crate::diagram::apply_label_experiment(
+            self.project(),
+            &self.project().diagrams[&self.active_diagram.unwrap()],
+            &view,
+            &mut geometry,
+        );
         let left = geometry.bounds.position.x;
         let top = geometry.bounds.position.y;
         let right = left + geometry.bounds.size.width;

crates/oa-desktop/src/app/allocation_drag.rs

@@ -1,12 +1,22 @@
 //! Allocation work-body input admission. Gesture authority lives here, while
 //! the canvas retains ordered native pointer positions and frozen hit geometry.
 use super::{App, Message, Page};
-use crate::{allocation_drag as plan, route_edit::Context};
+use crate::{
+    allocation_drag as plan,
+    diagram_selection::Snapshot,
+    diagram_usage::{Surface, Target as SelectionTarget},
+    route_edit::Context,
+};
 use iced::{Point, Rectangle, Task, Vector};
 use oa_core::{projection::ProjectedView, routing::RoutedView, *};
-use std::{collections::BTreeMap, sync::Arc};
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    sync::Arc,
+};
 
-pub const FINISH_EDIT: &str = "Finish or cancel the current edit before selecting or moving work.";
+pub const FINISH_EDIT: &str =
+    "Finish or cancel the current edit before selecting or moving elements.";
+const ARRANGE_ARMED: &str = "Arrange next drag armed · presentation only · Esc cancels";
 
 #[derive(Debug, Clone, Copy, PartialEq)]
 pub struct Stamp {
@@ -65,7 +75,8 @@ pub fn contains(r: Rectangle, p: Point) -> bool {
 impl Frozen {
     pub fn capture(
         project: &Project,
-        scope: &plan::Scope,
+        diagram: &Diagram,
+        affected: &BTreeMap<Id, NodePlacement>,
         view: &ProjectedView,
         routed: &RoutedView,
         zoom: f32,
@@ -73,7 +84,7 @@ impl Frozen {
         let mut targets = Vec::new();
         let mut cards = Vec::new();
         for n in &view.nodes {
-            if scope.placements.contains_key(&n.id) {
+            if affected.contains_key(&n.id) {
                 continue;
             }
             let region = Rectangle::new(
@@ -84,7 +95,7 @@ impl Frozen {
                 cards.push(region);
                 continue;
             };
-            if e.kind().is_performer() && e.layer() == scope.diagram.layer {
+            if e.kind().is_performer() && e.layer() == diagram.layer {
                 let mut ancestors = Vec::new();
                 let mut parent = e.parent;
                 while let Some(id) = parent {
@@ -95,7 +106,7 @@ impl Frozen {
                     parent = project.elements.get(&id).and_then(|e| e.parent);
                 }
                 let name = project.named(e.id).to_owned();
-                let collapsed = scope.diagram.nodes[&n.id].collapsed;
+                let collapsed = diagram.nodes[&n.id].collapsed;
                 targets.push(Target {
                     element: e.id,
                     placement: n.id,
@@ -118,7 +129,7 @@ impl Frozen {
         let mut controls: Vec<_> = view
             .ports
             .iter()
-            .filter(|port| !scope.placements.contains_key(&port.owner))
+            .filter(|port| !affected.contains_key(&port.owner))
             .map(|port| {
                 Rectangle::new(
                     Point::new(port.position.x - radius, port.position.y - radius),
@@ -224,17 +235,23 @@ impl Frozen {
     }
 }
 
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Mode {
+    Assign,
+    Arrange,
+}
+
 #[derive(Debug, Clone)]
-pub struct Press {
+pub(crate) struct Press {
     pub stamp: Stamp,
     pub token: Id,
     pub start: Point,
-    pub scope: plan::Scope,
-    pub frozen: Frozen,
-    pub arrange: bool,
+    pub selection: Snapshot,
+    pub target: SelectionTarget,
+    pub mode: Mode,
 }
 #[derive(Debug, Clone)]
-pub enum Event {
+pub(crate) enum Event {
     Press(Arc<Press>),
     Preview(Stamp, Id, Option<Point>),
     Release(Stamp, Id, Option<Point>),
@@ -244,23 +261,266 @@ pub enum Event {
     Unfocused,
     KeyboardBoundary,
 }
+pub struct PreviewPlacement {
+    pub diagram: Diagram,
+    pub view: ProjectedView,
+    pub delta: Position,
+}
+
 pub struct Preview {
     pub token: Id,
-    pub semantic: Arc<plan::SemanticPlan>,
-    pub placement: plan::PlacementPlan,
+    pub candidate: Candidate,
+    pub placement: PreviewPlacement,
     pub routed: Arc<RoutedView>,
 }
+impl Preview {
+    pub fn project(&self) -> &Project {
+        self.candidate.project()
+    }
+    #[cfg(test)]
+    pub fn index(&self) -> &view_options::ViewIndex {
+        self.candidate.index()
+    }
+}
+
+enum Prepared {
+    Singleton(Box<plan::Scope>),
+    Assignment(plan::assignment::Scope),
+    Arrange(Arc<plan::arrange::Plan>),
+    Performers(Arc<PerformerPlan>),
+    Refused(String),
+}
+
+#[derive(Clone)]
+pub enum Candidate {
+    Singleton(Arc<plan::SemanticPlan>),
+    Assignment(Arc<plan::assignment::SemanticPlan>),
+    Arrange(Arc<plan::arrange::Plan>),
+    Performers(Arc<PerformerPlan>),
+}
+
+enum Placed {
+    Planned(plan::PlacementPlan),
+    Performers {
+        preview: PreviewPlacement,
+        command: Box<Command>,
+        requested: Position,
+    },
+}
+
+impl Placed {
+    fn diagram(&self) -> &Diagram {
+        match self {
+            Self::Planned(p) => &p.diagram,
+            Self::Performers { preview, .. } => &preview.diagram,
+        }
+    }
+    fn view(&self) -> &ProjectedView {
+        match self {
+            Self::Planned(p) => &p.view,
+            Self::Performers { preview, .. } => &preview.view,
+        }
+    }
+    fn into_preview(self) -> PreviewPlacement {
+        match self {
+            Self::Planned(p) => PreviewPlacement {
+                diagram: p.diagram,
+                view: p.view,
+                delta: p.delta,
+            },
+            Self::Performers { preview, .. } => preview,
+        }
+    }
+}
+
+/// Ordinary performer movement preserves the established core translation policy.
+/// It shares input provenance, not the explicit Arrange geometry restrictions.
+pub struct PerformerPlan {
+    accepted: Project,
+    index: view_options::ViewIndex,
+    diagram: Id,
+    selected: BTreeSet<Id>,
+    anchor: Id,
+    affected: BTreeMap<Id, NodePlacement>,
+}
+impl PerformerPlan {
+    fn place(&self, requested: Position) -> Result<Placed, plan::Refusal> {
+        let original = &self.accepted.diagrams[&self.diagram];
+        let anchor = original.nodes[&self.anchor].position;
+        let delta = if requested == anchor {
+            Position { x: 0., y: 0. }
+        } else {
+            Position {
+                x: (requested.x / 10.).round() * 10. - anchor.x,
+                y: (requested.y / 10.).round() * 10. - anchor.y,
+            }
+        };
+        let command =
+            diagram_edit::translate_placements(&self.accepted, self.diagram, &self.selected, delta)
+                .map_err(|e| plan::Refusal::InvalidCandidate(e.to_string()))?;
+        let mut diagram = original.clone();
+        let Command::Batch(edits) = &command else {
+            unreachable!("translation is an atomic batch")
+        };
+        for edit in edits {
+            match edit {
+                Command::EditNode {
+                    diagram: id,
+                    original,
+                    node,
+                } if *id == self.diagram => {
+                    diagram.nodes.insert(*original, node.clone());
+                }
+                Command::SetEdgeRoute { diagram: id, route } if *id == self.diagram => {
+                    let stored = diagram
+                        .routes
+                        .iter_mut()
+                        .find(|r| r.edge == route.edge)
+                        .ok_or(plan::Refusal::StaleScope)?;
+                    *stored = route.clone();
+                }
+                _ => {
+                    return Err(plan::Refusal::InvalidCandidate(
+                        "Unexpected performer movement edit.".into(),
+                    ));
+                }
+            }
+        }
+        let view = projection::project_diagram_with_index(&self.accepted, &diagram, &self.index);
+        Ok(Placed::Performers {
+            preview: PreviewPlacement {
+                diagram,
+                view,
+                delta,
+            },
+            command: Box::new(command),
+            requested,
+        })
+    }
+}
+
+impl Candidate {
+    pub fn project(&self) -> &Project {
+        match self {
+            Self::Singleton(p) => p.project(),
+            Self::Assignment(p) => p.project(),
+            Self::Arrange(p) => p.project(),
+            Self::Performers(p) => &p.accepted,
+        }
+    }
+    #[cfg(test)]
+    pub fn index(&self) -> &view_options::ViewIndex {
+        match self {
+            Self::Singleton(p) => p.index(),
+            Self::Assignment(p) => p.index(),
+            Self::Arrange(p) => p.index(),
+            Self::Performers(p) => &p.index,
+        }
+    }
+    fn place(
+        &self,
+        requested: Position,
+        presentation: plan::PresentationContext,
+    ) -> Result<Placed, plan::Refusal> {
+        match self {
+            Self::Singleton(p) => plan::place(p, requested, presentation).map(Placed::Planned),
+            Self::Assignment(p) => {
+                plan::assignment::place(p, requested, presentation).map(Placed::Planned)
+            }
+            Self::Arrange(p) => {
+                plan::arrange::place(p, requested, presentation).map(Placed::Planned)
+            }
+            Self::Performers(p) => p.place(requested),
+        }
+    }
+    fn finish(&self, live: &Project, placed: &Placed) -> Result<Option<Command>, plan::Refusal> {
+        match (self, placed) {
+            (Self::Singleton(p), Placed::Planned(result)) => plan::finish(p, live, result),
+            (Self::Assignment(p), Placed::Planned(result)) => {
+                plan::assignment::finish(p, live, result)
+            }
+            (Self::Arrange(p), Placed::Planned(result)) => plan::arrange::finish(p, live, result),
+            (
+                Self::Performers(p),
+                Placed::Performers {
+                    preview,
+                    command,
+                    requested,
+                },
+            ) => {
+                if live != &p.accepted {
+                    return Err(plan::Refusal::StaleScope);
+                }
+                let checked = p.place(*requested)?;
+                let Placed::Performers {
+                    preview: checked,
+                    command: checked_command,
+                    ..
+                } = checked
+                else {
+                    unreachable!()
+                };
+                if checked.diagram != preview.diagram
+                    || checked.view != preview.view
+                    || checked.delta != preview.delta
+                    || &checked_command != command
+                {
+                    return Err(plan::Refusal::StaleScope);
+                }
+                let mut expected = p.accepted.clone();
+                expected.diagrams.insert(p.diagram, checked.diagram);
+                let actual = prepare_command(live, &checked_command)
+                    .map_err(|e| plan::Refusal::InvalidCandidate(e.to_string()))?
+                    .project;
+                if actual != expected {
+                    return Err(plan::Refusal::InvalidCandidate(
+                        "Performer movement would change unrelated records.".into(),
+                    ));
+                }
+                Ok((actual != *live).then_some(*checked_command))
+            }
+            _ => Err(plan::Refusal::StaleScope),
+        }
+    }
+    fn label(&self) -> String {
+        let (label, warnings) = match self {
+            Self::Singleton(p) => (p.label.clone(), p.warnings.len()),
+            Self::Assignment(p) => (p.label().to_owned(), p.warnings().len()),
+            Self::Arrange(p) => (
+                format!(
+                    "Arrange {} selected elements · {} affected placements",
+                    p.selected().len(),
+                    p.affected().len()
+                ),
+                0,
+            ),
+            Self::Performers(p) => (
+                format!("Move {} selected performer(s)", p.selected.len()),
+                0,
+            ),
+        };
+        if warnings == 0 {
+            label
+        } else {
+            format!("{label} · {warnings} model warning(s) retained")
+        }
+    }
+}
+
 struct Active {
     press: Arc<Press>,
+    selection: Snapshot,
+    crossed: bool,
+    prepared: Prepared,
+    frozen: Option<Arc<Frozen>>,
     inspection_targets: Vec<usize>,
     ids: BTreeMap<Id, Id>,
-    cache: Vec<(
-        plan::Destination,
-        Result<Arc<plan::SemanticPlan>, plan::Refusal>,
-    )>,
+    cache: Vec<(plan::Destination, Result<Candidate, plan::Refusal>)>,
 }
-pub struct Feedback {
+pub(crate) struct Feedback {
     pub press: Arc<Press>,
+    pub frozen: Option<Arc<Frozen>>,
+    ordinary_performers: bool,
     pub targets: Vec<usize>,
     /// Last captured target names for inspection only; never resolver input.
     pub inspection_targets: Vec<usize>,
@@ -273,7 +533,13 @@ impl Feedback {
             let names = self
                 .inspection_targets
                 .iter()
-                .map(|index| self.press.frozen.targets[*index].name.as_str())
+                .filter_map(|index| {
+                    self.frozen
+                        .as_ref()?
+                        .targets
+                        .get(*index)
+                        .map(|t| t.name.as_str())
+                })
                 .collect::<Vec<_>>()
                 .join(" / ");
             format!(
@@ -293,7 +559,9 @@ impl Feedback {
     /// Captured accepted names, independent of clipped status/refusal prose.
     pub fn destination_identity(&self) -> String {
         match self.targets.as_slice() {
-            [] => if self.press.arrange {
+            [] => if self.ordinary_performers {
+                "Move performers"
+            } else if self.press.mode == Mode::Arrange {
                 "Arrange only"
             } else if self.refused {
                 "No eligible destination"
@@ -301,12 +569,22 @@ impl Feedback {
                 "Outside performers"
             }
             .into(),
-            [index] => self.press.frozen.targets[*index].name.clone(),
+            [index] => self
+                .frozen
+                .as_ref()
+                .and_then(|f| f.targets.get(*index))
+                .map(|t| t.name.clone())
+                .unwrap_or_else(|| "No eligible destination".into()),
             indices => format!(
                 "Ambiguous: {}",
                 indices
                     .iter()
-                    .map(|index| self.press.frozen.targets[*index].name.as_str())
+                    .filter_map(|index| self
+                        .frozen
+                        .as_ref()?
+                        .targets
+                        .get(*index)
+                        .map(|t| t.name.as_str()))
                     .collect::<Vec<_>>()
                     .join(" / ")
             ),
@@ -358,6 +636,7 @@ impl App {
     }
     pub(crate) fn allocation_input_owner(&self) -> bool {
         self.page == Page::Diagram
+            && !self.context_help
             && self
                 .active_diagram
                 .and_then(|id| self.project().diagrams.get(&id))
@@ -391,6 +670,18 @@ impl App {
             && self.canvas_size.is_none_or(|s| s == stamp.bounds.size())
             && stamp.bounds.width > 0.
             && stamp.bounds.height > 0.
+            && stamp.zoom > 0.
+            && [
+                stamp.bounds.x,
+                stamp.bounds.y,
+                stamp.bounds.width,
+                stamp.bounds.height,
+                stamp.pan.x,
+                stamp.pan.y,
+                stamp.zoom,
+            ]
+            .iter()
+            .all(|value| value.is_finite())
     }
     /// Called before general input dispatch. Even equal-valued actions (Fit,
     /// Undo/Redo, tool/modal round trips) retire old render-time capabilities.
@@ -410,7 +701,12 @@ impl App {
                 | Message::DiagramUsagesReady(_)
                 | Message::DiagramRevealViewport(..)
         ) {
+            let clear_armed_status =
+                self.allocation_drag.arrange_next && self.status == ARRANGE_ARMED;
             self.allocation_drag.retire();
+            if clear_armed_status {
+                self.status = "Arrange cancelled".into();
+            }
         }
     }
     pub(super) fn allocation_boundary(&self) -> impl PartialEq + use<> {
@@ -427,20 +723,54 @@ impl App {
     pub(super) fn allocation_retire(&mut self) {
         self.allocation_drag.retire();
     }
-    fn select_work_clean(&mut self, press: &Press) -> bool {
-        if !self.allocation_stamp_valid(press.stamp) {
-            return false;
-        }
-        self.selected = press.scope.work;
-        self.selected_node = Some(press.scope.placement);
-        self.selected_bend = None;
-        self.refresh_draft();
-        true
+    fn allocation_selection_valid(&self, snapshot: &Snapshot) -> bool {
+        self.multiselect_context().is_some_and(|current| {
+            self.diagram_selection
+                .as_ref()
+                .is_some_and(|selection| selection.matches(snapshot, current))
+        })
     }
     pub(super) fn allocation_press_owns_current_view(&self, press: &Press) -> bool {
-        self.allocation_drag.active.is_none()
-            && self.allocation_stamp_valid(press.stamp)
-            && press.arrange == self.allocation_drag.arrange_next
+        if self.allocation_drag.active.is_some()
+            || !self.allocation_stamp_valid(press.stamp)
+            || (press.mode == Mode::Arrange) != self.allocation_drag.arrange_next
+            || !self.allocation_selection_valid(&press.selection)
+            || press.selection.context().scope.surface
+                != Surface::Saved(press.stamp.context.diagram)
+            || !press.start.x.is_finite()
+            || !press.start.y.is_finite()
+            || !contains(press.stamp.bounds, press.start)
+        {
+            return false;
+        }
+        let view = projection::project_view_with_index(
+            self.project(),
+            press.stamp.context.diagram,
+            self.document.view_index(),
+        );
+        super::multiselect::visible(
+            self.project(),
+            press.stamp.context.diagram,
+            &view,
+            &press.target,
+        )
+    }
+    /// Bare Allocation movement has no lifetime provenance. All actual Allocation
+    /// placement gestures now enter Press/Active, including ordinary performers.
+    pub(super) fn allocation_legacy_move(&self, message: &Message) -> bool {
+        let allocation = |diagram| {
+            self.project()
+                .diagrams
+                .get(&diagram)
+                .is_some_and(|d| d.projection == ProjectionKind::Allocation)
+        };
+        match message {
+            Message::MoveNode(..) => self.active_diagram.is_some_and(allocation),
+            Message::DiagramSelection(super::multiselect::Event::Move(snapshot, _)) => {
+                matches!(snapshot.context().scope.surface, Surface::Saved(diagram) if allocation(diagram))
+            }
+            _ => false,
+        }
     }
     pub(super) fn allocation_event_envelope(&self, event: &Event) -> bool {
         match event {
@@ -451,11 +781,64 @@ impl App {
                     .is_some_and(|active| active.press.token == *token)
             }
             Event::Refused(epoch, _) => *epoch == self.allocation_drag.epoch,
-            // Invalid Press packets deliberately report why the view or draft
-            // changed. Leave their existing validation and feedback intact.
             _ => true,
         }
     }
+    fn allocation_prepare(&self, press: &Press, selection: &Snapshot) -> Prepared {
+        let SelectionTarget::Placement(anchor) = &press.target else {
+            return Prepared::Refused("Move requires only placed work or performers; ports and connections cannot be moved with this selection.".into());
+        };
+        let anchor = *anchor;
+        let Some(ids) = super::multiselect::placements(selection) else {
+            return Prepared::Refused("Move requires only placed work or performers; remove ports, rows and connections from the selection.".into());
+        };
+        let project = self.project();
+        let diagram = press.stamp.context.diagram;
+        let d = &project.diagrams[&diagram];
+        let selected: BTreeMap<_, _> = ids.iter().map(|id| (*id, d.nodes[id].element)).collect();
+        let result = if press.mode == Mode::Arrange {
+            plan::arrange::capture(project, diagram, &selected, anchor)
+                .map(|p| Prepared::Arrange(Arc::new(p)))
+        } else if selected
+            .values()
+            .all(|id| project.elements[id].kind().is_work())
+        {
+            if selected.len() == 1 {
+                plan::capture(project, diagram, selected[&anchor], anchor)
+                    .map(|scope| Prepared::Singleton(Box::new(scope)))
+            } else {
+                plan::assignment::capture(project, diagram, &selected, anchor)
+                    .map(Prepared::Assignment)
+            }
+        } else if selected
+            .values()
+            .all(|id| project.elements[id].kind().is_performer())
+        {
+            validate_candidate(project)
+                .map_err(|e| plan::Refusal::InvalidCandidate(e.to_string()))
+                .map(|_| {
+                    let mut affected = BTreeMap::new();
+                    for id in &ids {
+                        for member in std::iter::once(*id)
+                            .chain(projection::descendant_nodes(project, diagram, *id))
+                        {
+                            affected.insert(member, d.nodes[&member].clone());
+                        }
+                    }
+                    Prepared::Performers(Arc::new(PerformerPlan {
+                        accepted: project.clone(),
+                        index: view_options::ViewIndex::new(project),
+                        diagram,
+                        selected: ids,
+                        anchor,
+                        affected,
+                    }))
+                })
+        } else {
+            Err(plan::Refusal::Ineligible("Assignment requires only work. Arm Arrange next drag to arrange a supported work/performer selection.".into()))
+        };
+        result.unwrap_or_else(|reason| Prepared::Refused(refusal(&reason)))
+    }
     pub(super) fn allocation_event(&mut self, event: Event) -> Task<Message> {
         if !self.allocation_event_envelope(&event) {
             return Task::none();
@@ -465,7 +848,7 @@ impl App {
                 self.allocation_drag.retire();
                 if self.allocation_drag_clean() {
                     self.allocation_drag.arrange_next = true;
-                    self.status = "Arrange next drag armed · moves work only · Esc cancels".into();
+                    self.status = ARRANGE_ARMED.into();
                 } else {
                     self.status = FINISH_EDIT.into();
                 }
@@ -476,22 +859,13 @@ impl App {
                     self.allocation_drag.retire();
                 }
             }
-            Event::Cancel(token) => {
-                if self
-                    .allocation_drag
-                    .active
-                    .as_ref()
-                    .is_some_and(|a| a.press.token == token)
-                {
-                    self.allocation_drag.retire();
-                    self.status = "Work drag canceled".into();
-                }
+            Event::Cancel(_) => {
+                self.allocation_drag.retire();
+                self.status = "Drag canceled".into();
             }
-            Event::Refused(epoch, text) => {
-                if epoch == self.allocation_drag.epoch {
-                    self.allocation_drag.retire();
-                    self.status = text;
-                }
+            Event::Refused(_, text) => {
+                self.allocation_drag.retire();
+                self.status = text;
             }
             Event::Press(press) => {
                 if self.allocation_drag.active.is_some() {
@@ -505,32 +879,73 @@ impl App {
                     };
                     return Task::none();
                 }
-                let checked = plan::capture(
-                    self.project(),
-                    press.scope.diagram.id,
-                    press.scope.work,
-                    press.scope.placement,
-                );
-                if checked.as_ref() != Ok(&press.scope) || !self.select_work_clean(&press) {
-                    self.status = checked
-                        .err()
-                        .as_ref()
-                        .map(refusal)
-                        .unwrap_or_else(|| "The view changed. Start this drag again.".into());
-                    self.allocation_drag.retire();
+                // A selected-member press has no selection or inspector effect.
+                // An unselected press replaces selection atomically in this handler.
+                if !press.selection.targets().contains(&press.target) {
+                    self.multiselect_event(super::multiselect::Event::Choose(
+                        press.selection.context(),
+                        press.target.clone(),
+                        super::multiselect::Choice::Replace,
+                    ));
+                }
+                let Some(selection) = self.multiselect_snapshot() else {
+                    return Task::none();
+                };
+                if !selection.targets().contains(&press.target)
+                    || (!press.selection.targets().contains(&press.target)
+                        && selection.targets() != [press.target.clone()])
+                {
                     return Task::none();
                 }
-                let ids = press
-                    .scope
-                    .leaves
-                    .keys()
-                    .map(|id| (*id, Id::new_v4()))
-                    .collect();
+                let diagram = press.stamp.context.diagram;
+                let view = projection::project_view_with_index(
+                    self.project(),
+                    diagram,
+                    self.document.view_index(),
+                );
+                if !selection.targets().iter().all(|target| {
+                    super::multiselect::visible(self.project(), diagram, &view, target)
+                }) {
+                    self.allocation_drag.retire();
+                    self.status = "The view changed. Start this drag again.".into();
+                    return Task::none();
+                }
+                let prepared = self.allocation_prepare(&press, &selection);
+                let (affected, leaf_ids) = match &prepared {
+                    Prepared::Singleton(scope) => (
+                        Some(&scope.placements),
+                        scope.leaves.keys().copied().collect::<Vec<_>>(),
+                    ),
+                    Prepared::Assignment(scope) => (
+                        Some(scope.affected()),
+                        scope.leaves().keys().copied().collect(),
+                    ),
+                    Prepared::Arrange(plan) => (Some(plan.affected()), Vec::new()),
+                    Prepared::Performers(plan) => (Some(&plan.affected), Vec::new()),
+                    Prepared::Refused(_) => (None, Vec::new()),
+                };
+                let frozen = affected.map(|affected| {
+                    let d = &self.project().diagrams[&diagram];
+                    let routed = routing::route_diagram(self.project(), d, &view);
+                    Arc::new(Frozen::capture(
+                        self.project(),
+                        d,
+                        affected,
+                        &view,
+                        &routed,
+                        press.stamp.zoom,
+                    ))
+                });
+                let ids = leaf_ids.into_iter().map(|id| (id, Id::new_v4())).collect();
                 self.allocation_drag.arrange_next = false;
                 self.allocation_drag.preview = None;
                 self.allocation_drag.feedback = None;
                 self.allocation_drag.active = Some(Active {
                     press,
+                    selection,
+                    crossed: false,
+                    prepared,
+                    frozen,
                     inspection_targets: Vec::new(),
                     ids,
                     cache: Vec::new(),
@@ -552,15 +967,16 @@ impl App {
         pointer: Option<Point>,
         release: bool,
     ) {
-        if self
-            .allocation_drag
-            .active
-            .as_ref()
-            .is_none_or(|a| a.press.token != token)
-        {
-            return; // An old packet cannot cancel a newer gesture.
+        let Some(active) = self.allocation_drag.active.as_ref() else {
+            return;
+        };
+        if active.press.token != token {
+            return;
         }
-        if !self.allocation_stamp_valid(stamp) {
+        if !self.allocation_stamp_valid(stamp)
+            || !self.allocation_selection_valid(&active.selection)
+            || active.press.stamp != stamp
+        {
             self.allocation_drag.retire();
             self.status = if self.allocation_drag_clean() {
                 "The view changed. Start this drag again.".into()
@@ -569,17 +985,35 @@ impl App {
             };
             return;
         }
-        let Some(mut active) = self.allocation_drag.active.take() else {
-            return;
-        };
-        if active.press.token != token || active.press.stamp != stamp {
-            self.allocation_drag.active = Some(active);
+        let mut active = self.allocation_drag.active.take().unwrap();
+        let press = active.press.clone();
+        active.crossed |= pointer.is_some_and(|p| p.distance(press.start) > 3.);
+        let in_bounds = pointer
+            .is_some_and(|p| p.x.is_finite() && p.y.is_finite() && contains(stamp.bounds, p));
+        if !active.crossed && in_bounds {
+            if release {
+                self.multiselect_event(super::multiselect::Event::Collapse(
+                    active.selection,
+                    press.target.clone(),
+                ));
+                self.allocation_drag.retire();
+                self.status = "Element selected".into();
+            } else {
+                self.allocation_drag.active = Some(active);
+            }
             return;
         }
-        let press = active.press.clone();
-        let moved = pointer.is_some_and(|p| p.distance(press.start) > 3.);
-        let hit = press.frozen.resolve(stamp, pointer, press.arrange);
-        if moved {
+        let ordinary_performers = matches!(&active.prepared, Prepared::Performers(_));
+        let hit = if !in_bounds {
+            Hit::OutsideViewport
+        } else if ordinary_performers {
+            Hit::Destination(plan::Destination::LayoutOnly, None)
+        } else {
+            active.frozen.as_ref().map_or(Hit::Occluded, |f| {
+                f.resolve(stamp, pointer, press.mode == Mode::Arrange)
+            })
+        };
+        if active.crossed {
             match &hit {
                 Hit::Destination(_, Some(target)) => active.inspection_targets = vec![*target],
                 Hit::Ambiguous(targets) => active.inspection_targets = targets.clone(),
@@ -588,64 +1022,63 @@ impl App {
         }
         let mut targets = Vec::new();
         let mut preview = None;
-        let result: Result<String, String> = match hit {
-            Hit::OutsideViewport => Err(if release {
-                "Work drag canceled outside the canvas."
-            } else {
-                "Pointer outside canvas · return to choose a destination; releasing here cancels the drag."
-            }.into()),
-            _ if !moved => Ok("Work selected".into()),
+        let result: Result<String, String> = if matches!(hit, Hit::OutsideViewport) {
+            Err(if release { "Drag canceled outside the canvas." }
+                else { "Pointer outside canvas · return to choose a destination; releasing here cancels the drag." }.into())
+        } else if let Prepared::Refused(reason) = &active.prepared {
+            Err(reason.clone())
+        } else {
+            match hit {
+            Hit::OutsideViewport => unreachable!(),
             Hit::Occluded => Err("Aim at exposed performer space or empty canvas; this card, port, connection or control blocks the drop.".into()),
             Hit::Ambiguous(indices) => {
-                targets = indices;
-                Err("Two unrelated performers overlap here. Use an exposed region.".into())
+                targets = indices; Err("Two unrelated performers overlap here. Use an exposed region.".into())
             }
             Hit::Destination(destination, target) => {
                 targets.extend(target);
-                let semantic = if let Some((_, result)) = active.cache.iter().find(|(d, _)| *d == destination) {
-                    result.clone()
-                } else {
-                    let result = plan::plan_semantics(self.project(), &press.scope, destination, &active.ids).map(Arc::new);
-                    active.cache.push((destination, result.clone()));
-                    result
+                let candidate = if let Some((_, cached)) = active.cache.iter().find(|(d, _)| *d == destination) { cached.clone() }
+                else {
+                    let candidate = match &active.prepared {
+                        Prepared::Singleton(scope) => plan::plan_semantics(self.project(), scope, destination, &active.ids)
+                            .map(|p| Candidate::Singleton(Arc::new(p))),
+                        Prepared::Assignment(scope) => plan::assignment::plan_semantics(scope, destination, &active.ids)
+                            .map(|p| Candidate::Assignment(Arc::new(p))),
+                        Prepared::Arrange(plan) => Ok(Candidate::Arrange(plan.clone())),
+                        Prepared::Performers(plan) => Ok(Candidate::Performers(plan.clone())),
+                        Prepared::Refused(_) => unreachable!(),
+                    };
+                    active.cache.push((destination, candidate.clone())); candidate
                 };
-                semantic.map_err(|r| refusal(&r)).and_then(|semantic| {
-                    if stamp.zoom * 16. < 9. {
+                candidate.map_err(|r| refusal(&r)).and_then(|candidate| {
+                    if !ordinary_performers && stamp.zoom * 16. < 9. {
                         return Err("Make room or adjust the view, then drag again. Zoom in to read the work and destination.".into());
                     }
-                    let pointer = pointer.unwrap();
-                    let delta = pointer - press.start;
-                    let original = press.scope.placements[&press.scope.placement].position;
+                    let SelectionTarget::Placement(anchor) = &press.target else { unreachable!("supported placement") };
+                    let original = self.project().diagrams[&stamp.context.diagram].nodes[anchor].position;
+                    let delta = pointer.unwrap() - press.start;
                     let requested = Position { x: original.x + delta.x / stamp.zoom, y: original.y + delta.y / stamp.zoom };
                     let presentation = plan::PresentationContext {
                         viewport: stamp.viewport(), zoom: stamp.zoom,
-                        target: target.map(|i| {
-                            let t = &press.frozen.targets[i];
-                            plan::TargetPresentation { placement: t.placement }
-                        }),
-                    };
-                    let placement = plan::place(&semantic, requested, presentation).map_err(|r| refusal(&r))?;
-                    let label = if semantic.warnings.is_empty() { semantic.label.clone() } else {
-                        format!("{} · {} model warning(s) retained", semantic.label, semantic.warnings.len())
+                        target: target.map(|i| plan::TargetPresentation { placement: active.frozen.as_ref().unwrap().targets[i].placement }),
                     };
+                    let placed = candidate.place(requested, presentation).map_err(|r| refusal(&r))?;
+                    let label = candidate.label();
                     if release {
-                        let command = plan::finish(&semantic, self.project(), &placement).map_err(|r| refusal(&r))?;
-                        if let Some(command) = command {
-                            // Bypass applying selectors and unrelated repair helpers. The
-                            // planner's exact Batch enters the authoritative source pipeline.
-                            self.document.execute(command).map_err(|e| format!("{} · retry this drag after correcting the source issue", e))?;
+                        if let Some(command) = candidate.finish(self.project(), &placed).map_err(|r| refusal(&r))? {
+                            self.document.execute(command)
+                                .map_err(|e| format!("{e} · retry this drag after correcting the source issue"))?;
+                            // sync refreshes the retained primary once; no anchor promotion.
                             self.sync();
-                            self.selected = press.scope.work;
-                            self.selected_node = Some(press.scope.placement);
-                            self.refresh_draft();
+                            self.reconcile_multiselect();
                         }
                     } else {
-                        let routed = Arc::new(routing::route_diagram(semantic.project(), &placement.diagram, &placement.view));
-                        preview = Some(Arc::new(Preview { token, semantic, placement, routed }));
+                        let routed = Arc::new(routing::route_diagram(candidate.project(), placed.diagram(), placed.view()));
+                        preview = Some(Arc::new(Preview { token, candidate, placement: placed.into_preview(), routed }));
                     }
                     Ok(label)
                 })
             }
+        }
         };
         let refused = result.is_err();
         let text = result.unwrap_or_else(|text| text);
@@ -654,10 +1087,13 @@ impl App {
             self.allocation_drag.retire();
         } else {
             let inspection_targets = active.inspection_targets.clone();
+            let frozen = active.frozen.clone();
             self.allocation_drag.active = Some(active);
             self.allocation_drag.preview = preview;
             self.allocation_drag.feedback = Some(Feedback {
                 press,
+                frozen,
+                ordinary_performers,
                 targets,
                 inspection_targets,
                 text,

crates/oa-desktop/src/app/allocation_drag_full_tree_tests.rs

@@ -4,6 +4,9 @@ use super::*;
 use crate::behavior::canvas_workspace::tests::{Mounted, key};
 use iced::{Event as Input, keyboard};
 
+#[path = "allocation_drag_tests/control_focus.rs"]
+mod control_focus;
+
 fn character(text: &str, modifiers: keyboard::Modifiers) -> Input {
     Input::Keyboard(keyboard::Event::KeyPressed {
         key: keyboard::Key::Character(text.into()),
@@ -187,6 +190,7 @@ async fn actual_keyboard_arrange_shortcut_consumes_once_escape_cancels_and_dirty
         )
         .await;
     assert!(!f.app.allocation_drag.arrange_next);
+    assert_eq!(f.app.status, "Arrange cancelled");
     mounted
         .batch(
             &mut f.app,
@@ -211,7 +215,7 @@ async fn actual_keyboard_arrange_shortcut_consumes_once_escape_cancels_and_dirty
     assert!(
         messages
             .iter()
-            .any(|m| matches!(m, Message::WorkDrag(Event::Press(p)) if p.arrange))
+            .any(|m| matches!(m, Message::WorkDrag(Event::Press(p)) if p.mode == Mode::Arrange))
     );
     assert!(!f.app.allocation_drag.arrange_next);
     assert_eq!(f.app.document.revision(), 1, "{}", f.app.status);
@@ -282,7 +286,7 @@ async fn actual_rendered_canvas_pixels_do_not_change_when_toolbar_feedback_text_
         .as_ref()
         .expect("active frozen destination");
     assert!(!feedback.refused, "{}", feedback.text);
-    let target = &feedback.press.frozen.targets[feedback.targets[0]];
+    let target = &feedback.frozen.as_ref().unwrap().targets[feedback.targets[0]];
     assert!(target.region.y * f.app.zoom + f.app.pan.y < 0.);
     assert_eq!(feedback.destination_identity(), "A");
     let canvas = canvas_bounds(&mut mounted, &f.app);
@@ -434,7 +438,7 @@ async fn actual_app_tree_exact_incoming_drag_keeps_destination_visible_and_canva
                 selected_header.x + selected_header.width <= canvas.x + canvas.width
                     && selected_header.y + selected_header.height <= canvas.y + canvas.height
             );
-            let mut expected = preview.semantic.project().clone();
+            let mut expected = preview.project().clone();
             expected
                 .diagrams
                 .insert(f.diagram, preview.placement.diagram.clone());
@@ -689,7 +693,7 @@ async fn actual_toolbar_hover_inspects_last_full_name_without_authorizing_an_out
             .await;
         assert!(f.app.allocation_drag.active.is_none());
         assert!(f.app.allocation_drag.feedback.is_none());
-        assert_eq!(f.app.status, "Work drag canceled outside the canvas.");
+        assert_eq!(f.app.status, "Drag canceled outside the canvas.");
         assert_eq!(f.app.document.bundle(), &before);
         assert!(!f.app.document.can_undo());
         // A fresh gesture cannot inherit the previous inspection name.

crates/oa-desktop/src/app/allocation_drag_tests.rs

@@ -8,6 +8,9 @@ use iced::{
 #[path = "allocation_drag_full_tree_tests.rs"]
 mod full_tree;
 
+#[path = "allocation_drag_tests/group.rs"]
+mod group;
+
 #[path = "allocation_drag_tests/navigation_union.rs"]
 mod navigation_union;
 
@@ -48,6 +51,7 @@ fn fixture(layer: Layer) -> Fixture {
     app.zoom = 1.;
     app.pan = Vector::ZERO;
     app.fit_to_view = false;
+    app.reconcile_multiselect();
     Fixture {
         app,
         a,
@@ -59,7 +63,7 @@ fn fixture(layer: Layer) -> Fixture {
 }
 fn canvas(app: &App) -> DiagramCanvas<'_> {
     DiagramCanvas {
-        selection: None,
+        selection: app.diagram_selection.as_ref(),
         allocation: Some(app.allocation_capability()),
         project: app.project(),
         view_index: Some(app.document.view_index()),
@@ -122,6 +126,18 @@ fn press(f: &Fixture) -> Arc<Press> {
         })
         .expect("actual clean work-body press")
 }
+fn admit_press(f: &mut Fixture) -> Arc<Press> {
+    let p = press(f);
+    let _ = f.app.update(Message::WorkDrag(Event::Press(p.clone())));
+    assert!(f.app.allocation_drag.active.is_some(), "{}", f.app.status);
+    p
+}
+fn singleton(candidate: &Candidate) -> &Arc<plan::SemanticPlan> {
+    let Candidate::Singleton(plan) = candidate else {
+        panic!("legacy singleton candidate")
+    };
+    plan
+}
 fn drag(f: &mut Fixture, to: Point) {
     let events = batch(&f.app, start(f), to);
     assert!(matches!(
@@ -359,7 +375,7 @@ fn arrange_is_one_gesture_and_snapped_noop_preserves_redo_and_source() {
     assert!(f.app.allocation_drag.arrange_next);
     let p = press(&f);
     let _ = f.app.update(Message::WorkDrag(Event::Press(p.clone())));
-    assert!(p.arrange);
+    assert_eq!(p.mode, Mode::Arrange);
     assert!(!f.app.allocation_drag.arrange_next);
     let _ = f.app.update(Message::WorkDrag(Event::Release(
         p.stamp,
@@ -370,7 +386,7 @@ fn arrange_is_one_gesture_and_snapped_noop_preserves_redo_and_source() {
     assert_eq!(f.app.document.revision(), revision);
     assert!(f.app.document.can_redo());
     assert!(f.app.project().relations.is_empty());
-    assert!(!press(&f).arrange);
+    assert_eq!(press(&f).mode, Mode::Assign);
 }
 
 #[test]
@@ -397,14 +413,15 @@ fn candidate_semantics_are_cached_per_destination_with_stable_ids_and_own_index(
     let _ = f
         .app
         .update(Message::WorkDrag(Event::Preview(p.stamp, p.token, Some(a))));
-    let first = f
-        .app
-        .allocation_drag
-        .preview
-        .as_ref()
-        .expect(&f.app.status)
-        .semantic
-        .clone();
+    let first = singleton(
+        &f.app
+            .allocation_drag
+            .preview
+            .as_ref()
+            .expect(&f.app.status)
+            .candidate,
+    )
+    .clone();
     let stable = first
         .project()
         .relations
@@ -419,20 +436,20 @@ fn candidate_semantics_are_cached_per_destination_with_stable_ids_and_own_index(
     )));
     assert!(Arc::ptr_eq(
         &first,
-        &f.app.allocation_drag.preview.as_ref().unwrap().semantic
+        singleton(&f.app.allocation_drag.preview.as_ref().unwrap().candidate)
     ));
     let _ = f
         .app
         .update(Message::WorkDrag(Event::Preview(p.stamp, p.token, Some(b))));
     let preview = f.app.allocation_drag.preview.as_ref().expect(&f.app.status);
-    assert!(!Arc::ptr_eq(&first, &preview.semantic));
-    assert_eq!(preview.semantic.project().relations[&stable].source(), f.b);
+    assert!(!Arc::ptr_eq(&first, singleton(&preview.candidate)));
+    assert_eq!(preview.project().relations[&stable].source(), f.b);
     assert_eq!(
         preview.placement.view,
         projection::project_diagram_with_index(
-            preview.semantic.project(),
+            preview.project(),
             &preview.placement.diagram,
-            preview.semantic.index()
+            preview.index()
         )
     );
     assert_ne!(
@@ -448,7 +465,7 @@ fn candidate_semantics_are_cached_per_destination_with_stable_ids_and_own_index(
         .update(Message::WorkDrag(Event::Preview(p.stamp, p.token, Some(a))));
     assert!(Arc::ptr_eq(
         &first,
-        &f.app.allocation_drag.preview.as_ref().unwrap().semantic
+        singleton(&f.app.allocation_drag.preview.as_ref().unwrap().candidate)
     ));
     assert_eq!(
         f.app.allocation_drag.active.as_ref().unwrap().cache.len(),
@@ -458,9 +475,19 @@ fn candidate_semantics_are_cached_per_destination_with_stable_ids_and_own_index(
 
 #[test]
 fn frozen_targets_use_half_open_semantic_priority_and_refuse_incomparable_overlap() {
-    let f = fixture(Layer::Oa);
-    let p = press(&f);
-    let mut frozen = p.frozen.clone();
+    let mut f = fixture(Layer::Oa);
+    let p = admit_press(&mut f);
+    let mut frozen = f
+        .app
+        .allocation_drag
+        .active
+        .as_ref()
+        .unwrap()
+        .frozen
+        .as_ref()
+        .unwrap()
+        .as_ref()
+        .clone();
     let ai = frozen
         .targets
         .iter()
@@ -540,6 +567,7 @@ fn release_uses_ordered_native_position_before_later_motion_in_same_batch() {
 fn replace(f: &mut Fixture, project: Project) {
     f.app.document = crate::document::Document::from_project(project, Default::default()).unwrap();
     f.app.sync();
+    f.app.reconcile_multiselect();
 }
 
 #[test]
@@ -588,7 +616,7 @@ fn same_snapped_position_on_opposite_shared_border_rebuilds_semantics_even_if_la
         .1
         .as_ref()
         .unwrap();
-    assert!(!Arc::ptr_eq(a, b));
+    assert!(!Arc::ptr_eq(singleton(a), singleton(b)));
     let stable = a
         .project()
         .relations
@@ -655,13 +683,24 @@ fn mounted_role_only_outgoing_refusal_retains_placement_and_same_performer_creat
         "{}",
         f.app.status
     );
-    let target = press(&f)
+    let admitted = admit_press(&mut f);
+    let target = f
+        .app
+        .allocation_drag
+        .active
+        .as_ref()
+        .unwrap()
         .frozen
+        .as_ref()
+        .unwrap()
         .targets
         .iter()
         .find(|t| t.element == f.a)
         .unwrap()
         .region;
+    let _ = f
+        .app
+        .update(Message::WorkDrag(Event::Cancel(admitted.token)));
     drag(&mut f, screen(xy(target.x + 45., target.y + 100.)));
     assert_eq!(f.app.document.revision(), 1, "{}", f.app.status);
     assert_eq!(f.app.project().relations, relations);
@@ -774,8 +813,18 @@ fn frozen_collapsed_target_uses_only_visible_header_and_port_edge_controls_occlu
         .unwrap()
         .collapsed = true;
     replace(&mut f, project);
-    let p = press(&f);
-    let mut frozen = p.frozen.clone();
+    let p = admit_press(&mut f);
+    let mut frozen = f
+        .app
+        .allocation_drag
+        .active
+        .as_ref()
+        .unwrap()
+        .frozen
+        .as_ref()
+        .unwrap()
+        .as_ref()
+        .clone();
     let t = frozen.targets.iter().find(|t| t.element == f.a).unwrap();
     let bottom = xy(t.region.x + 30., t.region.y + t.region.height);
     assert!(t.region.height <= 62.);
@@ -945,7 +994,7 @@ fn toolbar_destination_names_transformed_target_whose_header_is_clipped() {
         send(&mut f.app, events);
         let feedback = f.app.allocation_drag.feedback.as_ref().unwrap();
         assert!(!feedback.refused, "{}", feedback.text);
-        let target = &feedback.press.frozen.targets[feedback.targets[0]];
+        let target = &feedback.frozen.as_ref().unwrap().targets[feedback.targets[0]];
         assert!(screen(xy(target.region.x, target.region.y)).y < bounds().y);
         assert_eq!(feedback.destination_identity(), "A");
         assert!(f.app.allocation_drag.preview.is_some());
@@ -1004,7 +1053,7 @@ fn oa_sa_clipped_selected_header_refuses_preview_release_and_retries_without_par
             assert!(feedback.refused, "{}", feedback.text);
             assert!(feedback.text.contains("Make room or adjust the view"));
             assert_eq!(
-                feedback.press.frozen.targets[feedback.targets[0]].element,
+                feedback.frozen.as_ref().unwrap().targets[feedback.targets[0]].element,
                 f.a
             );
             assert_eq!(f.app.project(), &accepted);
@@ -1029,14 +1078,14 @@ fn oa_sa_clipped_selected_header_refuses_preview_release_and_retries_without_par
             send(&mut f.app, events);
             let active = f.app.allocation_drag.active.as_ref().unwrap();
             let p = active.press.clone();
-            let semantic = active.cache[0].1.as_ref().unwrap().clone();
+            let semantic = singleton(active.cache[0].1.as_ref().unwrap()).clone();
             let _ = f.app.update(Message::WorkDrag(Event::Preview(
                 p.stamp,
                 p.token,
                 Some(clear),
             )));
             let preview = f.app.allocation_drag.preview.as_ref().expect(&f.app.status);
-            assert!(Arc::ptr_eq(&semantic, &preview.semantic));
+            assert!(Arc::ptr_eq(&semantic, singleton(&preview.candidate)));
             assert_eq!(
                 preview.placement.diagram.nodes[&f.node].position,
                 xy(120., 160.)
@@ -1132,7 +1181,7 @@ fn oa_sa_toolbar_identity_accepts_exact_receiver_and_collapsed_header_drag() {
                 assert!(!feedback.refused, "{}", feedback.text);
                 assert_eq!(feedback.destination_identity(), name);
                 assert_eq!(
-                    feedback.press.frozen.targets[feedback.targets[0]].placement,
+                    feedback.frozen.as_ref().unwrap().targets[feedback.targets[0]].placement,
                     target_id
                 );
                 let preview = f.app.allocation_drag.preview.as_ref().expect(&f.app.status);
@@ -1144,12 +1193,12 @@ fn oa_sa_toolbar_identity_accepts_exact_receiver_and_collapsed_header_drag() {
                 assert_eq!(
                     preview.placement.view,
                     projection::project_diagram_with_index(
-                        preview.semantic.project(),
+                        preview.project(),
                         &preview.placement.diagram,
-                        preview.semantic.index()
+                        preview.index()
                     )
                 );
-                let mut expected = preview.semantic.project().clone();
+                let mut expected = preview.project().clone();
                 expected
                     .diagrams
                     .insert(f.diagram, preview.placement.diagram.clone());
@@ -1184,6 +1233,8 @@ fn destination_identity_does_not_describe_blocked_or_outside_viewport_as_unalloc
     let p = press(&f);
     let mut feedback = Feedback {
         press: p,
+        frozen: None,
+        ordinary_performers: false,
         targets: vec![],
         inspection_targets: vec![],
         text: "A card blocks this drop".into(),

crates/oa-desktop/src/app/allocation_drag_tests/control_focus.rs

@@ -0,0 +1,111 @@
+use super::*;
+
+#[tokio::test]
+async fn dirty_selected_pin_outer_ring_keeps_real_name_focus_and_caret() {
+    let mut f = fixture(Layer::Oa);
+    let mut p = f.app.project().clone();
+    let peer = p
+        .add_element(Kind::Activity, Layer::Oa, "Peer", None)
+        .unwrap();
+    p.place(f.diagram, peer, xy(700., 500.));
+    let edge = p.relate(RelationKind::Interaction, "Flow", f.work, peer);
+    let pin = xy(450., 547.);
+    p.diagrams
+        .get_mut(&f.diagram)
+        .unwrap()
+        .routes
+        .push(EdgeRoute {
+            edge,
+            source_attachment: Some(EdgeAttachment {
+                side: PortAnchorSide::Right,
+                offset: 0.5,
+            }),
+            target_attachment: Some(EdgeAttachment {
+                side: PortAnchorSide::Left,
+                offset: 0.5,
+            }),
+            waypoints: vec![pin],
+            label: Some(EdgeLabel {
+                fraction: 0.8,
+                offset: xy(0., -60.),
+            }),
+        });
+    validate_candidate(&p).unwrap();
+    let view = projection::project_view(&p, f.diagram);
+    let routed = routing::route_diagram(&p, &p.diagrams[&f.diagram], &view);
+    assert_eq!(routed.edges[&edge].pins, vec![pin]);
+    assert!(!routed.edges[&edge].custom_suspended);
+    assert!(
+        routed.edges[&edge]
+            .points
+            .iter()
+            .all(|point| point.y == 547.)
+    );
+    f.app = App::with_project(p);
+    f.app.active_diagram = Some(f.diagram);
+    f.app.window_size = iced::Size::new(2000., 1400.);
+    let _ = f.app.update(Message::Select(edge));
+    f.app.reconcile_multiselect();
+    let mut mounted = Mounted::new(&mut f.app).await;
+    f.app.zoom = 1.;
+    f.app.pan = Vector::ZERO;
+    f.app.fit_to_view = false;
+    mounted.settle(&mut f.app).await;
+    let field = name_field(&mut mounted, &f.app);
+    mounted.click(&mut f.app, field.center()).await;
+    mounted
+        .batch(
+            &mut f.app,
+            &[key(keyboard::key::Named::Home)],
+            mouse::Cursor::Unavailable,
+        )
+        .await;
+    type_key(&mut mounted, &mut f.app, "X").await;
+    mounted
+        .batch(
+            &mut f.app,
+            &[key(keyboard::key::Named::ArrowLeft)],
+            mouse::Cursor::Unavailable,
+        )
+        .await;
+    assert_eq!(f.app.draft.as_ref().unwrap().inputs["/name"].raw, "XFlow");
+    assert!(f.app.draft_dirty());
+    let accepted = f.app.document.snapshot();
+    let source = f.app.document.bundle().clone();
+    let selection = f.app.multiselect_snapshot().unwrap();
+    let pan = f.app.pan;
+    // Exposed straight-run bend: outside the 7px line hit, within the 8px handle.
+    let point = at(&mut mounted, &f, xy(pin.x, pin.y + 7.5));
+    let messages = mounted.click(&mut f.app, point).await;
+    assert!(
+        messages
+            .iter()
+            .any(|m| matches!(m, Message::WorkDrag(Event::Refused(..))))
+    );
+    assert!(!messages.iter().any(|m| matches!(
+        m,
+        Message::Pan(_)
+            | Message::Select(_)
+            | Message::SelectNode(_)
+            | Message::MoveNode(..)
+            | Message::Route(_)
+            | Message::DiagramSelection(_)
+    )));
+    assert!(Arc::ptr_eq(&accepted, &f.app.document.snapshot()));
+    assert_eq!(f.app.document.bundle(), &source);
+    assert_eq!(f.app.multiselect_snapshot().unwrap(), selection);
+    assert_eq!(f.app.pan, pan);
+    assert!(
+        is_focused(&mut mounted, &f.app, field),
+        "dirty handle press must stop before outside-press unfocus"
+    );
+    let messages = type_key(&mut mounted, &mut f.app, "Y").await;
+    assert!(
+        messages
+            .iter()
+            .any(|m| matches!(m, Message::Field(path, _) if path == "/name"))
+    );
+    assert_eq!(f.app.draft.as_ref().unwrap().inputs["/name"].raw, "YXFlow");
+    assert_eq!(f.app.document.bundle(), &source);
+    assert!(!f.app.document.can_undo());
+}

crates/oa-desktop/src/app/allocation_drag_tests/group.rs

@@ -0,0 +1,904 @@
+use super::*;
+use crate::app::multiselect::{self, Choice};
+use crate::diagram_usage::Target as SelectionTarget;
+use iced::widget::text_editor;
+
+#[path = "group/connection_lifetime.rs"]
+mod connection_lifetime;
+#[path = "group/route_lifetime.rs"]
+mod route_lifetime;
+
+struct Group {
+    f: Fixture,
+    y: Id,
+    yn: Id,
+    c: Id,
+    cn: Id,
+    an: Id,
+    ax: Id,
+    by: Id,
+}
+
+fn group(layer: Layer) -> Group {
+    let mut f = fixture(layer);
+    let mut p = f.app.project().clone();
+    let y = p
+        .add_element(p.elements[&f.work].kind(), layer, "Y", None)
+        .unwrap();
+    let c = p
+        .add_element(
+            if layer == Layer::Oa {
+                Kind::Actor
+            } else {
+                Kind::SystemActor
+            },
+            layer,
+            "C",
+            None,
+        )
+        .unwrap();
+    let yn = p.place(f.diagram, y, xy(140., 600.));
+    let cn = p.place(f.diagram, c, xy(1500., 100.));
+    let d = p.diagrams.get_mut(&f.diagram).unwrap();
+    d.nodes.get_mut(&f.node).unwrap().position = xy(140., 200.);
+    d.nodes
+        .values_mut()
+        .find(|n| n.element == f.b)
+        .unwrap()
+        .position = xy(100., 500.);
+    d.nodes.get_mut(&cn).unwrap().size = Size {
+        width: 600.,
+        height: 900.,
+    };
+    let an = d.nodes.values().find(|n| n.element == f.a).unwrap().id;
+    let ax = p.relate(
+        RelationKind::Allocation,
+        "Reviewed X responsibility",
+        f.a,
+        f.work,
+    );
+    let by = p.relate(
+        RelationKind::Allocation,
+        "Reviewed Y responsibility",
+        f.b,
+        y,
+    );
+    p.relations.get_mut(&ax).unwrap().description = "Keep X provenance".into();
+    p.relations.get_mut(&by).unwrap().description = "Keep Y provenance".into();
+    validate_candidate(&p).unwrap();
+    f.app = App::with_project(p);
+    f.app.active_diagram = Some(f.diagram);
+    f.app.zoom = 1.;
+    f.app.pan = Vector::ZERO;
+    f.app.fit_to_view = false;
+    f.app.reconcile_multiselect();
+    Group {
+        f,
+        y,
+        yn,
+        c,
+        cn,
+        an,
+        ax,
+        by,
+    }
+}
+
+fn choose(app: &mut App, target: SelectionTarget, choice: Choice) {
+    let context = multiselect::context(app.route_context().unwrap());
+    let _ = app.update(Message::DiagramSelection(multiselect::Event::Choose(
+        context, target, choice,
+    )));
+}
+
+fn select(app: &mut App, ids: &[Id]) {
+    for (i, id) in ids.iter().enumerate() {
+        choose(
+            app,
+            SelectionTarget::Placement(*id),
+            if i == 0 { Choice::Replace } else { Choice::Add },
+        );
+    }
+    assert_eq!(
+        app.diagram_selection.as_ref().unwrap().targets(),
+        &ids.iter()
+            .copied()
+            .map(SelectionTarget::Placement)
+            .collect::<Vec<_>>()
+    );
+}
+
+fn selection(
+    app: &App,
+) -> (
+    Vec<SelectionTarget>,
+    Option<SelectionTarget>,
+    Id,
+    Option<Id>,
+) {
+    let s = app.diagram_selection.as_ref().unwrap();
+    (
+        s.targets().to_vec(),
+        s.primary().cloned(),
+        app.selected,
+        app.selected_node,
+    )
+}
+
+fn node_point(app: &App, node: Id) -> Point {
+    let view = projection::project_view(app.project(), app.active_diagram.unwrap());
+    let n = view.nodes.iter().find(|n| n.id == node).unwrap();
+    screen(xy(n.position.x + 40., n.position.y + 35.))
+}
+
+fn input(app: &mut App, state: &mut CanvasState, event: mouse::Event, at: Point) {
+    if let Some(message) = pointer(&canvas(app), state, event, at) {
+        let _ = app.update(message);
+    }
+}
+
+fn begin(app: &mut App, state: &mut CanvasState, from: Point) -> Arc<Press> {
+    input(
+        app,
+        state,
+        mouse::Event::CursorMoved { position: from },
+        from,
+    );
+    let message = pointer(
+        &canvas(app),
+        state,
+        mouse::Event::ButtonPressed(mouse::Button::Left),
+        from,
+    )
+    .unwrap();
+    let Message::WorkDrag(Event::Press(packet)) = &message else {
+        panic!("Allocation placement must enter its captured lifetime: {message:?}");
+    };
+    let packet = packet.clone();
+    let _ = app.update(message);
+    packet
+}
+
+fn move_pointer(app: &mut App, state: &mut CanvasState, to: Point) {
+    input(app, state, mouse::Event::CursorMoved { position: to }, to);
+}
+
+fn release(app: &mut App, state: &mut CanvasState, to: Point) {
+    input(
+        app,
+        state,
+        mouse::Event::ButtonReleased(mouse::Button::Left),
+        to,
+    );
+}
+
+fn exact_history(
+    app: &mut App,
+    before: &Project,
+    source: &oa_core::source_project::SourceBundle,
+    expected: &Project,
+) {
+    assert_eq!(app.project(), expected);
+    let after = app.document.bundle().clone();
+    let reopened =
+        crate::document::Document::from_bundle(after.clone(), Default::default()).unwrap();
+    assert_eq!(reopened.project(), expected);
+    let _ = app.update(Message::Undo);
+    assert_eq!(app.project(), before);
+    assert_eq!(app.document.bundle(), source);
+    assert!(
+        !app.document.can_undo(),
+        "one group drag is one history step"
+    );
+    let _ = app.update(Message::Redo);
+    assert_eq!(app.project(), expected);
+    assert_eq!(app.document.bundle(), &after);
+    assert!(!app.document.can_redo());
+}
+
+#[test]
+fn completed_text_apply_rejects_old_allocation_packets_without_retiring_a_new_drag() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut g = group(layer);
+        select(&mut g.f.app, &[g.f.node, g.yn]);
+        let before = g.f.app.document.snapshot();
+        assert!(!g.f.app.document.can_undo());
+        let from = node_point(&g.f.app, g.f.node);
+        let mut old_canvas = CanvasState::default();
+        let old = begin(&mut g.f.app, &mut old_canvas, from);
+        assert!(g.f.app.allocation_drag.active.is_some());
+        let location = g.f.app.document.compiled().index.declarations[&g.f.work].clone();
+        let original = &before.bundle.files[&location.path];
+        let quoted_name = format!("\"{}\"", g.f.app.project().elements[&g.f.work].name);
+        assert_eq!(original.matches(quoted_name.as_str()).count(), 1);
+        let edited = original.replace(quoted_name.as_str(), "\"Changed through Text\"");
+        let mut expected = before.decoded.project.clone();
+        expected.elements.get_mut(&g.f.work).unwrap().name = "Changed through Text".into();
+        let mut expected_bundle = before.bundle.clone();
+        expected_bundle
+            .files
+            .insert(location.path.clone(), edited.clone());
+
+        let _ = g.f.app.update(Message::Page(Page::Text));
+        assert!(g.f.app.allocation_drag.active.is_none());
+        let _ = g.f.app.update(Message::SourceFile(location.path));
+        let _ =
+            g.f.app
+                .update(Message::SourceEdit(text_editor::Action::SelectAll));
+        let _ =
+            g.f.app
+                .update(Message::SourceEdit(text_editor::Action::Edit(
+                    text_editor::Edit::Paste(Arc::new(edited.clone())),
+                )));
+        assert!(g.f.app.source_dirty());
+        assert_eq!(g.f.app.source_editor.text(), edited);
+        assert!(Arc::ptr_eq(&before, &g.f.app.document.snapshot()));
+        let _ = g.f.app.update(Message::ApplySource);
+        assert!(!g.f.app.source_dirty(), "{}", g.f.app.status);
+        assert_eq!(g.f.app.project(), &expected);
+        assert_eq!(g.f.app.document.bundle(), &expected_bundle);
+
+        let _ = g.f.app.update(Message::Page(Page::Diagram));
+        assert_eq!(g.f.app.active_diagram, Some(g.f.diagram));
+        select(&mut g.f.app, &[g.f.node, g.yn]);
+        let from = node_point(&g.f.app, g.f.node);
+        let to = from + Vector::new(1400., 0.);
+        let mut current_canvas = CanvasState::default();
+        let current = begin(&mut g.f.app, &mut current_canvas, from);
+        assert_ne!(current.token, old.token);
+        assert_ne!(current.stamp.context, old.stamp.context);
+        move_pointer(&mut g.f.app, &mut current_canvas, to);
+        let preview =
+            g.f.app
+                .allocation_drag
+                .preview
+                .as_ref()
+                .expect(&g.f.app.status)
+                .clone();
+        let Candidate::Assignment(plan) = &preview.candidate else {
+            panic!("the current gesture must be a real group assignment");
+        };
+        assert_eq!(plan.changed_count(), 2);
+        let accepted = g.f.app.document.snapshot();
+        let revision = g.f.app.document.revision();
+        let held = selection(&g.f.app);
+        let selected = g.f.app.multiselect_snapshot().unwrap();
+        let workspace = g.f.app.source_workspace.bundle();
+        let editor = g.f.app.source_editor.text();
+        let camera = (
+            g.f.app.zoom,
+            g.f.app.pan,
+            g.f.app.fit_to_view,
+            g.f.app.canvas_size,
+        );
+        let epochs = (
+            g.f.app.canvas_epoch,
+            g.f.app.camera_epoch,
+            g.f.app.allocation_drag.epoch,
+        );
+        let draft =
+            g.f.app
+                .draft
+                .as_ref()
+                .map(|d| serde_json::to_value(d.recovery_snapshot()).unwrap());
+        let form = g.f.app.behavior.recovery_snapshot();
+        let status = g.f.app.status.clone();
+        let pending_reveal = g.f.app.pending_diagram_reveal.clone();
+        let arrange = g.f.app.allocation_drag.arrange_next;
+        // An idle obsolete press intentionally reports a stale-view explanation.
+        // With a newer real gesture active, both old packets must be fully inert.
+        for event in [
+            Event::Press(old.clone()),
+            Event::Release(old.stamp, old.token, Some(to)),
+        ] {
+            let _ = g.f.app.update(Message::WorkDrag(event));
+            assert!(Arc::ptr_eq(&accepted, &g.f.app.document.snapshot()));
+            assert_eq!(g.f.app.project(), &expected);
+            assert_eq!(g.f.app.document.bundle(), &expected_bundle);
+            assert_eq!(g.f.app.document.revision(), revision);
+            assert_eq!(selection(&g.f.app), held);
+            assert_eq!(g.f.app.multiselect_snapshot(), Some(selected.clone()));
+            assert!(Arc::ptr_eq(
+                &g.f.app.allocation_drag.active.as_ref().unwrap().press,
+                &current
+            ));
+            assert!(Arc::ptr_eq(
+                g.f.app.allocation_drag.preview.as_ref().unwrap(),
+                &preview
+            ));
+            assert_eq!(g.f.app.source_workspace.bundle(), workspace);
+            assert_eq!(g.f.app.source_editor.text(), editor);
+            assert_eq!(
+                (
+                    g.f.app.zoom,
+                    g.f.app.pan,
+                    g.f.app.fit_to_view,
+                    g.f.app.canvas_size
+                ),
+                camera
+            );
+            assert_eq!(
+                (
+                    g.f.app.canvas_epoch,
+                    g.f.app.camera_epoch,
+                    g.f.app.allocation_drag.epoch
+                ),
+                epochs
+            );
+            assert_eq!(
+                g.f.app
+                    .draft
+                    .as_ref()
+                    .map(|d| serde_json::to_value(d.recovery_snapshot()).unwrap()),
+                draft
+            );
+            assert_eq!(g.f.app.behavior.recovery_snapshot(), form);
+            assert_eq!(g.f.app.pending_diagram_reveal, pending_reveal);
+            assert_eq!(g.f.app.allocation_drag.arrange_next, arrange);
+            assert_eq!(g.f.app.status, status);
+            assert!(!g.f.app.source_dirty());
+            assert!(g.f.app.document.can_undo());
+            assert!(!g.f.app.document.can_redo());
+        }
+        // The current gesture remains only a preview. History contains solely
+        // the accepted text rename, never either stale assignment packet.
+        let _ = g.f.app.update(Message::Undo);
+        assert_eq!(g.f.app.project(), &before.decoded.project);
+        assert_eq!(g.f.app.document.bundle(), &before.bundle);
+        assert!(!g.f.app.document.can_undo());
+        assert!(g.f.app.document.can_redo());
+        let _ = g.f.app.update(Message::Redo);
+        assert_eq!(g.f.app.project(), &expected);
+        assert_eq!(g.f.app.document.bundle(), &expected_bundle);
+        assert!(g.f.app.document.can_undo());
+        assert!(!g.f.app.document.can_redo());
+    }
+}
+
+#[test]
+fn group_assignment_split_rebuild_preserves_primary_and_commits_one_complete_candidate() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        for anchor_is_primary in [false, true] {
+            let mut g = group(layer);
+            select(&mut g.f.app, &[g.f.node, g.yn]);
+            let held = selection(&g.f.app);
+            let before = g.f.app.project().clone();
+            let source = g.f.app.document.bundle().clone();
+            let anchor = if anchor_is_primary { g.yn } else { g.f.node };
+            let from = node_point(&g.f.app, anchor);
+            let to = from + Vector::new(1400., 0.);
+            let mut state = CanvasState::default();
+            let packet = begin(&mut g.f.app, &mut state, from);
+            assert_eq!(packet.target, SelectionTarget::Placement(anchor));
+            assert_eq!(
+                selection(&g.f.app),
+                held,
+                "member press must not inspect/collapse"
+            );
+            assert_eq!(g.f.app.document.bundle(), &source);
+            move_pointer(&mut g.f.app, &mut state, to);
+            let preview =
+                g.f.app
+                    .allocation_drag
+                    .preview
+                    .as_ref()
+                    .expect(&g.f.app.status);
+            let Candidate::Assignment(plan) = &preview.candidate else {
+                panic!("group must use combined assignment");
+            };
+            assert_eq!(plan.changed_count(), 2);
+            assert_eq!(plan.already_correct_count(), 0);
+            assert_eq!(selection(&g.f.app), held);
+            assert_eq!(g.f.app.project(), &before, "preview is immutable");
+            release(&mut g.f.app, &mut state, to);
+            let mut expected = before.clone();
+            for (relation, work) in [(g.ax, g.f.work), (g.by, g.y)] {
+                expected.relations.get_mut(&relation).unwrap().body = RelationBody::Allocation {
+                    source: g.c,
+                    target: work,
+                };
+            }
+            let d = expected.diagrams.get_mut(&g.f.diagram).unwrap();
+            d.nodes.get_mut(&g.f.node).unwrap().position = xy(1540., 200.);
+            d.nodes.get_mut(&g.yn).unwrap().position = xy(1540., 600.);
+            assert_eq!(selection(&g.f.app), held);
+            exact_history(&mut g.f.app, &before, &source, &expected);
+        }
+    }
+}
+
+#[test]
+fn group_arrange_work_and_performer_anchors_preserve_every_responsibility() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        for performer_anchor in [false, true] {
+            let mut g = group(layer);
+            select(&mut g.f.app, &[g.an, g.yn]);
+            let held = selection(&g.f.app);
+            let before = g.f.app.project().clone();
+            let source = g.f.app.document.bundle().clone();
+            let _ = g.f.app.update(Message::WorkDrag(Event::ArrangeNext));
+            assert!(g.f.app.allocation_drag.arrange_next);
+            let from = node_point(&g.f.app, if performer_anchor { g.an } else { g.yn });
+            let to = from + Vector::new(400., 0.);
+            let mut state = CanvasState::default();
+            let packet = begin(&mut g.f.app, &mut state, from);
+            assert_eq!(packet.mode, Mode::Arrange);
+            assert!(!g.f.app.allocation_drag.arrange_next);
+            assert_eq!(selection(&g.f.app), held);
+            move_pointer(&mut g.f.app, &mut state, to);
+            assert!(
+                matches!(
+                    g.f.app
+                        .allocation_drag
+                        .preview
+                        .as_ref()
+                        .map(|p| &p.candidate),
+                    Some(Candidate::Arrange(_))
+                ),
+                "{}",
+                g.f.app.status
+            );
+            release(&mut g.f.app, &mut state, to);
+            let mut expected = before.clone();
+            let d = expected.diagrams.get_mut(&g.f.diagram).unwrap();
+            d.nodes.get_mut(&g.an).unwrap().position = xy(500., 100.);
+            d.nodes.get_mut(&g.f.node).unwrap().position = xy(540., 200.);
+            d.nodes.get_mut(&g.yn).unwrap().position = xy(540., 600.);
+            assert_eq!(selection(&g.f.app), held);
+            exact_history(&mut g.f.app, &before, &source, &expected);
+        }
+    }
+}
+
+#[test]
+fn unsupported_group_click_collapses_but_threshold_crossing_never_becomes_click() {
+    for performer_anchor in [false, true] {
+        for distance in [0., 3., 3.25] {
+            let mut g = group(Layer::Oa);
+            select(&mut g.f.app, &[g.an, g.f.node]);
+            let held = selection(&g.f.app);
+            let before = g.f.app.document.snapshot();
+            let anchor = if performer_anchor { g.an } else { g.f.node };
+            let from = node_point(&g.f.app, anchor);
+            let mut state = CanvasState::default();
+            begin(&mut g.f.app, &mut state, from);
+            assert_eq!(selection(&g.f.app), held);
+            move_pointer(&mut g.f.app, &mut state, from + Vector::new(distance, 0.));
+            if distance > 3. {
+                assert!(
+                    g.f.app
+                        .allocation_drag
+                        .feedback
+                        .as_ref()
+                        .is_some_and(|f| f.refused)
+                );
+                assert!(g.f.app.allocation_drag.preview.is_none());
+            }
+            move_pointer(&mut g.f.app, &mut state, from);
+            release(&mut g.f.app, &mut state, from);
+            assert!(g.f.app.allocation_drag.active.is_none());
+            assert!(Arc::ptr_eq(&before, &g.f.app.document.snapshot()));
+            if distance > 3. {
+                assert_eq!(
+                    selection(&g.f.app),
+                    held,
+                    "crossed-and-returned refusal must retain group"
+                );
+            } else {
+                let s = g.f.app.diagram_selection.as_ref().unwrap();
+                assert_eq!(s.targets(), &[SelectionTarget::Placement(anchor)]);
+                assert_eq!(s.primary(), Some(&SelectionTarget::Placement(anchor)));
+            }
+        }
+    }
+}
+
+#[test]
+fn allocation_bare_moves_cannot_bypass_armed_active_or_retired_lifetime() {
+    for (stage, singleton) in (0..3).flat_map(|stage| [(stage, false), (stage, true)]) {
+        let mut g = group(Layer::Oa);
+        let ids = if singleton {
+            vec![g.an]
+        } else {
+            vec![g.an, g.cn]
+        };
+        select(&mut g.f.app, &ids);
+        let snapshot = g.f.app.multiselect_snapshot().unwrap();
+        let held = selection(&g.f.app);
+        let before = g.f.app.document.snapshot();
+        let _ = g.f.app.update(Message::WorkDrag(Event::ArrangeNext));
+        let mut state = CanvasState::default();
+        let from = node_point(&g.f.app, g.an);
+        if stage > 0 {
+            let press = begin(&mut g.f.app, &mut state, from);
+            if stage == 2 {
+                let _ =
+                    g.f.app
+                        .update(Message::WorkDrag(Event::Cancel(press.token)));
+            }
+        }
+        let epoch = g.f.app.allocation_drag.epoch;
+        let armed = g.f.app.allocation_drag.arrange_next;
+        let token =
+            g.f.app
+                .allocation_drag
+                .active
+                .as_ref()
+                .map(|a| a.press.token);
+        let _ = g.f.app.update(Message::MoveNode(g.an, xy(500., 100.)));
+        let _ =
+            g.f.app
+                .update(Message::DiagramSelection(multiselect::Event::Move(
+                    snapshot,
+                    xy(400., 0.),
+                )));
+        assert!(Arc::ptr_eq(&before, &g.f.app.document.snapshot()));
+        assert_eq!(selection(&g.f.app), held);
+        assert_eq!(g.f.app.allocation_drag.epoch, epoch);
+        assert_eq!(g.f.app.allocation_drag.arrange_next, armed);
+        assert_eq!(
+            g.f.app
+                .allocation_drag
+                .active
+                .as_ref()
+                .map(|a| a.press.token),
+            token
+        );
+    }
+    // A fresh ordinary performer gesture still uses the existing layout policy.
+    // C's right edge leaves the viewport: explicit Arrange's header gate must not
+    // accidentally become a new restriction on ordinary performer movement.
+    let mut g = group(Layer::Oa);
+    select(&mut g.f.app, &[g.an, g.cn]);
+    let held = selection(&g.f.app);
+    let before = g.f.app.project().clone();
+    let source = g.f.app.document.bundle().clone();
+    let _ = g.f.app.update(Message::WorkDrag(Event::ArrangeNext));
+    let from = node_point(&g.f.app, g.an);
+    let mut state = CanvasState::default();
+    let old = begin(&mut g.f.app, &mut state, from);
+    let _ = g.f.app.update(Message::WorkDrag(Event::Cancel(old.token)));
+    let mut state = CanvasState::default();
+    let fresh = begin(&mut g.f.app, &mut state, from);
+    assert_eq!(fresh.mode, Mode::Assign);
+    let to = from + Vector::new(300., 0.);
+    move_pointer(&mut g.f.app, &mut state, to);
+    assert!(
+        matches!(
+            g.f.app
+                .allocation_drag
+                .preview
+                .as_ref()
+                .map(|p| &p.candidate),
+            Some(Candidate::Performers(_))
+        ),
+        "{}",
+        g.f.app.status
+    );
+    release(&mut g.f.app, &mut state, to);
+    let mut expected = before.clone();
+    let d = expected.diagrams.get_mut(&g.f.diagram).unwrap();
+    d.nodes.get_mut(&g.an).unwrap().position = xy(400., 100.);
+    d.nodes.get_mut(&g.f.node).unwrap().position = xy(440., 200.);
+    d.nodes.get_mut(&g.cn).unwrap().position = xy(1800., 100.);
+    assert_eq!(selection(&g.f.app), held);
+    exact_history(&mut g.f.app, &before, &source, &expected);
+}
+
+#[test]
+fn idle_group_press_rejects_selection_generation_aba_with_unchanged_other_stamps() {
+    for membership_aba in [false, true] {
+        let mut g = group(Layer::Oa);
+        select(&mut g.f.app, &[g.f.node, g.yn]);
+        let old = press(&g.f);
+        let before = g.f.app.document.snapshot();
+        let held = selection(&g.f.app);
+        let epoch = g.f.app.allocation_drag.epoch;
+        // Deliberately isolate selection generation from App message retirement.
+        // Final selection/primary/context/Document values are unchanged; this
+        // exercises the snapshot boundary, not an ordinary user-input sequence.
+        let s = g.f.app.diagram_selection.as_mut().unwrap();
+        if membership_aba {
+            assert!(s.remove(&SelectionTarget::Placement(g.yn)));
+            assert!(s.add(SelectionTarget::Placement(g.yn), |_| true));
+        } else {
+            assert!(s.set_primary(&SelectionTarget::Placement(g.f.node)));
+            assert!(s.set_primary(&SelectionTarget::Placement(g.yn)));
+        }
+        assert_eq!(selection(&g.f.app), held);
+        assert_eq!(g.f.app.allocation_drag.epoch, epoch);
+        assert_eq!(g.f.app.route_context(), Some(old.stamp.context));
+        let _ = g.f.app.update(Message::WorkDrag(Event::Press(old.clone())));
+        assert!(
+            g.f.app.allocation_drag.active.is_none(),
+            "generation-only stale selection must not acquire input"
+        );
+        let _ = g.f.app.update(Message::WorkDrag(Event::Release(
+            old.stamp,
+            old.token,
+            Some(start(&g.f)),
+        )));
+        assert!(Arc::ptr_eq(&before, &g.f.app.document.snapshot()));
+        assert_eq!(selection(&g.f.app), held);
+    }
+}
+
+#[test]
+fn group_selection_aba_and_old_press_cannot_retire_a_new_token() {
+    let mut g = group(Layer::Oa);
+    select(&mut g.f.app, &[g.f.node, g.yn]);
+    let old = press(&g.f);
+    choose(
+        &mut g.f.app,
+        SelectionTarget::Placement(g.f.node),
+        Choice::Inspect,
+    );
+    choose(
+        &mut g.f.app,
+        SelectionTarget::Placement(g.yn),
+        Choice::Inspect,
+    );
+    let before = g.f.app.document.snapshot();
+    let from = node_point(&g.f.app, g.f.node);
+    let mut state = CanvasState::default();
+    let fresh = begin(&mut g.f.app, &mut state, from);
+    let held = selection(&g.f.app);
+    let epoch = g.f.app.allocation_drag.epoch;
+    let _ = g.f.app.update(Message::WorkDrag(Event::Press(old.clone())));
+    let _ = g.f.app.update(Message::WorkDrag(Event::Release(
+        old.stamp,
+        old.token,
+        Some(from + Vector::new(1400., 0.)),
+    )));
+    assert_eq!(
+        g.f.app
+            .allocation_drag
+            .active
+            .as_ref()
+            .map(|a| a.press.token),
+        Some(fresh.token)
+    );
+    assert_eq!(g.f.app.allocation_drag.epoch, epoch);
+    assert_eq!(selection(&g.f.app), held);
+    assert!(Arc::ptr_eq(&before, &g.f.app.document.snapshot()));
+    release(&mut g.f.app, &mut state, from);
+}
+
+fn unassign(g: &mut Group, inside_c: bool) {
+    let mut project = g.f.app.project().clone();
+    project.relations.remove(&g.ax);
+    project.relations.remove(&g.by);
+    if inside_c {
+        let d = project.diagrams.get_mut(&g.f.diagram).unwrap();
+        // These unassigned cards overlap an unrelated empty performer at the
+        // same depth. Paint C first so the intended work press is visible and
+        // independent of random UUID ordering; no semantic containment exists.
+        let mut target = d.nodes.remove(&g.cn).unwrap();
+        g.cn = Id::from_u128(1);
+        target.id = g.cn;
+        assert!(d.nodes.insert(g.cn, target).is_none());
+        d.nodes.get_mut(&g.f.node).unwrap().position = xy(1540., 200.);
+        d.nodes.get_mut(&g.yn).unwrap().position = xy(1540., 600.);
+    }
+    g.f.app = App::with_project(project);
+    g.f.app.active_diagram = Some(g.f.diagram);
+    g.f.app.zoom = 1.;
+    g.f.app.pan = Vector::ZERO;
+    g.f.app.fit_to_view = false;
+    g.f.app.reconcile_multiselect();
+}
+
+fn c_allocations(expected: &mut Project, g: &Group, ids: &BTreeMap<Id, Id>) {
+    for (work, name, alias) in [
+        (g.f.work, "C performs Work", "c_performs_work"),
+        (g.y, "C performs Y", "c_performs_y"),
+    ] {
+        expected.relations.insert(
+            ids[&work],
+            Relation {
+                id: ids[&work],
+                alias: alias.into(),
+                name: name.into(),
+                description: String::new(),
+                body: RelationBody::Allocation {
+                    source: g.c,
+                    target: work,
+                },
+            },
+        );
+    }
+}
+
+#[test]
+fn group_out_and_back_assigns_at_zero_delta_then_true_noop_preserves_redo() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut g = group(layer);
+        unassign(&mut g, true);
+        select(&mut g.f.app, &[g.f.node, g.yn]);
+        let held = selection(&g.f.app);
+        let before = g.f.app.project().clone();
+        let source = g.f.app.document.bundle().clone();
+        let from = node_point(&g.f.app, g.f.node);
+        let mut state = CanvasState::default();
+        let press = begin(&mut g.f.app, &mut state, from);
+        assert_eq!(press.target, SelectionTarget::Placement(g.f.node));
+        assert_eq!(selection(&g.f.app), held);
+        move_pointer(&mut g.f.app, &mut state, from + Vector::new(4., 0.));
+        let preview =
+            g.f.app
+                .allocation_drag
+                .preview
+                .as_ref()
+                .expect(&g.f.app.status);
+        assert_eq!(preview.placement.delta, xy(0., 0.));
+        let Candidate::Assignment(candidate) = &preview.candidate else {
+            panic!("exact work group must preview assignment");
+        };
+        assert_eq!(candidate.destination(), plan::Destination::Performer(g.c));
+        assert_eq!(candidate.changed_count(), 2);
+        let ids: BTreeMap<_, _> = preview
+            .project()
+            .relations
+            .values()
+            .filter(|r| r.kind() == RelationKind::Allocation)
+            .map(|r| (r.target(), r.id))
+            .collect();
+        assert_eq!(ids.len(), 2);
+        move_pointer(&mut g.f.app, &mut state, from);
+        release(&mut g.f.app, &mut state, from);
+        let mut expected = before.clone();
+        c_allocations(&mut expected, &g, &ids);
+        assert_eq!(selection(&g.f.app), held);
+        exact_history(&mut g.f.app, &before, &source, &expected);
+        g.f.app
+            .document
+            .execute(Command::Describe(g.y, "Future rationale".into()))
+            .unwrap();
+        g.f.app.sync();
+        let future = g.f.app.document.bundle().clone();
+        let _ = g.f.app.update(Message::Undo);
+        assert!(g.f.app.document.can_undo() && g.f.app.document.can_redo());
+        let snapshot = g.f.app.document.snapshot();
+        let revision = g.f.app.document.revision();
+        let held = selection(&g.f.app);
+        let from = node_point(&g.f.app, g.f.node);
+        let mut state = CanvasState::default();
+        begin(&mut g.f.app, &mut state, from);
+        move_pointer(&mut g.f.app, &mut state, from + Vector::new(4., 0.));
+        move_pointer(&mut g.f.app, &mut state, from);
+        release(&mut g.f.app, &mut state, from);
+        assert!(
+            Arc::ptr_eq(&snapshot, &g.f.app.document.snapshot()),
+            "{}",
+            g.f.app.status
+        );
+        assert_eq!(g.f.app.document.revision(), revision);
+        assert_eq!(selection(&g.f.app), held);
+        assert!(g.f.app.document.can_undo() && g.f.app.document.can_redo());
+        let _ = g.f.app.update(Message::Redo);
+        assert_eq!(g.f.app.document.bundle(), &future);
+    }
+}
+
+#[test]
+fn group_source_refusal_retains_primary_source_and_both_history_paths() {
+    let mut g = group(Layer::Oa);
+    unassign(&mut g, false);
+    let source = g.f.app.document.bundle().clone();
+    let mut limits = oa_core::source_project::ProjectLimits::default();
+    limits.model.max_source_bytes = source.files.values().map(String::len).sum::<usize>() + 128;
+    g.f.app.document = crate::document::Document::from_bundle(source, limits).unwrap();
+    g.f.app
+        .document
+        .execute(Command::Describe(g.f.work, "Reviewed".into()))
+        .unwrap();
+    g.f.app
+        .document
+        .execute(Command::Rename(g.y, "Future Y".into()))
+        .unwrap();
+    let future = g.f.app.document.bundle().clone();
+    assert!(g.f.app.document.undo());
+    g.f.app.sync();
+    g.f.app.reconcile_multiselect();
+    select(&mut g.f.app, &[g.f.node, g.yn]);
+    let held = selection(&g.f.app);
+    let before = g.f.app.document.snapshot();
+    let source = g.f.app.document.bundle().clone();
+    let revision = g.f.app.document.revision();
+    assert!(g.f.app.document.can_undo() && g.f.app.document.can_redo());
+    let from = node_point(&g.f.app, g.f.node);
+    let to = from + Vector::new(1400., 0.);
+    let mut state = CanvasState::default();
+    begin(&mut g.f.app, &mut state, from);
+    move_pointer(&mut g.f.app, &mut state, to);
+    assert!(
+        g.f.app.allocation_drag.preview.is_some(),
+        "geometry and semantics pass before source refusal: {}",
+        g.f.app.status
+    );
+    release(&mut g.f.app, &mut state, to);
+    assert!(g.f.app.status.contains("retry"), "{}", g.f.app.status);
+    assert!(g.f.app.allocation_drag.active.is_none());
+    assert!(Arc::ptr_eq(&before, &g.f.app.document.snapshot()));
+    assert_eq!(g.f.app.document.bundle(), &source);
+    assert_eq!(g.f.app.document.revision(), revision);
+    assert_eq!(selection(&g.f.app), held);
+    assert!(g.f.app.document.can_undo() && g.f.app.document.can_redo());
+    let _ = g.f.app.update(Message::Redo);
+    assert_eq!(g.f.app.document.bundle(), &future);
+    let _ = g.f.app.update(Message::Undo);
+    assert_eq!(g.f.app.document.bundle(), &source);
+}
+
+#[test]
+fn ordinary_off_grid_performer_out_and_back_is_noop_with_redo() {
+    for singleton in [false, true] {
+        let mut g = group(Layer::Oa);
+        let mut project = g.f.app.project().clone();
+        project
+            .diagrams
+            .get_mut(&g.f.diagram)
+            .unwrap()
+            .nodes
+            .get_mut(&g.an)
+            .unwrap()
+            .position = xy(103., 107.);
+        g.f.app = App::with_project(project);
+        g.f.app.active_diagram = Some(g.f.diagram);
+        g.f.app.zoom = 1.;
+        g.f.app.pan = Vector::ZERO;
+        g.f.app.fit_to_view = false;
+        g.f.app
+            .document
+            .execute(Command::Describe(g.f.work, "Reviewed".into()))
+            .unwrap();
+        g.f.app
+            .document
+            .execute(Command::Describe(g.y, "Future".into()))
+            .unwrap();
+        let future = g.f.app.document.bundle().clone();
+        assert!(g.f.app.document.undo());
+        g.f.app.sync();
+        g.f.app.reconcile_multiselect();
+        select(
+            &mut g.f.app,
+            &if singleton {
+                vec![g.an]
+            } else {
+                vec![g.an, g.cn]
+            },
+        );
+        let held = selection(&g.f.app);
+        let before = g.f.app.document.snapshot();
+        let source = g.f.app.document.bundle().clone();
+        let revision = g.f.app.document.revision();
+        let from = node_point(&g.f.app, g.an);
+        let mut state = CanvasState::default();
+        begin(&mut g.f.app, &mut state, from);
+        move_pointer(&mut g.f.app, &mut state, from + Vector::new(20., 0.));
+        assert!(
+            g.f.app.allocation_drag.preview.is_some(),
+            "{}",
+            g.f.app.status
+        );
+        move_pointer(&mut g.f.app, &mut state, from);
+        assert_eq!(
+            g.f.app
+                .allocation_drag
+                .preview
+                .as_ref()
+                .unwrap()
+                .placement
+                .delta,
+            xy(0., 0.)
+        );
+        release(&mut g.f.app, &mut state, from);
+        assert!(Arc::ptr_eq(&before, &g.f.app.document.snapshot()));
+        assert_eq!(g.f.app.document.bundle(), &source);
+        assert_eq!(g.f.app.document.revision(), revision);
+        assert_eq!(selection(&g.f.app), held);
+        assert!(g.f.app.document.can_undo() && g.f.app.document.can_redo());
+        let _ = g.f.app.update(Message::Redo);
+        assert_eq!(g.f.app.document.bundle(), &future);
+    }
+}

crates/oa-desktop/src/app/allocation_drag_tests/group/connection_lifetime.rs

@@ -0,0 +1,292 @@
+//! Delayed captured drawing packets must not retire a newer Allocation owner.
+use super::*;
+use crate::connection_edit::Event as ConnectionEvent;
+use crate::connection_tool::Tool;
+
+fn drawing_tool(layer: Layer) -> Tool {
+    match layer {
+        Layer::Oa => Tool::Interaction,
+        Layer::Sa => Tool::FunctionalExchange,
+    }
+}
+
+fn drawing_source(g: &mut Group, layer: Layer) -> crate::route_edit::Context {
+    let _ =
+        g.f.app
+            .update(Message::Connection(ConnectionEvent::Choose(Some(
+                drawing_tool(layer),
+            ))));
+    let context = g.f.app.route_context().unwrap();
+    let _ =
+        g.f.app
+            .update(Message::Connection(ConnectionEvent::Endpoint(
+                context, g.f.work,
+            )));
+    let session = g.f.app.connection.as_ref().unwrap();
+    assert_eq!(session.context, context);
+    assert_eq!(session.source, Some(g.f.work));
+    assert!(session.candidates.contains(&g.y));
+    assert_eq!(g.f.app.route_context(), Some(context));
+    context
+}
+
+fn assert_captured_noop(app: &mut App, captured: crate::route_edit::Context, target: Id) {
+    for event in [
+        ConnectionEvent::Endpoint(captured, target),
+        ConnectionEvent::Restart(captured),
+    ] {
+        assert_connection_noop(app, event);
+    }
+}
+
+fn assert_connection_noop(app: &mut App, event: ConnectionEvent) {
+    let document = app.document.snapshot();
+    let selected = selection(app);
+    let context = app.route_context();
+    let camera = (app.pan, app.zoom, app.canvas_epoch, app.camera_epoch);
+    let ownership = (app.allocation_drag.epoch, app.allocation_drag.arrange_next);
+    let active = app
+        .allocation_drag
+        .active
+        .as_ref()
+        .map(|a| (a.press.clone(), a.crossed, a.cache.len()));
+    let preview = app.allocation_drag.preview.as_ref().map(|p| {
+        (
+            p.token,
+            p.placement.diagram.clone(),
+            p.placement.delta,
+            p.project().clone(),
+            p.routed.clone(),
+        )
+    });
+    let feedback = app.allocation_drag.feedback.as_ref().map(|f| {
+        (
+            f.press.token,
+            f.text.clone(),
+            f.refused,
+            f.targets.clone(),
+            f.inspection_targets.clone(),
+        )
+    });
+    let connection = |app: &App| {
+        app.connection
+            .as_ref()
+            .map(|s| (s.context, s.tool, s.source, s.candidates.clone()))
+    };
+    let session = connection(app);
+    let interaction = app.source_symbols.interaction;
+    let status = app.status.clone();
+    let _ = app.update(Message::Connection(event));
+    assert_eq!(selection(app), selected);
+    assert_eq!(app.route_context(), context);
+    assert_eq!(
+        (app.pan, app.zoom, app.canvas_epoch, app.camera_epoch),
+        camera
+    );
+    assert_eq!(
+        (app.allocation_drag.epoch, app.allocation_drag.arrange_next),
+        ownership,
+        "rejected drawing packet must not retire the newer input owner"
+    );
+    match (active, app.allocation_drag.active.as_ref()) {
+        (Some((press, crossed, cached)), Some(current)) => {
+            assert!(Arc::ptr_eq(&press, &current.press));
+            assert_eq!((current.crossed, current.cache.len()), (crossed, cached));
+        }
+        (None, None) => {}
+        _ => panic!("rejected drawing packet changed the active Allocation token"),
+    }
+    match (preview, app.allocation_drag.preview.as_ref()) {
+        (Some((token, diagram, delta, project, routed)), Some(current)) => {
+            assert_eq!(current.token, token);
+            assert_eq!(current.placement.diagram, diagram);
+            assert_eq!(current.placement.delta, delta);
+            assert_eq!(current.project(), &project);
+            assert!(Arc::ptr_eq(&current.routed, &routed));
+        }
+        (None, None) => {}
+        _ => panic!("rejected drawing packet changed the Allocation preview"),
+    }
+    assert_eq!(
+        app.allocation_drag.feedback.as_ref().map(|f| (
+            f.press.token,
+            f.text.clone(),
+            f.refused,
+            f.targets.clone(),
+            f.inspection_targets.clone(),
+        )),
+        feedback
+    );
+    assert_eq!(connection(app), session);
+    assert_eq!(app.source_symbols.interaction, interaction);
+    assert_eq!(app.status, status);
+    assert!(Arc::ptr_eq(&document, &app.document.snapshot()));
+    assert_eq!(app.source_workspace.bundle(), document.bundle);
+}
+
+#[test]
+fn captured_connection_after_cancel_preserves_arrange_arm_and_live_group() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut g = group(layer);
+        let old = drawing_source(&mut g, layer);
+        let _ = g.f.app.update(Message::Escape);
+        assert!(g.f.app.connection.is_none());
+        select(&mut g.f.app, &[g.an, g.yn]);
+        let _ = g.f.app.update(Message::WorkDrag(Event::ArrangeNext));
+        assert!(g.f.app.allocation_drag.arrange_next);
+        let current = g.f.app.route_context().unwrap();
+        assert_captured_noop(&mut g.f.app, old, g.y);
+        // Matching context with no session isolates the missing-owner guard.
+        assert_captured_noop(&mut g.f.app, current, g.y);
+
+        let before = g.f.app.project().clone();
+        let source = g.f.app.document.bundle().clone();
+        let held = selection(&g.f.app);
+        let from = node_point(&g.f.app, g.an);
+        let to = from + Vector::new(400., 0.);
+        let mut state = CanvasState::default();
+        let press = begin(&mut g.f.app, &mut state, from);
+        assert_eq!(press.mode, Mode::Arrange);
+        assert!(!g.f.app.allocation_drag.arrange_next);
+        move_pointer(&mut g.f.app, &mut state, to);
+        assert!(matches!(
+            g.f.app
+                .allocation_drag
+                .preview
+                .as_ref()
+                .map(|p| &p.candidate),
+            Some(Candidate::Arrange(_))
+        ));
+        let current = g.f.app.route_context().unwrap();
+        assert_captured_noop(&mut g.f.app, old, g.y);
+        assert_captured_noop(&mut g.f.app, current, g.y);
+        release(&mut g.f.app, &mut state, to);
+        let mut expected = before.clone();
+        let diagram = expected.diagrams.get_mut(&g.f.diagram).unwrap();
+        diagram.nodes.get_mut(&g.an).unwrap().position = xy(500., 100.);
+        diagram.nodes.get_mut(&g.f.node).unwrap().position = xy(540., 200.);
+        diagram.nodes.get_mut(&g.yn).unwrap().position = xy(540., 600.);
+        assert_eq!(selection(&g.f.app), held);
+        exact_history(&mut g.f.app, &before, &source, &expected);
+    }
+}
+
+#[test]
+fn captured_connection_context_mismatches_preserve_the_current_session() {
+    let mut g = group(Layer::Oa);
+    let current = drawing_source(&mut g, Layer::Oa);
+    // Session and current context agree: each old captured field is the sole
+    // invalid relationship, not hidden behind a missing session.
+    for captured in [
+        crate::route_edit::Context {
+            document: Id::new_v4(),
+            ..current
+        },
+        crate::route_edit::Context {
+            diagram: Id::new_v4(),
+            ..current
+        },
+        crate::route_edit::Context {
+            revision: current.revision + 1,
+            ..current
+        },
+        crate::route_edit::Context {
+            epoch: current.epoch + 1,
+            ..current
+        },
+    ] {
+        assert_eq!(g.f.app.connection.as_ref().unwrap().context, current);
+        assert_captured_noop(&mut g.f.app, captured, g.y);
+    }
+    // Captured/session contexts agree, but the rendered view has advanced.
+    // This isolates the live-route predicate from session ownership.
+    g.f.app.canvas_epoch += 1;
+    assert_ne!(g.f.app.route_context(), Some(current));
+    assert_eq!(g.f.app.connection.as_ref().unwrap().context, current);
+    assert_captured_noop(&mut g.f.app, current, g.y);
+    g.f.app.canvas_epoch = current.epoch;
+
+    // Conversely, incoming/current contexts agree. Retain obsolete session
+    // metadata explicitly to isolate the session-context admission branch.
+    g.f.app.connection.as_mut().unwrap().context.epoch += 1;
+    assert_eq!(g.f.app.route_context(), Some(current));
+    assert_captured_noop(&mut g.f.app, current, g.y);
+}
+
+#[test]
+fn captured_connection_current_restart_and_pair_commit_after_tool_boundary() {
+    for begin_tool in [false, true] {
+        let mut g = group(Layer::Oa);
+        select(&mut g.f.app, &[g.an, g.yn]);
+        let _ = g.f.app.update(Message::WorkDrag(Event::ArrangeNext));
+        let from = node_point(&g.f.app, g.an);
+        let mut state = CanvasState::default();
+        begin(&mut g.f.app, &mut state, from);
+        move_pointer(&mut g.f.app, &mut state, from + Vector::new(400., 0.));
+        assert!(g.f.app.allocation_drag.preview.is_some());
+        let before = g.f.app.project().clone();
+        let source = g.f.app.document.bundle().clone();
+        let epoch = g.f.app.allocation_drag.epoch;
+        let event = if begin_tool {
+            ConnectionEvent::Begin(Tool::Interaction, g.f.work)
+        } else {
+            ConnectionEvent::Choose(Some(Tool::Interaction))
+        };
+        let _ = g.f.app.update(Message::Connection(event));
+        assert!(g.f.app.allocation_drag.epoch > epoch);
+        assert!(g.f.app.allocation_drag.active.is_none());
+        assert!(g.f.app.allocation_drag.preview.is_none());
+        assert!(!g.f.app.allocation_drag.arrange_next);
+        let context = g.f.app.route_context().unwrap();
+        if !begin_tool {
+            let _ =
+                g.f.app
+                    .update(Message::Connection(ConnectionEvent::Endpoint(
+                        context, g.f.work,
+                    )));
+        }
+        assert_eq!(g.f.app.connection.as_ref().unwrap().source, Some(g.f.work));
+        assert!(
+            g.f.app
+                .connection
+                .as_ref()
+                .unwrap()
+                .candidates
+                .contains(&g.y)
+        );
+        let document = g.f.app.document.snapshot();
+        let _ =
+            g.f.app
+                .update(Message::Connection(ConnectionEvent::Restart(context)));
+        let context = g.f.app.route_context().unwrap();
+        let restarted = g.f.app.connection.as_ref().unwrap();
+        assert_eq!(restarted.context, context);
+        assert_eq!(restarted.tool, Tool::Interaction);
+        assert_eq!(restarted.source, None);
+        assert!(restarted.candidates.contains(&g.f.work));
+        assert!(Arc::ptr_eq(&document, &g.f.app.document.snapshot()));
+        let _ =
+            g.f.app
+                .update(Message::Connection(ConnectionEvent::Endpoint(
+                    context, g.f.work,
+                )));
+        assert_eq!(g.f.app.connection.as_ref().unwrap().source, Some(g.f.work));
+        let revision = g.f.app.document.revision();
+        let _ =
+            g.f.app
+                .update(Message::Connection(ConnectionEvent::Endpoint(context, g.y)));
+        assert!(g.f.app.connection.is_none());
+        assert_eq!(g.f.app.document.revision(), revision + 1);
+        let relation = &g.f.app.project().relations[&g.f.app.selected];
+        assert_eq!(relation.kind(), RelationKind::Interaction);
+        assert_eq!((relation.source(), relation.target()), (g.f.work, g.y));
+        let mut expected = before.clone();
+        assert!(
+            expected
+                .relations
+                .insert(relation.id, relation.clone())
+                .is_none()
+        );
+        exact_history(&mut g.f.app, &before, &source, &expected);
+    }
+}

crates/oa-desktop/src/app/allocation_drag_tests/group/route_lifetime.rs

@@ -0,0 +1,274 @@
+//! Captured route commits cannot retire a newer Allocation input owner.
+use super::*;
+use crate::route_edit::{Context, Event as RouteEvent};
+
+fn routed_group() -> (Group, Id) {
+    let mut g = group(Layer::Oa);
+    let mut project = g.f.app.project().clone();
+    let edge = project.relate(
+        RelationKind::Interaction,
+        "Reviewed exchange",
+        g.f.work,
+        g.y,
+    );
+    project
+        .diagrams
+        .get_mut(&g.f.diagram)
+        .unwrap()
+        .routes
+        .push(EdgeRoute {
+            edge,
+            waypoints: vec![xy(700., 400.)],
+            label: Some(EdgeLabel {
+                fraction: 0.4,
+                offset: xy(5., 10.),
+            }),
+            source_attachment: None,
+            target_attachment: Some(EdgeAttachment {
+                side: PortAnchorSide::Left,
+                offset: 0.6,
+            }),
+        });
+    validate_candidate(&project).unwrap();
+    g.f.app = App::with_project(project);
+    g.f.app.active_diagram = Some(g.f.diagram);
+    g.f.app.zoom = 1.;
+    g.f.app.pan = Vector::ZERO;
+    g.f.app.fit_to_view = false;
+    choose(&mut g.f.app, SelectionTarget::Edge(edge), Choice::Replace);
+    assert_eq!(g.f.app.selected, edge);
+    let view = projection::project_view(g.f.app.project(), g.f.diagram);
+    assert!(view.edges.iter().any(|e| e.id == edge));
+    assert_eq!(
+        crate::route_edit::attachment_node(
+            g.f.app.project(),
+            &g.f.app.project().diagrams[&g.f.diagram],
+            &view,
+            edge,
+            EdgeEnd::Source,
+        )
+        .unwrap()
+        .id,
+        g.f.node
+    );
+    (g, edge)
+}
+
+fn packet(g: &Group, edge: Id, captured: Context, attachment: bool) -> RouteEvent {
+    let mut route =
+        crate::route_edit::stored_route(&g.f.app.project().diagrams[&g.f.diagram], edge);
+    if attachment {
+        route.source_attachment = Some(EdgeAttachment {
+            side: PortAnchorSide::Top,
+            offset: 0.25,
+        });
+        RouteEvent::CommitAttachment(captured, route, EdgeEnd::Source, g.f.node)
+    } else {
+        route.waypoints[0] = xy(750., 450.);
+        RouteEvent::Commit(captured, route, Some(0))
+    }
+}
+
+fn assert_route_noop(app: &mut App, event: RouteEvent) {
+    let document = app.document.snapshot();
+    let selected = selection(app);
+    let context = app.route_context();
+    let camera = (app.pan, app.zoom, app.canvas_epoch, app.camera_epoch);
+    let ownership = (app.allocation_drag.epoch, app.allocation_drag.arrange_next);
+    let press = app.allocation_drag.active.as_ref().map(|a| a.press.clone());
+    let preview = app.allocation_drag.preview.clone();
+    let feedback = app.allocation_drag.feedback.as_ref().map(|f| {
+        (
+            f.press.token,
+            f.text.clone(),
+            f.refused,
+            f.targets.clone(),
+            f.inspection_targets.clone(),
+        )
+    });
+    let handles = (app.selected_bend, app.selected_attachment);
+    let interaction = app.source_symbols.interaction;
+    let status = app.status.clone();
+    let _ = app.update(Message::Route(event));
+    assert_eq!(selection(app), selected);
+    assert_eq!(app.route_context(), context);
+    assert_eq!(
+        (app.pan, app.zoom, app.canvas_epoch, app.camera_epoch),
+        camera
+    );
+    assert_eq!(
+        (app.allocation_drag.epoch, app.allocation_drag.arrange_next),
+        ownership
+    );
+    match (press, app.allocation_drag.active.as_ref()) {
+        (Some(before), Some(after)) => assert!(Arc::ptr_eq(&before, &after.press)),
+        (None, None) => {}
+        _ => panic!("stale route packet changed the active Allocation token"),
+    }
+    match (preview, app.allocation_drag.preview.as_ref()) {
+        (Some(before), Some(after)) => assert!(Arc::ptr_eq(&before, after)),
+        (None, None) => {}
+        _ => panic!("stale route packet changed the Allocation preview"),
+    }
+    assert_eq!(
+        app.allocation_drag.feedback.as_ref().map(|f| (
+            f.press.token,
+            f.text.clone(),
+            f.refused,
+            f.targets.clone(),
+            f.inspection_targets.clone(),
+        )),
+        feedback
+    );
+    assert_eq!((app.selected_bend, app.selected_attachment), handles);
+    assert_eq!(app.source_symbols.interaction, interaction);
+    assert_eq!(app.status, status);
+    assert!(Arc::ptr_eq(&document, &app.document.snapshot()));
+    assert_eq!(app.source_workspace.bundle(), document.bundle);
+}
+
+fn stale_route_preserves_new_group(attachment: bool, escape: bool) {
+    let (mut g, edge) = routed_group();
+    let old = g.f.app.route_context().unwrap();
+    let delayed = packet(&g, edge, old, attachment);
+    if escape {
+        let _ = g.f.app.update(Message::Escape);
+        assert_ne!(g.f.app.route_context(), Some(old));
+    }
+    select(&mut g.f.app, &[g.an, g.yn]);
+    let _ = g.f.app.update(Message::WorkDrag(Event::ArrangeNext));
+    assert!(g.f.app.allocation_drag.arrange_next);
+    if !escape {
+        assert_eq!(g.f.app.route_context(), Some(old));
+        assert_ne!(g.f.app.selected, edge);
+    }
+    assert_route_noop(&mut g.f.app, delayed.clone());
+    let before = g.f.app.project().clone();
+    let source = g.f.app.document.bundle().clone();
+    let selected = selection(&g.f.app);
+    let from = node_point(&g.f.app, g.an);
+    let to = from + Vector::new(400., 0.);
+    let mut state = CanvasState::default();
+    let press = begin(&mut g.f.app, &mut state, from);
+    assert_eq!(press.mode, Mode::Arrange);
+    move_pointer(&mut g.f.app, &mut state, to);
+    assert!(g.f.app.allocation_drag.preview.is_some());
+    if !escape {
+        assert_eq!(g.f.app.route_context(), Some(old));
+        assert_ne!(g.f.app.selected, edge);
+    }
+    assert_route_noop(&mut g.f.app, delayed);
+    release(&mut g.f.app, &mut state, to);
+    let mut expected = before.clone();
+    let diagram = expected.diagrams.get_mut(&g.f.diagram).unwrap();
+    diagram.nodes.get_mut(&g.an).unwrap().position = xy(500., 100.);
+    diagram.nodes.get_mut(&g.f.node).unwrap().position = xy(540., 200.);
+    diagram.nodes.get_mut(&g.yn).unwrap().position = xy(540., 600.);
+    // Both endpoint placements move by (400, 0); the saved pin follows once,
+    // while label offset and endpoint attachment settings stay unchanged.
+    diagram
+        .routes
+        .iter_mut()
+        .find(|r| r.edge == edge)
+        .unwrap()
+        .waypoints = vec![xy(1100., 400.)];
+    assert_eq!(selection(&g.f.app), selected);
+    exact_history(&mut g.f.app, &before, &source, &expected);
+}
+
+#[test]
+fn stale_route_commit_preserves_arrange_arm_and_live_group() {
+    stale_route_preserves_new_group(false, true);
+}
+
+#[test]
+fn stale_route_attachment_preserves_arrange_arm_and_live_group() {
+    stale_route_preserves_new_group(true, true);
+}
+
+#[test]
+fn same_context_route_commit_after_selection_preserves_arrange_arm_and_live_group() {
+    stale_route_preserves_new_group(false, false);
+}
+
+#[test]
+fn same_context_route_attachment_after_selection_preserves_arrange_arm_and_live_group() {
+    stale_route_preserves_new_group(true, false);
+}
+
+#[test]
+fn captured_route_context_fields_independently_reject_before_retirement() {
+    for attachment in [false, true] {
+        let (mut g, edge) = routed_group();
+        let current = g.f.app.route_context().unwrap();
+        // The selected edge and route payload are valid. Each capture mismatch
+        // is isolated; no nonexistent route session can mask admission.
+        for captured in [
+            Context {
+                document: Id::new_v4(),
+                ..current
+            },
+            Context {
+                diagram: Id::new_v4(),
+                ..current
+            },
+            Context {
+                revision: current.revision + 1,
+                ..current
+            },
+            Context {
+                epoch: current.epoch + 1,
+                ..current
+            },
+        ] {
+            let event = packet(&g, edge, captured, attachment);
+            assert_route_noop(&mut g.f.app, event);
+        }
+        // Hold the captured packet fixed and advance the live context instead.
+        let event = packet(&g, edge, current, attachment);
+        g.f.app.canvas_epoch += 1;
+        assert_route_noop(&mut g.f.app, event.clone());
+        g.f.app.canvas_epoch = current.epoch;
+        g.f.app.active_diagram = None;
+        assert_route_noop(&mut g.f.app, event);
+    }
+}
+
+#[test]
+fn current_route_commits_without_session_preserve_exact_route_history() {
+    for attachment in [false, true] {
+        let (mut g, edge) = routed_group();
+        let current = g.f.app.route_context().unwrap();
+        let event = packet(&g, edge, current, attachment);
+        let before = g.f.app.project().clone();
+        let source = g.f.app.document.bundle().clone();
+        let revision = g.f.app.document.revision();
+        assert!(g.f.app.connection.is_none());
+        assert!(g.f.app.selected_attachment.is_none());
+        let _ = g.f.app.update(Message::Route(event));
+        assert_eq!(g.f.app.document.revision(), revision + 1);
+        assert_eq!(g.f.app.selected, edge);
+        assert_eq!(
+            g.f.app.selected_bend,
+            if attachment { None } else { Some((edge, 0)) }
+        );
+        let mut expected = before.clone();
+        let route = expected
+            .diagrams
+            .get_mut(&g.f.diagram)
+            .unwrap()
+            .routes
+            .iter_mut()
+            .find(|r| r.edge == edge)
+            .unwrap();
+        if attachment {
+            route.source_attachment = Some(EdgeAttachment {
+                side: PortAnchorSide::Top,
+                offset: 0.25,
+            });
+        } else {
+            route.waypoints = vec![xy(750., 450.)];
+        }
+        exact_history(&mut g.f.app, &before, &source, &expected);
+    }
+}

crates/oa-desktop/src/app/allocation_drag_tests/navigation_union.rs

@@ -161,7 +161,7 @@ fn stale_gesture_packets_preserve_navigation_and_a_new_live_cancel_still_works()
         .update(Message::WorkDrag(Event::Cancel(current.token)));
     assert!(f.app.allocation_drag.active.is_none());
     assert!(f.app.allocation_drag.epoch > epoch);
-    assert_eq!(f.app.status, "Work drag canceled");
+    assert_eq!(f.app.status, "Drag canceled");
     assert!(Arc::ptr_eq(&before, &f.app.document.snapshot()));
     assert_eq!(f.app.source_workspace.bundle(), before.bundle);
 }

crates/oa-desktop/src/app/architecture_authoring.rs

@@ -27,30 +27,11 @@ pub enum Event {
     Cancel,
 }
 
-pub fn subscription(app: &App) -> Subscription<Message> {
-    if app.architecture.as_ref().is_some_and(State::inline) {
-        iced::event::listen_with(captured_escape)
-    } else {
-        Subscription::none()
-    }
-}
-
-fn captured_escape(
-    event: iced::Event,
-    status: iced::event::Status,
-    _: iced::window::Id,
-) -> Option<Message> {
-    // A focused Iced text input captures Escape while dropping its focus. Only
-    // inline architecture naming opts into also cancelling that same keypress.
-    (status == iced::event::Status::Captured
-        && matches!(
-            event,
-            iced::Event::Keyboard(iced::keyboard::Event::KeyPressed {
-                key: iced::keyboard::Key::Named(iced::keyboard::key::Named::Escape),
-                ..
-            })
-        ))
-    .then_some(Message::Architecture(Event::CapturedEscape))
+pub(super) fn captured_escape_message(app: &App) -> Option<Message> {
+    app.architecture
+        .as_ref()
+        .is_some_and(State::inline)
+        .then_some(Message::Architecture(Event::CapturedEscape))
 }
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
@@ -313,6 +294,17 @@ impl App {
                     _ => return Task::none(),
                 };
                 let placing = point.is_none() && matches!(intent, Intent::Create { .. });
+                let filter = if matches!(intent, Intent::Existing { .. })
+                    && self
+                        .project()
+                        .diagrams
+                        .get(&diagram)
+                        .is_some_and(|d| d.projection == ProjectionKind::Traceability)
+                {
+                    Filter::AllCompatible
+                } else {
+                    Filter::Context
+                };
                 let saved = Saved {
                     version: 1,
                     base: oa_core::transitions::project_fingerprint(self.project()),
@@ -321,7 +313,7 @@ impl App {
                     point,
                     placing,
                     query: String::new(),
-                    filter: Filter::Context,
+                    filter,
                     show_placed: false,
                     page: 0,
                 };

crates/oa-desktop/src/app/architecture_authoring/palette.rs

@@ -229,13 +229,7 @@ pub fn view(app: &App) -> Element<'_, Message> {
     content = content.push(group("Connections"));
     for connection in crate::connection_tool::Tool::for_layer(app.layer) {
         let d = &app.project().diagrams[&app.active_diagram.unwrap()];
-        let kind = match connection {
-            crate::connection_tool::Tool::Interaction => Kind::Activity,
-            crate::connection_tool::Tool::FunctionalExchange => Kind::Function,
-            crate::connection_tool::Tool::CommunicationMean => Kind::Entity,
-            crate::connection_tool::Tool::BoundaryExchange => Kind::System,
-        };
-        if !d.projection.includes(kind) {
+        if !connection.available_in(app.layer, d.projection) {
             continue;
         }
         content = content.push(tool(

crates/oa-desktop/src/app/architecture_authoring/tests.rs

@@ -1,4 +1,5 @@
 use super::*;
+mod traceability;
 
 fn setup(layer: Layer) -> App {
     let mut app = App::with_project(Project::empty());
@@ -233,65 +234,6 @@ fn architecture_stale_submit_keeps_create_and_rename_visible_and_exact() {
     }
 }
 
-fn key_event(named: iced::keyboard::key::Named) -> iced::Event {
-    use iced::keyboard;
-    iced::Event::Keyboard(keyboard::Event::KeyPressed {
-        key: keyboard::Key::Named(named),
-        modified_key: keyboard::Key::Named(named),
-        physical_key: keyboard::key::Physical::Code(keyboard::key::Code::Escape),
-        location: keyboard::Location::Standard,
-        modifiers: keyboard::Modifiers::empty(),
-        text: None,
-        repeat: false,
-    })
-}
-
-fn focused_text_input_escape(name: &str) -> Message {
-    use iced::advanced::{Layout, Shell, layout, widget};
-    let mut field: iced::Element<'_, (), iced::Theme, ()> = text_input("Engineering name", name)
-        .id("architecture-name")
-        .on_input(|_| ())
-        .into();
-    let mut tree = widget::Tree::new(field.as_widget());
-    let size = iced::Size::new(300., 40.);
-    let node =
-        field
-            .as_widget_mut()
-            .layout(&mut tree, &(), &layout::Limits::new(iced::Size::ZERO, size));
-    tree.state
-        .downcast_mut::<iced::widget::text_input::State<()>>()
-        .focus();
-    let escape = key_event(iced::keyboard::key::Named::Escape);
-    let mut messages = Vec::new();
-    let mut shell = Shell::new(&mut messages);
-    field.as_widget_mut().update(
-        &mut tree,
-        &escape,
-        Layout::new(&node),
-        iced::mouse::Cursor::Unavailable,
-        &(),
-        &mut iced::advanced::clipboard::Null,
-        &mut shell,
-        &iced::Rectangle::new(iced::Point::ORIGIN, size),
-    );
-    assert!(
-        shell.is_event_captured(),
-        "Iced consumes focused-input Escape"
-    );
-    assert!(
-        !tree
-            .state
-            .downcast_ref::<iced::widget::text_input::State<()>>()
-            .is_focused()
-    );
-    captured_escape(
-        escape,
-        iced::event::Status::Captured,
-        iced::window::Id::unique(),
-    )
-    .unwrap()
-}
-
 #[test]
 fn architecture_first_focused_input_escape_cancels_create_and_rename() {
     for rename in [false, true] {
@@ -311,8 +253,9 @@ fn architecture_first_focused_input_escape_cancels_create_and_rename() {
         let name = "  Unaccepted long engineering name 雨  ";
         send(&mut app, Event::Name(name.into()));
         assert!(app.architecture.as_ref().unwrap().inline());
-        let message = focused_text_input_escape(name);
-        let _ = app.update(message);
+        let mut messages = crate::app::escape::tests::focused_input_messages(&app);
+        assert_eq!(messages.len(), 1);
+        let _ = app.update(messages.remove(0));
         assert!(app.architecture.is_none());
         assert!(inline_editor(&app).is_none());
         assert_eq!(app.status, "Cancelled · Select / move");
@@ -342,8 +285,8 @@ fn architecture_captured_escape_does_not_cancel_other_controls_or_placement() {
         let before = app.document.bundle().clone();
         let status = app.status.clone();
         let epoch = app.canvas_epoch;
-        let message = focused_text_input_escape("Other field or existing-element search");
-        let _ = app.update(message);
+        let messages = crate::app::escape::tests::focused_input_messages(&app);
+        assert!(messages.is_empty());
         assert_eq!(
             app.architecture
                 .as_ref()
@@ -355,19 +298,7 @@ fn architecture_captured_escape_does_not_cancel_other_controls_or_placement() {
         assert_eq!(app.canvas_epoch, epoch);
     }
     assert!(
-        captured_escape(
-            key_event(iced::keyboard::key::Named::Escape),
-            iced::event::Status::Ignored,
-            iced::window::Id::unique(),
-        )
-        .is_none()
-    );
-    assert!(
-        captured_escape(
-            key_event(iced::keyboard::key::Named::Enter),
-            iced::event::Status::Captured,
-            iced::window::Id::unique(),
-        )
-        .is_none()
+        crate::app::escape::tests::focused_input_key(&app, iced::keyboard::key::Named::Enter,)
+            .is_empty()
     );
 }

crates/oa-desktop/src/app/architecture_authoring/tests/traceability.rs

@@ -0,0 +1,124 @@
+use super::*;
+
+#[test]
+fn traceability_existing_defaults_show_opposite_layer_and_place_only_one_node() {
+    let mut project = Project::empty();
+    let sa = project
+        .add_element(Kind::Function, Layer::Sa, "Deliver report", None)
+        .unwrap();
+    let system = project
+        .add_element(Kind::System, Layer::Sa, "System", None)
+        .unwrap();
+    let diagram = project.ensure_diagram(Layer::Oa);
+    project.diagrams.get_mut(&diagram).unwrap().projection = ProjectionKind::Traceability;
+    let mut app = App::with_project(project);
+    app.page = Page::Diagram;
+    app.layer = Layer::Oa;
+    app.active_diagram = Some(diagram);
+    let before = app.document.snapshot();
+    send(&mut app, Event::Existing(None));
+    assert_eq!(
+        app.architecture.as_ref().unwrap().saved.filter,
+        Filter::AllCompatible
+    );
+    let listed = candidates(&app);
+    assert!(listed.iter().any(|(id, _, shown)| *id == sa && !shown));
+    assert!(listed.iter().any(|(id, _, shown)| *id == system && !shown));
+    send(&mut app, Event::Pick(sa));
+    assert!(app.architecture.as_ref().unwrap().saved.placing);
+    assert_eq!(app.project(), &before.decoded.project);
+    let context = app.route_context().unwrap();
+    let point = Position { x: 345., y: 215. };
+    send(&mut app, Event::Click(context, point));
+    assert!(app.architecture.is_none(), "{}", app.status);
+    assert_eq!(app.active_diagram, Some(diagram));
+    let placed = app.project().diagrams[&diagram]
+        .nodes
+        .values()
+        .find(|n| n.element == sa)
+        .unwrap()
+        .clone();
+    assert_eq!(placed.position, point);
+    let mut expected = before.decoded.project.clone();
+    expected
+        .diagrams
+        .get_mut(&diagram)
+        .unwrap()
+        .nodes
+        .insert(placed.id, placed);
+    assert_eq!(app.project(), &expected);
+    let accepted = app.document.bundle().clone();
+    let _ = app.update(Message::Undo);
+    assert_eq!(app.document.bundle(), &before.bundle);
+    assert!(!app.document.can_undo());
+    let _ = app.update(Message::Redo);
+    assert_eq!(app.project(), &expected);
+    assert_eq!(app.document.bundle(), &accepted);
+}
+
+#[test]
+fn traceability_default_does_not_change_creation_or_ordinary_picker_guards() {
+    let mut app = setup(Layer::Oa);
+    let diagram = app.active_diagram.unwrap();
+    send(&mut app, Event::Existing(None));
+    assert_eq!(
+        app.architecture.as_ref().unwrap().saved.filter,
+        Filter::Context
+    );
+    send(&mut app, Event::Cancel);
+    let _ = app.update(Message::Projection(ProjectionKind::Traceability));
+    send(&mut app, Event::Start(Kind::Entity, None));
+    assert_eq!(
+        app.architecture.as_ref().unwrap().saved.filter,
+        Filter::Context
+    );
+    send(&mut app, Event::Cancel);
+    assert_eq!(app.active_diagram, Some(diagram));
+
+    let mut project = app.project().clone();
+    let sa = project
+        .add_element(Kind::Function, Layer::Sa, "Other layer", None)
+        .unwrap();
+    let port = Id::new_v4();
+    project.elements.insert(
+        port,
+        oa_core::Element {
+            id: port,
+            alias: "legacy_port".into(),
+            name: "Port".into(),
+            description: String::new(),
+            parent: Some(sa),
+            body: ElementBody::shared_in(
+                Layer::Sa,
+                SharedBody::Port {
+                    contract: PortContract::Legacy,
+                    legacy: Some(LegacyPortContract {
+                        direction: PortDirection::InOut,
+                        interface: None,
+                    }),
+                },
+            ),
+        },
+    );
+    oa_core::validate_candidate(&project).unwrap();
+    for projection in [ProjectionKind::Overview, ProjectionKind::Traceability] {
+        let mut p = project.clone();
+        p.diagrams.get_mut(&diagram).unwrap().projection = projection;
+        let mut trial = App::with_project(p);
+        trial.page = Page::Diagram;
+        trial.active_diagram = Some(diagram);
+        trial.layer = Layer::Oa;
+        let before = trial.document.bundle().clone();
+        send(&mut trial, Event::Existing(None));
+        send(&mut trial, Event::Filter(Filter::AllCompatible));
+        assert_eq!(
+            candidates(&trial).iter().any(|(id, _, _)| *id == sa),
+            projection == ProjectionKind::Traceability
+        );
+        assert!(!candidates(&trial).iter().any(|(id, _, _)| *id == port));
+        send(&mut trial, Event::Pick(port));
+        assert!(!trial.architecture.as_ref().unwrap().saved.placing);
+        send(&mut trial, Event::Cancel);
+        assert_eq!(trial.document.bundle(), &before);
+    }
+}

crates/oa-desktop/src/app/behavior_removal_tests.rs

@@ -544,9 +544,16 @@ async fn mounted_qualified_process_child_delete_refuses_outer_reference_and_shar
         .await;
     assert!(messages.iter().any(|message| matches!(
         message,
-        Message::TopologyCanvas(topology::CanvasEvent::SelectQualified(..))
+        Message::DiagramSelection(multiselect::Event::Choose(
+            _, crate::diagram_usage::Target::ProcessOccurrence(actual), multiselect::Choice::Replace
+        )) if actual == &endpoint
     )));
-    assert_eq!(app.selected, references[0]);
+    assert_eq!(app.selected, f.nodes[0]);
+    assert!(app.draft.is_none(), "Qualified inspection stays read-only");
+    assert_eq!(
+        app.behavior.topology.selection_address().unwrap().endpoint,
+        endpoint
+    );
     assert!(
         app.behavior
             .topology

crates/oa-desktop/src/app/context_help_tests.rs

@@ -0,0 +1,723 @@
+//! Context help is a reading overlay, not a workspace navigation or edit.
+use super::*;
+use crate::diagram_usage::Target;
+use crate::guide::Topic;
+
+fn send(app: &mut App, message: Message) {
+    // Do not poll I/O tasks: exercise the same admission boundary as the UI.
+    let _ = app.update(message);
+}
+
+fn architecture() -> (App, Id, Id, Id) {
+    let mut project = Project::empty();
+    let a = project
+        .add_element(Kind::Function, Layer::Sa, "Send", None)
+        .unwrap();
+    let b = project
+        .add_element(Kind::Function, Layer::Sa, "Receive", None)
+        .unwrap();
+    let diagram = project.ensure_diagram(Layer::Sa);
+    project.diagrams.get_mut(&diagram).unwrap().projection = ProjectionKind::FunctionalDataflow;
+    let a = project.place(diagram, a, Position { x: 20., y: 20. });
+    let b = project.place(diagram, b, Position { x: 400., y: 20. });
+    let mut app = App::with_project(project);
+    app.page = Page::Diagram;
+    app.layer = Layer::Sa;
+    app.active_diagram = Some(diagram);
+    app.selected = diagram;
+    app.refresh_draft();
+    app.reconcile_multiselect();
+    (app, diagram, a, b)
+}
+
+fn choose(app: &mut App, placement: Id, choice: multiselect::Choice) {
+    let context = app.multiselect_context().unwrap();
+    send(
+        app,
+        Message::DiagramSelection(multiselect::Event::Choose(
+            context,
+            Target::Placement(placement),
+            choice,
+        )),
+    );
+}
+
+#[test]
+fn context_help_preserves_group_property_draft_camera_and_model() {
+    let (mut app, diagram, a, b) = architecture();
+    choose(&mut app, a, multiselect::Choice::Replace);
+    choose(&mut app, b, multiselect::Choice::Toggle);
+    send(
+        &mut app,
+        Message::Field("/name".into(), "Uncommitted name 雨".into()),
+    );
+    assert!(app.draft_dirty());
+    app.zoom = 0.73;
+    app.pan = iced::Vector::new(31., -57.);
+    let selected = app.selected;
+    let selection = app.multiselect_snapshot().unwrap().targets().to_vec();
+    assert_eq!(selection.len(), 2);
+    let draft = serde_json::to_value(app.draft.as_ref().unwrap().recovery_snapshot()).unwrap();
+    let before = app.document.snapshot();
+    let camera = (app.zoom, app.pan);
+
+    send(&mut app, Message::ContextHelp(Topic::Nesting));
+    assert!(app.context_help);
+    for message in [
+        Message::Page(Page::Catalog),
+        Message::Select(diagram),
+        Message::Apply,
+        Message::RevertProperties,
+        Message::Undo,
+        Message::Delete,
+        Message::Field("/name".into(), "Background mutation".into()),
+    ] {
+        send(&mut app, message);
+    }
+    assert!(app.context_help);
+    send(
+        &mut app,
+        Message::Guide(crate::guide::Event::Topic(Topic::Exchanges)),
+    );
+    assert_eq!(app.guide.topic, Topic::Exchanges);
+    send(&mut app, Message::CloseContextHelp);
+
+    assert!(!app.context_help);
+    assert_eq!(app.page, Page::Diagram);
+    assert_eq!(app.active_diagram, Some(diagram));
+    assert_eq!(app.selected, selected);
+    assert_eq!(
+        app.multiselect_snapshot().unwrap().targets(),
+        selection.as_slice()
+    );
+    assert_eq!((app.zoom, app.pan), camera);
+    assert_eq!(
+        serde_json::to_value(app.draft.as_ref().unwrap().recovery_snapshot()).unwrap(),
+        draft
+    );
+    assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+    assert!(!app.document.can_undo());
+}
+
+#[test]
+fn context_help_escape_preserves_pending_behavior_form_and_blocks_submit() {
+    use crate::behavior::states;
+    let mut project = Project::empty();
+    let system = project
+        .add_element(Kind::System, Layer::Sa, "System", None)
+        .unwrap();
+    let machine = project
+        .add_element(Kind::StateMachine, Layer::Sa, "Modes", Some(system))
+        .unwrap();
+    let region = project
+        .add_element(Kind::Region, Layer::Sa, "Main", Some(machine))
+        .unwrap();
+    let state = project
+        .add_element(Kind::State, Layer::Sa, "Ready", Some(region))
+        .unwrap();
+    let mut app = App::with_project(project);
+    send(&mut app, Message::Select(state));
+    send(&mut app, Message::Page(Page::Behavior));
+    send(
+        &mut app,
+        Message::Behavior(behavior::Event::States(states::Event::Start(
+            machine,
+            states::Tool::Transition,
+            state,
+        ))),
+    );
+    send(
+        &mut app,
+        Message::Behavior(behavior::Event::States(states::Event::Name(
+            "Pending transition 雨".into(),
+        ))),
+    );
+    assert!(app.behavior.has_pending());
+    let draft = app.behavior.recovery_snapshot().unwrap();
+    let before = app.document.snapshot();
+    let selected = app.selected;
+    send(&mut app, Message::Help);
+    assert!(app.context_help);
+    assert_eq!(app.guide.topic, Topic::States);
+    for event in [
+        states::Event::Cancel,
+        states::Event::Submit,
+        states::Event::Name("Lost".into()),
+    ] {
+        send(&mut app, Message::Behavior(behavior::Event::States(event)));
+    }
+    send(&mut app, Message::Page(Page::Catalog));
+    send(&mut app, Message::Escape);
+    assert!(!app.context_help);
+    assert_eq!(app.page, Page::Behavior);
+    assert_eq!(app.selected, selected);
+    assert_eq!(app.behavior.active_owner, Some(machine));
+    assert!(app.behavior.has_pending());
+    assert_eq!(app.behavior.recovery_snapshot().unwrap(), draft);
+    assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+}
+
+#[test]
+fn context_help_retains_source_draft_and_rejects_background_source_input() {
+    let (mut app, diagram, _, _) = architecture();
+    send(&mut app, Message::Page(Page::Text));
+    send(
+        &mut app,
+        Message::SourceEdit(text_editor::Action::SelectAll),
+    );
+    send(
+        &mut app,
+        Message::SourceEdit(text_editor::Action::Edit(text_editor::Edit::Paste(
+            Arc::new("invalid unfinished source 雨".into()),
+        ))),
+    );
+    assert!(app.source_dirty());
+    send(&mut app, Message::Page(Page::Diagram));
+    let source = app.source_editor.text();
+    let version = app.source_version;
+    let before = app.document.snapshot();
+    send(&mut app, Message::Help);
+    assert!(app.context_help);
+    assert_eq!(app.guide.topic, Topic::Nesting);
+    for message in [
+        Message::ApplySource,
+        Message::RevertSource,
+        Message::SourceEdit(text_editor::Action::Edit(text_editor::Edit::Paste(
+            Arc::new("overwrite".into()),
+        ))),
+    ] {
+        send(&mut app, message);
+    }
+    send(&mut app, Message::Escape);
+    assert_eq!(app.page, Page::Diagram);
+    assert_eq!(app.active_diagram, Some(diagram));
+    assert!(app.source_dirty());
+    assert_eq!(app.source_editor.text(), source);
+    assert_eq!(app.source_version, version);
+    assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+}
+
+#[test]
+fn context_help_f1_selects_scenario_topic_without_leaving_the_workspace() {
+    let fixture = behavior::scenario::direct_tests::fixture();
+    let mut app = App::with_project(fixture.project);
+    send(&mut app, Message::Select(fixture.owner));
+    send(&mut app, Message::Page(Page::Behavior));
+    let before = app.document.snapshot();
+    send(&mut app, Message::Help);
+    assert!(app.context_help);
+    assert_eq!(app.guide.topic, Topic::Scenarios);
+    assert_eq!(app.page, Page::Behavior);
+    assert!(app.scenario_focus_owner().is_none());
+    assert!(!behavior::canvas_workspace::keyboard_owner_enabled(&app));
+    send(&mut app, Message::Escape);
+    assert!(!app.context_help);
+    assert_eq!(app.selected, fixture.owner);
+    assert_eq!(app.behavior.active_owner, Some(fixture.owner));
+    assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+}
+
+#[test]
+fn context_help_disables_allocation_input_including_early_work_drag_dispatch() {
+    let mut project = Project::empty();
+    let diagram = project.ensure_diagram(Layer::Oa);
+    project.diagrams.get_mut(&diagram).unwrap().projection = ProjectionKind::Allocation;
+    let mut app = App::with_project(project);
+    assert!(app.allocation_input_owner());
+    send(
+        &mut app,
+        Message::WorkDrag(allocation_drag::Event::ArrangeNext),
+    );
+    assert!(app.allocation_drag.arrange_next);
+    send(&mut app, Message::Help);
+    assert!(app.context_help);
+    assert!(!app.allocation_input_owner());
+    assert!(!app.allocation_drag.arrange_next);
+    assert_eq!(app.status, "Arrange cancelled");
+    let before = app.document.snapshot();
+    send(
+        &mut app,
+        Message::WorkDrag(allocation_drag::Event::ArrangeNext),
+    );
+    assert!(!app.allocation_drag.arrange_next);
+    assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+    send(&mut app, Message::Escape);
+    assert!(app.allocation_input_owner());
+}
+
+#[test]
+fn context_help_rejects_a_reference_picker_open_queued_from_the_inspector() {
+    let mut project = Project::empty();
+    let owner = project
+        .add_element(Kind::DataType, Layer::Oa, "Record", None)
+        .unwrap();
+    if let Some(SharedBody::DataType { definition, .. }) =
+        project.elements.get_mut(&owner).unwrap().shared_mut()
+    {
+        *definition = DataTypeDefinition::Record { supertype: None };
+    }
+    let mut app = App::with_project(project);
+    send(&mut app, Message::Select(owner));
+    let request = app.draft.as_ref().unwrap().reference_open(
+        app.project(),
+        "/body/Oa/Shared/DataType/definition/Record/supertype",
+        iced::Rectangle {
+            x: 790.,
+            y: 400.,
+            width: 278.,
+            height: 32.,
+        },
+    );
+    let before = serde_json::to_value(app.draft.as_ref().unwrap().recovery_snapshot()).unwrap();
+    send(&mut app, Message::ContextHelp(Topic::Nesting));
+    assert!(app.context_help);
+    send(&mut app, Message::FieldReferenceOpen(request));
+    assert!(!app.reference_input_active());
+    send(&mut app, Message::Escape);
+    assert!(!app.context_help);
+    assert_eq!(
+        serde_json::to_value(app.draft.as_ref().unwrap().recovery_snapshot()).unwrap(),
+        before
+    );
+}
+
+#[test]
+fn context_help_accepts_live_process_viewport_and_rejects_stale_measurements() {
+    use crate::behavior::topology::CanvasEvent;
+    let mut project = Project::empty();
+    let owner = project
+        .add_element(Kind::Process, Layer::Oa, "Response process", None)
+        .unwrap();
+    let mut app = App::with_project(project);
+    send(&mut app, Message::Select(owner));
+    send(&mut app, Message::Page(Page::Behavior));
+    let context = app.topology_context().unwrap();
+    send(
+        &mut app,
+        Message::TopologyCanvas(CanvasEvent::Viewport(context, iced::Size::new(640., 480.))),
+    );
+    let initial = app.behavior.topology.camera_boundary();
+    let before = app.document.snapshot();
+    send(&mut app, Message::Help);
+    assert!(app.context_help);
+    assert_eq!(app.guide.topic, Topic::Chains);
+
+    let resized = iced::Size::new(420., 330.);
+    let context = app.topology_context().unwrap();
+    send(
+        &mut app,
+        Message::TopologyCanvas(CanvasEvent::Viewport(context, resized)),
+    );
+    let measured = app.behavior.topology.camera_boundary();
+    assert!(
+        measured != initial,
+        "Help must admit passive viewport measurements"
+    );
+    assert!(app.context_help);
+    let epoch = app.canvas_epoch;
+    for field in 0..3 {
+        let mut stale = app.topology_context().unwrap();
+        match field {
+            0 => stale.document = Id::new_v4(),
+            1 => stale.owner = Id::new_v4(),
+            _ => stale.revision += 1,
+        }
+        send(
+            &mut app,
+            Message::TopologyCanvas(CanvasEvent::Viewport(stale, iced::Size::new(999., 777.))),
+        );
+        assert!(app.behavior.topology.camera_boundary() == measured);
+        assert_eq!(app.canvas_epoch, epoch);
+    }
+
+    send(&mut app, Message::CloseContextHelp);
+    assert!(!app.context_help);
+    assert!(app.behavior.topology.camera_boundary() == measured);
+    let context = app.topology_context().unwrap();
+    let epoch = app.canvas_epoch;
+    send(
+        &mut app,
+        Message::TopologyCanvas(CanvasEvent::Viewport(context, resized)),
+    );
+    assert_eq!(
+        app.canvas_epoch, epoch,
+        "The size observed behind Help is already current"
+    );
+    let context = app.topology_context().unwrap();
+    send(
+        &mut app,
+        Message::TopologyCanvas(CanvasEvent::Viewport(context, iced::Size::new(700., 500.))),
+    );
+    assert!(app.behavior.topology.camera_boundary() != measured);
+    assert_eq!(app.page, Page::Behavior);
+    assert_eq!(app.selected, owner);
+    assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+    assert!(!app.document.can_undo());
+}
+
+async fn help_key(
+    mounted: &mut crate::behavior::canvas_workspace::tests::Mounted,
+    app: &mut App,
+    event: iced::Event,
+) -> Vec<Message> {
+    let (mut messages, statuses) = mounted.input_with_status(
+        app,
+        std::slice::from_ref(&event),
+        iced::mouse::Cursor::Unavailable,
+    );
+    super::escape::tests::subscriptions(app, event, statuses[0], &mut messages);
+    for message in messages.iter().cloned() {
+        let task = app.update(message);
+        mounted.perform(app, task).await;
+    }
+    messages
+}
+
+#[tokio::test]
+async fn mounted_context_help_keyboard_scroll_preserves_inspector_focus_and_exact_caret() {
+    use crate::behavior::canvas_workspace::tests::{Mounted, character, key};
+    use iced::keyboard::key::Named;
+    let (mut app, diagram, a, _) = architecture();
+    let element = app.project().diagrams[&diagram].nodes[&a].element;
+    send(&mut app, Message::Select(element));
+    let before = app.document.snapshot();
+    let mut mounted = Mounted::new(&mut app).await;
+    let field = mounted
+        .geometry(&app)
+        .text_inputs
+        .into_iter()
+        .filter(|bounds| bounds.x > app.window_size.width - 320.)
+        .min_by(|a, b| a.y.total_cmp(&b.y))
+        .expect("visible Inspector Name input");
+    mounted.click(&mut app, field.center()).await;
+    help_key(&mut mounted, &mut app, key(Named::Home)).await;
+    for character_value in "DRAFT ".chars() {
+        help_key(
+            &mut mounted,
+            &mut app,
+            character(&character_value.to_string()),
+        )
+        .await;
+    }
+    help_key(&mut mounted, &mut app, key(Named::ArrowLeft)).await;
+    assert_eq!(
+        app.draft.as_ref().unwrap().inputs["/name"].raw,
+        "DRAFT Send"
+    );
+    let camera = (app.zoom, app.pan);
+    help_key(&mut mounted, &mut app, key(Named::F1)).await;
+    assert!(app.context_help);
+    let article = iced::advanced::widget::Id::new(crate::guide::ARTICLE_SCROLL_ID);
+    let geometry = mounted.geometry(&app);
+    let background_scrolls = geometry
+        .scrolls
+        .iter()
+        .filter(|(id, _)| **id != article)
+        .map(|(id, (_, offset))| (id.clone(), *offset))
+        .collect::<Vec<_>>();
+    assert_eq!(geometry.scrolls[&article].1.y, 0.);
+
+    help_key(&mut mounted, &mut app, key(Named::PageDown)).await;
+    let down = mounted.geometry(&app).scrolls[&article].1.y;
+    assert!(down > 0., "PageDown scrolls the mounted Help article");
+    help_key(&mut mounted, &mut app, key(Named::End)).await;
+    let end = mounted.geometry(&app).scrolls[&article].1.y;
+    assert!(end > down);
+    help_key(&mut mounted, &mut app, key(Named::PageDown)).await;
+    assert_eq!(mounted.geometry(&app).scrolls[&article].1.y, end);
+    help_key(&mut mounted, &mut app, key(Named::PageUp)).await;
+    assert!(mounted.geometry(&app).scrolls[&article].1.y < end);
+    help_key(&mut mounted, &mut app, key(Named::Home)).await;
+    assert_eq!(mounted.geometry(&app).scrolls[&article].1.y, 0.);
+    help_key(&mut mounted, &mut app, key(Named::ArrowDown)).await;
+    assert_eq!(mounted.geometry(&app).scrolls[&article].1.y, 40.);
+    help_key(&mut mounted, &mut app, key(Named::ArrowUp)).await;
+    help_key(&mut mounted, &mut app, key(Named::PageUp)).await;
+    let geometry = mounted.geometry(&app);
+    assert_eq!(geometry.scrolls[&article].1.y, 0.);
+    for (id, offset) in background_scrolls {
+        assert_eq!(
+            geometry.scrolls[&id].1, offset,
+            "Help only scrolls its own article"
+        );
+    }
+    for character_value in "IGNORED".chars() {
+        help_key(
+            &mut mounted,
+            &mut app,
+            character(&character_value.to_string()),
+        )
+        .await;
+    }
+    let messages = mounted
+        .batch(
+            &mut app,
+            &[
+                iced::Event::InputMethod(iced::advanced::input_method::Event::Preedit(
+                    "雨".into(),
+                    None,
+                )),
+                iced::Event::InputMethod(iced::advanced::input_method::Event::Commit("雨".into())),
+            ],
+            iced::mouse::Cursor::Unavailable,
+        )
+        .await;
+    assert!(!messages.iter().any(|m| matches!(m, Message::Field(..))));
+    assert_eq!(
+        app.draft.as_ref().unwrap().inputs["/name"].raw,
+        "DRAFT Send"
+    );
+    help_key(&mut mounted, &mut app, key(Named::Escape)).await;
+    assert!(!app.context_help);
+    help_key(&mut mounted, &mut app, character("X")).await;
+    assert_eq!(
+        app.draft.as_ref().unwrap().inputs["/name"].raw,
+        "DRAFTX Send",
+        "Return keeps the actual mid-string caret without refocusing a guessed field"
+    );
+    assert_eq!((app.zoom, app.pan), camera);
+    assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+    let messages = help_key(&mut mounted, &mut app, key(Named::PageDown)).await;
+    assert!(
+        !messages
+            .iter()
+            .any(|m| matches!(m, Message::ContextHelpScroll(_)))
+    );
+    assert!(
+        iced_runtime::task::into_stream(
+            app.update(Message::ContextHelpScroll(crate::guide::ContextScroll::End,))
+        )
+        .is_none(),
+        "A late Help scroll cannot operate after closing"
+    );
+}
+
+#[tokio::test]
+async fn mounted_context_help_observes_modifier_release_before_plain_canvas_click() {
+    use crate::behavior::canvas_workspace::tests::{Mounted, key};
+    use iced::{
+        keyboard::{Event, Modifiers, key::Named},
+        mouse,
+    };
+    let (mut app, diagram, a, b) = architecture();
+    choose(&mut app, a, multiselect::Choice::Replace);
+    app.window_size = iced::Size::new(2000., 1400.);
+    let mut mounted = Mounted::new(&mut app).await;
+    app.zoom = 1.;
+    app.pan = iced::Vector::ZERO;
+    app.fit_to_view = false;
+    mounted.settle(&mut app).await;
+    mounted
+        .batch(
+            &mut app,
+            &[iced::Event::Keyboard(Event::ModifiersChanged(
+                Modifiers::SHIFT,
+            ))],
+            mouse::Cursor::Unavailable,
+        )
+        .await;
+    help_key(&mut mounted, &mut app, key(Named::F1)).await;
+    assert!(app.context_help);
+    mounted
+        .batch(
+            &mut app,
+            &[iced::Event::Keyboard(Event::ModifiersChanged(
+                Modifiers::empty(),
+            ))],
+            mouse::Cursor::Unavailable,
+        )
+        .await;
+    help_key(&mut mounted, &mut app, key(Named::Escape)).await;
+    let bounds = mounted
+        .geometry(&app)
+        .bounds(crate::allocation_input::CANVAS_ID);
+    let node = projection::project_view(app.project(), diagram)
+        .nodes
+        .into_iter()
+        .find(|node| node.id == b)
+        .unwrap();
+    let at = iced::Point::new(
+        bounds.x + node.position.x + 40.,
+        bounds.y + node.position.y + 35.,
+    );
+    mounted.click(&mut app, at).await;
+    assert_eq!(
+        app.multiselect_snapshot().unwrap().targets(),
+        &[Target::Placement(b)],
+        "Shift released during Help must not add the next card to the previous selection"
+    );
+}
+
+#[tokio::test]
+async fn mounted_context_help_retires_held_pan_without_replaying_its_release() {
+    use crate::behavior::canvas_workspace::tests::{Mounted, key};
+    use iced::{keyboard::key::Named, mouse};
+    let (mut app, _, _, _) = architecture();
+    let mut mounted = Mounted::new(&mut app).await;
+    let canvas = mounted
+        .geometry(&app)
+        .bounds(crate::allocation_input::CANVAS_ID);
+    let start = canvas.center();
+    let moved = start + iced::Vector::new(20., 10.);
+    mounted
+        .batch(
+            &mut app,
+            &[
+                iced::Event::Mouse(mouse::Event::CursorMoved { position: start }),
+                iced::Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Middle)),
+                iced::Event::Mouse(mouse::Event::CursorMoved { position: moved }),
+            ],
+            mouse::Cursor::Available(moved),
+        )
+        .await;
+    let camera = (app.zoom, app.pan);
+    let before = app.document.snapshot();
+    help_key(&mut mounted, &mut app, key(Named::F1)).await;
+    assert!(app.context_help);
+    mounted
+        .batch(
+            &mut app,
+            &[iced::Event::Mouse(mouse::Event::ButtonReleased(
+                mouse::Button::Middle,
+            ))],
+            mouse::Cursor::Unavailable,
+        )
+        .await;
+    help_key(&mut mounted, &mut app, key(Named::Escape)).await;
+    let next = moved + iced::Vector::new(90., 50.);
+    let messages = mounted
+        .batch(
+            &mut app,
+            &[iced::Event::Mouse(mouse::Event::CursorMoved {
+                position: next,
+            })],
+            mouse::Cursor::Available(next),
+        )
+        .await;
+    assert!(!messages.iter().any(|m| matches!(m, Message::Pan(_))));
+    assert_eq!(
+        (app.zoom, app.pan),
+        camera,
+        "Moving without a held button cannot resume the pre-Help pan"
+    );
+    assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+}
+
+#[tokio::test]
+async fn context_help_barrier_retires_text_selection_drag_without_changing_the_caret() {
+    use iced::advanced::{Layout, layout, widget};
+    use iced::{Element, Event, Rectangle, mouse};
+    type InputState = iced::widget::text_input::State<
+        <iced::Renderer as iced::advanced::text::Renderer>::Paragraph,
+    >;
+    fn input(open: bool) -> Element<'static, Message> {
+        crate::guide::protect_workspace(
+            open,
+            iced::widget::text_input("Name", "A long retained property name")
+                .on_input(|value| Message::Field("/name".into(), value))
+                .width(400)
+                .padding(8)
+                .into(),
+        )
+    }
+    fn dispatch(
+        root: &mut Element<'_, Message>,
+        tree: &mut widget::Tree,
+        node: &layout::Node,
+        renderer: &iced::Renderer,
+        event: Event,
+        cursor: mouse::Cursor,
+    ) -> Vec<Message> {
+        let mut messages = Vec::new();
+        root.as_widget_mut().update(
+            tree,
+            &event,
+            Layout::new(node),
+            cursor,
+            renderer,
+            &mut iced::advanced::clipboard::Null,
+            &mut iced::advanced::Shell::new(&mut messages),
+            &Rectangle::new(iced::Point::ORIGIN, iced::Size::new(400., 60.)),
+        );
+        messages
+    }
+    let mounted = crate::behavior::canvas_workspace::tests::Mounted::unshown().await;
+    let renderer = &mounted.renderer;
+    let mut root = input(false);
+    let mut tree = widget::Tree::new(root.as_widget());
+    let node = root.as_widget_mut().layout(
+        &mut tree,
+        renderer,
+        &layout::Limits::new(iced::Size::ZERO, iced::Size::new(400., 60.)),
+    );
+    let start = iced::Point::new(20., 18.);
+    let end = iced::Point::new(110., 18.);
+    for event in [
+        mouse::Event::CursorMoved { position: start },
+        mouse::Event::ButtonPressed(mouse::Button::Left),
+        mouse::Event::CursorMoved { position: end },
+    ] {
+        let cursor = if matches!(event, mouse::Event::CursorMoved { position } if position == end) {
+            mouse::Cursor::Available(end)
+        } else {
+            mouse::Cursor::Available(start)
+        };
+        dispatch(
+            &mut root,
+            &mut tree,
+            &node,
+            renderer,
+            Event::Mouse(event),
+            cursor,
+        );
+    }
+    let caret = tree.children[0].state.downcast_ref::<InputState>().cursor();
+    assert!(
+        tree.children[0]
+            .state
+            .downcast_ref::<InputState>()
+            .is_focused()
+    );
+    root = input(true);
+    tree.diff(root.as_widget());
+    let messages = dispatch(
+        &mut root,
+        &mut tree,
+        &node,
+        renderer,
+        Event::Window(iced::window::Event::RedrawRequested(
+            std::time::Instant::now(),
+        )),
+        mouse::Cursor::Unavailable,
+    );
+    assert!(
+        messages.is_empty(),
+        "Gesture retirement discards release actions"
+    );
+    dispatch(
+        &mut root,
+        &mut tree,
+        &node,
+        renderer,
+        Event::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left)),
+        mouse::Cursor::Unavailable,
+    );
+    root = input(false);
+    tree.diff(root.as_widget());
+    let later = iced::Point::new(300., 18.);
+    dispatch(
+        &mut root,
+        &mut tree,
+        &node,
+        renderer,
+        Event::Mouse(mouse::Event::CursorMoved { position: later }),
+        mouse::Cursor::Available(later),
+    );
+    let state = tree.children[0].state.downcast_ref::<InputState>();
+    assert!(state.is_focused());
+    assert_eq!(
+        state.cursor(),
+        caret,
+        "An unheld pointer no longer extends the pre-Help text selection"
+    );
+}

crates/oa-desktop/src/app/diagram_usages.rs

@@ -388,14 +388,7 @@ impl App {
             | Target::ScenarioObject(id)
             | Target::AllocationGrouping { relation: id, .. }
             | Target::ProcessPreviewLink { relation: id, .. } => (*id, None),
-            Target::ProcessOccurrence(endpoint) => (
-                endpoint
-                    .references
-                    .first()
-                    .copied()
-                    .unwrap_or(endpoint.occurrence),
-                None,
-            ),
+            Target::ProcessOccurrence(endpoint) => (endpoint.occurrence, None),
         };
         match usage.surface {
             Surface::Saved(id) => {

crates/oa-desktop/src/app/diagram_usages/tests.rs

@@ -881,7 +881,32 @@ fn repeated_process_calls_reveal_the_chosen_caller_and_distinct_tile_camera() {
         .unwrap()
         .clone();
     choose(&mut app, token, row);
-    assert_eq!(app.selected, first);
+    assert_eq!(app.selected, leaf);
+    let context = app.topology_context().unwrap();
+    send(
+        &mut app,
+        Message::TopologyCanvas(behavior::topology::CanvasEvent::Viewport(
+            context,
+            iced::Size::new(850., 460.),
+        )),
+    );
+    assert!(app.pending_diagram_reveal.is_none());
+    assert_eq!(
+        app.behavior.topology.selection_address().unwrap().endpoint,
+        OccurrenceEndpoint {
+            references: vec![first],
+            occurrence: leaf
+        }
+    );
+    assert_eq!(
+        app.multiselect_snapshot().unwrap().primary(),
+        Some(&Target::ProcessOccurrence(OccurrenceEndpoint {
+            references: vec![first],
+            occurrence: leaf
+        }))
+    );
+    assert!(app.process_preview_primary().is_some());
+    assert!(app.draft.is_none());
     assert_eq!(app.page, Page::Behavior);
     assert_eq!(app.behavior.active_owner, Some(fixture.owner));
     let first_camera = app.behavior.topology.camera_boundary();
@@ -898,7 +923,33 @@ fn repeated_process_calls_reveal_the_chosen_caller_and_distinct_tile_camera() {
         })
         .unwrap();
     choose(&mut app, token, row);
-    assert_eq!(app.selected, second);
+    assert_eq!(app.selected, leaf);
+    let context = app.topology_context().unwrap();
+    send(
+        &mut app,
+        Message::TopologyCanvas(behavior::topology::CanvasEvent::Viewport(
+            context,
+            iced::Size::new(850., 460.),
+        )),
+    );
+    assert!(app.pending_diagram_reveal.is_none());
+    assert_eq!(app.behavior.active_owner, Some(fixture.owner));
+    assert_eq!(
+        app.behavior.topology.selection_address().unwrap().endpoint,
+        OccurrenceEndpoint {
+            references: vec![second],
+            occurrence: leaf
+        }
+    );
+    assert_eq!(
+        app.multiselect_snapshot().unwrap().primary(),
+        Some(&Target::ProcessOccurrence(OccurrenceEndpoint {
+            references: vec![second],
+            occurrence: leaf
+        }))
+    );
+    assert!(app.process_preview_primary().is_some());
+    assert!(app.draft.is_none());
     assert_eq!(app.selected_node, None);
     assert!(app.behavior.topology.camera_boundary() != first_camera);
     assert_eq!(authored(&app), before);

crates/oa-desktop/src/app/escape.rs

@@ -0,0 +1,199 @@
+//! Keep overlay Escape ahead of modal cancellation in the ordinary widget tree.
+//!
+//! Iced skips root.update when an overlay captures an event. Keeping this
+//! wrapper present even when inactive preserves the child's widget state. A
+//! current-overlay preflight also handles pickers opened mid-batch. Passive
+//! overlays may see an ignored Escape again: the raw-input observer only makes
+//! pending focus requests stale; it does not publish modal cancellation.
+use super::{App, Message, Page, architecture_authoring};
+use iced::advanced::{Clipboard, Layout, Shell, Widget, layout, overlay, renderer, widget};
+use iced::{Element, Event, Length, Rectangle, Size, Theme, Vector, keyboard, mouse};
+
+pub(crate) fn root<'a, R: renderer::Renderer + 'a>(
+    app: &App,
+    content: Element<'a, Message, Theme, R>,
+) -> Element<'a, Message, Theme, R> {
+    let modal = app.text_workspace.menu().is_none()
+        && (app.context_help
+            || app.behavior.creation.has_pending()
+            || app.diagram_usages.is_some()
+            || app.behavior.source_active()
+            || (app.page == Page::Text
+                && (app.text_workspace.drawer().is_some()
+                    || app.source_navigation.open
+                    || app.source_rename.open())
+                && app.architecture.is_none()));
+    Element::new(Bridge {
+        content,
+        messages: [
+            architecture_authoring::captured_escape_message(app),
+            modal.then_some(Message::Escape),
+        ],
+    })
+}
+
+struct Bridge<'a, R> {
+    content: Element<'a, Message, Theme, R>,
+    messages: [Option<Message>; 2],
+}
+
+impl<R: renderer::Renderer> Widget<Message, Theme, R> for Bridge<'_, R> {
+    fn children(&self) -> Vec<widget::Tree> {
+        vec![widget::Tree::new(self.content.as_widget())]
+    }
+
+    fn diff(&self, tree: &mut widget::Tree) {
+        tree.diff_children(std::slice::from_ref(&self.content));
+    }
+
+    fn size(&self) -> Size<Length> {
+        self.content.as_widget().size()
+    }
+
+    fn size_hint(&self) -> Size<Length> {
+        self.content.as_widget().size_hint()
+    }
+
+    fn layout(
+        &mut self,
+        tree: &mut widget::Tree,
+        renderer: &R,
+        limits: &layout::Limits,
+    ) -> layout::Node {
+        self.content
+            .as_widget_mut()
+            .layout(&mut tree.children[0], renderer, limits)
+    }
+
+    fn operate(
+        &mut self,
+        tree: &mut widget::Tree,
+        layout: Layout<'_>,
+        renderer: &R,
+        operation: &mut dyn widget::Operation,
+    ) {
+        self.content
+            .as_widget_mut()
+            .operate(&mut tree.children[0], layout, renderer, operation);
+    }
+
+    fn update(
+        &mut self,
+        tree: &mut widget::Tree,
+        event: &Event,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        renderer: &R,
+        clipboard: &mut dyn Clipboard,
+        shell: &mut Shell<'_, Message>,
+        viewport: &Rectangle,
+    ) {
+        let escape = matches!(
+            event,
+            Event::Keyboard(keyboard::Event::KeyPressed {
+                key: keyboard::Key::Named(keyboard::key::Named::Escape),
+                ..
+            })
+        );
+        // Iced collects overlays before processing a batch of base events. A
+        // preceding click in that batch can therefore open a picker whose
+        // Escape would otherwise reach focused fields underneath it. Offer only
+        // Escape to the current overlay before updating the ordinary tree.
+        if escape {
+            if let Some(element) = self.content.as_widget_mut().overlay(
+                &mut tree.children[0],
+                layout,
+                renderer,
+                viewport,
+                Vector::ZERO,
+            ) {
+                let mut overlay = overlay::Nested::new(element);
+                let node = overlay.layout(renderer, viewport.size());
+                overlay.update(
+                    event,
+                    Layout::new(&node),
+                    cursor,
+                    renderer,
+                    clipboard,
+                    shell,
+                );
+            }
+            if shell.is_event_captured() {
+                return;
+            }
+        }
+        self.content.as_widget_mut().update(
+            &mut tree.children[0],
+            event,
+            layout,
+            cursor,
+            renderer,
+            clipboard,
+            shell,
+            viewport,
+        );
+        if shell.is_event_captured() && escape {
+            for message in self.messages.iter().flatten() {
+                shell.publish(message.clone());
+            }
+        }
+    }
+
+    fn draw(
+        &self,
+        tree: &widget::Tree,
+        renderer: &mut R,
+        theme: &Theme,
+        style: &renderer::Style,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        viewport: &Rectangle,
+    ) {
+        self.content.as_widget().draw(
+            &tree.children[0],
+            renderer,
+            theme,
+            style,
+            layout,
+            cursor,
+            viewport,
+        );
+    }
+
+    fn mouse_interaction(
+        &self,
+        tree: &widget::Tree,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        viewport: &Rectangle,
+        renderer: &R,
+    ) -> mouse::Interaction {
+        self.content.as_widget().mouse_interaction(
+            &tree.children[0],
+            layout,
+            cursor,
+            viewport,
+            renderer,
+        )
+    }
+
+    fn overlay<'b>(
+        &'b mut self,
+        tree: &'b mut widget::Tree,
+        layout: Layout<'b>,
+        renderer: &R,
+        viewport: &Rectangle,
+        translation: Vector,
+    ) -> Option<overlay::Element<'b, Message, Theme, R>> {
+        self.content.as_widget_mut().overlay(
+            &mut tree.children[0],
+            layout,
+            renderer,
+            viewport,
+            translation,
+        )
+    }
+}
+
+#[cfg(test)]
+pub(crate) mod tests;

crates/oa-desktop/src/app/escape/tests.rs

@@ -0,0 +1,618 @@
+use super::*;
+use crate::behavior::canvas_workspace::tests::key;
+use iced::advanced::{subscription, widget::operation};
+use iced::futures::{StreamExt, stream, task::noop_waker_ref};
+use iced::keyboard::key::Named;
+use iced::widget::{column, container, pick_list, text_input};
+use iced_runtime::user_interface::{Cache, UserInterface};
+use oa_core::{Layer, Project};
+use std::task::{Context, Poll};
+
+struct FocusInputs;
+impl widget::Operation for FocusInputs {
+    fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn widget::Operation)) {
+        visit(self);
+    }
+    fn focusable(
+        &mut self,
+        _: Option<&widget::Id>,
+        _: Rectangle,
+        state: &mut dyn operation::Focusable,
+    ) {
+        state.focus();
+    }
+}
+
+pub(crate) fn subscriptions(
+    app: &App,
+    event: Event,
+    status: iced::event::Status,
+    messages: &mut Vec<Message>,
+) {
+    let interaction = subscription::Event::Interaction {
+        window: iced::window::Id::unique(),
+        event,
+        status,
+    };
+    let mut boundaries = 0;
+    for recipe in subscription::into_recipes(app.subscription()) {
+        let mut output = recipe.stream(Box::pin(stream::iter([interaction.clone()])));
+        let mut cx = Context::from_waker(noop_waker_ref());
+        while let Poll::Ready(Some(message)) = output.poll_next_unpin(&mut cx) {
+            if matches!(
+                message,
+                Message::WorkDrag(crate::app::allocation_drag::Event::KeyboardBoundary)
+            ) {
+                boundaries += 1;
+            } else {
+                messages.push(message);
+            }
+        }
+    }
+    assert_eq!(
+        boundaries, 1,
+        "one passive allocation keyboard notification"
+    );
+}
+
+/// A real focused text input, production root bridge, UserInterface dispatch,
+/// and actual subscriptions. Existing app-policy tests use this instead of
+/// pretending every captured event came from a text control.
+pub(crate) fn focused_input_messages(app: &App) -> Vec<Message> {
+    focused_input_key(app, Named::Escape)
+}
+
+pub(crate) fn focused_input_key(app: &App, named: Named) -> Vec<Message> {
+    input_messages(app, named, true)
+}
+
+pub(crate) fn input_messages(app: &App, named: Named, focused: bool) -> Vec<Message> {
+    let runtime = tokio::runtime::Builder::new_current_thread()
+        .enable_time()
+        .build()
+        .unwrap();
+    let _entered = runtime.enter();
+    let input: Element<'_, Message, Theme, ()> = text_input("Retained input", "Uncommitted 雨")
+        .on_input(|_| Message::Escape)
+        .into();
+    let mut renderer = ();
+    let mut ui = UserInterface::build(
+        root(app, input),
+        Size::new(400., 100.),
+        Cache::new(),
+        &mut renderer,
+    );
+    if focused {
+        ui.operate(&renderer, &mut FocusInputs);
+    }
+    let event = key(named);
+    let mut messages = vec![];
+    let (_, statuses) = ui.update(
+        std::slice::from_ref(&event),
+        mouse::Cursor::Unavailable,
+        &mut renderer,
+        &mut iced::advanced::clipboard::Null,
+        &mut messages,
+    );
+    if named == Named::Escape {
+        assert_eq!(
+            statuses,
+            [if focused {
+                iced::event::Status::Captured
+            } else {
+                iced::event::Status::Ignored
+            }]
+        );
+    }
+    subscriptions(app, event, statuses[0], &mut messages);
+    messages
+}
+
+#[derive(Clone, Debug, PartialEq)]
+enum PickMessage {
+    Selected(&'static str),
+    Opened,
+    Closed,
+}
+
+fn picker(
+    selected: Option<&'static str>,
+    notify: bool,
+) -> Element<'static, PickMessage, Theme, ()> {
+    let list = pick_list(["Alpha", "Beta"], selected, PickMessage::Selected)
+        .width(200)
+        .padding(10)
+        .text_size(16)
+        .on_open(PickMessage::Opened);
+    if notify {
+        list.on_close(PickMessage::Closed).into()
+    } else {
+        list.into()
+    }
+}
+
+fn update<M>(
+    ui: &mut UserInterface<'_, M, Theme, ()>,
+    events: &[Event],
+    cursor: mouse::Cursor,
+) -> (Vec<M>, Vec<iced::event::Status>) {
+    let mut messages = vec![];
+    let (_, statuses) = ui.update(
+        events,
+        cursor,
+        &mut (),
+        &mut iced::advanced::clipboard::Null,
+        &mut messages,
+    );
+    (messages, statuses)
+}
+
+fn press_at(point: iced::Point) -> (Vec<Event>, mouse::Cursor) {
+    (
+        vec![
+            Event::Mouse(mouse::Event::CursorMoved { position: point }),
+            Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
+            Event::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left)),
+        ],
+        mouse::Cursor::Available(point),
+    )
+}
+
+#[test]
+fn picker_overlay_escape_closes_once_reopens_selects_and_retains_outside_click() {
+    for selected in [None, Some("Alpha")] {
+        for notify in [false, true] {
+            let mut ui = UserInterface::build(
+                picker(selected, notify),
+                Size::new(400., 300.),
+                Cache::new(),
+                &mut (),
+            );
+            let (click, cursor) = press_at(iced::Point::new(50., 15.));
+            assert_eq!(update(&mut ui, &click, cursor).0, [PickMessage::Opened]);
+            let cache = ui.into_cache();
+            let mut ui = UserInterface::build(
+                picker(selected, notify),
+                Size::new(400., 300.),
+                cache,
+                &mut (),
+            );
+            let (messages, statuses) = update(
+                &mut ui,
+                &[key(Named::Escape), key(Named::Escape)],
+                mouse::Cursor::Unavailable,
+            );
+            assert_eq!(
+                messages,
+                if notify {
+                    vec![PickMessage::Closed]
+                } else {
+                    vec![]
+                }
+            );
+            assert_eq!(
+                statuses,
+                [iced::event::Status::Captured, iced::event::Status::Ignored]
+            );
+            let cache = ui.into_cache();
+            let mut ui = UserInterface::build(
+                picker(selected, notify),
+                Size::new(400., 300.),
+                cache,
+                &mut (),
+            );
+            assert_eq!(update(&mut ui, &click, cursor).0, [PickMessage::Opened]);
+            let cache = ui.into_cache();
+            let mut ui = UserInterface::build(
+                picker(selected, notify),
+                Size::new(400., 300.),
+                cache,
+                &mut (),
+            );
+            let (outside, cursor) = press_at(iced::Point::new(350., 250.));
+            assert_eq!(
+                update(&mut ui, &outside, cursor).0,
+                if notify {
+                    vec![PickMessage::Closed]
+                } else {
+                    vec![]
+                }
+            );
+            let cache = ui.into_cache();
+            let mut ui = UserInterface::build(
+                picker(selected, notify),
+                Size::new(400., 300.),
+                cache,
+                &mut (),
+            );
+            let (click, cursor) = press_at(iced::Point::new(50., 15.));
+            assert_eq!(update(&mut ui, &click, cursor).0, [PickMessage::Opened]);
+            let cache = ui.into_cache();
+            let mut ui = UserInterface::build(
+                picker(selected, notify),
+                Size::new(400., 300.),
+                cache,
+                &mut (),
+            );
+            // Default 16px text uses 1.3 line-height: button/option height 40.8.
+            let (option, cursor) = press_at(iced::Point::new(50., 100.));
+            assert_eq!(
+                update(&mut ui, &option, cursor).0,
+                [PickMessage::Selected("Beta")]
+            );
+            let cache = ui.into_cache();
+            let mut ui = UserInterface::build(
+                picker(Some("Beta"), notify),
+                Size::new(400., 300.),
+                cache,
+                &mut (),
+            );
+            assert_eq!(
+                update(&mut ui, &[key(Named::Escape)], mouse::Cursor::Unavailable),
+                (vec![], vec![iced::event::Status::Ignored])
+            );
+        }
+    }
+}
+
+#[test]
+fn initially_closed_picker_handles_open_then_escape_in_one_runtime_batch() {
+    for notify in [false, true] {
+        let mut ui = UserInterface::build(
+            picker(Some("Alpha"), notify),
+            Size::new(400., 300.),
+            Cache::new(),
+            &mut (),
+        );
+        let (mut events, cursor) = press_at(iced::Point::new(50., 15.));
+        events.push(key(Named::Escape));
+        let (messages, statuses) = update(&mut ui, &events, cursor);
+        assert_eq!(
+            messages,
+            if notify {
+                vec![PickMessage::Opened, PickMessage::Closed]
+            } else {
+                vec![PickMessage::Opened]
+            }
+        );
+        assert_eq!(statuses.last(), Some(&iced::event::Status::Captured));
+        assert_eq!(
+            update(&mut ui, &[key(Named::Escape)], mouse::Cursor::Unavailable),
+            (vec![], vec![iced::event::Status::Ignored])
+        );
+    }
+}
+
+#[test]
+fn dismissed_picker_ignores_a_queued_click_in_its_old_option_area() {
+    let mut ui = UserInterface::build(
+        picker(Some("Alpha"), true),
+        Size::new(400., 300.),
+        Cache::new(),
+        &mut (),
+    );
+    let (click, cursor) = press_at(iced::Point::new(50., 15.));
+    assert_eq!(update(&mut ui, &click, cursor).0, [PickMessage::Opened]);
+    let cache = ui.into_cache();
+    let mut ui = UserInterface::build(
+        picker(Some("Alpha"), true),
+        Size::new(400., 300.),
+        cache,
+        &mut (),
+    );
+    let (click, cursor) = press_at(iced::Point::new(50., 100.));
+    let mut batch = vec![key(Named::Escape)];
+    batch.extend(click);
+    let (messages, _) = update(&mut ui, &batch, cursor);
+    assert_eq!(
+        messages,
+        [PickMessage::Closed],
+        "queued old-option click must not select Beta"
+    );
+}
+
+fn draft_with_picker(app: &App) -> Element<'_, Message, Theme, ()> {
+    // This composition deliberately keeps a focused input beneath the actual
+    // picker overlay. It tests event ownership, not a claimed production form.
+    root(
+        app,
+        crate::source_navigation::interaction::observe(
+            column![
+                container(
+                    text_input("Raw draft", "Keep exact bytes 雨").on_input(|_| Message::Escape)
+                )
+                .height(40),
+                pick_list([Layer::Oa, Layer::Sa], Some(Layer::Oa), Message::Layer)
+                    .width(200)
+                    .padding(10),
+            ]
+            .into(),
+            app.source_symbols.raw_interaction.clone(),
+        ),
+    )
+}
+
+#[test]
+fn picker_overlay_precedes_focused_input_and_creation_source_drafts() {
+    use crate::behavior::{Event as BehaviorEvent, creation, source_draft};
+    let runtime = tokio::runtime::Builder::new_current_thread()
+        .enable_time()
+        .build()
+        .unwrap();
+    let _entered = runtime.enter();
+    for (source, same_batch) in [(false, false), (true, false), (false, true), (true, true)] {
+        let mut app = App::with_project(Project::empty());
+        let send = |app: &mut App, event| {
+            let _ = app.update(Message::Behavior(BehaviorEvent::Creation(event)));
+        };
+        send(&mut app, creation::Event::Open(Layer::Oa));
+        send(&mut app, creation::Event::Choose(creation::Family::Machine));
+        send(
+            &mut app,
+            creation::Event::Name("Retained machine 雨".into()),
+        );
+        if source {
+            let recovery = app.behavior.creation.recovery_snapshot().unwrap().unwrap();
+            let invocation = serde_json::from_value(recovery["invocation"].clone()).unwrap();
+            send(
+                &mut app,
+                creation::Event::Source(source_draft::Event::Open(invocation)),
+            );
+            let recovery = app.behavior.creation.recovery_snapshot().unwrap().unwrap();
+            let token =
+                serde_json::from_value(recovery["source"]["editing"]["token"].clone()).unwrap();
+            send(
+                &mut app,
+                creation::Event::Source(source_draft::Event::Edit(
+                    token,
+                    source_draft::Edit::Name("Uncommitted owner 雨".into()),
+                )),
+            );
+            assert_eq!(
+                app.behavior.creation.recovery_snapshot().unwrap().unwrap()["source"]["editing"]["name"],
+                "Uncommitted owner 雨"
+            );
+        }
+        let draft = app.behavior.recovery_snapshot().unwrap();
+        let project = app.project().clone();
+        let bundle = app.document.bundle().clone();
+        let revision = app.document.revision();
+        let selection = (app.selected, app.selected_node, app.active_diagram);
+        let camera = (app.pan, app.zoom);
+        let raw_epoch = app
+            .source_symbols
+            .raw_interaction
+            .load(std::sync::atomic::Ordering::Acquire);
+        let mut ui = UserInterface::build(
+            draft_with_picker(&app),
+            Size::new(500., 400.),
+            Cache::new(),
+            &mut (),
+        );
+        let event = key(Named::Escape);
+        let (mut click, cursor) = press_at(iced::Point::new(50., 55.));
+        let (mut messages, statuses) = if same_batch {
+            ui.operate(&(), &mut FocusInputs);
+            click.push(event.clone());
+            update(&mut ui, &click, cursor)
+        } else {
+            assert!(update(&mut ui, &click, cursor).0.is_empty());
+            let cache = ui.into_cache();
+            ui = UserInterface::build(
+                draft_with_picker(&app),
+                Size::new(500., 400.),
+                cache,
+                &mut (),
+            );
+            ui.operate(&(), &mut FocusInputs);
+            update(
+                &mut ui,
+                std::slice::from_ref(&event),
+                mouse::Cursor::Unavailable,
+            )
+        };
+        assert_eq!(statuses.last(), Some(&iced::event::Status::Captured));
+        subscriptions(&app, event, *statuses.last().unwrap(), &mut messages);
+        assert!(
+            messages.is_empty(),
+            "picker must not forward global modal cancellation"
+        );
+        let cache = ui.into_cache();
+        assert_eq!(app.behavior.recovery_snapshot().unwrap(), draft);
+        assert!(!crate::source_navigation::interaction::is_current(
+            &app.source_symbols.raw_interaction,
+            raw_epoch,
+        ));
+        let mut ui = UserInterface::build(
+            draft_with_picker(&app),
+            Size::new(500., 400.),
+            cache,
+            &mut (),
+        );
+        let event = key(Named::Escape);
+        let (mut messages, statuses) = update(
+            &mut ui,
+            std::slice::from_ref(&event),
+            mouse::Cursor::Unavailable,
+        );
+        subscriptions(&app, event, statuses[0], &mut messages);
+        assert_eq!(messages.len(), 1);
+        assert!(matches!(messages[0], Message::Escape));
+        drop(ui);
+        let _ = app.update(messages.remove(0));
+        if source {
+            assert!(app.behavior.creation.has_pending());
+            assert!(!app.behavior.creation.source_open());
+            assert_eq!(
+                app.behavior.creation.recovery_snapshot().unwrap().unwrap()["name"],
+                "Retained machine 雨"
+            );
+        } else {
+            assert!(!app.behavior.creation.has_pending());
+        }
+        assert_eq!(app.project(), &project);
+        assert_eq!(app.document.bundle(), &bundle);
+        assert_eq!(app.document.revision(), revision);
+        assert_eq!(
+            (app.selected, app.selected_node, app.active_diagram),
+            selection
+        );
+        assert_eq!((app.pan, app.zoom), camera);
+        assert!(!app.document.can_undo() && !app.document.can_redo());
+    }
+}
+
+#[test]
+fn ignored_tooltip_escape_preserves_modal_priority_and_rejects_stale_focus() {
+    use crate::source_navigation::interaction;
+    use iced::widget::{text, tooltip};
+    use std::sync::atomic::Ordering;
+
+    let runtime = tokio::runtime::Builder::new_current_thread()
+        .enable_time()
+        .build()
+        .unwrap();
+    let _entered = runtime.enter();
+    let mut app = App::with_project(Project::empty());
+    app.page = Page::Text;
+    app.source_navigation.open = true;
+    let project = app.project().clone();
+    let source = app.document.bundle().clone();
+    let context = (
+        app.selected,
+        app.selected_node,
+        app.active_diagram,
+        app.pan,
+        app.zoom,
+    );
+    let content = || -> Element<'_, Message, Theme, ()> {
+        let field = text_input("Find", "Retained query 雨").on_input(|_| Message::Escape);
+        let tip = tooltip(field, text("Help"), tooltip::Position::Bottom)
+            .delay(std::time::Duration::ZERO);
+        root(
+            &app,
+            interaction::observe(tip.into(), app.source_symbols.raw_interaction.clone()),
+        )
+    };
+    let mut ui = UserInterface::build(content(), Size::new(400., 180.), Cache::new(), &mut ());
+    let point = iced::Point::new(10., 10.);
+    let cursor = mouse::Cursor::Available(point);
+    assert!(
+        update(
+            &mut ui,
+            &[Event::Mouse(mouse::Event::CursorMoved { position: point })],
+            cursor
+        )
+        .0
+        .is_empty()
+    );
+    let cache = ui.into_cache();
+    let mut ui = UserInterface::build(content(), Size::new(400., 180.), cache, &mut ());
+    ui.operate(&(), &mut FocusInputs);
+    let epoch = app.source_symbols.raw_interaction.load(Ordering::Acquire);
+    let event = key(Named::Escape);
+    let (mut messages, statuses) = update(&mut ui, std::slice::from_ref(&event), cursor);
+    assert_eq!(statuses, [iced::event::Status::Captured]);
+    subscriptions(&app, event, statuses[0], &mut messages);
+    assert_eq!(messages.len(), 1);
+    assert!(matches!(messages[0], Message::Escape));
+    assert!(!interaction::is_current(
+        &app.source_symbols.raw_interaction,
+        epoch
+    ));
+    drop(ui);
+    let _ = app.update(messages.remove(0));
+    assert!(!app.source_navigation.open);
+    assert_eq!(app.project(), &project);
+    assert_eq!(app.document.bundle(), &source);
+    assert_eq!(
+        (
+            app.selected,
+            app.selected_node,
+            app.active_diagram,
+            app.pan,
+            app.zoom
+        ),
+        context
+    );
+    assert!(!app.document.can_undo() && !app.document.can_redo());
+}
+
+#[test]
+fn toggling_bridge_policy_retains_focused_child_state() {
+    let mut app = App::with_project(Project::empty());
+    let content = || -> Element<'static, Message, Theme, ()> {
+        text_input("Raw field", "Still focused")
+            .on_input(|_| Message::Escape)
+            .into()
+    };
+    let mut ui = UserInterface::build(
+        root(&app, content()),
+        Size::new(400., 100.),
+        Cache::new(),
+        &mut (),
+    );
+    ui.operate(&(), &mut FocusInputs);
+    let cache = ui.into_cache();
+    app.page = Page::Text;
+    app.source_navigation.open = true;
+    let mut ui = UserInterface::build(root(&app, content()), Size::new(400., 100.), cache, &mut ());
+    let (messages, status) = update(&mut ui, &[key(Named::Escape)], mouse::Cursor::Unavailable);
+    assert_eq!(status, [iced::event::Status::Captured]);
+    assert_eq!(messages.len(), 1);
+    assert!(matches!(messages[0], Message::Escape));
+}
+
+#[tokio::test]
+async fn mounted_creation_name_escape_keeps_pending_modal_priority() {
+    use crate::behavior::canvas_workspace::tests::Mounted;
+    use crate::behavior::{Event as BehaviorEvent, creation};
+    for pending in [false, true] {
+        let mut app = App::with_project(Project::empty());
+        for event in [
+            creation::Event::Open(Layer::Oa),
+            creation::Event::Choose(creation::Family::Sequence),
+            creation::Event::Name("Exact unfinished process 雨".into()),
+        ] {
+            let _ = app.update(Message::Behavior(BehaviorEvent::Creation(event)));
+        }
+        app.page = Page::Behavior;
+        let mut mounted = Mounted::new(&mut app).await;
+        mounted
+            .perform(
+                &mut app,
+                iced::widget::operation::focus(creation::NAME_INPUT),
+            )
+            .await;
+        if pending {
+            app.pending = Some(super::super::Pending::Walkthrough);
+        }
+        let before = app.document.snapshot();
+        let draft = app.behavior.recovery_snapshot().unwrap();
+        let event = key(Named::Escape);
+        let (mut messages, statuses) = mounted.input_with_status(
+            &app,
+            std::slice::from_ref(&event),
+            mouse::Cursor::Unavailable,
+        );
+        subscriptions(&app, event, statuses[0], &mut messages);
+        assert_eq!(
+            messages
+                .iter()
+                .filter(|message| matches!(message, Message::Escape))
+                .count(),
+            1
+        );
+        for message in messages {
+            let _ = app.update(message);
+        }
+        if pending {
+            assert!(app.pending.is_none());
+            assert_eq!(app.behavior.recovery_snapshot().unwrap(), draft);
+        } else {
+            assert!(!app.behavior.creation.has_pending());
+        }
+        assert!(std::sync::Arc::ptr_eq(&before, &app.document.snapshot()));
+        assert!(!app.document.can_undo() && !app.document.can_redo());
+    }
+}

crates/oa-desktop/src/app/multiselect.rs

@@ -19,6 +19,10 @@ pub(crate) enum Event {
     Clear(Context),
     Move(Snapshot, Position),
     Hide(Snapshot),
+    ProcessReorder(
+        Snapshot,
+        crate::behavior::topology::group_reorder::Destination,
+    ),
     Refuse(Snapshot, String),
 }
 
@@ -33,6 +37,17 @@ pub(crate) fn context(c: crate::route_edit::Context) -> Context {
     }
 }
 
+pub(crate) fn process_context(c: crate::behavior::topology::Context) -> Context {
+    Context {
+        scope: Scope {
+            document: c.document,
+            surface: Surface::Process(c.owner),
+        },
+        revision: c.revision,
+        epoch: c.epoch,
+    }
+}
+
 /// The entire typed set must support a placement action. Never filter a mixture.
 pub(crate) fn placements(snapshot: &Snapshot) -> Option<std::collections::BTreeSet<Id>> {
     snapshot.primary()?;
@@ -49,7 +64,7 @@ pub(crate) fn placements(snapshot: &Snapshot) -> Option<std::collections::BTreeS
         .collect()
 }
 
-fn visible(
+pub(super) fn visible(
     project: &Project,
     diagram: Id,
     view: &projection::ProjectedView,
@@ -83,12 +98,17 @@ impl App {
             self.selected_node,
             (self.page == Page::Behavior).then(|| self.state_view_identity()),
             (self.page == Page::Behavior).then_some(self.behavior.diagram.placement),
+            self.topology_context(),
+            self.behavior.topology.selection_address(),
         )
     }
     pub(crate) fn multiselect_context(&self) -> Option<Context> {
         match self.page {
             Page::Diagram => self.route_context().map(context),
             Page::Behavior => {
+                if let Some(current) = self.topology_context() {
+                    return Some(process_context(current));
+                }
                 let current = self.state_context()?;
                 crate::behavior::state_edit::validate_context(self.project(), current, current)
                     .ok()?;
@@ -99,6 +119,13 @@ impl App {
     }
 
     pub(crate) fn multiselect_target_visible(&self, target: &Target) -> bool {
+        if let Some(context) = self.topology_context() {
+            return self
+                .behavior
+                .topology
+                .selection_targets(self.project(), context.owner)
+                .contains(target);
+        }
         let Some(Context {
             scope:
                 Scope {
@@ -130,11 +157,14 @@ impl App {
         };
         match event {
             Event::Choose(c, ..) | Event::Clear(c) => *c == current,
-            Event::Move(s, _) | Event::Hide(s) | Event::Refuse(s, _) | Event::Collapse(s, _) => {
-                self.diagram_selection
-                    .as_ref()
-                    .is_some_and(|selection| selection.matches(s, current))
-            }
+            Event::Move(s, _)
+            | Event::Hide(s)
+            | Event::ProcessReorder(s, _)
+            | Event::Refuse(s, _)
+            | Event::Collapse(s, _) => self
+                .diagram_selection
+                .as_ref()
+                .is_some_and(|selection| selection.matches(s, current)),
         }
     }
 
@@ -189,6 +219,10 @@ impl App {
     }
 
     pub(crate) fn reconcile_multiselect(&mut self) {
+        if self.topology_context().is_some() {
+            self.reconcile_process_multiselect();
+            return;
+        }
         let Some(current) = self.multiselect_context() else {
             self.diagram_selection = None;
             return;
@@ -249,7 +283,11 @@ impl App {
         }
     }
 
-    fn inspect_multiselect_primary(&mut self) {
+    pub(super) fn inspect_multiselect_primary(&mut self) {
+        if self.topology_context().is_some() {
+            self.inspect_process_multiselect_primary();
+            return;
+        }
         let diagram = self
             .multiselect_context()
             .and_then(|c| match c.scope.surface {
@@ -293,6 +331,10 @@ impl App {
         if !self.multiselect_envelope(&event) {
             return;
         }
+        if self.topology_context().is_some() {
+            self.process_multiselect_event(event);
+            return;
+        }
         if !diagram_removal::enabled(self)
             || self.architecture.is_some()
             || self.connection.is_some()
@@ -313,6 +355,7 @@ impl App {
             self.document.view_index(),
         );
         match event {
+            Event::ProcessReorder(..) => {}
             Event::Collapse(_, target) => {
                 if !visible(self.project(), diagram, &view, &target) {
                     return;
@@ -379,7 +422,7 @@ impl App {
                     })
                 {
                     self.status =
-                        "Group allocation drag is not available yet. The selection was retained."
+                        "Use an Allocation drag to assign this selection, or arm Arrange next drag."
                             .into();
                     return;
                 }

crates/oa-desktop/src/app/process_canvas.rs

@@ -129,6 +129,12 @@ impl App {
                 let resolved = oa_core::topology_context::TopologyIndex::new(self.project())
                     .resolve(context.owner, &endpoint);
                 if let Ok(resolved) = resolved {
+                    // The definition may be opened from a nonprimary context
+                    // target. Remember that exact invocation, not whichever
+                    // qualified occurrence happened to be primary beforehand.
+                    self.behavior
+                        .topology
+                        .select_context(resolved.address.clone());
                     self.behavior.topology.remember(
                         context.owner,
                         endpoint
@@ -138,27 +144,18 @@ impl App {
                             .unwrap_or(endpoint.occurrence),
                         resolved.defining_sequence,
                     );
+                    self.behavior.topology.clear_context();
                     self.behavior.active_owner = Some(resolved.defining_sequence);
                     self.select(endpoint.occurrence);
                     self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
                 }
             }
             CanvasEvent::SelectQualified(_, endpoint) => {
-                if !self.behavior.has_pending()
-                    && !self.draft_dirty()
-                    && !self.source_dirty()
-                    && let Ok(resolved) =
-                        oa_core::topology_context::TopologyIndex::new(self.project())
-                            .resolve(context.owner, &endpoint)
-                {
-                    let reference = endpoint
-                        .references
-                        .first()
-                        .copied()
-                        .unwrap_or(endpoint.occurrence);
-                    self.select(reference);
-                    self.behavior.topology.select_context(resolved.address);
-                }
+                self.multiselect_event(multiselect::Event::Choose(
+                    multiselect::process_context(context),
+                    crate::diagram_usage::Target::ProcessOccurrence(endpoint),
+                    multiselect::Choice::Replace,
+                ));
             }
             CanvasEvent::Select(_, id) => {
                 if !self.behavior.has_pending()
@@ -199,6 +196,9 @@ impl App {
                 if let Some(target) =
                     topology::referenced(self.project(), context.owner, occurrence)
                 {
+                    // Opening a local card returns to that local use, even if
+                    // a qualified tile was the previous inspection target.
+                    self.behavior.topology.clear_context();
                     if self
                         .project()
                         .elements
@@ -223,8 +223,20 @@ impl App {
                 self.behavior.topology = state;
                 if let Some((owner, occurrence)) = back {
                     self.behavior.active_owner = Some(owner);
-                    self.select(occurrence);
+                    // Back restores a use, whereas ordinary select navigates
+                    // to a defining object. The validated return address owns
+                    // the exact subject; never infer it from the outer card ID.
+                    self.selected = self
+                        .behavior
+                        .topology
+                        .selection_address()
+                        .filter(|address| address.owner == owner)
+                        .map_or(occurrence, |address| address.endpoint.occurrence);
                     self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
+                    // Synchronize the exact primary and inspector before the
+                    // returned caller is drawn or accepts property edits.
+                    self.reconcile_process_multiselect();
+                    self.inspect_process_multiselect_primary();
                 }
             }
             mutation => {
@@ -294,8 +306,9 @@ impl App {
                         occurrence, before, ..
                     } => {
                         match topology::reorder(self.project(), context.owner, occurrence, before) {
-                            Ok(command) => {
-                                if self.execute(command) {
+                            Ok(topology::group_reorder::Plan::Noop) => {}
+                            Ok(topology::group_reorder::Plan::Change(command)) => {
+                                if self.execute(*command) {
                                     self.selected = occurrence;
                                     self.refresh_draft();
                                     return self.reveal_process_selection();

crates/oa-desktop/src/app/process_multiselect.rs

@@ -0,0 +1,260 @@
+//! Exact Process presentation selection and one atomic order transaction.
+use super::*;
+use crate::behavior::topology::group_reorder::{Plan, Prepared};
+use crate::diagram_selection::Selection;
+use crate::diagram_usage::{Surface, Target};
+use multiselect::{Choice, Event};
+
+fn subject(target: &Target) -> Option<Id> {
+    match target {
+        Target::ProcessOccurrence(endpoint) => Some(endpoint.occurrence),
+        Target::ProcessLink(id) | Target::ProcessPreviewLink { relation: id, .. } => Some(*id),
+        _ => None,
+    }
+}
+
+impl App {
+    pub(crate) fn process_preview_primary(&self) -> Option<&Target> {
+        let context = self.topology_context()?;
+        let selection = self.diagram_selection.as_ref()?;
+        if selection.scope() != multiselect::process_context(context).scope {
+            return None;
+        }
+        selection
+            .primary()
+            .filter(|target| subject(target) == Some(self.selected))
+            .filter(|target| match target {
+                Target::ProcessOccurrence(endpoint) => !endpoint.references.is_empty(),
+                Target::ProcessPreviewLink { .. } => true,
+                _ => false,
+            })
+    }
+
+    pub(super) fn reconcile_process_multiselect(&mut self) {
+        let Some(context) = self.topology_context() else {
+            return;
+        };
+        let current = multiselect::process_context(context);
+        let visible = self
+            .behavior
+            .topology
+            .selection_targets(self.project(), context.owner);
+        let old = self
+            .diagram_selection
+            .as_ref()
+            .filter(|s| s.scope() == current.scope)
+            .and_then(Selection::primary)
+            .cloned();
+        let address = self.behavior.topology.selection_address();
+        let focused = self
+            .diagram_focus(Surface::Process(context.owner))
+            .map(|usage| usage.target.clone());
+        let legacy = focused
+            .clone()
+            .or_else(|| {
+                address
+                    .as_ref()
+                    .filter(|a| a.owner == context.owner && a.endpoint.occurrence == self.selected)
+                    .map(|a| Target::ProcessOccurrence(a.endpoint.clone()))
+            })
+            .or_else(|| {
+                visible
+                    .iter()
+                    .find(|target| match target {
+                        Target::ProcessOccurrence(endpoint) => {
+                            endpoint.references.is_empty() && endpoint.occurrence == self.selected
+                        }
+                        Target::ProcessLink(id) => *id == self.selected,
+                        _ => false,
+                    })
+                    .cloned()
+            })
+            .filter(|target| visible.contains(target));
+        let held = old.as_ref().is_some_and(|target| {
+            subject(target) == Some(self.selected)
+                && focused.as_ref().is_none_or(|focused| focused == target)
+                && match target {
+                    Target::ProcessOccurrence(endpoint) if !endpoint.references.is_empty() => {
+                        address
+                            .as_ref()
+                            .is_some_and(|a| a.owner == context.owner && a.endpoint == *endpoint)
+                    }
+                    _ => true,
+                }
+        });
+        let lost = old.as_ref().is_some_and(|target| !visible.contains(target));
+        let selection = self
+            .diagram_selection
+            .get_or_insert_with(|| Selection::new(current.scope));
+        selection.reconcile(current.scope, |target| visible.contains(target));
+        if held || lost {
+            if selection.primary() != old.as_ref() {
+                self.inspect_process_multiselect_primary();
+            }
+        } else if selection.primary() != legacy.as_ref() {
+            if let Some(target) = legacy {
+                selection.replace(target, |t| visible.contains(t));
+            } else {
+                selection.clear();
+            }
+        }
+        if self.process_preview_primary().is_some() {
+            self.draft = None;
+        }
+    }
+
+    pub(super) fn inspect_process_multiselect_primary(&mut self) {
+        let Some(context) = self.topology_context() else {
+            return;
+        };
+        let primary = self
+            .diagram_selection
+            .as_ref()
+            .and_then(Selection::primary)
+            .cloned();
+        self.behavior.topology.clear_context();
+        self.selected = primary.as_ref().and_then(subject).unwrap_or(context.owner);
+        self.selected_node = None;
+        self.selected_bend = None;
+        self.selected_attachment = None;
+        self.diagram_navigation_focus = None;
+        if let Some(Target::ProcessOccurrence(endpoint)) = primary
+            && !endpoint.references.is_empty()
+            && let Ok(resolved) = oa_core::topology_context::TopologyIndex::new(self.project())
+                .resolve(context.owner, &endpoint)
+        {
+            self.behavior.topology.select_context(resolved.address);
+        }
+        self.refresh_draft();
+        if self.process_preview_primary().is_some() {
+            self.draft = None;
+        }
+    }
+
+    pub(super) fn process_multiselect_event(&mut self, event: Event) {
+        let Some(context) = self.topology_context() else {
+            return;
+        };
+        if let Event::Refuse(_, reason) = &event
+            && diagram_removal::enabled(self)
+        {
+            self.status = reason.clone();
+            return;
+        }
+        if !diagram_removal::enabled(self) || !self.behavior.topology.selecting() {
+            self.status =
+                "Finish or cancel the active edit before changing the process selection.".into();
+            return;
+        }
+        let visible = self
+            .behavior
+            .topology
+            .selection_targets(self.project(), context.owner);
+        match event {
+            Event::Choose(_, target, choice) => {
+                if !visible.contains(&target) {
+                    return;
+                }
+                self.reconcile_process_multiselect();
+                let selection = self.diagram_selection.as_mut().unwrap();
+                let valid = |t: &Target| visible.contains(t);
+                match choice {
+                    Choice::Replace => {
+                        selection.replace(target, valid);
+                    }
+                    Choice::Add => {
+                        selection.add(target, valid);
+                    }
+                    Choice::Remove => {
+                        selection.remove(&target);
+                    }
+                    Choice::Toggle => {
+                        selection.toggle(target, valid);
+                    }
+                    Choice::Inspect => {
+                        selection.set_primary(&target);
+                    }
+                }
+                self.inspect_process_multiselect_primary();
+            }
+            Event::Collapse(_, target) => {
+                if !visible.contains(&target) {
+                    return;
+                }
+                self.diagram_selection
+                    .as_mut()
+                    .unwrap()
+                    .replace(target, |t| visible.contains(t));
+                self.inspect_process_multiselect_primary();
+            }
+            Event::Clear(_) => {
+                self.diagram_selection.as_mut().unwrap().clear();
+                self.inspect_process_multiselect_primary();
+            }
+            Event::Refuse(_, reason) => self.status = reason,
+            Event::Hide(_) => {
+                self.status =
+                    "Process cards are model contributions, not placements. Hide is unavailable."
+                        .into()
+            }
+            Event::Move(..) => {
+                self.status =
+                    "Process positions come from their paths. Reorder within one column instead."
+                        .into()
+            }
+            Event::ProcessReorder(snapshot, destination) => {
+                if !snapshot
+                    .targets()
+                    .iter()
+                    .all(|target| visible.contains(target))
+                {
+                    return;
+                }
+                match Prepared::new(self.project(), context.owner, snapshot.targets())
+                    .and_then(|prepared| prepared.plan(destination))
+                {
+                    Ok(Plan::Noop) => {}
+                    Ok(Plan::Change(command)) => {
+                        if self.execute(*command) {
+                            self.inspect_process_multiselect_primary();
+                            self.status = format!(
+                                "Reordered {} contributions · Undo restores their order",
+                                snapshot.targets().len()
+                            );
+                        }
+                    }
+                    Err(error) => self.status = error,
+                }
+            }
+        }
+    }
+
+    /// A no-op must not retire a pending reveal or allocate a history entry.
+    pub(super) fn process_order_noop(&self, message: &Message) -> bool {
+        let Some(context) = self.topology_context() else {
+            return false;
+        };
+        match message {
+            Message::DiagramSelection(Event::ProcessReorder(snapshot, destination)) => {
+                Prepared::new(self.project(), context.owner, snapshot.targets())
+                    .and_then(|prepared| prepared.plan(*destination))
+                    .is_ok_and(|p| matches!(p, Plan::Noop))
+            }
+            Message::TopologyCanvas(crate::behavior::topology::CanvasEvent::Reorder {
+                context: captured,
+                occurrence,
+                before,
+            }) if *captured == context => crate::behavior::topology::reorder(
+                self.project(),
+                context.owner,
+                *occurrence,
+                *before,
+            )
+            .is_ok_and(|p| matches!(p, Plan::Noop)),
+            _ => false,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests;

crates/oa-desktop/src/app/source_rename/tests.rs

@@ -754,76 +754,7 @@ fn invalid_open_retains_accepted_document_but_refuses_alias_rename() {
 }
 
 fn captured_escape(app: &App) -> Vec<Message> {
-    use iced::advanced::{Layout, Shell, layout, subscription, widget};
-    use iced::futures::{StreamExt, stream, task::noop_waker_ref};
-    use iced::keyboard::{self, key::Named};
-    use std::task::{Context as PollContext, Poll};
-    let mut input: iced::Element<'_, (), iced::Theme, ()> =
-        iced::widget::text_input("Source alias", "retained_alias")
-            .on_input(|_| ())
-            .into();
-    let mut tree = widget::Tree::new(input.as_widget());
-    let size = iced::Size::new(300., 40.);
-    let node =
-        input
-            .as_widget_mut()
-            .layout(&mut tree, &(), &layout::Limits::new(iced::Size::ZERO, size));
-    tree.state
-        .downcast_mut::<iced::widget::text_input::State<()>>()
-        .focus();
-    let event = iced::Event::Keyboard(keyboard::Event::KeyPressed {
-        key: keyboard::Key::Named(Named::Escape),
-        modified_key: keyboard::Key::Named(Named::Escape),
-        physical_key: keyboard::key::Physical::Code(keyboard::key::Code::Escape),
-        location: keyboard::Location::Standard,
-        modifiers: keyboard::Modifiers::empty(),
-        text: None,
-        repeat: false,
-    });
-    let mut widget_messages = Vec::new();
-    let mut shell = Shell::new(&mut widget_messages);
-    input.as_widget_mut().update(
-        &mut tree,
-        &event,
-        Layout::new(&node),
-        iced::mouse::Cursor::Unavailable,
-        &(),
-        &mut iced::advanced::clipboard::Null,
-        &mut shell,
-        &iced::Rectangle::new(iced::Point::ORIGIN, size),
-    );
-    assert!(shell.is_event_captured());
-    let event = subscription::Event::Interaction {
-        window: iced::window::Id::unique(),
-        event,
-        status: iced::event::Status::Captured,
-    };
-    let runtime = tokio::runtime::Builder::new_current_thread()
-        .enable_time()
-        .build()
-        .unwrap();
-    let _entered = runtime.enter();
-    let mut messages = Vec::new();
-    let mut keyboard_boundaries = 0;
-    for recipe in subscription::into_recipes(app.subscription()) {
-        let mut output = recipe.stream(Box::pin(stream::iter([event.clone()])));
-        let mut context = PollContext::from_waker(noop_waker_ref());
-        while let Poll::Ready(Some(message)) = output.poll_next_unpin(&mut context) {
-            if matches!(
-                &message,
-                Message::WorkDrag(crate::app::allocation_drag::Event::KeyboardBoundary)
-            ) {
-                keyboard_boundaries += 1;
-            } else {
-                messages.push(message);
-            }
-        }
-    }
-    assert_eq!(
-        keyboard_boundaries, 1,
-        "each key has exactly one passive allocation notification"
-    );
-    messages
+    crate::app::escape::tests::focused_input_messages(app)
 }
 
 #[test]

crates/oa-desktop/src/app/source_symbols/tests.rs

@@ -864,99 +864,11 @@ fn captured_input_subscription_messages(app: &App) -> Vec<Message> {
 }
 
 fn input_subscription_messages(app: &App, focused: bool) -> Vec<Message> {
-    use iced::advanced::{Layout, Shell, layout, subscription, widget};
-    use iced::futures::{StreamExt, stream, task::noop_waker_ref};
-    use iced::keyboard::{self, key::Named};
-    use std::task::{Context, Poll};
-
-    let mut input: iced::Element<'_, (), iced::Theme, ()> =
-        iced::widget::text_input("Find / modal input", "Retain exact text 雨")
-            .on_input(|_| ())
-            .into();
-    let mut tree = widget::Tree::new(input.as_widget());
-    let size = iced::Size::new(300., 40.);
-    let node =
-        input
-            .as_widget_mut()
-            .layout(&mut tree, &(), &layout::Limits::new(iced::Size::ZERO, size));
-    if focused {
-        tree.state
-            .downcast_mut::<iced::widget::text_input::State<()>>()
-            .focus();
-    }
-    let event = iced::Event::Keyboard(keyboard::Event::KeyPressed {
-        key: keyboard::Key::Named(Named::Escape),
-        modified_key: keyboard::Key::Named(Named::Escape),
-        physical_key: keyboard::key::Physical::Code(keyboard::key::Code::Escape),
-        location: keyboard::Location::Standard,
-        modifiers: keyboard::Modifiers::empty(),
-        text: None,
-        repeat: false,
-    });
-    let mut input_messages = Vec::new();
-    let mut shell = Shell::new(&mut input_messages);
-    input.as_widget_mut().update(
-        &mut tree,
-        &event,
-        Layout::new(&node),
-        iced::mouse::Cursor::Unavailable,
-        &(),
-        &mut iced::advanced::clipboard::Null,
-        &mut shell,
-        &iced::Rectangle::new(iced::Point::ORIGIN, size),
-    );
-    let captured = shell.is_event_captured();
-    assert_eq!(captured, focused);
-    assert!(input_messages.is_empty());
-    assert!(
-        !tree
-            .state
-            .downcast_ref::<iced::widget::text_input::State<()>>()
-            .is_focused()
-    );
-    let event = subscription::Event::Interaction {
-        window: iced::window::Id::unique(),
-        event,
-        status: if captured {
-            iced::event::Status::Captured
-        } else {
-            iced::event::Status::Ignored
-        },
-    };
-    let runtime = tokio::runtime::Builder::new_current_thread()
-        .enable_time()
-        .build()
-        .unwrap();
-    let _entered = runtime.enter();
-    let mut messages = Vec::new();
-    let mut keyboard_boundaries = 0;
-    for recipe in subscription::into_recipes(app.subscription()) {
-        let mut output = recipe.stream(Box::pin(stream::iter([event.clone()])));
-        let mut context = Context::from_waker(noop_waker_ref());
-        while let Poll::Ready(Some(message)) = output.poll_next_unpin(&mut context) {
-            assert!(
-                !matches!(message, Message::CheckpointTick),
-                "timer must remain pending"
-            );
-            if matches!(
-                &message,
-                Message::WorkDrag(crate::app::allocation_drag::Event::KeyboardBoundary)
-            ) {
-                keyboard_boundaries += 1;
-            } else {
-                messages.push(message);
-            }
-        }
-    }
-    assert_eq!(
-        keyboard_boundaries, 1,
-        "each key has exactly one passive allocation notification"
-    );
-    messages
+    crate::app::escape::tests::input_messages(app, iced::keyboard::key::Named::Escape, focused)
 }
 
 #[test]
-fn captured_find_and_modal_escape_use_one_actual_subscription_and_preserve_pending_work() {
+fn captured_find_and_modal_escape_use_one_actual_delivery_and_preserve_pending_work() {
     for pending in [false, true] {
         for modal in 0..4 {
             let mut app = fixture();
@@ -1053,7 +965,7 @@ fn captured_find_and_modal_escape_use_one_actual_subscription_and_preserve_pendi
 }
 
 #[test]
-fn captured_subscription_does_not_duplicate_existing_behavior_or_architecture_routes() {
+fn captured_delivery_does_not_duplicate_existing_behavior_or_architecture_routes() {
     let mut app = fixture();
     app.text_workspace.show_drawer(Some(DrawerTab::References));
     let project = app.project().clone();

crates/oa-desktop/src/app/state_diagram_tests.rs

@@ -4,6 +4,8 @@ use super::*;
 mod attachment_escape;
 #[path = "state_bend_tests.rs"]
 mod bends;
+#[path = "state_picker_escape_tests.rs"]
+mod picker_escape;
 use crate::behavior::{
     self,
     state_edit::{self, Context, Endpoint, Event, Tool},

crates/oa-desktop/src/app/state_picker_escape_tests.rs

@@ -0,0 +1,104 @@
+//! The actual State workspace picker, App root and subscriptions.
+use super::*;
+use crate::behavior::canvas_workspace::tests::{Mounted, key};
+use iced::{keyboard::key::Named, mouse};
+
+async fn press_escape(mounted: &mut Mounted, app: &mut App) -> Vec<Message> {
+    let input = key(Named::Escape);
+    let (mut messages, statuses) = mounted.input_with_status(
+        app,
+        std::slice::from_ref(&input),
+        mouse::Cursor::Unavailable,
+    );
+    assert_eq!(
+        statuses,
+        [iced::event::Status::Captured],
+        "the mounted picker must capture Escape before App subscriptions"
+    );
+    crate::app::escape::tests::subscriptions(app, input, statuses[0], &mut messages);
+    for message in messages.iter().cloned() {
+        let task = app.update(message);
+        mounted.perform(app, task).await;
+    }
+    mounted.settle(app).await;
+    messages
+}
+
+#[tokio::test]
+async fn mounted_state_missing_picker_escape_preserves_exact_document_then_reopens_and_places() {
+    let mut f = fixture();
+    let diagram = create_view(&mut f).diagram;
+    let mut project = f.app.project().clone();
+    project
+        .diagrams
+        .get_mut(&diagram)
+        .unwrap()
+        .nodes
+        .retain(|_, node| node.element != f.b);
+    let mut app = App::with_project(project);
+    app.window_size = iced::Size::new(1800., 1100.);
+    send(&mut app, Message::Select(f.a));
+    send(&mut app, Message::Page(Page::Behavior));
+    let choice = Choice {
+        id: diagram,
+        label: app.project().diagrams[&diagram].name.clone(),
+    };
+    send(&mut app, Message::BehaviorDiagram(choice));
+    let mut mounted = Mounted::new(&mut app).await;
+    assert_eq!(state_edit::unplaced(app.project(), diagram), vec![f.b]);
+    // Locate the stable picker slot itself: selection controls may sit between
+    // it and the canvas. The single menu option opens below this slot.
+    let bounds = mounted.geometry(&app).bounds("state-missing-picker");
+    let picker = bounds.center();
+    let option = iced::Point::new(picker.x, bounds.y + bounds.height * 1.5);
+    let before = app.document.snapshot();
+    let original = app.project().clone();
+    let source = app.document.bundle().clone();
+    let selection = (
+        app.selected,
+        app.selected_node,
+        app.behavior.diagram.placement,
+    );
+    let camera = (
+        app.behavior.diagram.zoom,
+        app.behavior.diagram.pan,
+        app.behavior.diagram.fit,
+    );
+    let revision = app.document.revision();
+    let history = (app.document.can_undo(), app.document.can_redo());
+    mounted.click(&mut app, picker).await;
+    assert!(
+        press_escape(&mut mounted, &mut app).await.is_empty(),
+        "open picker owns Escape, not the State canvas or App"
+    );
+    assert!(std::sync::Arc::ptr_eq(&before, &app.document.snapshot()));
+    assert_eq!(app.document.bundle(), &source);
+    assert_eq!(
+        (
+            app.selected,
+            app.selected_node,
+            app.behavior.diagram.placement
+        ),
+        selection
+    );
+    assert_eq!(
+        (
+            app.behavior.diagram.zoom,
+            app.behavior.diagram.pan,
+            app.behavior.diagram.fit
+        ),
+        camera
+    );
+    assert_eq!(app.document.revision(), revision);
+    assert_eq!((app.document.can_undo(), app.document.can_redo()), history);
+    // If Escape left the menu open this click would close it, and the following
+    // option click would fail to place. This checks actual overlay dismissal.
+    mounted.click(&mut app, picker).await;
+    let messages = mounted.click(&mut app, option).await;
+    assert!(messages.iter().any(|message| matches!(message, Message::StateDiagram(Event::Place { element, .. }) if *element == f.b)));
+    assert!(state_edit::unplaced(app.project(), diagram).is_empty());
+    assert_eq!(app.project().elements, original.elements);
+    assert_eq!(app.project().relations, original.relations);
+    let _ = app.update(Message::Undo);
+    assert_eq!(app.document.bundle(), &source);
+}

crates/oa-desktop/src/app/traceability_navigation_tests.rs

@@ -0,0 +1,277 @@
+use super::*;
+use crate::{context_menu::Entry, model_menu, views::traceability::Filter};
+
+fn send(app: &mut App, message: Message) {
+    let _ = app.update(message);
+}
+
+fn fixture() -> (App, Id, Id, Id, Id) {
+    let mut p = Project::empty();
+    let oa = p
+        .add_element(Kind::Activity, Layer::Oa, "Observe", None)
+        .unwrap();
+    let sa = p
+        .add_element(Kind::Function, Layer::Sa, "Detect", None)
+        .unwrap();
+    let mixed = p.ensure_diagram(Layer::Oa);
+    p.diagrams.get_mut(&mixed).unwrap().projection = ProjectionKind::Traceability;
+    p.place(mixed, oa, Position { x: 300., y: 200. });
+    let system = p.ensure_diagram(Layer::Sa);
+    p.place(system, sa, Position { x: 700., y: 200. });
+    oa_core::validate_candidate(&p).unwrap();
+    let mut app = App::with_project(p);
+    app.page = Page::Diagram;
+    app.layer = Layer::Oa;
+    app.active_diagram = Some(mixed);
+    app.selected = oa;
+    app.refresh_draft();
+    app.traceability.filter = Filter::Artifacts;
+    app.traceability.query = "stale artifact query".into();
+    (app, mixed, system, oa, sa)
+}
+
+fn show_action(app: &mut App, element: Id) -> Message {
+    send(app, model_menu::open(element, iced::Point::ORIGIN));
+    model_menu::popup(app)
+        .unwrap()
+        .entries
+        .into_iter()
+        .find_map(|entry| match entry {
+            Entry::Action { label, message, .. } if label == "Show in this diagram" => {
+                Some(message)
+            }
+            _ => None,
+        })
+        .expect("eligible real menu action")
+        .expect("eligible menu action must be enabled")
+}
+
+#[test]
+fn review_layer_traces_resets_inventory_without_applying_property_or_source_drafts() {
+    for source_draft in [false, true] {
+        let (mut app, mixed, _, oa, _) = fixture();
+        if source_draft {
+            send(&mut app, Message::Page(Page::Text));
+            send(
+                &mut app,
+                Message::SourceEdit(iced::widget::text_editor::Action::Edit(
+                    iced::widget::text_editor::Edit::Insert('x'),
+                )),
+            );
+            assert!(app.source_dirty());
+        } else {
+            send(
+                &mut app,
+                Message::Field("/alias".into(), "invalid alias".into()),
+            );
+            assert!(app.draft_dirty());
+        }
+        let raw = serde_json::to_value(app.draft.as_ref().unwrap().recovery_snapshot()).unwrap();
+        let source = app.source_editor.text();
+        let before = app.document.snapshot();
+        let camera = (app.zoom, app.pan);
+        send(&mut app, Message::ReviewLayerTraces);
+        assert_eq!(app.page, Page::Traces);
+        assert_eq!(app.traceability.filter, Filter::Traces);
+        assert!(app.traceability.query.is_empty());
+        assert_eq!(
+            (app.layer, app.active_diagram, app.selected),
+            (Layer::Oa, Some(mixed), oa)
+        );
+        assert_eq!((app.zoom, app.pan), camera);
+        assert_eq!(
+            serde_json::to_value(app.draft.as_ref().unwrap().recovery_snapshot()).unwrap(),
+            raw
+        );
+        assert_eq!(app.source_editor.text(), source);
+        assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+        assert!(!app.document.can_undo());
+    }
+}
+
+#[test]
+fn review_layer_traces_respects_busy_modal_and_active_placement_guards() {
+    for already_traces in [false, true] {
+        for guard in 0..5 {
+            let (mut app, mixed, _, oa, _) = fixture();
+            match guard {
+                0 => app.busy = true,
+                1 => app.delete_pending = true,
+                2 => app.hosted.visible = true,
+                3 => send(
+                    &mut app,
+                    Message::Architecture(architecture_authoring::Event::Existing(None)),
+                ),
+                4 => {
+                    app.page = Page::Behavior;
+                    let p = app.project().clone();
+                    app.behavior
+                        .creation
+                        .update(&p, behavior::creation::Event::Open(Layer::Oa))
+                        .unwrap();
+                    assert!(app.behavior.has_pending());
+                }
+                _ => unreachable!(),
+            }
+            if already_traces {
+                app.page = Page::Traces;
+            }
+            let original_page = app.page;
+            let before = app.document.snapshot();
+            let behavior_before = app.behavior.recovery_snapshot().unwrap();
+            send(&mut app, Message::ReviewLayerTraces);
+            assert_eq!(
+                app.page, original_page,
+                "guard {guard}, already traces {already_traces}"
+            );
+            assert_eq!(app.traceability.filter, Filter::Artifacts);
+            assert_eq!(app.traceability.query, "stale artifact query");
+            assert_eq!(
+                (app.layer, app.active_diagram, app.selected),
+                (Layer::Oa, Some(mixed), oa)
+            );
+            assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+            assert_eq!(app.behavior.recovery_snapshot().unwrap(), behavior_before);
+            if guard == 3 {
+                assert!(app.architecture.is_some());
+            }
+        }
+    }
+}
+
+#[test]
+fn mixed_view_show_keeps_its_context_for_every_diagram_app_and_target_layer() {
+    for diagram_layer in [Layer::Oa, Layer::Sa] {
+        for app_layer in [Layer::Oa, Layer::Sa] {
+            for target_layer in [Layer::Oa, Layer::Sa] {
+                let mut p = Project::empty();
+                let oa = p
+                    .add_element(Kind::Activity, Layer::Oa, "Observe", None)
+                    .unwrap();
+                let sa = p
+                    .add_element(Kind::Function, Layer::Sa, "Detect", None)
+                    .unwrap();
+                let target = if target_layer == Layer::Oa { oa } else { sa };
+                let other = if target_layer == Layer::Oa { sa } else { oa };
+                let mixed = p.ensure_diagram(diagram_layer);
+                p.diagrams.get_mut(&mixed).unwrap().projection = ProjectionKind::Traceability;
+                // An attractive same-layer alternative makes accidental
+                // semantic-selection navigation observable in both directions.
+                let mut alternative = p.diagrams[&mixed].clone();
+                alternative.id = Id::new_v4();
+                alternative.alias = "same_layer_alternative".into();
+                alternative.layer = target_layer;
+                alternative.projection = ProjectionKind::Overview;
+                let alternative_id = alternative.id;
+                p.diagrams.insert(alternative_id, alternative);
+                p.place(alternative_id, target, Position { x: 700., y: 200. });
+                oa_core::validate_candidate(&p).unwrap();
+                let mut app = App::with_project(p);
+                app.page = Page::Diagram;
+                app.layer = app_layer;
+                app.active_diagram = Some(mixed);
+                app.selected = other;
+                app.refresh_draft();
+                let before = app.project().clone();
+                let action = show_action(&mut app, target);
+                send(&mut app, action);
+                // The existing RevealInDiagram action synchronizes the layer
+                // to the captured view, even if the prior perspective differed.
+                assert_eq!(
+                    (app.active_diagram, app.layer, app.selected),
+                    (Some(mixed), diagram_layer, target)
+                );
+                let added = app.project().diagrams[&mixed]
+                    .nodes
+                    .values()
+                    .find(|n| n.element == target)
+                    .unwrap()
+                    .clone();
+                assert_eq!(app.selected_node, Some(added.id));
+                let mut expected = before;
+                expected
+                    .diagrams
+                    .get_mut(&mixed)
+                    .unwrap()
+                    .nodes
+                    .insert(added.id, added);
+                assert_eq!(app.project(), &expected);
+            }
+        }
+    }
+}
+
+#[test]
+fn mixed_view_show_menu_places_in_captured_view_with_exact_undo_redo() {
+    let (mut app, mixed, system, _, sa) = fixture();
+    let before = app.document.snapshot();
+    let action = show_action(&mut app, sa);
+    send(&mut app, action);
+    assert_eq!(
+        (app.active_diagram, app.layer, app.selected),
+        (Some(mixed), Layer::Oa, sa)
+    );
+    let added = app.project().diagrams[&mixed]
+        .nodes
+        .values()
+        .find(|n| n.element == sa)
+        .unwrap()
+        .clone();
+    assert_eq!(added.position, Position { x: 60., y: 60. });
+    let mut expected = before.decoded.project.clone();
+    expected
+        .diagrams
+        .get_mut(&mixed)
+        .unwrap()
+        .nodes
+        .insert(added.id, added);
+    assert_eq!(app.project(), &expected);
+    assert_eq!(
+        app.project().diagrams[&system],
+        before.decoded.project.diagrams[&system]
+    );
+    let after = app.document.snapshot();
+    send(&mut app, Message::Undo);
+    assert_eq!(app.project(), &before.decoded.project);
+    assert_eq!(app.document.bundle(), &before.bundle);
+    assert!(!app.document.can_undo());
+    send(&mut app, Message::Redo);
+    assert_eq!(app.project(), &after.decoded.project);
+    assert_eq!(app.document.bundle(), &after.bundle);
+}
+
+#[test]
+fn mixed_view_show_menu_rejects_stale_context_and_pending_property_changes() {
+    for refusal in 0..3 {
+        let (mut app, mixed, system, oa, sa) = fixture();
+        let action = show_action(&mut app, sa);
+        match refusal {
+            0 => app.active_diagram = Some(system),
+            1 => app.canvas_epoch = app.canvas_epoch.wrapping_add(1),
+            2 => {
+                // A queued action must not apply a draft that became dirty
+                // after the menu was rendered, even when its context is valid.
+                app.draft
+                    .as_mut()
+                    .unwrap()
+                    .input("/name", "Unapplied name".into());
+                assert!(app.draft_dirty());
+            }
+            _ => unreachable!(),
+        }
+        let before = app.document.snapshot();
+        let raw = serde_json::to_value(app.draft.as_ref().unwrap().recovery_snapshot()).unwrap();
+        send(&mut app, action);
+        assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+        assert_eq!(app.selected, oa);
+        assert_eq!(
+            app.active_diagram,
+            Some(if refusal == 0 { system } else { mixed })
+        );
+        assert_eq!(
+            serde_json::to_value(app.draft.as_ref().unwrap().recovery_snapshot()).unwrap(),
+            raw
+        );
+        assert!(!app.document.can_undo());
+    }
+}

crates/oa-desktop/src/behavior/canvas_workspace.rs

@@ -16,6 +16,7 @@ pub fn keyboard_enabled(app: &crate::app::App) -> bool {
 /// Passive I/O suspends commands without changing the logical input owner.
 pub(crate) fn keyboard_owner_enabled(app: &crate::app::App) -> bool {
     !app.hosted.visible
+        && !app.context_help
         && app.workflow.is_none()
         && app.file_prompt.is_none()
         && !app.delete_pending

crates/oa-desktop/src/behavior/canvas_workspace/viewport.rs

@@ -15,6 +15,7 @@ struct Input {
     pan: Option<(mouse::Button, Point)>,
     space: bool,
     bounds: Option<Rectangle>,
+    modifiers: keyboard::Modifiers,
 }
 impl operation::Focusable for Input {
     fn is_focused(&self) -> bool {
@@ -83,7 +84,11 @@ impl<Message, R: renderer::Renderer> Widget<Message, Theme, R> for Viewport<'_,
             (s.document, s.owner, s.revision)
                 != (self.scope.document, self.scope.owner, self.scope.revision)
         }) {
-            *state = Input::default();
+            let modifiers = state.modifiers;
+            *state = Input {
+                modifiers,
+                ..Input::default()
+            };
         }
         if state
             .scope
@@ -143,10 +148,29 @@ impl<Message, R: renderer::Renderer> Widget<Message, Theme, R> for Viewport<'_,
         shell: &mut Shell<'_, Message>,
         viewport: &Rectangle,
     ) {
+        let state = tree.state.downcast_mut::<Input>();
+        if let Event::Keyboard(keyboard::Event::ModifiersChanged(modifiers)) = event {
+            // Physical modifiers outlive focus, busy-state child replacement,
+            // and semantic revisions. Observing these emits no camera command.
+            state.modifiers = *modifiers;
+            self.content.as_widget_mut().update(
+                &mut tree.children[0],
+                event,
+                layout,
+                cursor,
+                renderer,
+                clipboard,
+                shell,
+                viewport,
+            );
+            return;
+        }
+        if matches!(event, Event::Window(iced::window::Event::Unfocused)) {
+            state.modifiers = keyboard::Modifiers::default();
+        }
         if shell.is_event_captured() {
             return;
         }
-        let state = tree.state.downcast_mut::<Input>();
         // A traversal operation is applied after this Iced event batch. Keep
         // its focus witness, but retire keyboard admission immediately.
         if state.focus_pending && matches!(event, Event::Keyboard(_)) {
@@ -334,6 +358,20 @@ impl<Message, R: renderer::Renderer> Widget<Message, Theme, R> for Viewport<'_,
         } else {
             mouse::Cursor::Unavailable
         };
+        if matches!(event, Event::Mouse(mouse::Event::ButtonPressed(_))) {
+            // A canvas may have been rebuilt while focus/commands were denied.
+            // Restore held (or released) Shift before this new pointer gesture.
+            self.content.as_widget_mut().update(
+                &mut tree.children[0],
+                &Event::Keyboard(keyboard::Event::ModifiersChanged(state.modifiers)),
+                layout,
+                child_cursor,
+                renderer,
+                clipboard,
+                shell,
+                viewport,
+            );
+        }
         self.content.as_widget_mut().update(
             &mut tree.children[0],
             event,

crates/oa-desktop/src/behavior/creation.rs

@@ -10,32 +10,6 @@ use serde::{Deserialize, Serialize};
 const PAGE_SIZE: usize = 6;
 pub const NAME_INPUT: &str = "behavior-creation-name";
 
-// A focused text input consumes Escape. Preserve the application's modal
-// priority by emitting its ordinary Escape message from this narrow bridge.
-pub fn subscription(active: bool) -> iced::Subscription<()> {
-    if active {
-        iced::event::listen_with(captured_escape)
-    } else {
-        iced::Subscription::none()
-    }
-}
-
-fn captured_escape(
-    event: iced::Event,
-    status: iced::event::Status,
-    _: iced::window::Id,
-) -> Option<()> {
-    (status == iced::event::Status::Captured
-        && matches!(
-            event,
-            iced::Event::Keyboard(iced::keyboard::Event::KeyPressed {
-                key: iced::keyboard::Key::Named(iced::keyboard::key::Named::Escape),
-                ..
-            })
-        ))
-    .then_some(())
-}
-
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 pub enum Family {
     Sequence,

crates/oa-desktop/src/behavior/creation/app_tests.rs

@@ -18,59 +18,11 @@ fn begin(app: &mut App, layer: Layer, family: Family, name: &str) {
     send(app, Event::Name(name.into()));
 }
 
-fn focused_escape() -> Message {
-    use iced::advanced::{Layout, Shell, layout, widget};
-    use iced::keyboard::{self, key::Named};
-    let mut input: iced::Element<'_, (), iced::Theme, ()> = text_input("Name", "Unfinished name")
-        .id(NAME_INPUT)
-        .on_input(|_| ())
-        .into();
-    let mut tree = widget::Tree::new(input.as_widget());
-    let size = iced::Size::new(300., 40.);
-    let node =
-        input
-            .as_widget_mut()
-            .layout(&mut tree, &(), &layout::Limits::new(iced::Size::ZERO, size));
-    tree.state
-        .downcast_mut::<iced::widget::text_input::State<()>>()
-        .focus();
-    let event = iced::Event::Keyboard(keyboard::Event::KeyPressed {
-        key: keyboard::Key::Named(Named::Escape),
-        modified_key: keyboard::Key::Named(Named::Escape),
-        physical_key: keyboard::key::Physical::Code(keyboard::key::Code::Escape),
-        location: keyboard::Location::Standard,
-        modifiers: keyboard::Modifiers::empty(),
-        text: None,
-        repeat: false,
-    });
-    let mut messages = Vec::new();
-    let mut shell = Shell::new(&mut messages);
-    input.as_widget_mut().update(
-        &mut tree,
-        &event,
-        Layout::new(&node),
-        iced::mouse::Cursor::Unavailable,
-        &(),
-        &mut iced::advanced::clipboard::Null,
-        &mut shell,
-        &iced::Rectangle::new(iced::Point::ORIGIN, size),
-    );
-    assert!(shell.is_event_captured());
-    assert_eq!(
-        captured_escape(
-            event.clone(),
-            iced::event::Status::Ignored,
-            iced::window::Id::unique()
-        ),
-        None
-    );
-    captured_escape(
-        event,
-        iced::event::Status::Captured,
-        iced::window::Id::unique(),
-    )
-    .unwrap();
-    Message::Escape
+fn focused_escape(app: &App) -> Message {
+    let mut messages = crate::app::escape::tests::focused_input_messages(app);
+    assert_eq!(messages.len(), 1);
+    assert!(matches!(messages[0], Message::Escape));
+    messages.remove(0)
 }
 
 #[test]
@@ -94,12 +46,12 @@ fn app_first_captured_escape_dismisses_file_or_pending_overlay_before_creation()
         } else {
             app.pending = Some(Pending::Walkthrough);
         }
-        let _ = app.update(focused_escape());
+        let _ = app.update(focused_escape(&app));
         assert!(app.file_prompt.is_none());
         assert!(app.pending.is_none());
         assert_eq!(app.behavior.recovery_snapshot().unwrap(), raw);
         assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
-        let _ = app.update(focused_escape());
+        let _ = app.update(focused_escape(&app));
         assert!(!app.behavior.has_pending());
         assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
         assert!(!app.document.can_undo());

crates/oa-desktop/src/behavior/scenario/workspace/tests.rs

@@ -3,6 +3,58 @@ use crate::behavior::canvas_workspace::tests::{Geometry, Mounted};
 use iced::Vector;
 use iced::advanced::{Layout, layout, widget};
 
+#[tokio::test]
+async fn production_scenario_passive_modifiers_do_not_acquire_keyboard_focus_or_mutate_model() {
+    use crate::behavior::canvas_workspace::tests::{focused, key};
+    let f = super::super::direct_tests::fixture();
+    let mut app = App::with_project(f.project.clone());
+    let _ = app.update(Message::Select(f.owner));
+    let _ = app.update(Message::Page(crate::app::Page::Behavior));
+    app.window_size = Size::new(1100., 700.);
+    let mut mounted = Mounted::new(&mut app).await;
+    let bounds = mounted.geometry(&app).bounds("scenario-viewport");
+    let point = bounds.position() + Vector::new(50., 50.);
+    let camera = app.behavior.scenario.camera_boundary();
+    let source = app.document.bundle().clone();
+    let shift = |held| {
+        iced::Event::Keyboard(iced::keyboard::Event::ModifiersChanged(if held {
+            iced::keyboard::Modifiers::SHIFT
+        } else {
+            iced::keyboard::Modifiers::empty()
+        }))
+    };
+    for busy in [false, true, false] {
+        app.busy = busy;
+        mounted.settle(&mut app).await;
+        let messages = mounted
+            .batch(
+                &mut app,
+                &[
+                    shift(true),
+                    shift(false),
+                    key(iced::keyboard::key::Named::ArrowRight),
+                ],
+                mouse::Cursor::Available(point),
+            )
+            .await;
+        assert!(
+            !messages
+                .iter()
+                .any(|message| matches!(message, Message::ScenarioCanvas(_)))
+        );
+        assert!(!focused(&mut mounted, &app, "viewport"));
+        assert!(app.behavior.scenario.camera_boundary() == camera);
+        assert_eq!(app.document.bundle(), &source);
+    }
+    mounted
+        .pan(&mut app, point, point + Vector::new(-15., 25.))
+        .await;
+    assert!(app.behavior.scenario.camera_boundary() != camera);
+    assert_eq!(app.document.bundle(), &source);
+    assert!(!app.document.can_undo());
+    assert_eq!(mounted.geometry(&app).bounds("scenario-viewport"), bounds);
+}
+
 #[tokio::test]
 async fn production_scenario_canvas_keeps_bounds_draft_identity_and_camera_through_editing() {
     use crate::behavior::canvas_workspace::{self, tests::Mounted};

crates/oa-desktop/src/behavior/state_canvas.rs

@@ -1497,7 +1497,9 @@ impl StateCanvas<'_> {
                         format!("{} · {} · right-click to edit", r.name, routing::state_transition_summary(self.project, r))
                     }
                 }).unwrap_or_default(),
-                _ => "Select / move · drag a vertex · drag selected transition endpoints to reconnect · middle-drag to pan".into(),
+                // General gestures are available in Help; keep this stable slot
+                // for the active operation or the item under the pointer.
+                _ => String::new(),
             },
         }
     }

crates/oa-desktop/src/behavior/state_view.rs

@@ -187,7 +187,7 @@ pub fn view<'a>(app: &'a App, machine: Id, mut out: Column<'a, Message>) -> Elem
     .into();
     out = out.push(
         column![
-            missing_controls,
+            container(missing_controls).id("state-missing-picker"),
             selection_controls(app),
             crate::diagram::focus::wrap(
                 canvas.map(event),
@@ -225,13 +225,13 @@ fn selection_controls(app: &App) -> Element<'_, Message> {
         }
         controls = controls
             .push(action(
-                "Clear selection",
+                "Clear",
                 Message::DiagramSelection(SelectionEvent::Clear(snapshot.context())),
             ))
             .push(
                 label(format!(
-                    "Properties edit only {}",
-                    crate::views::short(app.project().named(app.selected), 18)
+                    "Properties: {} only",
+                    crate::views::short(app.project().named(app.selected), 10)
                 ))
                 .wrapping(iced::widget::text::Wrapping::None),
             );
@@ -241,12 +241,12 @@ fn selection_controls(app: &App) -> Element<'_, Message> {
     } else {
         "Use Select / move to select multiple elements"
     };
-    column![
-        controls,
-        label(hint).wrapping(iced::widget::text::Wrapping::None)
-    ]
-    .height(56)
-    .into()
+    controls
+        .push(crate::views::diagram_help(
+            crate::guide::Topic::States,
+            hint,
+        ))
+        .into()
 }
 
 fn transition_details(machine: Id, selected: Id) -> Element<'static, Message> {

crates/oa-desktop/src/behavior/topology.rs

@@ -5,8 +5,11 @@ use iced::widget::{Column, text_input};
 use std::collections::BTreeSet;
 pub(crate) mod contextual;
 mod direct;
+pub(crate) mod group_reorder;
 mod usages;
 mod view;
+#[cfg(test)]
+pub(crate) use direct::End;
 use direct::Input;
 pub(crate) use direct::{
     CanvasEvent, CanvasTool, Context, Insertion, reconnect, referenced, reorder,
@@ -909,6 +912,53 @@ fn sequence_links(p: &Project, owner: Id) -> Vec<&Relation> {
         })
         .collect()
 }
+
+/// Integer columns shared by rendering and order planning. Edges whose endpoints
+/// are absent from the displayed order cannot participate in its layout.
+fn column_ranks(order: &[Id], adjacency: &[(Id, Id)]) -> BTreeMap<Id, usize> {
+    let ids: BTreeSet<_> = order.iter().copied().collect();
+    let adjacency: Vec<_> = adjacency
+        .iter()
+        .copied()
+        .filter(|(source, target)| ids.contains(source) && ids.contains(target))
+        .collect();
+    let mut incoming: BTreeMap<_, usize> = ids.iter().map(|id| (*id, 0)).collect();
+    let mut ranks: BTreeMap<_, usize> = ids.iter().map(|id| (*id, 0)).collect();
+    for &(_, target) in &adjacency {
+        *incoming.get_mut(&target).expect("Displayed endpoint") += 1;
+    }
+    let mut queue: Vec<_> = order
+        .iter()
+        .copied()
+        .filter(|id| incoming[id] == 0)
+        .collect();
+    let mut done = BTreeSet::new();
+    let mut offset = 0;
+    while offset < queue.len() {
+        let id = queue[offset];
+        offset += 1;
+        if !done.insert(id) {
+            continue;
+        }
+        for &(_, next) in adjacency.iter().filter(|(source, _)| *source == id) {
+            ranks.insert(next, ranks[&next].max(ranks[&id] + 1));
+            let count = incoming.get_mut(&next).expect("Displayed endpoint");
+            *count = count.saturating_sub(1);
+            if *count == 0 {
+                queue.push(next);
+            }
+        }
+    }
+    // Preserve deterministic fallback order for loops and cycle-blocked nodes.
+    let mut fallback = ranks.values().copied().max().unwrap_or(0) + 1;
+    for id in order {
+        if !done.contains(id) {
+            ranks.insert(*id, fallback);
+            fallback += 1;
+        }
+    }
+    ranks
+}
 #[derive(Debug, Clone, PartialEq, Eq)]
 struct PreviewLink {
     relation: Id,
@@ -1066,6 +1116,7 @@ struct Graph<'a> {
     selected: Id,
     selected_preview: Option<OccurrenceEndpoint>,
     selected_preview_link: Option<PreviewLink>,
+    selection: Option<crate::diagram_selection::Snapshot>,
     scale: f32,
 }
 impl<'a> Graph<'a> {
@@ -1084,50 +1135,19 @@ impl<'a> Graph<'a> {
     ) -> Self {
         let context_index = oa_core::topology_context::TopologyIndex::new(p);
         let choices = contributions(p, owner);
-        let links = sequence_links(p, owner);
+        let displayed: BTreeSet<_> = choices.iter().map(|choice| choice.id).collect();
+        let links: Vec<_> = sequence_links(p, owner)
+            .into_iter()
+            .filter(|link| displayed.contains(&link.source()) && displayed.contains(&link.target()))
+            .collect();
         let order = legacy_order(p, owner);
         let adjacency: Vec<_> = links
             .iter()
             .map(|r| (r.source(), r.target()))
             .chain(order.windows(2).map(|pair| (pair[0], pair[1])))
             .collect();
-        let ids: BTreeSet<_> = choices.iter().map(|c| c.id).collect();
-        let mut incoming: BTreeMap<_, usize> = ids.iter().map(|id| (*id, 0)).collect();
-        let mut ranks: BTreeMap<_, usize> = ids.iter().map(|id| (*id, 0)).collect();
-        for &(_, target) in &adjacency {
-            *incoming.entry(target).or_default() += 1;
-        }
-        let mut queue: Vec<_> = choices
-            .iter()
-            .filter(|c| incoming[&c.id] == 0)
-            .map(|c| c.id)
-            .collect();
-        let mut done = BTreeSet::new();
-        let mut offset = 0;
-        while offset < queue.len() {
-            let id = queue[offset];
-            offset += 1;
-            if !done.insert(id) {
-                continue;
-            }
-            for &(_, next) in adjacency.iter().filter(|(source, _)| *source == id) {
-                ranks.insert(next, ranks[&next].max(ranks[&id] + 1));
-                let count = incoming.get_mut(&next).expect("Graph endpoint");
-                *count = count.saturating_sub(1);
-                if *count == 0 {
-                    queue.push(next);
-                }
-            }
-        }
-        // Cycles remain explicit edges; deterministic fallback placement must
-        // terminate even while users are building a loop or incomplete graph.
-        let mut fallback = ranks.values().copied().max().unwrap_or(0) + 1;
-        for c in &choices {
-            if !done.contains(&c.id) {
-                ranks.insert(c.id, fallback);
-                fallback += 1;
-            }
-        }
+        let displayed_order: Vec<_> = choices.iter().map(|choice| choice.id).collect();
+        let ranks = column_ranks(&displayed_order, &adjacency);
         let mut rows: BTreeMap<usize, f32> = BTreeMap::new();
         let mut nodes = vec![];
         let mut size: Size = Size::new(640., 220.);
@@ -1238,25 +1258,17 @@ impl<'a> Graph<'a> {
         }
         let ordered_paths = order
             .windows(2)
-            .map(|pair| {
-                let a = nodes
-                    .iter()
-                    .find(|n| n.id == pair[0])
-                    .expect("ordered source")
-                    .rect;
-                let b = nodes
-                    .iter()
-                    .find(|n| n.id == pair[1])
-                    .expect("ordered target")
-                    .rect;
-                OrderedPath {
+            .filter_map(|pair| {
+                let a = nodes.iter().find(|n| n.id == pair[0])?.rect;
+                let b = nodes.iter().find(|n| n.id == pair[1])?.rect;
+                Some(OrderedPath {
                     source: pair[0],
                     target: pair[1],
                     points: vec![
                         Point::new(a.x + a.width, a.center_y()),
                         Point::new(b.x, b.center_y()),
                     ],
-                }
+                })
             })
             .collect();
         let mut edges = vec![];
@@ -1400,6 +1412,7 @@ impl<'a> Graph<'a> {
             selected,
             selected_preview: None,
             selected_preview_link: None,
+            selection: None,
             scale: 1.,
         }
     }
@@ -1518,9 +1531,16 @@ impl canvas::Program<Message> for Graph<'_> {
                                 EdgeLayer::Contextual
                             }
                     }) {
-                        let selected = e.id == self.selected
-                            || e.source == self.selected
-                            || e.target == self.selected;
+                        let selected = self.selection.as_ref().map_or(
+                            e.id == self.selected
+                                || e.source == self.selected
+                                || e.target == self.selected,
+                            |selection| {
+                                selection
+                                    .targets()
+                                    .contains(&crate::diagram_usage::Target::ProcessLink(e.id))
+                            },
+                        );
                         if e.incidence {
                             f.stroke(
                                 &Path::new(|path| {

crates/oa-desktop/src/behavior/topology/direct.rs

@@ -1,5 +1,7 @@
 //! Local pointer state and ordinary command proposals for the derived process graph.
 use super::*;
+#[path = "direct_selection.rs"]
+mod selection;
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub struct Context {
@@ -445,27 +447,23 @@ pub(crate) fn reconnect(
     execute_batch(p, std::slice::from_ref(&command)).map_err(|e| e.to_string())?;
     Ok(command)
 }
-pub(crate) fn reorder(p: &Project, owner: Id, id: Id, before: Id) -> Result<Command, String> {
-    if !is_contribution(p, owner, id) || !is_contribution(p, owner, before) {
-        return Err("Reorder contributions in this process only.".into());
-    }
-    let graph = Graph::new(p, owner, id);
-    let position = |id| graph.nodes.iter().find(|n| n.id == id).map(|n| n.rect.x);
-    if position(id) != position(before) {
-        return Err("Reorder within this column; links determine the path columns.".into());
-    }
-    let mut steps = p.elements[&owner].steps().unwrap().clone();
-    if id != before {
-        steps.retain(|v| *v != id);
-        let index = steps
-            .iter()
-            .position(|v| *v == before)
-            .ok_or("This slot no longer exists.")?;
-        steps.insert(index, id);
-    }
-    let command = Command::SetSteps(owner, steps);
-    execute_batch(p, std::slice::from_ref(&command)).map_err(|e| e.to_string())?;
-    Ok(command)
+pub(crate) fn reorder(
+    p: &Project,
+    owner: Id,
+    id: Id,
+    before: Id,
+) -> Result<super::group_reorder::Plan, String> {
+    super::group_reorder::Prepared::new(
+        p,
+        owner,
+        &[crate::diagram_usage::Target::ProcessOccurrence(
+            OccurrenceEndpoint {
+                references: vec![],
+                occurrence: id,
+            },
+        )],
+    )?
+    .plan(super::group_reorder::Destination::Before(before))
 }
 
 #[derive(Default)]
@@ -476,6 +474,8 @@ pub(super) struct Input {
     bounds: Option<Rectangle>,
     source: Option<Id>,
     press: Option<Press>,
+    modifiers: iced::keyboard::Modifiers,
+    group: Option<selection::GroupPress>,
 }
 #[derive(Clone, Copy)]
 enum Press {
@@ -504,6 +504,7 @@ impl Input {
     fn cancel(&mut self) {
         self.source = None;
         self.press = None;
+        self.group = None;
     }
 }
 impl Graph<'_> {
@@ -592,6 +593,9 @@ impl Graph<'_> {
         bounds: Rectangle,
         cursor: mouse::Cursor,
     ) -> Option<Action<Message>> {
+        if let Some(action) = self.selection_input(state, event, bounds, cursor) {
+            return Some(action);
+        }
         let (context, tool, editable) = self
             .interaction
             .map_or((None, CanvasTool::Select, false), |(c, t, e)| {
@@ -835,6 +839,7 @@ impl Graph<'_> {
         cursor: mouse::Cursor,
         bounds: Rectangle,
     ) {
+        self.selection_overlay(state, f, bounds);
         let Some((context, tool, editable)) = self.interaction else {
             return;
         };
@@ -935,7 +940,12 @@ impl Graph<'_> {
                 );
             }
         }
-        if tool == CanvasTool::Select {
+        if tool == CanvasTool::Select
+            && self
+                .selection
+                .as_ref()
+                .is_none_or(|s| s.targets().len() == 1)
+        {
             if let Some(r) = self.handle(self.selected) {
                 f.fill_rectangle(r.position(), r.size(), Color::WHITE);
                 draw_text(f, "↕".into(), r.position(), 17., style::TEAL);

crates/oa-desktop/src/behavior/topology/direct_selection.rs

@@ -0,0 +1,474 @@
+//! Exact-target selection and an order gesture over one immutable selection.
+use super::super::group_reorder::{Destination, Plan, Prepared};
+use super::*;
+use crate::app::multiselect::{Choice, Event as SelectionEvent, process_context};
+use crate::diagram_selection::Snapshot;
+use crate::diagram_usage::Target;
+
+pub(super) struct GroupPress {
+    snapshot: Snapshot,
+    target: Target,
+    start: Point,
+    bounds: Rectangle,
+    pan: iced::Vector,
+    scale: f32,
+    crossed: bool,
+    retired: bool,
+    prepared: Result<Prepared, String>,
+    destination: Option<Destination>,
+    plan: Option<Result<Plan, String>>,
+}
+
+impl Graph<'_> {
+    fn exact_target_at(&self, point: Point) -> Option<Target> {
+        // Visible singleton reconnect rings are painted over the card/edge.
+        // Shift and context selection must resolve that same topmost target.
+        if self.interaction.is_some_and(|(_, tool, editable)| editable && tool == CanvasTool::Select)
+            && self.selection.as_ref().is_some_and(|snapshot| {
+                snapshot.targets().len() == 1
+                    && matches!(snapshot.primary(), Some(Target::ProcessLink(id)) if *id == self.selected)
+            })
+            && let Some((link, _)) = self.endpoint_at(point)
+        {
+            return Some(Target::ProcessLink(link));
+        }
+        if let Some(endpoint) = self.qualified_at(point) {
+            return Some(Target::ProcessOccurrence(endpoint));
+        }
+        for node in &self.nodes {
+            for link in &node.preview_links {
+                if node
+                    .preview_link_visible_segment(link)
+                    .is_some_and(|[a, b]| {
+                        crate::diagram::distance_to_segment(point, a, b) < 5. / self.scale
+                    })
+                {
+                    return Some(Target::ProcessPreviewLink {
+                        relation: link.relation,
+                        source: link.source.clone(),
+                        target: link.target.clone(),
+                    });
+                }
+            }
+        }
+        self.contextual_edge_at(point)
+            .map(Target::ProcessLink)
+            .or_else(|| {
+                self.node_at(point).map(|id| {
+                    Target::ProcessOccurrence(OccurrenceEndpoint {
+                        references: vec![],
+                        occurrence: id,
+                    })
+                })
+            })
+            .or_else(|| self.edge_at(point).map(Target::ProcessLink))
+    }
+
+    fn destination_at(&self, point: Point) -> Option<Destination> {
+        let id = self.node_at(point)?;
+        let node = self.nodes.iter().find(|n| n.id == id)?;
+        Some(if point.y < node.rect.center_y() {
+            Destination::Before(id)
+        } else {
+            Destination::After(id)
+        })
+    }
+
+    fn update_group(&self, group: &mut GroupPress, pointer: Point) {
+        if group.retired {
+            return;
+        }
+        if !pointer.x.is_finite() || !pointer.y.is_finite() || !group.bounds.contains(pointer) {
+            group.retired = true;
+            group.plan = None;
+            return;
+        }
+        group.crossed |= pointer.distance(group.start) >= 3.;
+        let world = Point::new(
+            (pointer.x - group.bounds.x - self.camera_pan.x) / self.scale,
+            (pointer.y - group.bounds.y - self.camera_pan.y) / self.scale,
+        );
+        let destination = self.destination_at(world);
+        // The captured semantic facts are prepared once. Only a changed object
+        // anchor/side needs another order plan; motion within a slot is free.
+        if destination != group.destination {
+            group.destination = destination;
+            group.plan = destination.map(|destination| match &group.prepared {
+                Ok(prepared) => prepared.plan(destination),
+                Err(reason) => Err(reason.clone()),
+            });
+        }
+    }
+
+    pub(super) fn selection_input(
+        &self,
+        state: &mut Input,
+        event: &canvas::Event,
+        bounds: Rectangle,
+        cursor: mouse::Cursor,
+    ) -> Option<Action<Message>> {
+        use iced::keyboard::{Event as KeyEvent, Key, key::Named};
+        match event {
+            canvas::Event::Keyboard(KeyEvent::ModifiersChanged(modifiers))
+            | canvas::Event::Keyboard(KeyEvent::KeyPressed { modifiers, .. })
+            | canvas::Event::Keyboard(KeyEvent::KeyReleased { modifiers, .. }) => {
+                state.modifiers = *modifiers
+            }
+            canvas::Event::Window(iced::window::Event::Unfocused) => {
+                state.modifiers = iced::keyboard::Modifiers::empty()
+            }
+            _ => {}
+        }
+        let Some((context, tool, editable)) = self.interaction else {
+            state.group = None;
+            return None;
+        };
+        let snapshot = self
+            .selection
+            .as_ref()
+            .filter(|s| s.context() == process_context(context));
+        if let Some(group) = &state.group {
+            let cancelled = !editable
+                || tool != CanvasTool::Select
+                || snapshot != Some(&group.snapshot)
+                || group.bounds != bounds
+                || group.pan != self.camera_pan
+                || group.scale != self.scale
+                || matches!(
+                    event,
+                    canvas::Event::Window(
+                        iced::window::Event::Unfocused | iced::window::Event::Resized(_)
+                    ) | canvas::Event::Mouse(
+                        mouse::Event::CursorLeft
+                            | mouse::Event::WheelScrolled { .. }
+                            | mouse::Event::ButtonPressed(
+                                mouse::Button::Right | mouse::Button::Middle
+                            )
+                    ) | canvas::Event::Keyboard(KeyEvent::KeyPressed {
+                        key: Key::Named(Named::Escape),
+                        ..
+                    })
+                );
+            if cancelled {
+                state.cancel();
+                state.pointer = None;
+                return Some(Action::request_redraw().and_capture());
+            }
+        }
+        if let Some(group) = &mut state.group {
+            match event {
+                canvas::Event::Mouse(mouse::Event::CursorMoved { position }) => {
+                    state.pointer = Some(*position);
+                    self.update_group(group, *position);
+                    return Some(Action::request_redraw().and_capture());
+                }
+                canvas::Event::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left)) => {
+                    let mut group = state.group.take().unwrap();
+                    // An unavailable cursor must never reuse the last inside point.
+                    if let Some(pointer) = cursor.position() {
+                        self.update_group(&mut group, pointer);
+                    } else {
+                        group.retired = true;
+                    }
+                    let result = if group.retired {
+                        None
+                    } else if !group.crossed {
+                        Some(SelectionEvent::Collapse(group.snapshot, group.target))
+                    } else if let Err(reason) = group.prepared {
+                        Some(SelectionEvent::Refuse(group.snapshot, reason))
+                    } else {
+                        match (group.destination, group.plan) {
+                            (Some(destination), Some(Ok(Plan::Change(_)))) => {
+                                Some(SelectionEvent::ProcessReorder(group.snapshot, destination))
+                            }
+                            (_, Some(Err(reason))) => {
+                                Some(SelectionEvent::Refuse(group.snapshot, reason))
+                            }
+                            _ => None,
+                        }
+                    };
+                    return Some(
+                        result
+                            .map_or_else(Action::request_redraw, |event| {
+                                Action::publish(Message::DiagramSelection(event))
+                            })
+                            .and_capture(),
+                    );
+                }
+                canvas::Event::Keyboard(iced::keyboard::Event::ModifiersChanged(_)) => return None,
+                canvas::Event::Keyboard(_) => return Some(Action::capture()),
+                _ => {}
+            }
+        }
+        let snapshot = snapshot?;
+        if !editable {
+            return None;
+        }
+        let publish = |event| Some(Action::publish(Message::DiagramSelection(event)).and_capture());
+        if matches!(
+            event,
+            canvas::Event::Keyboard(KeyEvent::KeyPressed {
+                key: Key::Named(Named::Delete),
+                repeat: false,
+                ..
+            })
+        ) && (snapshot.targets().len() > 1
+            || snapshot.targets().iter().any(|t| match t {
+                Target::ProcessPreviewLink { .. } => true,
+                Target::ProcessOccurrence(endpoint) => !endpoint.references.is_empty(),
+                _ => false,
+            }))
+        {
+            return publish(SelectionEvent::Refuse(snapshot.clone(), "Remove is unavailable for this selection. Open the referenced definition to edit qualified contributions; group removal needs an aggregate review.".into()));
+        }
+        let pointer = match event {
+            canvas::Event::Mouse(mouse::Event::CursorMoved { position }) => Some(*position),
+            _ => cursor.position().and(state.pointer.or(cursor.position())),
+        }?;
+        if !bounds.contains(pointer) {
+            return None;
+        }
+        let world = Point::new(
+            (pointer.x - bounds.x - self.camera_pan.x) / self.scale,
+            (pointer.y - bounds.y - self.camera_pan.y) / self.scale,
+        );
+        if matches!(
+            event,
+            canvas::Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Right))
+        ) {
+            state.cancel();
+            let target = self.exact_target_at(world)?;
+            let object = match &target {
+                Target::ProcessOccurrence(endpoint) => endpoint.occurrence,
+                Target::ProcessLink(id) | Target::ProcessPreviewLink { relation: id, .. } => *id,
+                _ => return None,
+            };
+            let mut request = crate::model_menu::Request::object(object, pointer);
+            request.selection_target = Some(Box::new(target));
+            request.process = Some(Box::new(context));
+            return Some(
+                Action::publish(Message::Menu(crate::model_menu::Event::Open(request)))
+                    .and_capture(),
+            );
+        }
+        if !matches!(
+            event,
+            canvas::Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left))
+        ) {
+            return None;
+        }
+        if tool == CanvasTool::Connect && snapshot.targets().len() > 1 {
+            state.cancel();
+            return publish(SelectionEvent::Refuse(
+                snapshot.clone(),
+                "Connecting a selection as a group is unavailable. Select one contribution first."
+                    .into(),
+            ));
+        }
+        if tool != CanvasTool::Select {
+            return None;
+        }
+        let target = self.exact_target_at(world);
+        if state.modifiers.shift() {
+            state.cancel();
+            return target
+                .and_then(|target| {
+                    publish(SelectionEvent::Choose(
+                        process_context(context),
+                        target,
+                        Choice::Toggle,
+                    ))
+                })
+                .or_else(|| Some(Action::capture()));
+        }
+        let Some(target) = target else {
+            state.cancel();
+            // Clearing and starting the existing background camera pan can
+            // share this press; only semantic object hits capture it.
+            return Some(Action::publish(Message::DiagramSelection(
+                SelectionEvent::Clear(process_context(context)),
+            )));
+        };
+        // The ordinary endpoint gesture is valid only for an exact singleton
+        // local link. A mixed selection must never reconnect just its primary.
+        if snapshot.targets().len() == 1
+            && matches!(snapshot.primary(), Some(Target::ProcessLink(id)) if *id == self.selected)
+            && self.endpoint_at(world).is_some()
+        {
+            return None;
+        }
+        if !snapshot.targets().contains(&target) {
+            state.cancel();
+            return publish(SelectionEvent::Choose(
+                process_context(context),
+                target,
+                Choice::Replace,
+            ));
+        }
+        state.cancel();
+        state.context = Some(context);
+        state.tool = tool;
+        state.bounds = Some(bounds);
+        state.pointer = Some(pointer);
+        state.group = Some(GroupPress {
+            snapshot: snapshot.clone(),
+            target,
+            start: pointer,
+            bounds,
+            pan: self.camera_pan,
+            scale: self.scale,
+            crossed: false,
+            retired: false,
+            prepared: Prepared::new(self.project, context.owner, snapshot.targets()),
+            destination: None,
+            plan: None,
+        });
+        Some(Action::request_redraw().and_capture())
+    }
+
+    pub(super) fn selection_overlay(&self, state: &Input, frame: &mut Frame, bounds: Rectangle) {
+        if let Some(selection) = &self.selection {
+            for target in selection.targets() {
+                let primary = selection.primary() == Some(target);
+                let width = if primary { 3.5 } else { 2. };
+                let color = if primary {
+                    style::TEAL
+                } else {
+                    Color::from_rgb8(64, 123, 188)
+                };
+                match target {
+                    Target::ProcessOccurrence(endpoint) => {
+                        let rect = if endpoint.references.is_empty() {
+                            self.nodes
+                                .iter()
+                                .find(|n| n.id == endpoint.occurrence)
+                                .map(|n| n.rect)
+                        } else {
+                            self.nodes
+                                .iter()
+                                .find(|n| n.preview.iter().any(|(shown, _)| shown == endpoint))
+                                .map(|n| n.endpoint_rect(endpoint))
+                        };
+                        if let Some(rect) = rect {
+                            frame.stroke(
+                                &Path::rounded_rectangle(rect.position(), rect.size(), 5.into()),
+                                Stroke::default().with_color(color).with_width(width),
+                            );
+                        }
+                    }
+                    Target::ProcessPreviewLink {
+                        relation,
+                        source,
+                        target,
+                    } => {
+                        let link = PreviewLink {
+                            relation: *relation,
+                            source: source.clone(),
+                            target: target.clone(),
+                        };
+                        for node in &self.nodes {
+                            if node.preview_links.contains(&link)
+                                && let Some([a, b]) = node.preview_link_visible_segment(&link)
+                            {
+                                frame.stroke(
+                                    &Path::line(a, b),
+                                    Stroke::default().with_color(color).with_width(width),
+                                );
+                            }
+                        }
+                    }
+                    _ => {}
+                }
+            }
+        }
+        let Some(group) = &state.group else {
+            return;
+        };
+        if group.retired
+            || !group.crossed
+            || group.bounds != bounds
+            || self.selection.as_ref() != Some(&group.snapshot)
+            || group.pan != self.camera_pan
+            || group.scale != self.scale
+        {
+            return;
+        }
+        let reason = group
+            .prepared
+            .as_ref()
+            .err()
+            .or_else(|| group.plan.as_ref().and_then(|plan| plan.as_ref().err()));
+        let color = if reason.is_some() {
+            Color::from_rgb8(178, 49, 49)
+        } else {
+            style::TEAL
+        };
+        let mut position = state
+            .pointer
+            .map(|p| {
+                Point::new(
+                    (p.x - bounds.x - self.camera_pan.x) / self.scale + 12.,
+                    (p.y - bounds.y - self.camera_pan.y) / self.scale + 18.,
+                )
+            })
+            .unwrap_or(Point::ORIGIN);
+        if let Some(destination) = group.destination {
+            let (id, after) = match destination {
+                Destination::Before(id) => (id, false),
+                Destination::After(id) => (id, true),
+            };
+            if let Some(node) = self.nodes.iter().find(|n| n.id == id) {
+                let y = if after {
+                    node.rect.y + node.rect.height + 7.
+                } else {
+                    node.rect.y - 7.
+                };
+                frame.stroke(
+                    &Path::line(
+                        Point::new(node.rect.x, y),
+                        Point::new(node.rect.x + node.rect.width, y),
+                    ),
+                    Stroke::default().with_color(color).with_width(3.),
+                );
+                position = Point::new(node.rect.x, y + 3.);
+            }
+        }
+        let caption = reason.cloned().unwrap_or_else(|| match &group.plan {
+            Some(Ok(Plan::Noop)) => "Order unchanged".into(),
+            Some(Ok(Plan::Change(_))) => format!(
+                "Insert {} in source order · paths unchanged",
+                group.snapshot.targets().len()
+            ),
+            _ => "Point at a card's upper / lower half to insert before / after".into(),
+        });
+        draw_text(frame, caption, position, 12. / self.scale, color);
+        if reason.is_none() {
+            let mut index = 0;
+            // Graph nodes are in original steps order; these numbers describe
+            // the block the exact same cached plan will commit on release.
+            for node in &self.nodes {
+                if group
+                    .snapshot
+                    .targets()
+                    .contains(&Target::ProcessOccurrence(OccurrenceEndpoint {
+                        references: vec![],
+                        occurrence: node.id,
+                    }))
+                {
+                    index += 1;
+                    draw_text(
+                        frame,
+                        format!("{index}"),
+                        Point::new(node.rect.x + node.rect.width - 18., node.rect.y + 7.),
+                        13.,
+                        style::TEAL,
+                    );
+                }
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+#[path = "direct_selection_tests.rs"]
+mod tests;

crates/oa-desktop/src/behavior/topology/direct_selection_tests.rs

@@ -0,0 +1,403 @@
+use super::*;
+use crate::behavior::topology::direct_tests::{Fixture, context, fixture};
+use crate::diagram_selection::Selection;
+
+fn local(id: Id) -> Target {
+    Target::ProcessOccurrence(OccurrenceEndpoint {
+        references: vec![],
+        occurrence: id,
+    })
+}
+fn peers(layer: Layer) -> Fixture {
+    let mut fixture = fixture(layer);
+    fixture.p = execute_batch(&fixture.p, &[Command::Delete(fixture.link)]).unwrap();
+    fixture
+}
+fn graph<'a>(fixture: &'a Fixture, targets: &[Target]) -> Graph<'a> {
+    let context = context(fixture.owner);
+    let mut selection = Selection::new(process_context(context).scope);
+    for target in targets {
+        selection.add(target.clone(), |_| true);
+    }
+    let mut graph = Graph::new(&fixture.p, fixture.owner, fixture.owner);
+    graph.interaction = Some((context, CanvasTool::Select, true));
+    graph.selection = selection.snapshot(process_context(context));
+    graph
+}
+fn bounds() -> Rectangle {
+    Rectangle::new(Point::ORIGIN, Size::new(1800., 1400.))
+}
+fn point(graph: &Graph<'_>, id: Id, after: bool) -> Point {
+    let rect = graph.nodes.iter().find(|node| node.id == id).unwrap().rect;
+    Point::new(
+        rect.x + 70.,
+        rect.y + if after { rect.height - 15. } else { 20. },
+    )
+}
+fn send(
+    graph: &Graph<'_>,
+    input: &mut Input,
+    event: canvas::Event,
+    point: Point,
+) -> Option<Message> {
+    graph
+        .input(input, &event, bounds(), mouse::Cursor::Available(point))
+        .and_then(|action| action.into_inner().0)
+}
+fn press(graph: &Graph<'_>, input: &mut Input, point: Point) -> Option<Message> {
+    send(
+        graph,
+        input,
+        canvas::Event::Mouse(mouse::Event::CursorMoved { position: point }),
+        point,
+    );
+    send(
+        graph,
+        input,
+        canvas::Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
+        point,
+    )
+}
+fn release(graph: &Graph<'_>, input: &mut Input, point: Point) -> Option<Message> {
+    send(
+        graph,
+        input,
+        canvas::Event::Mouse(mouse::Event::CursorMoved { position: point }),
+        point,
+    );
+    send(
+        graph,
+        input,
+        canvas::Event::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left)),
+        point,
+    )
+}
+
+#[test]
+fn exact_shift_toggle_and_stationary_group_click_defer_primary() {
+    let f = peers(Layer::Oa);
+    let graph = graph(&f, &[local(f.nodes[2]), local(f.nodes[0])]);
+    let mut input = Input::default();
+    let at = point(&graph, f.nodes[2], false);
+    assert!(press(&graph, &mut input, at).is_none());
+    assert!(
+        matches!(release(&graph, &mut input, at), Some(Message::DiagramSelection(SelectionEvent::Collapse(snapshot, target)))
+        if target == local(f.nodes[2]) && snapshot == graph.selection.clone().unwrap())
+    );
+    send(
+        &graph,
+        &mut input,
+        canvas::Event::Keyboard(iced::keyboard::Event::ModifiersChanged(
+            iced::keyboard::Modifiers::SHIFT,
+        )),
+        at,
+    );
+    assert!(
+        matches!(press(&graph, &mut input, at), Some(Message::DiagramSelection(SelectionEvent::Choose(_, target, Choice::Toggle))) if target == local(f.nodes[2]))
+    );
+    assert!(input.group.is_none());
+    send(
+        &graph,
+        &mut input,
+        canvas::Event::Window(iced::window::Event::Unfocused),
+        at,
+    );
+    assert!(!input.modifiers.shift());
+}
+
+#[test]
+fn group_drag_uses_midpoint_anchors_and_original_order_and_singleton_after_gap() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let f = peers(layer);
+        for targets in [
+            vec![local(f.nodes[2]), local(f.nodes[0])],
+            vec![local(f.nodes[0])],
+        ] {
+            let graph = graph(&f, &targets);
+            let mut input = Input::default();
+            let start = point(&graph, f.nodes[0], false);
+            let end = point(&graph, f.nodes[1], true);
+            assert!(press(&graph, &mut input, start).is_none());
+            let Some(Message::DiagramSelection(SelectionEvent::ProcessReorder(
+                snapshot,
+                destination,
+            ))) = release(&graph, &mut input, end)
+            else {
+                panic!("admitted after slot");
+            };
+            assert_eq!(snapshot, graph.selection.clone().unwrap());
+            assert_eq!(destination, Destination::After(f.nodes[1]));
+            let Plan::Change(command) = Prepared::new(&f.p, f.owner, snapshot.targets())
+                .unwrap()
+                .plan(destination)
+                .unwrap()
+            else {
+                panic!("changed steps");
+            };
+            let Command::SetSteps(owner, steps) = *command else {
+                panic!("expected SetSteps");
+            };
+            assert_eq!(owner, f.owner);
+            assert_eq!(steps, vec![f.nodes[1], f.nodes[0], f.nodes[2]]);
+        }
+    }
+}
+
+#[test]
+fn selected_anchor_noop_and_irreversible_threshold_never_collapse_after_motion() {
+    let f = peers(Layer::Oa);
+    let graph = graph(&f, &[local(f.nodes[0]), local(f.nodes[2])]);
+    let mut input = Input::default();
+    let start = point(&graph, f.nodes[0], false);
+    press(&graph, &mut input, start);
+    let away = start + iced::Vector::new(10., 0.);
+    send(
+        &graph,
+        &mut input,
+        canvas::Event::Mouse(mouse::Event::CursorMoved { position: away }),
+        away,
+    );
+    assert!(release(&graph, &mut input, start).is_none());
+    assert!(input.group.is_none());
+    press(&graph, &mut input, start);
+    let outside = Point::new(-1., 100.);
+    send(
+        &graph,
+        &mut input,
+        canvas::Event::Mouse(mouse::Event::CursorMoved { position: outside }),
+        outside,
+    );
+    assert!(release(&graph, &mut input, point(&graph, f.nodes[1], true)).is_none());
+}
+
+#[test]
+fn whole_mixed_set_refuses_drag_delete_and_connect_without_singleton_bypass() {
+    let f = fixture(Layer::Sa);
+    let mut graph = graph(&f, &[local(f.nodes[0]), Target::ProcessLink(f.link)]);
+    graph.selected = f.link;
+    let mut input = Input::default();
+    let start = point(&graph, f.nodes[0], false);
+    press(&graph, &mut input, start);
+    assert!(
+        matches!(release(&graph, &mut input, point(&graph, f.nodes[2], true)), Some(Message::DiagramSelection(SelectionEvent::Refuse(snapshot, _))) if snapshot.targets().len() == 2)
+    );
+    let key = crate::behavior::canvas_workspace::tests::key(iced::keyboard::key::Named::Delete);
+    let iced::Event::Keyboard(key) = key else {
+        panic!("keyboard");
+    };
+    assert!(matches!(
+        send(&graph, &mut input, canvas::Event::Keyboard(key), start),
+        Some(Message::DiagramSelection(SelectionEvent::Refuse(_, _)))
+    ));
+    graph.interaction.as_mut().unwrap().1 = CanvasTool::Connect;
+    assert!(matches!(
+        press(&graph, &mut input, start),
+        Some(Message::DiagramSelection(SelectionEvent::Refuse(_, _)))
+    ));
+}
+
+#[test]
+fn camera_busy_context_bounds_and_escape_retire_captured_gestures() {
+    let f = peers(Layer::Oa);
+    for change in 0..6 {
+        let mut graph = graph(&f, &[local(f.nodes[0]), local(f.nodes[2])]);
+        let mut input = Input::default();
+        let start = point(&graph, f.nodes[0], false);
+        press(&graph, &mut input, start);
+        match change {
+            0 => graph.camera_pan.x += 1.,
+            1 => graph.scale = 2.,
+            2 => graph.interaction.as_mut().unwrap().2 = false,
+            3 => graph.interaction.as_mut().unwrap().0.epoch += 1,
+            4 => {
+                let iced::Event::Keyboard(key) = crate::behavior::canvas_workspace::tests::key(
+                    iced::keyboard::key::Named::Escape,
+                ) else {
+                    panic!("keyboard");
+                };
+                send(&graph, &mut input, canvas::Event::Keyboard(key), start);
+            }
+            _ => {
+                graph.input(
+                    &mut input,
+                    &canvas::Event::Mouse(mouse::Event::CursorMoved { position: start }),
+                    Rectangle::new(Point::new(1., 0.), bounds().size()),
+                    mouse::Cursor::Available(start),
+                );
+            }
+        }
+        assert!(release(&graph, &mut input, point(&graph, f.nodes[1], true)).is_none());
+        assert!(input.group.is_none());
+    }
+}
+
+#[test]
+fn qualified_occurrences_and_visible_preview_links_keep_exact_invocation_paths() {
+    let mut f = peers(Layer::Oa);
+    let source =
+        f.p.make_element(Kind::Process, Layer::Oa, "Reusable", None)
+            .unwrap();
+    let source_id = source.id;
+    f.p = execute_batch(&f.p, &[Command::CreateElement(source)]).unwrap();
+    let mut leaves = vec![];
+    for name in ["One", "Two"] {
+        let leaf = occurrence(
+            &f.p,
+            source_id,
+            name,
+            OccurrenceBody::Action {
+                action: Some(f.work[0]),
+                lifeline: None,
+            },
+        );
+        leaves.push(leaf.id);
+        f.p = execute_batch(&f.p, &[Command::CreateElement(leaf)]).unwrap();
+    }
+    let link = link(&f.p, leaves[0], leaves[1], "");
+    f.p = execute_batch(&f.p, &[link]).unwrap();
+    let mut references = vec![];
+    for name in ["First", "Second"] {
+        let reference = occurrence(
+            &f.p,
+            f.owner,
+            name,
+            OccurrenceBody::SequenceReference {
+                sequence: Some(source_id),
+            },
+        );
+        references.push(reference.id);
+        f.p = execute_batch(&f.p, &[Command::CreateElement(reference)]).unwrap();
+    }
+    let graph = graph(&f, &[]);
+    let mut targets = vec![];
+    for reference in references {
+        let node = graph.nodes.iter().find(|n| n.id == reference).unwrap();
+        let endpoint = OccurrenceEndpoint {
+            references: vec![reference],
+            occurrence: leaves[0],
+        };
+        let tile = node.endpoint_rect(&endpoint).center();
+        assert_eq!(
+            graph.exact_target_at(tile),
+            Some(Target::ProcessOccurrence(endpoint.clone()))
+        );
+        targets.push(Target::ProcessOccurrence(endpoint));
+        let link = &node.preview_links[0];
+        let [a, b] = node.preview_link_visible_segment(link).unwrap();
+        let at = Point::new((a.x + b.x) / 2., (a.y + b.y) / 2.);
+        let expected = Target::ProcessPreviewLink {
+            relation: link.relation,
+            source: link.source.clone(),
+            target: link.target.clone(),
+        };
+        assert_eq!(graph.exact_target_at(at), Some(expected.clone()));
+        let mut input = Input::default();
+        send(
+            &graph,
+            &mut input,
+            canvas::Event::Keyboard(iced::keyboard::Event::ModifiersChanged(
+                iced::keyboard::Modifiers::SHIFT,
+            )),
+            at,
+        );
+        assert!(
+            matches!(press(&graph, &mut input, at), Some(Message::DiagramSelection(SelectionEvent::Choose(_, target, Choice::Toggle))) if target == expected)
+        );
+        assert!(
+            matches!(send(&graph, &mut input, canvas::Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Right)), at), Some(Message::Menu(crate::model_menu::Event::Open(request))) if request.selection_target.as_deref() == Some(&expected) && request.process.as_deref().copied() == graph.interaction.map(|(context,_,_)| context))
+        );
+    }
+    assert_ne!(targets[0], targets[1]);
+    assert!(Prepared::new(&f.p, f.owner, &targets).is_err());
+}
+
+// The endpoint ring is drawn last, over the underlying contribution card.
+// Probe two pixels inside that card: both semantic shapes occupy the point,
+// so these tests establish the visible handle's selection precedence.
+fn handle_point(graph: &Graph<'_>, link: Id, end: End) -> Point {
+    let edge = graph.edges.iter().find(|edge| edge.id == link).unwrap();
+    match end {
+        End::Source => edge.points[0] + iced::Vector::new(-2., 0.),
+        End::Target => *edge.points.last().unwrap() + iced::Vector::new(2., 0.),
+    }
+}
+
+#[test]
+fn singleton_process_link_snapshot_reconnects_both_ends_but_stationary_release_is_inert() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let f = fixture(layer);
+        for end in [End::Source, End::Target] {
+            let mut graph = graph(&f, &[Target::ProcessLink(f.link)]);
+            graph.selected = f.link;
+            let original = graph.selection.clone().unwrap();
+            let start = handle_point(&graph, f.link, end);
+            let mut input = Input::default();
+            assert!(press(&graph, &mut input, start).is_none());
+            assert!(input.group.is_none());
+            assert!(
+                matches!(input.press, Some(Press::Reconnect { link, end: armed, moved: false, .. }) if link == f.link && armed == end)
+            );
+            assert!(release(&graph, &mut input, start).is_none());
+            assert!(input.press.is_none());
+            assert_eq!(graph.selection.as_ref(), Some(&original));
+
+            assert!(press(&graph, &mut input, start).is_none());
+            let target = point(&graph, f.nodes[2], false);
+            assert!(matches!(release(&graph, &mut input, target),
+                Some(Message::TopologyCanvas(CanvasEvent::Reconnect { context, link, end: actual, target }))
+                if context == graph.interaction.unwrap().0 && link == f.link && actual == end && target == f.nodes[2]));
+            assert!(input.group.is_none());
+            assert_eq!(graph.selection.as_ref(), Some(&original));
+        }
+    }
+}
+
+#[test]
+fn shift_on_visible_singleton_process_link_handle_toggles_that_link_not_underlying_card() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let f = fixture(layer);
+        for (end, underneath) in [(End::Source, f.nodes[0]), (End::Target, f.nodes[1])] {
+            let mut graph = graph(&f, &[Target::ProcessLink(f.link)]);
+            graph.selected = f.link;
+            let start = handle_point(&graph, f.link, end);
+            assert_eq!(graph.node_at(start), Some(underneath));
+            let mut input = Input::default();
+            send(
+                &graph,
+                &mut input,
+                canvas::Event::Keyboard(iced::keyboard::Event::ModifiersChanged(
+                    iced::keyboard::Modifiers::SHIFT,
+                )),
+                start,
+            );
+            assert!(matches!(press(&graph, &mut input, start),
+                Some(Message::DiagramSelection(SelectionEvent::Choose(_, Target::ProcessLink(id), Choice::Toggle)))
+                if id == f.link));
+            assert!(input.group.is_none() && input.press.is_none());
+        }
+    }
+}
+
+#[test]
+fn mixed_group_at_endpoint_card_refuses_whole_drag_without_hidden_singleton_handle() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let f = fixture(layer);
+        for (end, underneath) in [(End::Source, f.nodes[0]), (End::Target, f.nodes[1])] {
+            let mut graph = graph(&f, &[local(underneath), Target::ProcessLink(f.link)]);
+            graph.selected = f.link;
+            let snapshot = graph.selection.clone().unwrap();
+            let start = handle_point(&graph, f.link, end);
+            // Multiple selections render no reconnect rings. The visible
+            // selected card owns this point, while the mixed set stays whole.
+            assert_eq!(graph.exact_target_at(start), Some(local(underneath)));
+            let mut input = Input::default();
+            assert!(press(&graph, &mut input, start).is_none());
+            assert!(input.group.is_some() && input.press.is_none());
+            assert!(
+                matches!(release(&graph, &mut input, point(&graph, f.nodes[2], false)),
+                Some(Message::DiagramSelection(SelectionEvent::Refuse(captured, _))) if captured == snapshot)
+            );
+            assert_eq!(graph.selection.as_ref(), Some(&snapshot));
+        }
+    }
+}

crates/oa-desktop/src/behavior/topology/direct_tests.rs

@@ -360,11 +360,12 @@ fn direct_process_reconnect_delete_and_reorder_preserve_other_paths_and_sources(
     assert_eq!(doc.bundle(), &reconnected);
     doc.undo();
     assert_eq!(doc.bundle(), &original);
-    let reordered = execute_batch(
-        &f.p,
-        &[direct::reorder(&f.p, f.owner, f.nodes[2], f.nodes[0]).unwrap()],
-    )
-    .unwrap();
+    let group_reorder::Plan::Change(command) =
+        direct::reorder(&f.p, f.owner, f.nodes[2], f.nodes[0]).unwrap()
+    else {
+        panic!("changed order");
+    };
+    let reordered = execute_batch(&f.p, &[*command]).unwrap();
     assert_eq!(reordered.elements[&f.owner].steps().unwrap()[0], f.nodes[2]);
     assert_eq!(reordered.relations, f.p.relations);
     assert!(direct::reorder(&f.p, f.owner, f.nodes[0], f.nodes[1]).is_err());

crates/oa-desktop/src/behavior/topology/group_reorder.rs

@@ -0,0 +1,176 @@
+//! Immutable, bounded order proposals for local Process/FunctionalChain cards.
+use super::*;
+use crate::diagram_usage::Target;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum Destination {
+    Before(Id),
+    After(Id),
+}
+
+#[derive(Debug)]
+pub(crate) enum Plan {
+    Noop,
+    Change(Box<Command>),
+}
+
+/// Captured semantic facts only: no project clone, projection or routed scene.
+/// The adapter must check its document/revision/selection lifetime before commit
+/// and apply the returned command through the ordinary validated transaction.
+#[derive(Debug)]
+pub(crate) struct Prepared {
+    owner: Id,
+    steps: Vec<Id>,
+    adjacency: Vec<(Id, Id)>,
+    legacy: bool,
+    ranks: BTreeMap<Id, usize>,
+    selected: BTreeSet<Id>,
+    column: usize,
+}
+
+impl Prepared {
+    pub(crate) fn new(project: &Project, owner: Id, targets: &[Target]) -> Result<Self, String> {
+        let element = project
+            .elements
+            .get(&owner)
+            .filter(|e| matches!(e.kind(), Kind::Process | Kind::FunctionalChain))
+            .ok_or("Choose a Process or Functional Chain.")?;
+        let steps = element
+            .steps()
+            .ok_or("This owner has no contribution order.")?;
+        let mut ids = BTreeSet::new();
+        for id in steps {
+            if !is_contribution(project, owner, *id) || !ids.insert(*id) {
+                return Err(
+                    "Every process step must name a unique local contribution before reordering."
+                        .into(),
+                );
+            }
+        }
+        let mut adjacency: Vec<_> = sequence_links(project, owner)
+            .into_iter()
+            .map(|link| (link.source(), link.target()))
+            .collect();
+        // Unlisted local occurrences are legal incomplete source. Rendering can
+        // omit their links, but order editing must not silently ignore them.
+        if adjacency
+            .iter()
+            .any(|(a, b)| !ids.contains(a) || !ids.contains(b))
+        {
+            return Err("A sequence link refers to an unlisted contribution; repair the process order before reordering.".into());
+        }
+        let legacy = !legacy_order(project, owner).is_empty();
+        if legacy {
+            adjacency.extend(steps.windows(2).map(|pair| (pair[0], pair[1])));
+        }
+        if targets.is_empty() {
+            return Err("Select at least one local contribution.".into());
+        }
+        let mut selected = BTreeSet::new();
+        for target in targets {
+            let Target::ProcessOccurrence(endpoint) = target else {
+                return Err(
+                    "Reorder requires local contribution cards only; links cannot move with them."
+                        .into(),
+                );
+            };
+            if !endpoint.references.is_empty() {
+                return Err("Open the referenced definition to reorder its contents.".into());
+            }
+            if !ids.contains(&endpoint.occurrence) || !selected.insert(endpoint.occurrence) {
+                return Err(
+                    "Every selected contribution must occur exactly once in this process.".into(),
+                );
+            }
+        }
+        let ranks = column_ranks(steps, &adjacency);
+        let first = *selected.first().expect("Nonempty selection admitted");
+        let column = ranks[&first];
+        if selected.iter().any(|id| ranks[id] != column) {
+            return Err("Reorder within one column; links determine the path columns.".into());
+        }
+        Ok(Self {
+            owner,
+            steps: steps.clone(),
+            adjacency,
+            legacy,
+            ranks,
+            selected,
+            column,
+        })
+    }
+
+    pub(crate) fn plan(&self, destination: Destination) -> Result<Plan, String> {
+        let (anchor, after) = match destination {
+            Destination::Before(id) => (id, false),
+            Destination::After(id) => (id, true),
+        };
+        if self.ranks.get(&anchor) != Some(&self.column) {
+            return Err(
+                "Choose a local contribution in the selected column as the destination.".into(),
+            );
+        }
+        // Complete step, adjacency and typed selection admission already ran.
+        if self.selected.contains(&anchor) {
+            return Ok(Plan::Noop);
+        }
+        let indices: Vec<_> = self
+            .steps
+            .iter()
+            .enumerate()
+            .filter_map(|(i, id)| (self.ranks[id] == self.column).then_some(i))
+            .collect();
+        let block: Vec<_> = indices
+            .iter()
+            .map(|&i| self.steps[i])
+            .filter(|id| self.selected.contains(id))
+            .collect();
+        let mut remaining: Vec<_> = indices
+            .iter()
+            .map(|&i| self.steps[i])
+            .filter(|id| !self.selected.contains(id))
+            .collect();
+        let gap = remaining
+            .iter()
+            .position(|id| *id == anchor)
+            .ok_or("The destination slot no longer exists.")?
+            + usize::from(after);
+        remaining.splice(gap..gap, block);
+        let mut ordered = self.steps.clone();
+        for (index, id) in indices.into_iter().zip(remaining) {
+            ordered[index] = id;
+        }
+        if ordered == self.steps {
+            return Ok(Plan::Noop);
+        }
+        // Legacy adjacency comes from order itself. In valid legacy layouts each
+        // card has its own column; retain the check instead of assuming that.
+        let ranks = if self.legacy {
+            let adjacency: Vec<_> = ordered.windows(2).map(|pair| (pair[0], pair[1])).collect();
+            column_ranks(&ordered, &adjacency)
+        } else {
+            column_ranks(&ordered, &self.adjacency)
+        };
+        if ranks != self.ranks {
+            return Err(
+                "This reorder would change process columns; the whole move was refused.".into(),
+            );
+        }
+        Ok(Plan::Change(Box::new(Command::SetSteps(
+            self.owner, ordered,
+        ))))
+    }
+}
+
+#[cfg(test)]
+fn plan(
+    project: &Project,
+    owner: Id,
+    targets: &[Target],
+    destination: Destination,
+) -> Result<Plan, String> {
+    Prepared::new(project, owner, targets)?.plan(destination)
+}
+
+#[cfg(test)]
+mod tests;

crates/oa-desktop/src/behavior/topology/group_reorder/tests.rs

@@ -0,0 +1,407 @@
+use super::*;
+use crate::document::Document;
+use oa_core::source_project::ProjectLimits;
+
+fn local(id: Id) -> Target {
+    Target::ProcessOccurrence(OccurrenceEndpoint {
+        references: vec![],
+        occurrence: id,
+    })
+}
+
+fn columns(project: &Project, owner: Id) -> BTreeMap<Id, usize> {
+    let first = project.elements[&owner].steps().unwrap()[0];
+    Prepared::new(project, owner, &[local(first)])
+        .unwrap()
+        .ranks
+}
+
+// Literal order [a,u,b,v,c]; a,b,c are peers. u,v are either downstream
+// contributions or a separate cycle, so their slots must never change.
+fn fixture(layer: Layer, cycle: bool) -> (Project, Id, [Id; 5]) {
+    let (f, _) = super::super::direct_tests::empty_exchange_fixture(layer);
+    let mut project = f.p;
+    let mut ids = vec![];
+    for name in ["a", "u", "b", "v", "c"] {
+        let element = occurrence(
+            &project,
+            f.owner,
+            name,
+            OccurrenceBody::Action {
+                action: Some(f.work[0]),
+                lifeline: None,
+            },
+        );
+        ids.push(element.id);
+        project = execute_batch(&project, &[Command::CreateElement(element)]).unwrap();
+    }
+    let ids: [Id; 5] = ids.try_into().unwrap();
+    let [a, u, b, v, _] = ids;
+    let pairs = if cycle {
+        [(u, v), (v, u)]
+    } else {
+        [(a, u), (b, v)]
+    };
+    // fresh_alias must see the first link before generating the second; two
+    // commands built from the same snapshot both choose "sequence_link".
+    for (source, target) in pairs {
+        let command = link(&project, source, target, "");
+        project = execute_batch(&project, &[command]).unwrap();
+    }
+    assert_eq!(project.elements[&f.owner].steps().unwrap(), &ids);
+    (project, f.owner, ids)
+}
+
+fn changed(project: &Project, owner: Id, targets: &[Target], drop: Destination) -> Command {
+    let Plan::Change(command) = plan(project, owner, targets, drop).unwrap() else {
+        panic!("Expected an actual order change");
+    };
+    assert!(matches!(command.as_ref(), Command::SetSteps(id, _) if *id == owner));
+    *command
+}
+
+#[test]
+fn process_group_columns_reverse_noncontiguous_selection_preserves_project_and_history() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        for cycle in [false, true] {
+            let (project, owner, [a, u, b, v, c]) = fixture(layer, cycle);
+            assert_eq!(
+                columns(&project, owner),
+                BTreeMap::from([
+                    (a, 0),
+                    (u, 1),
+                    (b, 0),
+                    (v, if cycle { 2 } else { 1 }),
+                    (c, 0)
+                ])
+            );
+            // Reverse click order must not reverse the source-ordered a,c block.
+            let command = changed(
+                &project,
+                owner,
+                &[local(c), local(a)],
+                Destination::After(b),
+            );
+            let mut expected = project.clone();
+            *expected
+                .elements
+                .get_mut(&owner)
+                .unwrap()
+                .steps_mut()
+                .unwrap() = vec![b, u, a, v, c];
+            let result = execute_batch(&project, std::slice::from_ref(&command)).unwrap();
+            assert_eq!(result, expected, "Nothing outside owner steps may change");
+            assert_eq!(columns(&result, owner), columns(&project, owner));
+            let mut doc =
+                Document::from_project(project.clone(), ProjectLimits::default()).unwrap();
+            let original = doc.bundle().clone();
+            doc.execute(command).unwrap();
+            assert_eq!(doc.project(), &expected);
+            let after = doc.bundle().clone();
+            let reopened = Document::from_bundle(after.clone(), ProjectLimits::default()).unwrap();
+            assert_eq!(reopened.project(), &expected);
+            assert_eq!(reopened.bundle(), &after);
+            assert!(doc.undo());
+            assert_eq!(doc.project(), &project);
+            assert_eq!(doc.bundle(), &original);
+            assert!(!doc.can_undo());
+            assert!(doc.redo());
+            assert_eq!(doc.project(), &expected);
+            assert_eq!(doc.bundle(), &after);
+            assert!(!doc.can_redo());
+        }
+    }
+}
+
+#[test]
+fn process_group_columns_end_gaps_and_selected_anchor_noops() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let (project, owner, [a, u, b, v, c]) = fixture(layer, false);
+        for (members, drop, expected) in [
+            (
+                vec![local(c), local(b)],
+                Destination::Before(a),
+                vec![b, u, c, v, a],
+            ),
+            (
+                vec![local(b), local(a)],
+                Destination::After(c),
+                vec![c, u, a, v, b],
+            ),
+        ] {
+            let command = changed(&project, owner, &members, drop);
+            assert_eq!(
+                execute_batch(&project, &[command]).unwrap().elements[&owner]
+                    .steps()
+                    .unwrap(),
+                &expected
+            );
+        }
+        let doc = Document::from_project(project.clone(), ProjectLimits::default()).unwrap();
+        let original = doc.bundle().clone();
+        for (members, drop) in [
+            (vec![local(b), local(c)], Destination::After(a)),
+            (vec![local(c), local(a)], Destination::Before(c)),
+            (vec![local(a), local(c)], Destination::After(a)),
+            (vec![local(c), local(b), local(a)], Destination::After(b)),
+        ] {
+            assert!(matches!(
+                plan(doc.project(), owner, &members, drop),
+                Ok(Plan::Noop)
+            ));
+            assert_eq!(doc.bundle(), &original);
+            assert!(!doc.can_undo());
+        }
+    }
+}
+
+#[test]
+fn process_group_columns_refuse_entire_invalid_typed_sets_before_noop() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let (project, owner, [a, u, _, _, c]) = fixture(layer, true);
+        let foreign = super::super::direct_tests::fixture(layer).nodes[0];
+        let qualified = Target::ProcessOccurrence(OccurrenceEndpoint {
+            references: vec![a],
+            occurrence: c,
+        });
+        let relation = *project.relations.keys().next().unwrap();
+        for members in [
+            vec![],
+            vec![local(a), local(a)],
+            vec![local(a), local(u)],
+            vec![local(a), local(foreign)],
+            vec![local(a), qualified],
+            vec![local(a), Target::ProcessLink(relation)],
+            vec![local(a), Target::Placement(c)],
+        ] {
+            // A selected anchor must not conceal invalid second members.
+            assert!(plan(&project, owner, &members, Destination::Before(a)).is_err());
+        }
+        assert!(plan(&project, owner, &[local(a)], Destination::After(foreign)).is_err());
+        assert!(plan(&project, a, &[local(a)], Destination::Before(a)).is_err());
+        assert!(
+            plan(
+                &project,
+                owner,
+                &[
+                    local(u),
+                    local(project.elements[&owner].steps().unwrap()[3])
+                ],
+                Destination::Before(u)
+            )
+            .is_err()
+        );
+    }
+}
+
+#[test]
+fn process_group_columns_legacy_exchange_order_refuses_cross_rank_group() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let (f, next) = super::super::direct_tests::empty_exchange_fixture(layer);
+        let mut project = f.p;
+        let mut ids = vec![];
+        for (name, exchange) in [("first", f.exchange), ("second", next)] {
+            let element = occurrence(
+                &project,
+                f.owner,
+                name,
+                OccurrenceBody::Exchange {
+                    exchange: Some(exchange),
+                    sender: None,
+                    receiver: None,
+                    message_kind: MessageKind::default(),
+                    reply_to: None,
+                    values: vec![],
+                    operation: None,
+                },
+            );
+            ids.push(element.id);
+            project = execute_batch(&project, &[Command::CreateElement(element)]).unwrap();
+        }
+        assert_eq!(legacy_order(&project, f.owner), ids);
+        assert!(
+            plan(
+                &project,
+                f.owner,
+                &[local(ids[0]), local(ids[1])],
+                Destination::Before(ids[0])
+            )
+            .is_err()
+        );
+        assert!(matches!(
+            plan(
+                &project,
+                f.owner,
+                &[local(ids[1])],
+                Destination::After(ids[1])
+            ),
+            Ok(Plan::Noop)
+        ));
+    }
+}
+
+#[test]
+fn process_group_columns_accept_all_local_card_kinds_and_different_heights() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let (f, _) = super::super::direct_tests::empty_exchange_fixture(layer);
+        let mut project = f.p;
+        let source = project
+            .make_element(
+                project.elements[&f.owner].kind(),
+                layer,
+                "Reusable definition",
+                None,
+            )
+            .unwrap();
+        let source_id = source.id;
+        project = execute_batch(&project, &[Command::CreateElement(source)]).unwrap();
+        let bodies = [
+            OccurrenceBody::Action {
+                action: Some(f.work[0]),
+                lifeline: None,
+            },
+            OccurrenceBody::Exchange {
+                exchange: Some(f.exchange),
+                sender: None,
+                receiver: None,
+                message_kind: MessageKind::default(),
+                reply_to: None,
+                values: vec![],
+                operation: None,
+            },
+            OccurrenceBody::Control {
+                kind: ControlKind::Choice,
+            },
+            OccurrenceBody::SequenceReference {
+                sequence: Some(source_id),
+            },
+            OccurrenceBody::Action {
+                action: Some(f.work[0]),
+                lifeline: None,
+            },
+        ];
+        let mut ids = vec![];
+        for (index, body) in bodies.into_iter().enumerate() {
+            let element = occurrence(&project, f.owner, &format!("Card {index}"), body);
+            ids.push(element.id);
+            project = execute_batch(&project, &[Command::CreateElement(element)]).unwrap();
+        }
+        let graph = Graph::new(&project, f.owner, ids[0]);
+        assert_ne!(graph.nodes[0].rect.height, graph.nodes[3].rect.height);
+        let selected = vec![local(ids[3]), local(ids[2]), local(ids[1]), local(ids[0])];
+        let command = changed(&project, f.owner, &selected, Destination::After(ids[4]));
+        let mut expected = project.clone();
+        *expected
+            .elements
+            .get_mut(&f.owner)
+            .unwrap()
+            .steps_mut()
+            .unwrap() = vec![ids[4], ids[0], ids[1], ids[2], ids[3]];
+        assert_eq!(execute_batch(&project, &[command]).unwrap(), expected);
+    }
+}
+
+#[test]
+fn process_group_columns_full_order_admission_precedes_selected_anchor_noop() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let (mut project, owner, [a, u, b, v, c]) = fixture(layer, false);
+        let other = project
+            .make_element(project.elements[&owner].kind(), layer, "Other", None)
+            .unwrap();
+        let other_owner = other.id;
+        project = execute_batch(&project, &[Command::CreateElement(other)]).unwrap();
+        let foreign = occurrence(
+            &project,
+            other_owner,
+            "Foreign local occurrence",
+            OccurrenceBody::Control {
+                kind: ControlKind::Choice,
+            },
+        );
+        let foreign_id = foreign.id;
+        project = execute_batch(&project, &[Command::CreateElement(foreign)]).unwrap();
+        assert!(Prepared::new(&project, owner, &[local(a), local(foreign_id)]).is_err());
+        let prepared = Prepared::new(&project, owner, &[local(a)]).unwrap();
+        assert!(prepared.plan(Destination::Before(foreign_id)).is_err());
+
+        // Corrupt/incomplete imported orders must fail even when only the valid
+        // card is selected and the requested destination would be a no-op.
+        for order in [
+            vec![a, u, b, v, c, c],
+            vec![a, u, b, v, Id::new_v4()],
+            vec![a, u, b, v, foreign_id],
+            vec![a, b, v, c], // local a -> u remains, but u is unlisted
+        ] {
+            let mut incomplete = project.clone();
+            *incomplete
+                .elements
+                .get_mut(&owner)
+                .unwrap()
+                .steps_mut()
+                .unwrap() = order;
+            let original = incomplete.clone();
+            assert!(plan(&incomplete, owner, &[local(a)], Destination::Before(a)).is_err());
+            assert_eq!(incomplete, original);
+        }
+    }
+}
+
+#[test]
+fn process_group_columns_renderer_omits_links_to_unlisted_nodes_without_panicking() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let (project, owner, [a, u, b, v, c]) = fixture(layer, false);
+        for (omitted, expected_ids, expected_ranks) in [
+            (
+                u,
+                vec![a, b, v, c],
+                BTreeMap::from([(a, 0), (b, 0), (v, 1), (c, 0)]),
+            ),
+            (
+                a,
+                vec![u, b, v, c],
+                BTreeMap::from([(u, 0), (b, 0), (v, 1), (c, 0)]),
+            ),
+        ] {
+            // This omission is core-valid incomplete source, not a renderer-only
+            // manufactured dangling element. The semantic occurrence remains.
+            let incomplete =
+                execute_batch(&project, &[Command::SetSteps(owner, expected_ids.clone())]).unwrap();
+            assert!(incomplete.elements.contains_key(&omitted));
+            let graph = Graph::new(&incomplete, owner, b);
+            assert_eq!(
+                graph.nodes.iter().map(|node| node.id).collect::<Vec<_>>(),
+                expected_ids
+            );
+            assert_eq!(graph.edges.len(), 1);
+            assert_eq!((graph.edges[0].source, graph.edges[0].target), (b, v));
+            for node in &graph.nodes {
+                assert_eq!(node.rect.x, 24. + expected_ranks[&node.id] as f32 * 420.);
+            }
+            assert!(Prepared::new(&incomplete, owner, &[local(b)]).is_err());
+        }
+    }
+}
+
+#[test]
+fn process_group_columns_parallel_links_keep_exact_ranks_and_relation_records() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let (mut project, owner, [a, u, b, v, c]) = fixture(layer, false);
+        project = execute_batch(&project, &[link(&project, a, u, "alternative")]).unwrap();
+        assert_eq!(
+            columns(&project, owner),
+            BTreeMap::from([(a, 0), (u, 1), (b, 0), (v, 1), (c, 0)])
+        );
+        let prepared = Prepared::new(&project, owner, &[local(c), local(b)]).unwrap();
+        let Plan::Change(command) = prepared.plan(Destination::Before(a)).unwrap() else {
+            panic!("Expected move");
+        };
+        let result = execute_batch(&project, &[*command]).unwrap();
+        assert_eq!(
+            result.elements[&owner].steps().unwrap(),
+            &vec![b, u, c, v, a]
+        );
+        assert_eq!(result.relations, project.relations);
+        assert_eq!(columns(&result, owner), prepared.ranks);
+        assert_eq!(Graph::new(&result, owner, b).edges.len(), 3);
+    }
+}

crates/oa-desktop/src/behavior/topology/layout_tests.rs

@@ -1,5 +1,320 @@
 use super::*;
 
+#[tokio::test]
+async fn production_process_multiselect_modifiers_survive_focus_busy_and_clear_on_window_loss() {
+    use crate::behavior::canvas_workspace::tests::Mounted;
+    use iced::keyboard::{Event as KeyEvent, Modifiers};
+    let mut f = super::super::direct_tests::fixture(Layer::Oa);
+    f.p = execute_batch(&f.p, &[Command::Delete(f.link)]).unwrap();
+    let mut app = App::with_project(f.p);
+    let _ = app.update(Message::Select(f.owner));
+    let _ = app.update(Message::Page(crate::app::Page::Behavior));
+    app.window_size = Size::new(1440., 900.);
+    let mut mounted = Mounted::new(&mut app).await;
+    let bounds = mounted.geometry(&app).bounds("process-viewport");
+    let at = |app: &App, id| {
+        let graph = Graph::new(app.project(), f.owner, id);
+        let rect = graph.nodes.iter().find(|n| n.id == id).unwrap().rect;
+        bounds.position()
+            + app.behavior.topology.pan
+            + iced::Vector::new(rect.x + 60., rect.y + 20.)
+                * app
+                    .behavior
+                    .topology
+                    .scale(graph.size, (app.window_size.width - 600.).max(200.))
+    };
+    let shift = |held| {
+        iced::Event::Keyboard(KeyEvent::ModifiersChanged(if held {
+            Modifiers::SHIFT
+        } else {
+            Modifiers::empty()
+        }))
+    };
+    let first = at(&app, f.nodes[2]);
+    mounted
+        .batch(&mut app, &[shift(true)], mouse::Cursor::Available(first))
+        .await;
+    mounted.click(&mut app, first).await;
+    let second = at(&app, f.nodes[0]);
+    mounted.click(&mut app, second).await;
+    assert_eq!(
+        app.multiselect_snapshot().unwrap().targets().len(),
+        2,
+        "Shift before canvas focus reaches both clicks"
+    );
+    assert_eq!(mounted.geometry(&app).bounds("process-viewport"), bounds);
+    app.busy = true;
+    mounted.settle(&mut app).await;
+    mounted
+        .batch(&mut app, &[shift(false)], mouse::Cursor::Available(second))
+        .await;
+    app.busy = false;
+    mounted.settle(&mut app).await;
+    let third = at(&app, f.nodes[1]);
+    mounted.click(&mut app, third).await;
+    assert_eq!(
+        app.multiselect_snapshot().unwrap().targets().len(),
+        1,
+        "Shift released during busy is not resurrected"
+    );
+    app.busy = true;
+    mounted
+        .batch(&mut app, &[shift(true)], mouse::Cursor::Available(second))
+        .await;
+    app.busy = false;
+    mounted.settle(&mut app).await;
+    mounted.click(&mut app, second).await;
+    assert_eq!(
+        app.multiselect_snapshot().unwrap().targets().len(),
+        2,
+        "Shift held through busy survives child lifetime"
+    );
+    mounted
+        .batch(
+            &mut app,
+            &[iced::Event::Window(iced::window::Event::Unfocused)],
+            mouse::Cursor::Unavailable,
+        )
+        .await;
+    mounted.click(&mut app, first).await;
+    assert_eq!(
+        app.multiselect_snapshot().unwrap().targets().len(),
+        1,
+        "real window loss clears held modifiers"
+    );
+    assert_eq!(mounted.geometry(&app).bounds("process-viewport"), bounds);
+    assert!(!app.document.can_undo());
+    let pan = app.behavior.topology.pan;
+    let source = app.document.bundle().clone();
+    let blank = bounds.position() + iced::Vector::new(bounds.width - 40., bounds.height - 40.);
+    let end = blank + iced::Vector::new(-25., -20.);
+    mounted
+        .batch(
+            &mut app,
+            &[
+                iced::Event::Mouse(mouse::Event::CursorMoved { position: blank }),
+                iced::Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
+            ],
+            mouse::Cursor::Available(blank),
+        )
+        .await;
+    assert!(app.multiselect_snapshot().unwrap().targets().is_empty());
+    assert_eq!(app.behavior.topology.pan, pan);
+    assert_eq!(app.document.bundle(), &source);
+    // Each batch rebuilds the production tree and applies all App messages.
+    // Selection Clear must not retire the camera pan started by its press.
+    assert_eq!(mounted.geometry(&app).bounds("process-viewport"), bounds);
+    mounted
+        .batch(
+            &mut app,
+            &[iced::Event::Mouse(mouse::Event::CursorMoved {
+                position: end,
+            })],
+            mouse::Cursor::Available(end),
+        )
+        .await;
+    assert_eq!(
+        app.behavior.topology.pan,
+        pan + iced::Vector::new(-25., -20.)
+    );
+    assert_eq!(app.document.bundle(), &source);
+    assert_eq!(mounted.geometry(&app).bounds("process-viewport"), bounds);
+    mounted
+        .batch(
+            &mut app,
+            &[iced::Event::Mouse(mouse::Event::ButtonReleased(
+                mouse::Button::Left,
+            ))],
+            mouse::Cursor::Available(end),
+        )
+        .await;
+    assert!(app.multiselect_snapshot().unwrap().targets().is_empty());
+    assert_eq!(
+        app.behavior.topology.pan,
+        pan + iced::Vector::new(-25., -20.)
+    );
+    assert_eq!(app.document.bundle(), &source);
+    assert!(!app.document.can_undo());
+}
+
+#[tokio::test]
+async fn production_process_multiselect_reverse_click_group_drop_has_one_history_step_and_stable_camera()
+ {
+    use crate::behavior::canvas_workspace::tests::Mounted;
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = super::super::direct_tests::fixture(layer);
+        f.p = execute_batch(&f.p, &[Command::Delete(f.link)]).unwrap();
+        let mut app = App::with_project(f.p);
+        let _ = app.update(Message::Select(f.owner));
+        let _ = app.update(Message::Page(crate::app::Page::Behavior));
+        app.window_size = Size::new(1440., 900.);
+        let mut mounted = Mounted::new(&mut app).await;
+        let bounds = mounted.geometry(&app).bounds("process-viewport");
+        let graph = Graph::new(app.project(), f.owner, f.owner);
+        let scale = app
+            .behavior
+            .topology
+            .scale(graph.size, (app.window_size.width - 600.).max(200.));
+        let at = |id, after| {
+            let rect = graph.nodes.iter().find(|n| n.id == id).unwrap().rect;
+            bounds.position()
+                + iced::Vector::new(
+                    rect.x + 60.,
+                    rect.y + if after { rect.height - 15. } else { 20. },
+                ) * scale
+        };
+        let points = [
+            at(f.nodes[2], false),
+            at(f.nodes[0], false),
+            at(f.nodes[1], true),
+        ];
+        drop(graph);
+        mounted
+            .batch(
+                &mut app,
+                &[iced::Event::Keyboard(
+                    iced::keyboard::Event::ModifiersChanged(iced::keyboard::Modifiers::SHIFT),
+                )],
+                mouse::Cursor::Available(points[0]),
+            )
+            .await;
+        mounted.click(&mut app, points[0]).await;
+        mounted.click(&mut app, points[1]).await;
+        mounted
+            .batch(
+                &mut app,
+                &[iced::Event::Keyboard(
+                    iced::keyboard::Event::ModifiersChanged(iced::keyboard::Modifiers::empty()),
+                )],
+                mouse::Cursor::Available(points[1]),
+            )
+            .await;
+        let snapshot = app.multiselect_snapshot().unwrap();
+        let source = app.document.bundle().clone();
+        let camera = (app.behavior.topology.pan, app.behavior.topology.zoom);
+        // Reuse the existing opt-in raw WGPU evidence convention. These are
+        // actual production-tree pixels, not a reconstructed preview image.
+        let record_feedback = |stage: &str, mounted: &mut Mounted, app: &App, cursor: Point| {
+            let Some(path) = std::env::var_os("ARCADIA_RENDER_EVIDENCE_DIR") else {
+                return;
+            };
+            let path = std::path::PathBuf::from(path);
+            std::fs::create_dir_all(&path).unwrap();
+            let name = format!("process-{layer:?}-{stage}");
+            let pixels = mounted.pixels_at(app, mouse::Cursor::Available(cursor));
+            let width = app.window_size.width as u32;
+            let height = app.window_size.height as u32;
+            assert_eq!(pixels.len(), width as usize * height as usize * 4);
+            let mut file = std::fs::OpenOptions::new()
+                .write(true)
+                .create_new(true)
+                .open(path.join(format!("{name}.rgba")))
+                .unwrap();
+            std::io::Write::write_all(&mut file, &pixels).unwrap();
+            let metadata = serde_json::json!({
+                "width": width, "height": height, "format": "RGBA8",
+                "stage": stage, "layer": format!("{layer:?}"),
+                "canvas": [bounds.x, bounds.y, bounds.width, bounds.height],
+                "cursor": [cursor.x, cursor.y], "scale": scale,
+                "camera": [app.behavior.topology.pan.x, app.behavior.topology.pan.y],
+                "selectionCount": snapshot.targets().len(),
+                "selection": format!("{snapshot:?}"),
+                "source": app.document.bundle(),
+            });
+            let mut file = std::fs::OpenOptions::new()
+                .write(true)
+                .create_new(true)
+                .open(path.join(format!("{name}.json")))
+                .unwrap();
+            std::io::Write::write_all(&mut file, &serde_json::to_vec_pretty(&metadata).unwrap())
+                .unwrap();
+            assert_eq!(app.document.bundle(), &source);
+            assert_eq!(app.multiselect_snapshot().unwrap(), snapshot);
+            assert!(!app.document.can_undo());
+        };
+        record_feedback("before-press", &mut mounted, &app, points[1]);
+        let pressed = mounted
+            .batch(
+                &mut app,
+                &[
+                    iced::Event::Mouse(mouse::Event::CursorMoved {
+                        position: points[1],
+                    }),
+                    iced::Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
+                ],
+                mouse::Cursor::Available(points[1]),
+            )
+            .await;
+        assert!(
+            !pressed
+                .iter()
+                .any(|message| matches!(message, Message::DiagramSelection(_)))
+        );
+        assert_eq!(app.multiselect_snapshot().unwrap(), snapshot);
+        assert_eq!(app.document.bundle(), &source);
+        assert!(!app.document.can_undo());
+        assert_eq!(mounted.geometry(&app).bounds("process-viewport"), bounds);
+        let moved = mounted
+            .batch(
+                &mut app,
+                &[iced::Event::Mouse(mouse::Event::CursorMoved {
+                    position: points[2],
+                })],
+                mouse::Cursor::Available(points[2]),
+            )
+            .await;
+        assert!(
+            !moved
+                .iter()
+                .any(|message| matches!(message, Message::DiagramSelection(_)))
+        );
+        assert_eq!(app.multiselect_snapshot().unwrap(), snapshot);
+        assert_eq!(app.document.bundle(), &source);
+        assert!(!app.document.can_undo());
+        assert_eq!(mounted.geometry(&app).bounds("process-viewport"), bounds);
+        assert_eq!(
+            (app.behavior.topology.pan, app.behavior.topology.zoom),
+            camera
+        );
+        record_feedback("after-motion", &mut mounted, &app, points[2]);
+        let messages = mounted
+            .batch(
+                &mut app,
+                &[iced::Event::Mouse(mouse::Event::ButtonReleased(
+                    mouse::Button::Left,
+                ))],
+                mouse::Cursor::Available(points[2]),
+            )
+            .await;
+        assert!(
+            messages.iter().any(|m| matches!(
+                m,
+                Message::DiagramSelection(crate::app::multiselect::Event::ProcessReorder(_, _))
+            )),
+            "{messages:?}"
+        );
+        assert_eq!(
+            app.project().elements[&f.owner].steps().unwrap(),
+            &vec![f.nodes[1], f.nodes[0], f.nodes[2]]
+        );
+        assert_eq!(
+            app.multiselect_snapshot().unwrap().targets(),
+            snapshot.targets()
+        );
+        assert_eq!(mounted.geometry(&app).bounds("process-viewport"), bounds);
+        assert_eq!(
+            (app.behavior.topology.pan, app.behavior.topology.zoom),
+            camera
+        );
+        let changed = app.document.bundle().clone();
+        let _ = app.update(Message::Undo);
+        assert_eq!(app.document.bundle(), &source);
+        assert!(!app.document.can_undo());
+        let _ = app.update(Message::Redo);
+        assert_eq!(app.document.bundle(), &changed);
+    }
+}
+
 #[tokio::test]
 async fn production_process_canvas_scaled_path_creation_preserves_source_and_editor_bounds() {
     use crate::behavior::canvas_workspace::{self, tests::Mounted};

crates/oa-desktop/src/behavior/topology/usages.rs

@@ -23,6 +23,38 @@ impl UsageSnapshot {
 }
 
 impl State {
+    pub(crate) fn selection_address(&self) -> Option<oa_core::topology_context::ContextAddress> {
+        self.selected_context.clone()
+    }
+
+    pub(crate) fn selection_targets(&self, p: &Project, owner: Id) -> Vec<Target> {
+        let graph = self.usage_graph(p, owner);
+        let mut targets = vec![];
+        for node in &graph.nodes {
+            targets.push(Target::ProcessOccurrence(OccurrenceEndpoint {
+                references: vec![],
+                occurrence: node.id,
+            }));
+            targets.extend(
+                node.preview
+                    .iter()
+                    .map(|(endpoint, _)| Target::ProcessOccurrence(endpoint.clone())),
+            );
+            for link in &node.preview_links {
+                let target = Target::ProcessPreviewLink {
+                    relation: link.relation,
+                    source: link.source.clone(),
+                    target: link.target.clone(),
+                };
+                if graph.usage_bounds(&target).is_some() {
+                    targets.push(target);
+                }
+            }
+        }
+        targets.extend(graph.edges.iter().map(|edge| Target::ProcessLink(edge.id)));
+        targets
+    }
+
     pub(crate) fn usage_snapshot(&self) -> UsageSnapshot {
         UsageSnapshot {
             identity: self.identity,

crates/oa-desktop/src/behavior/topology/view.rs

@@ -66,7 +66,8 @@ pub(super) fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Ele
     let pending = state.draft.is_some();
     let ordered = !legacy_order(p, owner).is_empty();
     let selected = is_contribution(p, owner, app.selected).then_some(app.selected);
-    let clean = !app.behavior.has_pending() && !app.draft_dirty() && !app.source_dirty();
+    let clean =
+        !app.busy && !app.behavior.has_pending() && !app.draft_dirty() && !app.source_dirty();
     // A fixed sibling keeps Iced's canvas scroll state through selection/form changes.
     let mut navigation = column![].spacing(6);
     if let Some(Relation {
@@ -183,6 +184,7 @@ pub(super) fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Ele
         &state.expanded,
         &state.contextual_expanded,
     );
+    graph.selection = app.multiselect_snapshot();
     graph.selected_preview = state
         .qualified_selection(p, owner)
         .filter(|address| {
@@ -195,6 +197,11 @@ pub(super) fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Ele
                 == app.selected
         })
         .map(|address| address.endpoint.clone());
+    if let Some(crate::diagram_usage::Target::ProcessOccurrence(endpoint)) =
+        graph.selection.as_ref().and_then(|s| s.primary())
+    {
+        graph.selected_preview = (!endpoint.references.is_empty()).then(|| endpoint.clone());
+    }
     graph.selected_preview_link = app
         .diagram_focus(crate::diagram_usage::Surface::Process(owner))
         .and_then(|usage| match &usage.target {
@@ -256,7 +263,8 @@ pub(super) fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Ele
             event(Event::Shelf(Shelf::Selection)),
             move |zoom| Message::TopologyCanvas(CanvasEvent::Zoom(context, zoom)),
             camera
-        )
+        ),
+        selection_controls(app)
     ]
     .spacing(4);
     let entries = [
@@ -322,7 +330,7 @@ pub(super) fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Ele
             )
         }),
     );
-    let details = scrollable(navigation.push(text("Layout is derived. The reorder handle changes display order within its column; it does not author a position.").size(11)))
+    let details = scrollable(navigation.push(text("Drag selected local cards to the upper or lower half of a card to insert before or after it in the same column. The group keeps source order; paths stay unchanged. Qualified previews remain read-only.").size(11)))
         .id("process-details").width(Fill).height(Fill).into();
     let mut form_panel: Element<'_, Message> = iced::widget::Space::new().height(0).into();
     if let Some(d) = state.draft.as_ref().filter(|d| d.owner == owner) {
@@ -552,6 +560,40 @@ pub(super) fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Ele
     super::super::canvas_workspace::host(header.into(), palette, canvas, editor)
 }
 
+fn selection_controls(app: &App) -> Element<'_, Message> {
+    use crate::app::multiselect::Event as SelectionEvent;
+    let snapshot = app.multiselect_snapshot();
+    let enabled = !app.busy
+        && !app.behavior.has_pending()
+        && !app.draft_dirty()
+        && !app.source_dirty()
+        && app.behavior.topology.tool == CanvasTool::Select;
+    let count = snapshot.as_ref().map_or(0, |s| s.targets().len());
+    let mut controls = row![label(format!("{count} selected"))]
+        .spacing(7)
+        .align_y(iced::Center)
+        .height(32);
+    if let Some(snapshot) = snapshot.filter(|s| !s.targets().is_empty()) {
+        controls = controls.push(button("Clear selection").on_press_maybe(
+            enabled.then(|| Message::DiagramSelection(SelectionEvent::Clear(snapshot.context()))),
+        ));
+        controls = controls.push(
+            label(format!(
+                "Properties: {}",
+                short(app.project().named(app.selected), 24)
+            ))
+            .wrapping(iced::widget::text::Wrapping::None),
+        );
+    }
+    // Keep the row even with an empty set so selection never moves the canvas.
+    controls
+        .push(crate::views::diagram_help(
+            crate::guide::Topic::Chains,
+            "Shift-click toggles selection. Drag selected local cards to reorder; reused previews are read-only.",
+        ))
+        .into()
+}
+
 fn editor_panel<'a, R: iced::advanced::text::Renderer + 'a>(
     session: Id,
     actions: iced::Element<'a, Message, iced::Theme, R>,

crates/oa-desktop/src/connection_allocation_tests.rs

@@ -0,0 +1,480 @@
+// Included in connection_edit::tests: exercise the real application event path.
+use oa_core::projection::project_view;
+
+fn allocation_fixture(layer: Layer, projection: ProjectionKind) -> (App, Id, Id, Id) {
+    let mut project = Project::empty();
+    let (performer_kind, work_kind) = match layer {
+        Layer::Oa => (Kind::Entity, Kind::Activity),
+        Layer::Sa => (Kind::System, Kind::Function),
+    };
+    let performer = project.add(performer_kind, "Assigned performer", 20., 20.);
+    let work = project.add(work_kind, "Existing leaf work", 420., 20.);
+    let diagram = project.ensure_diagram(layer);
+    project.diagrams.get_mut(&diagram).unwrap().projection = projection;
+    let reference_id = Id::new_v4();
+    let mut reference = project.diagrams[&diagram].clone();
+    reference.id = reference_id;
+    reference.alias = project.fresh_alias("Reference view", "diagram", reference_id);
+    reference.name = "Reference view".into();
+    reference.nodes.clear();
+    project.diagrams.insert(reference_id, reference);
+    project.place(reference_id, performer, Position { x: 80., y: 100. });
+    project.place(reference_id, work, Position { x: 500., y: 300. });
+    let mut app = App::with_project(project);
+    let _ = app.update(Message::Diagram(crate::app::Choice {
+        id: diagram,
+        label: app.project().diagrams[&diagram].name.clone(),
+    }));
+    (app, performer, work, diagram)
+}
+
+fn start_allocation(app: &mut App, performer: Id) -> Context {
+    send(app, Event::Choose(Some(Tool::Allocation)));
+    let context = app.route_context().unwrap();
+    assert!(
+        app.connection
+            .as_ref()
+            .unwrap()
+            .candidates
+            .contains(&performer)
+    );
+    send(app, Event::Endpoint(context, performer));
+    assert_eq!(app.connection.as_ref().unwrap().source, Some(performer));
+    context
+}
+
+#[test]
+fn allocation_projection_eligibility_requires_both_endpoint_categories() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        for projection in [
+            ProjectionKind::Overview,
+            ProjectionKind::Decomposition,
+            ProjectionKind::Traceability,
+            ProjectionKind::Allocation,
+        ] {
+            assert!(Tool::Allocation.available_in(layer, projection));
+        }
+        for projection in [
+            ProjectionKind::FunctionalDataflow,
+            ProjectionKind::Capabilities,
+            ProjectionKind::StateMachine {
+                machine: Id::new_v4(),
+            },
+        ] {
+            assert!(!Tool::Allocation.available_in(layer, projection));
+        }
+        for projection in [
+            ProjectionKind::FunctionalDataflow,
+            ProjectionKind::Capabilities,
+        ] {
+            let (mut app, _, _, _) = allocation_fixture(layer, projection);
+            let before = app.document.bundle().clone();
+            send(&mut app, Event::Choose(Some(Tool::Allocation)));
+            assert!(app.connection.is_none());
+            assert_eq!(app.document.bundle(), &before);
+        }
+    }
+    // The new predicate retains the four established exchange-tool policies.
+    assert!(Tool::Interaction.available_in(Layer::Oa, ProjectionKind::FunctionalDataflow));
+    assert!(Tool::FunctionalExchange.available_in(Layer::Sa, ProjectionKind::FunctionalDataflow));
+    assert!(Tool::CommunicationMean.available_in(Layer::Oa, ProjectionKind::Capabilities));
+    assert!(Tool::BoundaryExchange.available_in(Layer::Sa, ProjectionKind::Capabilities));
+    assert!(!Tool::FunctionalExchange.available_in(Layer::Oa, ProjectionKind::Overview));
+}
+
+#[test]
+fn allocation_canvas_commits_only_one_relation_with_exact_source_undo_redo() {
+    use oa_core::source_project::{ProjectLimits, compile_bundle};
+    for layer in [Layer::Oa, Layer::Sa] {
+        for projection in [
+            ProjectionKind::Overview,
+            ProjectionKind::Decomposition,
+            ProjectionKind::Traceability,
+            ProjectionKind::Allocation,
+        ] {
+            let (mut app, performer, work, diagram) = allocation_fixture(layer, projection);
+            let original = app.project().clone();
+            let before = app.document.bundle().clone();
+            let revision = app.document.revision();
+            let context = start_allocation(&mut app, performer);
+            assert_eq!(app.document.bundle(), &before);
+            send(&mut app, Event::Endpoint(context, work));
+            assert!(app.connection.is_none());
+            assert_eq!(app.document.revision(), revision + 1);
+            let relation = &app.project().relations[&app.selected];
+            let name = "Allocation: Assigned performer → Existing leaf work";
+            let expected_relation = Relation {
+                id: relation.id,
+                alias: original.fresh_alias(name, "relation", relation.id),
+                name: name.into(),
+                description: String::new(),
+                body: RelationBody::new(RelationKind::Allocation, performer, work),
+            };
+            let relation_id = relation.id;
+            let mut expected = original.clone();
+            expected.relations.insert(relation_id, expected_relation);
+            assert_eq!(app.project(), &expected, "Only the new relation may change");
+            assert_eq!(app.active_diagram, Some(diagram));
+            assert!(
+                app.status
+                    .contains("Allocated Existing leaf work to Assigned performer")
+            );
+            let projected = project_view(app.project(), diagram);
+            if projection == ProjectionKind::Allocation {
+                assert!(!projected.edges.iter().any(|edge| edge.id == relation_id));
+                let owner = projected
+                    .nodes
+                    .iter()
+                    .find(|node| node.element == performer)
+                    .unwrap();
+                let child = projected
+                    .nodes
+                    .iter()
+                    .find(|node| node.element == work)
+                    .unwrap();
+                assert_eq!(child.visual_parent, Some(owner.id));
+            } else {
+                assert!(projected.edges.iter().any(|edge| edge.id == relation_id));
+            }
+            let after = app.document.bundle().clone();
+            assert_eq!(
+                compile_bundle(&after, ProjectLimits::default())
+                    .unwrap()
+                    .decoded
+                    .project,
+                expected
+            );
+            send(&mut app, Event::Endpoint(context, work));
+            assert_eq!(
+                app.document.revision(),
+                revision + 1,
+                "Repeated release is not another transaction"
+            );
+            let _ = app.update(Message::Undo);
+            assert_eq!(app.project(), &original);
+            assert_eq!(app.document.bundle(), &before);
+            let _ = app.update(Message::Redo);
+            assert_eq!(app.project(), &expected);
+            assert_eq!(app.document.bundle(), &after);
+        }
+    }
+}
+
+#[test]
+fn allocation_candidates_reject_nonleaf_occupied_cross_layer_port_and_hidden_work() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let (base, performer, work, diagram) =
+            allocation_fixture(layer, ProjectionKind::Traceability);
+        let mut project = base.project().clone();
+        let work_kind = project.elements[&work].kind();
+        let composite = project
+            .add_element(work_kind, layer, "Composite work", None)
+            .unwrap();
+        project
+            .add_element(work_kind, layer, "Child work", Some(composite))
+            .unwrap();
+        let occupied = project
+            .add_element(work_kind, layer, "Occupied work", None)
+            .unwrap();
+        let allocation = Tool::Allocation
+            .command(&project, performer, occupied)
+            .unwrap();
+        project = prepare_command(&project, &allocation).unwrap().project;
+        let hidden = project
+            .add_element(work_kind, layer, "Unplaced work", None)
+            .unwrap();
+        let other_layer = if layer == Layer::Oa {
+            Layer::Sa
+        } else {
+            Layer::Oa
+        };
+        let other_kind = if other_layer == Layer::Oa {
+            Kind::Activity
+        } else {
+            Kind::Function
+        };
+        let foreign = project
+            .add_element(other_kind, other_layer, "Other perspective", None)
+            .unwrap();
+        let foreign_performer_kind = if other_layer == Layer::Oa {
+            Kind::Actor
+        } else {
+            Kind::SystemActor
+        };
+        let foreign_performer = project
+            .add_element(foreign_performer_kind, other_layer, "Other performer", None)
+            .unwrap();
+        for (index, id) in [composite, occupied, foreign, foreign_performer]
+            .into_iter()
+            .enumerate()
+        {
+            project.place(
+                diagram,
+                id,
+                Position {
+                    x: index as f32 * 300.,
+                    y: 400.,
+                },
+            );
+        }
+        let port_owner = if layer == Layer::Sa { work } else { foreign };
+        let port_id = Id::new_v4();
+        let port = make_port(
+            &project,
+            port_id,
+            port_owner,
+            "Work input",
+            PortContract::FunctionInput {
+                incoming_items: vec![],
+            },
+        )
+        .unwrap();
+        project.elements.insert(port_id, port);
+        let mut app = App::with_project(project);
+        let _ = app.update(Message::Diagram(crate::app::Choice {
+            id: diagram,
+            label: app.project().diagrams[&diagram].name.clone(),
+        }));
+        let before = app.document.bundle().clone();
+        let original = app.project().clone();
+        let revision = app.document.revision();
+        send(&mut app, Event::Choose(Some(Tool::Allocation)));
+        assert!(
+            app.connection
+                .as_ref()
+                .unwrap()
+                .candidates
+                .contains(&foreign_performer)
+        );
+        let context = app.route_context().unwrap();
+        send(&mut app, Event::Endpoint(context, performer));
+        assert!(app.connection.as_ref().unwrap().candidates.contains(&work));
+        assert!(Tool::Allocation.can_connect(app.project(), performer, hidden));
+        for target in [composite, occupied, foreign, port_id, hidden, performer] {
+            assert!(
+                !app.connection
+                    .as_ref()
+                    .unwrap()
+                    .candidates
+                    .contains(&target)
+            );
+            send(&mut app, Event::Endpoint(context, target));
+            assert_eq!(app.document.revision(), revision);
+            assert_eq!(app.project(), &original);
+            assert_eq!(app.document.bundle(), &before);
+        }
+        for target in [composite, occupied, foreign, port_id, performer] {
+            assert!(
+                Tool::Allocation
+                    .command(app.project(), performer, target)
+                    .is_err()
+            );
+        }
+        send(&mut app, Event::Endpoint(context, work));
+        assert_eq!(
+            app.document.revision(),
+            revision + 1,
+            "Invalid clicks do not prevent recovery"
+        );
+    }
+}
+
+#[test]
+fn allocation_creation_preserves_saved_edge_filters() {
+    let (base, performer, work, diagram) =
+        allocation_fixture(Layer::Oa, ProjectionKind::Decomposition);
+    let mut project = base.project().clone();
+    project
+        .diagrams
+        .get_mut(&diagram)
+        .unwrap()
+        .view_options
+        .relation_kinds = oa_core::view_options::RelationKinds::Only(vec![]);
+    let diagrams = project.diagrams.clone();
+    let mut app = App::with_project(project);
+    let _ = app.update(Message::Diagram(crate::app::Choice {
+        id: diagram,
+        label: app.project().diagrams[&diagram].name.clone(),
+    }));
+    let context = start_allocation(&mut app, performer);
+    send(&mut app, Event::Endpoint(context, work));
+    assert_eq!(
+        app.project().relations[&app.selected].kind(),
+        RelationKind::Allocation
+    );
+    assert_eq!(app.project().diagrams, diagrams);
+    assert!(project_view(app.project(), diagram).edges.is_empty());
+    assert!(app.status.contains("view filters are unchanged"));
+}
+
+#[test]
+fn allocation_mixed_view_keeps_captured_canvas_for_opposite_layer_pairs() {
+    for owner_layer in [Layer::Oa, Layer::Sa] {
+        for app_layer in [Layer::Oa, Layer::Sa] {
+            let (base, owner_performer, owner_work, diagram) =
+                allocation_fixture(owner_layer, ProjectionKind::Traceability);
+            let mut project = base.project().clone();
+            let layer = if owner_layer == Layer::Oa {
+                Layer::Sa
+            } else {
+                Layer::Oa
+            };
+            let (performer_kind, work_kind) = if layer == Layer::Oa {
+                (Kind::Actor, Kind::Activity)
+            } else {
+                (Kind::SystemActor, Kind::Function)
+            };
+            let performer = project.add(performer_kind, "Opposite-layer performer", 40., 60.);
+            let work = project.add(work_kind, "Opposite-layer work", 420., 60.);
+            project.place(diagram, performer, Position { x: 40., y: 350. });
+            project.place(diagram, work, Position { x: 420., y: 350. });
+            let mut app = App::with_project(project);
+            let _ = app.update(Message::Diagram(crate::app::Choice {
+                id: diagram,
+                label: app.project().diagrams[&diagram].name.clone(),
+            }));
+            let _ = app.update(Message::Pan(iced::Vector::new(73., 29.)));
+            app.layer = app_layer;
+            let camera = (app.pan, app.zoom);
+            let before = app.document.bundle().clone();
+            let original = app.project().clone();
+            let revision = app.document.revision();
+            let cancelled = start_allocation(&mut app, performer);
+            let _ = app.update(Message::Escape);
+            send(&mut app, Event::Endpoint(cancelled, work));
+            assert!(app.connection.is_none());
+            assert_eq!(app.layer, app_layer);
+            assert_eq!(app.active_diagram, Some(diagram));
+            assert_eq!((app.pan, app.zoom), camera);
+            assert_eq!(app.document.bundle(), &before);
+            let context = start_allocation(&mut app, performer);
+            assert_eq!(app.active_diagram, Some(diagram));
+            assert_eq!(app.layer, app_layer);
+            assert_eq!(app.route_context(), Some(context));
+            assert_eq!((app.pan, app.zoom), camera);
+            assert_eq!(app.selected, performer);
+            assert!(app.connection.as_ref().unwrap().candidates.contains(&work));
+            for wrong_target in [owner_performer, owner_work] {
+                assert!(
+                    !app.connection
+                        .as_ref()
+                        .unwrap()
+                        .candidates
+                        .contains(&wrong_target)
+                );
+                send(&mut app, Event::Endpoint(context, wrong_target));
+                assert_eq!(app.project(), &original);
+                assert_eq!(app.layer, app_layer);
+                assert_eq!(app.active_diagram, Some(diagram));
+                assert_eq!((app.pan, app.zoom), camera);
+                assert_eq!(app.document.bundle(), &before);
+            }
+            send(&mut app, Event::Endpoint(context, work));
+            assert!(app.connection.is_none());
+            assert_eq!(app.document.revision(), revision + 1);
+            assert_eq!(app.active_diagram, Some(diagram));
+            assert_eq!(app.layer, owner_layer);
+            assert_eq!((app.pan, app.zoom), camera);
+            let relation = &app.project().relations[&app.selected];
+            assert_eq!(
+                relation.body,
+                RelationBody::new(RelationKind::Allocation, performer, work)
+            );
+            let mut expected = original.clone();
+            expected.relations.insert(relation.id, relation.clone());
+            assert_eq!(app.project(), &expected);
+            let after = app.document.bundle().clone();
+            let _ = app.update(Message::Undo);
+            assert_eq!(app.project(), &original);
+            assert_eq!(app.document.bundle(), &before);
+            assert_eq!(app.active_diagram, Some(diagram));
+            assert_eq!((app.pan, app.zoom), camera);
+            let _ = app.update(Message::Redo);
+            assert_eq!(app.project(), &expected);
+            assert_eq!(app.document.bundle(), &after);
+            assert_eq!(app.active_diagram, Some(diagram));
+            assert_eq!((app.pan, app.zoom), camera);
+        }
+    }
+}
+
+#[test]
+fn allocation_cancel_navigation_stale_context_and_pending_edits_preserve_model() {
+    let (mut app, performer, work, diagram) =
+        allocation_fixture(Layer::Oa, ProjectionKind::Decomposition);
+    let original = app.project().clone();
+    let before = app.document.bundle().clone();
+    let old = start_allocation(&mut app, performer);
+    let _ = app.update(Message::Escape);
+    assert!(app.connection.is_none());
+    send(&mut app, Event::Endpoint(old, work));
+    let current = start_allocation(&mut app, performer);
+    send(&mut app, Event::Endpoint(old, work));
+    assert_eq!(app.connection.as_ref().unwrap().context, current);
+    let _ = app.update(Message::Page(Page::Catalog));
+    assert!(app.connection.is_none());
+    let _ = app.update(Message::Page(Page::Diagram));
+    let _ = app.update(Message::Diagram(crate::app::Choice {
+        id: diagram,
+        label: app.project().diagrams[&diagram].name.clone(),
+    }));
+    start_allocation(&mut app, performer);
+    send(&mut app, Event::Choose(None));
+    assert!(app.connection.is_none());
+    start_allocation(&mut app, performer);
+    send(&mut app, Event::Choose(Some(Tool::Interaction)));
+    assert_eq!(app.connection.as_ref().unwrap().tool, Tool::Interaction);
+    assert_eq!(app.project(), &original);
+    let current = start_allocation(&mut app, performer);
+    for stale in [
+        Context {
+            document: Id::new_v4(),
+            ..current
+        },
+        Context {
+            diagram: Id::new_v4(),
+            ..current
+        },
+        Context {
+            revision: current.revision + 1,
+            ..current
+        },
+    ] {
+        send(&mut app, Event::Endpoint(stale, work));
+        assert_eq!(app.connection.as_ref().unwrap().context, current);
+    }
+    app.delete_pending = true;
+    send(&mut app, Event::Endpoint(current, work));
+    assert_eq!(app.project(), &original);
+    let _ = app.update(Message::CancelDelete);
+    let _ = app.update(Message::Escape);
+    let _ = app.update(Message::Select(performer));
+    let _ = app.update(Message::Field(
+        "/name".into(),
+        "Unapplied performer name".into(),
+    ));
+    send(&mut app, Event::Choose(Some(Tool::Allocation)));
+    assert!(app.connection.is_none());
+    assert!(app.draft_dirty());
+    assert_eq!(app.project(), &original);
+    assert_eq!(app.document.bundle(), &before);
+
+    let (mut source_app, performer, work, _) =
+        allocation_fixture(Layer::Sa, ProjectionKind::Decomposition);
+    let before = source_app.document.bundle().clone();
+    let context = start_allocation(&mut source_app, performer);
+    use iced::widget::text_editor;
+    let _ = source_app.update(Message::SourceEdit(text_editor::Action::SelectAll));
+    let _ = source_app.update(Message::SourceEdit(text_editor::Action::Edit(
+        text_editor::Edit::Paste(std::sync::Arc::new("invalid raw source retained".into())),
+    )));
+    send(&mut source_app, Event::Endpoint(context, work));
+    send(&mut source_app, Event::Choose(Some(Tool::Allocation)));
+    assert!(source_app.connection.is_none());
+    assert!(source_app.source_dirty());
+    assert_eq!(
+        source_app.source_editor.text(),
+        "invalid raw source retained"
+    );
+    assert_eq!(source_app.document.bundle(), &before);
+}

crates/oa-desktop/src/connection_edit.rs

@@ -52,6 +52,8 @@ mod tests {
     use crate::app::{App, Message, Page};
     use oa_core::*;
 
+    include!("connection_allocation_tests.rs");
+
     fn fixture() -> (App, Id, Id, Id) {
         let mut p = Project::empty();
         let a = p.add(Kind::Function, "Send command", 0., 0.);

crates/oa-desktop/src/connection_tool.rs

@@ -9,13 +9,18 @@ pub enum Tool {
     CommunicationMean,
     FunctionalExchange,
     BoundaryExchange,
+    Allocation,
 }
 
 impl Tool {
     pub fn for_layer(layer: Layer) -> &'static [Self] {
         match layer {
-            Layer::Oa => &[Self::Interaction, Self::CommunicationMean],
-            Layer::Sa => &[Self::FunctionalExchange, Self::BoundaryExchange],
+            Layer::Oa => &[Self::Interaction, Self::CommunicationMean, Self::Allocation],
+            Layer::Sa => &[
+                Self::FunctionalExchange,
+                Self::BoundaryExchange,
+                Self::Allocation,
+            ],
         }
     }
 
@@ -25,11 +30,15 @@ impl Tool {
             Self::CommunicationMean => "Communication means",
             Self::FunctionalExchange => "Functional exchange",
             Self::BoundaryExchange => "Boundary exchange",
+            Self::Allocation => "Allocation",
         }
     }
 
     pub fn hint(self) -> &'static str {
         match self {
+            Self::Allocation => {
+                "Click a performer, then highlighted unallocated leaf work. In allocated-work views, allocation appears as nesting rather than a line."
+            }
             Self::Interaction => "Click a source activity, then a target activity.",
             Self::CommunicationMean => {
                 "Click an operational entity or actor, then another participant. Communication is bidirectional unless you change its orientation."
@@ -45,6 +54,10 @@ impl Tool {
 
     pub fn can_start(self, project: &Project, source: Id) -> bool {
         match self {
+            Self::Allocation => project
+                .elements
+                .get(&source)
+                .is_some_and(|e| e.kind().is_performer()),
             Self::CommunicationMean => project.elements.get(&source).is_some_and(|e| {
                 e.layer() == Layer::Oa && matches!(e.kind(), Kind::Entity | Kind::Actor)
             }),
@@ -65,6 +78,9 @@ impl Tool {
             return false;
         }
         match self {
+            Self::Allocation => {
+                validation::can_connect(project, RelationKind::Allocation, source, target)
+            }
             Self::CommunicationMean => {
                 validation::can_connect(project, RelationKind::CommunicationMean, source, target)
             }
@@ -140,6 +156,7 @@ impl Tool {
         }
         let name = engineering_name(project, self, source, target);
         let body = match self {
+            Self::Allocation => RelationBody::new(RelationKind::Allocation, source, target),
             Self::CommunicationMean => {
                 RelationBody::new(RelationKind::CommunicationMean, source, target)
             }
@@ -162,6 +179,28 @@ impl Tool {
         prepare_command(project, &command)?;
         Ok(command)
     }
+
+    /// Both endpoint categories must be supported before offering Allocation.
+    /// Preserve the established projection eligibility of the exchange tools.
+    pub fn available_in(self, layer: Layer, projection: ProjectionKind) -> bool {
+        if !Self::for_layer(layer).contains(&self) {
+            return false;
+        }
+        let kind = match self {
+            Self::Interaction => Kind::Activity,
+            Self::CommunicationMean => Kind::Entity,
+            Self::FunctionalExchange => Kind::Function,
+            Self::BoundaryExchange => Kind::System,
+            Self::Allocation => {
+                let (performer, work) = match layer {
+                    Layer::Oa => (Kind::Entity, Kind::Activity),
+                    Layer::Sa => (Kind::System, Kind::Function),
+                };
+                return projection.includes(performer) && projection.includes(work);
+            }
+        };
+        projection.includes(kind)
+    }
 }
 
 /// A clicked port determines its own function owner. It cannot be paired with
@@ -291,7 +330,7 @@ mod tests {
         let before = p.clone();
         assert_eq!(
             Tool::for_layer(Layer::Oa),
-            &[Tool::Interaction, Tool::CommunicationMean]
+            &[Tool::Interaction, Tool::CommunicationMean, Tool::Allocation]
         );
         assert_eq!(
             Tool::Interaction.targets(&p, source),
@@ -592,6 +631,8 @@ mod tests {
             (Tool::CommunicationMean, oa_team, oa_actor),
             (Tool::FunctionalExchange, sa_a, sa_b),
             (Tool::BoundaryExchange, boundary_a, boundary_b),
+            (Tool::Allocation, oa_team, oa_a),
+            (Tool::Allocation, system, sa_a),
         ] {
             let before = document.bundle().clone();
             let original = document.project().clone();

crates/oa-desktop/src/diagram.rs

@@ -22,6 +22,9 @@ use std::{
     sync::Arc,
 };
 #[cfg(test)]
+#[path = "diagram/allocation_group_tests.rs"]
+mod allocation_group_tests;
+#[cfg(test)]
 #[path = "diagram/attachment_tests.rs"]
 mod attachment_tests;
 #[cfg(test)]
@@ -34,6 +37,9 @@ mod port_hit_tests;
 #[path = "diagram/view_options_tests.rs"]
 mod view_options_tests;
 
+#[path = "diagram/label_layout_experiment.rs"]
+mod label_layout_experiment;
+
 #[path = "diagram/port_labels.rs"]
 mod port_labels;
 pub use port_labels::PortLabels;
@@ -85,8 +91,14 @@ pub struct State {
     cache: RefCell<Option<CachedScene>>,
 }
 struct Scene {
+    label_layout: Option<label_layout_experiment::Layout>,
+    profile: label_layout_experiment::Profile,
+    font_version: Option<iced::advanced::graphics::text::Version>,
     work: Option<Arc<crate::app::allocation_drag::Preview>>,
     view: ProjectedView,
+    /// Core routing is the gesture baseline. Presentation-only wrapping must
+    /// never become a frozen label in a later core preview.
+    core_routed: Arc<RoutedView>,
     routed: Arc<RoutedView>,
 }
 struct CachedScene {
@@ -511,6 +523,14 @@ impl DiagramCanvas<'_> {
         }
     }
     fn scene(&self, state: &State) -> Arc<Scene> {
+        self.scene_with_profile(state, label_layout_experiment::profile())
+    }
+    fn scene_with_profile(
+        &self,
+        state: &State,
+        profile: label_layout_experiment::Profile,
+    ) -> Arc<Scene> {
+        let font_version = label_layout_experiment::font_version(profile);
         if let Some(preview) = self.work_preview()
             && state
                 .work
@@ -519,13 +539,32 @@ impl DiagramCanvas<'_> {
         {
             if let Some(scene) = state.work_cache.borrow().as_ref()
                 && scene.work.as_ref().is_some_and(|p| Arc::ptr_eq(p, preview))
+                && scene.profile == profile
+                && scene.font_version == font_version
             {
                 return scene.clone();
             }
+            let core_routed = preview.routed.clone();
+            let mut routed = core_routed.clone();
+            let label_layout = if profile == label_layout_experiment::Profile::Baseline {
+                None
+            } else {
+                label_layout_experiment::apply(
+                    preview.project(),
+                    &preview.placement.diagram,
+                    &preview.placement.view,
+                    Arc::make_mut(&mut routed),
+                    profile,
+                )
+            };
             let scene = Arc::new(Scene {
+                label_layout,
+                profile,
+                font_version,
                 work: Some(preview.clone()),
                 view: preview.placement.view.clone(),
-                routed: preview.routed.clone(),
+                core_routed,
+                routed,
             });
             *state.work_cache.borrow_mut() = Some(scene.clone());
             return scene;
@@ -551,6 +590,8 @@ impl DiagramCanvas<'_> {
             && cache.preview == preview
             && cache.route == route
             && cache.port == port
+            && cache.scene.profile == profile
+            && cache.scene.font_version == font_version
         {
             return cache.scene.clone();
         }
@@ -560,7 +601,7 @@ impl DiagramCanvas<'_> {
             self.project.diagrams[&self.diagram].clone()
         };
         let view = self.projected(&diagram);
-        let routed = Arc::new(
+        let core_routed = Arc::new(
             if let Some(gesture) = state
                 .route_drag
                 .as_ref()
@@ -577,9 +618,25 @@ impl DiagramCanvas<'_> {
                 route_diagram(self.project, &diagram, &view)
             },
         );
+        let mut routed = core_routed.clone();
+        let label_layout = if profile == label_layout_experiment::Profile::Baseline {
+            None
+        } else {
+            label_layout_experiment::apply(
+                self.project,
+                &diagram,
+                &view,
+                Arc::make_mut(&mut routed),
+                profile,
+            )
+        };
         let scene = Arc::new(Scene {
+            label_layout,
+            profile,
+            font_version,
             work: None,
             view,
+            core_routed,
             routed,
         });
         *state.cache.borrow_mut() = Some(CachedScene {
@@ -592,7 +649,23 @@ impl DiagramCanvas<'_> {
         scene
     }
     fn begin_route(&self, state: &mut State, world: Point, handle: Handle, route: EdgeRoute) {
-        let baseline = self.scene(state).routed.clone();
+        self.begin_route_with_profile(
+            state,
+            world,
+            handle,
+            route,
+            label_layout_experiment::profile(),
+        );
+    }
+    fn begin_route_with_profile(
+        &self,
+        state: &mut State,
+        world: Point,
+        handle: Handle,
+        route: EdgeRoute,
+        profile: label_layout_experiment::Profile,
+    ) {
+        let baseline = self.scene_with_profile(state, profile).core_routed.clone();
         state.route_drag = Some(Gesture {
             context: self.context,
             start: world,
@@ -912,6 +985,15 @@ impl canvas::Program<Message> for DiagramCanvas<'_> {
                     state.pan_start = None;
                     return Some(Action::publish(Message::Connection(event)).and_capture());
                 }
+                // group_input handles production selection first (including
+                // Shift). This also closes legacy movement when selection or
+                // Allocation capability is absent: never emit a bare MoveNode.
+                if self.allocation_surface()
+                    && let Some(target) = self.allocation_press_target(&scene, p)
+                    && self.allocation_handles_press(&target)
+                {
+                    return Some(self.begin_allocation(state, target, cursor.position()?, bounds));
+                }
                 if self.editable
                     && let Some(edge) = scene.routed.edges.get(&self.selected)
                     && !edge.custom_suspended
@@ -984,16 +1066,6 @@ impl canvas::Program<Message> for DiagramCanvas<'_> {
                     return Some(Action::publish(Message::Select(port.element)).and_capture());
                 }
                 if let Some(id) = self.hit(view, p) {
-                    if self.work_eligible(id) {
-                        return Some(self.begin_work(
-                            state,
-                            id,
-                            cursor.position()?,
-                            bounds,
-                            view,
-                            &scene.routed,
-                        ));
-                    }
                     let position = self
                         .project
                         .diagrams
@@ -1269,10 +1341,7 @@ impl canvas::Program<Message> for DiagramCanvas<'_> {
         f.translate(self.pan);
         f.scale(self.zoom);
         let scene = self.scene(state);
-        let project = scene
-            .work
-            .as_ref()
-            .map_or(self.project, |p| p.semantic.project());
+        let project = scene.work.as_ref().map_or(self.project, |p| p.project());
         let view = &scene.view;
         let containers = view
             .nodes
@@ -1356,16 +1425,27 @@ impl canvas::Program<Message> for DiagramCanvas<'_> {
                     Size::new(label.bounds.size.width, label.bounds.size.height),
                     Color::WHITE,
                 );
-                f.fill_text(Text {
-                    content: label.text.clone(),
-                    position: point(label.center),
-                    color: if active { style::TEAL } else { style::MUTED },
-                    size: 13.into(),
-                    align_x: iced::widget::text::Alignment::Center,
-                    align_y: iced::alignment::Vertical::Center,
-                    max_width: f32::INFINITY,
-                    ..Default::default()
-                });
+                if let Some(layout) = scene
+                    .label_layout
+                    .as_ref()
+                    .filter(|_| edge.id == label_layout_experiment::edge_id())
+                {
+                    for line in layout.canvas_lines(if active { style::TEAL } else { style::MUTED })
+                    {
+                        f.fill_text(line);
+                    }
+                } else {
+                    f.fill_text(Text {
+                        content: label.text.clone(),
+                        position: point(label.center),
+                        color: if active { style::TEAL } else { style::MUTED },
+                        size: 13.into(),
+                        align_x: iced::widget::text::Alignment::Center,
+                        align_y: iced::alignment::Vertical::Center,
+                        max_width: f32::INFINITY,
+                        ..Default::default()
+                    });
+                }
             }
             if let Some(relation) = project.relations.get(&edge.id) {
                 for end in routing::association_end_geometry(relation, routed) {
@@ -1944,7 +2024,30 @@ impl std::fmt::Display for ExportError {
 }
 impl std::error::Error for ExportError {}
 
+/// Private opt-in trial adapter for consumers that already own routed geometry.
+pub(crate) fn apply_label_experiment(
+    p: &Project,
+    diagram: &Diagram,
+    view: &ProjectedView,
+    routed: &mut RoutedView,
+) {
+    let _ = label_layout_experiment::apply(
+        p,
+        diagram,
+        view,
+        routed,
+        label_layout_experiment::profile(),
+    );
+}
+
 pub fn export_svg(p: &Project, diagram: Id) -> Result<String, ExportError> {
+    export_svg_with_profile(p, diagram, label_layout_experiment::profile())
+}
+fn export_svg_with_profile(
+    p: &Project,
+    diagram: Id,
+    profile: label_layout_experiment::Profile,
+) -> Result<String, ExportError> {
     let d = p
         .diagrams
         .get(&diagram)
@@ -1953,7 +2056,8 @@ pub fn export_svg(p: &Project, diagram: Id) -> Result<String, ExportError> {
         return Err(ExportError::UnsupportedScenario(diagram));
     }
     let view = project_view(p, diagram);
-    let routed = route_diagram(p, d, &view);
+    let mut routed = route_diagram(p, d, &view);
+    let label_layout = label_layout_experiment::apply(p, d, &view, &mut routed, profile);
     let left = routed.bounds.position.x - 30.;
     let top = routed.bounds.position.y - 30.;
     let right = routed.bounds.position.x + routed.bounds.size.width + 30.;
@@ -2030,7 +2134,12 @@ pub fn export_svg(p: &Project, diagram: Id) -> Result<String, ExportError> {
             .join(" ");
         svg.push_str(&format!("<path data-edge=\"{}\" d=\"{path}\" fill=\"none\" stroke=\"#8999a9\" stroke-width=\"1.5\"{dashed}{arrow}><title>{}</title></path>",edge.id,escape(p.named(edge.id))));
         let label = &route.label;
-        if !label.text.is_empty() {
+        if let Some(layout) = label_layout
+            .as_ref()
+            .filter(|_| edge.id == label_layout_experiment::edge_id())
+        {
+            svg.push_str(&layout.svg());
+        } else if !label.text.is_empty() {
             svg.push_str(&format!("<rect x=\"{}\" y=\"{}\" width=\"{}\" height=\"{}\" fill=\"white\"/><text x=\"{}\" y=\"{}\" text-anchor=\"middle\" dominant-baseline=\"central\" font-family=\"sans-serif\" font-size=\"13\" fill=\"#637487\">{}</text>",label.bounds.position.x,label.bounds.position.y,label.bounds.size.width,label.bounds.size.height,label.center.x,label.center.y,escape(&label.text)));
         }
         if let Some(relation) = p.relations.get(&edge.id) {

crates/oa-desktop/src/diagram/allocation_group_tests.rs

@@ -0,0 +1,520 @@
+//! Exact Allocation dispatch through real canvas events and App rebuilds.
+use super::*;
+use crate::app::{
+    App,
+    allocation_drag::{Event as WorkEvent, Mode},
+    multiselect::{Choice, Event as SelectionEvent, context},
+};
+use crate::diagram_usage::Target;
+use iced::{keyboard, widget::canvas::Program};
+
+#[derive(Clone, Copy, Debug)]
+enum Control {
+    Attachment,
+    Bend,
+}
+
+struct Fixture {
+    app: App,
+    diagram: Id,
+    work: Id,
+    edge: Id,
+    cover: Option<Id>,
+    at: Position,
+}
+fn xy(x: f32, y: f32) -> Position {
+    Position { x, y }
+}
+fn bounds() -> Rectangle {
+    Rectangle::new(Point::new(120., 80.), Size::new(2400., 1800.))
+}
+fn screen(p: Position) -> Point {
+    Point::new(bounds().x + p.x, bounds().y + p.y)
+}
+fn fixture(control: Control, cover: Option<Kind>) -> Fixture {
+    let mut project = Project::empty();
+    let a = project
+        .add_element(Kind::Activity, Layer::Oa, "Send", None)
+        .unwrap();
+    let b = project
+        .add_element(Kind::Activity, Layer::Oa, "Receive", None)
+        .unwrap();
+    let edge = project.relate(RelationKind::Interaction, "Report", a, b);
+    let diagram = project.ensure_diagram(Layer::Oa);
+    project.diagrams.get_mut(&diagram).unwrap().projection = ProjectionKind::Allocation;
+    let work = project.place(diagram, a, xy(100., 150.));
+    project.place(diagram, b, xy(700., 150.));
+    project
+        .diagrams
+        .get_mut(&diagram)
+        .unwrap()
+        .routes
+        .push(EdgeRoute {
+            edge,
+            waypoints: vec![xy(450., 450.)],
+            label: None,
+            source_attachment: Some(EdgeAttachment {
+                side: PortAnchorSide::Right,
+                offset: 0.6,
+            }),
+            target_attachment: Some(EdgeAttachment {
+                side: PortAnchorSide::Left,
+                offset: 0.5,
+            }),
+        });
+    let view = projection::project_view(&project, diagram);
+    let routed = routing::route_diagram(&project, &project.diagrams[&diagram], &view);
+    let at = match control {
+        Control::Attachment => {
+            let at = *routed.edges[&edge].points.first().unwrap();
+            // Inside the handle radius but outside its owner's right boundary,
+            // so the covered-card discriminator does not depend on node order.
+            xy(at.x + 4., at.y)
+        }
+        Control::Bend => routed.edges[&edge].pins[0],
+    };
+    let cover = cover.map(|kind| {
+        let element = project
+            .add_element(kind, Layer::Oa, "Underlying card", None)
+            .unwrap();
+        project.place(diagram, element, xy(at.x - 40., at.y - 35.))
+    });
+    validate_candidate(&project).unwrap();
+    let mut app = App::with_project(project);
+    app.active_diagram = Some(diagram);
+    app.zoom = 1.;
+    app.pan = Vector::ZERO;
+    let _ = app.update(Message::Zoom(1.));
+    let _ = app.update(Message::Select(edge));
+    app.reconcile_multiselect();
+    Fixture {
+        app,
+        diagram,
+        work,
+        edge,
+        cover,
+        at,
+    }
+}
+fn canvas(app: &App) -> DiagramCanvas<'_> {
+    DiagramCanvas {
+        selection: app.diagram_selection.as_ref(),
+        allocation: Some(app.allocation_capability()),
+        project: app.project(),
+        view_index: Some(app.document.view_index()),
+        diagram: app.active_diagram.unwrap(),
+        selected: app.selected,
+        navigation_focus: None,
+        zoom: app.zoom,
+        pan: app.pan,
+        context: app.route_context().unwrap(),
+        selected_bend: app
+            .selected_bend
+            .filter(|(edge, _)| *edge == app.selected)
+            .map(|(_, bend)| bend),
+        selected_attachment: None,
+        editable: !app.draft_dirty() && !app.source_dirty(),
+        placing: false,
+        connection: None,
+    }
+}
+fn input(app: &App, state: &mut State, event: canvas::Event, at: Point) -> Option<Message> {
+    canvas(app)
+        .update(state, &event, bounds(), mouse::Cursor::Available(at))
+        .and_then(|action| action.into_inner().0)
+}
+fn pointer(app: &App, state: &mut State, event: mouse::Event, at: Point) -> Option<Message> {
+    input(app, state, canvas::Event::Mouse(event), at)
+}
+fn mixed(f: &mut Fixture) {
+    for (target, choice) in [
+        (Target::Placement(f.work), Choice::Replace),
+        (Target::Edge(f.edge), Choice::Add),
+    ] {
+        let current = context(f.app.route_context().unwrap());
+        let _ = f
+            .app
+            .update(Message::DiagramSelection(SelectionEvent::Choose(
+                current, target, choice,
+            )));
+    }
+    assert_eq!(f.app.multiselect_snapshot().unwrap().targets().len(), 2);
+    assert_eq!(
+        f.app.selected, f.edge,
+        "selected edge exposes its real handles"
+    );
+}
+fn assert_control(f: &Fixture, control: Control) {
+    let c = canvas(&f.app);
+    let scene = c.scene(&State::default());
+    let edge = &scene.routed.edges[&f.edge];
+    assert!(!edge.custom_suspended);
+    match control {
+        Control::Attachment => assert!(c.attachment_at(&scene, point(f.at)).is_some()),
+        Control::Bend => assert!(edge.pins.contains(&f.at)),
+    }
+    let local = point(f.at);
+    if let Some(cover) = f.cover {
+        assert_eq!(
+            c.hit(&scene.view, local),
+            Some(cover),
+            "fixture actually places a card under the visible control"
+        );
+    } else if matches!(control, Control::Bend) {
+        assert!(
+            c.hit(&scene.view, local).is_none(),
+            "isolated bend has no underlying card"
+        );
+    }
+    assert_eq!(
+        c.allocation_press_target(&scene, local),
+        Some(Target::Edge(f.edge))
+    );
+}
+
+#[test]
+fn allocation_handles_keep_exact_edge_through_shift_and_pending_group_dispatch() {
+    for control in [Control::Attachment, Control::Bend] {
+        for cover in [None, Some(Kind::Activity), Some(Kind::Entity)] {
+            let mut f = fixture(control, cover);
+            mixed(&mut f);
+            assert_control(&f, control);
+            let from = screen(f.at);
+            let mut state = State::default();
+            let _ = input(
+                &f.app,
+                &mut state,
+                canvas::Event::Keyboard(keyboard::Event::ModifiersChanged(
+                    keyboard::Modifiers::SHIFT,
+                )),
+                from,
+            );
+            let _ = pointer(
+                &f.app,
+                &mut state,
+                mouse::Event::CursorMoved { position: from },
+                from,
+            );
+            let message = pointer(
+                &f.app,
+                &mut state,
+                mouse::Event::ButtonPressed(mouse::Button::Left),
+                from,
+            )
+            .unwrap();
+            assert!(
+                matches!(&message, Message::DiagramSelection(SelectionEvent::Choose(_, Target::Edge(id), Choice::Toggle)) if *id == f.edge)
+            );
+            let _ = f.app.update(message);
+            assert_eq!(
+                f.app.multiselect_snapshot().unwrap().targets(),
+                &[Target::Placement(f.work)]
+            );
+            assert!(state.work.is_none() && state.group.is_none() && state.route_drag.is_none());
+        }
+    }
+}
+
+#[test]
+fn allocation_handle_click_collapses_but_out_and_back_refuses_after_app_rebuilds() {
+    for control in [Control::Attachment, Control::Bend] {
+        for cover in [None, Some(Kind::Activity), Some(Kind::Entity)] {
+            for crossed in [false, true] {
+                let mut f = fixture(control, cover);
+                mixed(&mut f);
+                assert_control(&f, control);
+                let accepted = f.app.project().clone();
+                let source = f.app.document.bundle().clone();
+                let revision = f.app.document.revision();
+                let selection = f.app.multiselect_snapshot().unwrap();
+                let from = screen(f.at);
+                let mut state = State::default();
+                let _ = pointer(
+                    &f.app,
+                    &mut state,
+                    mouse::Event::CursorMoved { position: from },
+                    from,
+                );
+                let message = pointer(
+                    &f.app,
+                    &mut state,
+                    mouse::Event::ButtonPressed(mouse::Button::Left),
+                    from,
+                )
+                .unwrap();
+                let Message::WorkDrag(WorkEvent::Press(press)) = &message else {
+                    panic!("exact mixed-set Allocation press")
+                };
+                assert_eq!(press.target, Target::Edge(f.edge));
+                assert_eq!(press.selection, selection);
+                assert_eq!(press.mode, Mode::Assign);
+                let _ = f.app.update(message);
+                assert_eq!(
+                    f.app.multiselect_snapshot().unwrap(),
+                    selection,
+                    "press retains primary and membership"
+                );
+                if crossed {
+                    for at in [from + Vector::new(4., 0.), from] {
+                        let message = pointer(
+                            &f.app,
+                            &mut state,
+                            mouse::Event::CursorMoved { position: at },
+                            at,
+                        )
+                        .unwrap();
+                        assert!(matches!(
+                            &message,
+                            Message::WorkDrag(WorkEvent::Preview(..))
+                        ));
+                        let _ = f.app.update(message);
+                    }
+                }
+                let message = pointer(
+                    &f.app,
+                    &mut state,
+                    mouse::Event::ButtonReleased(mouse::Button::Left),
+                    from,
+                )
+                .unwrap();
+                assert!(matches!(
+                    &message,
+                    Message::WorkDrag(WorkEvent::Release(..))
+                ));
+                let _ = f.app.update(message);
+                if crossed {
+                    assert_eq!(
+                        f.app.multiselect_snapshot().unwrap(),
+                        selection,
+                        "crossed return cannot collapse or move an underlying card"
+                    );
+                } else {
+                    assert_eq!(
+                        f.app.multiselect_snapshot().unwrap().targets(),
+                        &[Target::Edge(f.edge)]
+                    );
+                }
+                assert_eq!(f.app.project(), &accepted);
+                assert_eq!(f.app.document.bundle(), &source);
+                assert_eq!(f.app.document.revision(), revision);
+                assert!(!f.app.document.can_undo());
+                assert!(!f.app.document.can_redo());
+                assert!(
+                    state.work.is_none() && state.group.is_none() && state.route_drag.is_none()
+                );
+            }
+        }
+    }
+}
+
+#[test]
+fn armed_isolated_bend_is_owned_but_unarmed_controls_still_edit_routes() {
+    for control in [Control::Attachment, Control::Bend] {
+        for armed in [false, true] {
+            let mut f = fixture(control, None);
+            assert_control(&f, control);
+            if armed {
+                let _ = f.app.update(Message::WorkDrag(WorkEvent::ArrangeNext));
+            }
+            let from = screen(f.at);
+            let mut state = State::default();
+            let _ = pointer(
+                &f.app,
+                &mut state,
+                mouse::Event::CursorMoved { position: from },
+                from,
+            );
+            let message = pointer(
+                &f.app,
+                &mut state,
+                mouse::Event::ButtonPressed(mouse::Button::Left),
+                from,
+            );
+            if armed {
+                let Some(Message::WorkDrag(WorkEvent::Press(press))) = message else {
+                    panic!("armed handle requires Allocation ownership")
+                };
+                assert_eq!(press.target, Target::Edge(f.edge));
+                assert_eq!(press.mode, Mode::Arrange);
+                assert!(state.work.is_some());
+                assert!(state.route_drag.is_none());
+            } else {
+                assert!(state.work.is_none());
+                let gesture = state
+                    .route_drag
+                    .as_ref()
+                    .expect("ordinary selected handle remains a route editor");
+                match control {
+                    Control::Attachment => {
+                        assert!(matches!(gesture.handle, Handle::Attachment { .. }))
+                    }
+                    Control::Bend => assert!(matches!(gesture.handle, Handle::Bend(0))),
+                }
+                assert!(!matches!(message, Some(Message::WorkDrag(_))));
+            }
+        }
+    }
+}
+
+#[test]
+fn ordinary_performer_body_uses_one_token_and_retains_existing_movement_policy() {
+    let mut f = fixture(Control::Bend, None);
+    let mut project = f.app.project().clone();
+    let performer = project
+        .add_element(Kind::Entity, Layer::Oa, "Mover", None)
+        .unwrap();
+    let node = project.place(f.diagram, performer, xy(1200., 800.));
+    f.app = App::with_project(project);
+    f.app.active_diagram = Some(f.diagram);
+    f.app.zoom = 1.;
+    f.app.pan = Vector::ZERO;
+    let _ = f.app.update(Message::Zoom(1.));
+    f.app.reconcile_multiselect();
+    let accepted = f.app.project().clone();
+    let source = f.app.document.bundle().clone();
+    let from = screen(xy(1240., 835.));
+    let to = from + Vector::new(30., 20.);
+    let mut state = State::default();
+    let _ = pointer(
+        &f.app,
+        &mut state,
+        mouse::Event::CursorMoved { position: from },
+        from,
+    );
+    let message = pointer(
+        &f.app,
+        &mut state,
+        mouse::Event::ButtonPressed(mouse::Button::Left),
+        from,
+    )
+    .unwrap();
+    assert!(
+        matches!(&message, Message::WorkDrag(WorkEvent::Press(p)) if p.target == Target::Placement(node) && p.mode == Mode::Assign)
+    );
+    let _ = f.app.update(message);
+    assert_eq!(
+        f.app.selected, performer,
+        "clean unselected press selects immediately"
+    );
+    assert_eq!(
+        f.app.multiselect_snapshot().unwrap().targets(),
+        &[Target::Placement(node)]
+    );
+    for event in [
+        mouse::Event::CursorMoved { position: to },
+        mouse::Event::ButtonReleased(mouse::Button::Left),
+    ] {
+        let message = pointer(&f.app, &mut state, event, to).unwrap();
+        assert!(matches!(
+            &message,
+            Message::WorkDrag(WorkEvent::Preview(..) | WorkEvent::Release(..))
+        ));
+        let _ = f.app.update(message);
+    }
+    let mut expected = accepted;
+    expected
+        .diagrams
+        .get_mut(&f.diagram)
+        .unwrap()
+        .nodes
+        .get_mut(&node)
+        .unwrap()
+        .position = xy(1230., 820.);
+    assert_eq!(f.app.project(), &expected);
+    assert_eq!(f.app.document.revision(), 1);
+    let after = f.app.document.bundle().clone();
+    let _ = f.app.update(Message::Undo);
+    assert_eq!(f.app.document.bundle(), &source);
+    let _ = f.app.update(Message::Redo);
+    assert_eq!(f.app.document.bundle(), &after);
+}
+
+#[test]
+fn dirty_selected_pin_outer_ring_is_shielded_without_starting_pan() {
+    for zoom in [0.5, 1., 2.] {
+        let mut f = fixture(Control::Bend, None);
+        let mut project = f.app.project().clone();
+        let route = &mut project.diagrams.get_mut(&f.diagram).unwrap().routes[0];
+        route.source_attachment.as_mut().unwrap().offset = 0.5;
+        route.target_attachment.as_mut().unwrap().offset = 0.5;
+        let view = projection::project_view(&project, f.diagram);
+        let routed = routing::route_diagram(&project, &project.diagrams[&f.diagram], &view);
+        let y = routed.edges[&f.edge].points.first().unwrap().y;
+        assert_eq!(routed.edges[&f.edge].points.last().unwrap().y, y);
+        let pin = xy(450., y);
+        project.diagrams.get_mut(&f.diagram).unwrap().routes[0].waypoints = vec![pin];
+        f.app = App::with_project(project);
+        f.app.active_diagram = Some(f.diagram);
+        f.app.zoom = zoom;
+        f.app.pan = Vector::ZERO;
+        let _ = f.app.update(Message::Zoom(1.));
+        let _ = f.app.update(Message::Select(f.edge));
+        let _ = f.app.update(Message::Field(
+            "/name".into(),
+            "Keep this unfinished relation name".into(),
+        ));
+        assert!(f.app.draft_dirty());
+        let c = canvas(&f.app);
+        assert!(!c.editable);
+        let scene = c.scene(&State::default());
+        assert!(!scene.routed.edges[&f.edge].custom_suspended);
+        assert_eq!(scene.routed.edges[&f.edge].pins, vec![pin]);
+        let local = Point::new(pin.x * zoom, pin.y * zoom + 7.5);
+        let at = Point::new(bounds().x + local.x, bounds().y + local.y);
+        assert!(c.hit(&scene.view, local).is_none());
+        assert!(c.hit_port(&scene.view, local).is_none());
+        assert!(
+            c.hit_edge(&scene.routed, local).is_none(),
+            "outer ring lies beyond the ordinary 7px edge hit"
+        );
+        assert!(c.hit_label(&scene.routed, local).is_none());
+        assert!(c.hit_association_label(&scene.routed, local).is_none());
+        assert!(
+            c.work_dirty_point(bounds(), at),
+            "the root shield must cover the visible 8px pin handle while editable=false"
+        );
+        let project = f.app.project().clone();
+        let source = f.app.document.bundle().clone();
+        let selection = f.app.multiselect_snapshot().unwrap();
+        let draft = f.app.draft.as_ref().unwrap().value.clone();
+        let revision = f.app.document.revision();
+        let pan = f.app.pan;
+        let mut state = State::default();
+        let _ = pointer(
+            &f.app,
+            &mut state,
+            mouse::Event::CursorMoved { position: at },
+            at,
+        );
+        let message = pointer(
+            &f.app,
+            &mut state,
+            mouse::Event::ButtonPressed(mouse::Button::Left),
+            at,
+        )
+        .unwrap();
+        assert!(matches!(
+            &message,
+            Message::WorkDrag(WorkEvent::Refused(..))
+        ));
+        let _ = f.app.update(message);
+        assert!(state.pan_start.is_none() && state.route_drag.is_none() && state.work.is_none());
+        let moved = at + Vector::new(40., 20.);
+        for event in [
+            mouse::Event::CursorMoved { position: moved },
+            mouse::Event::ButtonReleased(mouse::Button::Left),
+        ] {
+            let message = pointer(&f.app, &mut state, event, moved);
+            assert!(
+                message.is_none(),
+                "refused handle press must not become background pan or a selector"
+            );
+        }
+        assert_eq!(f.app.project(), &project);
+        assert_eq!(f.app.document.bundle(), &source);
+        assert_eq!(f.app.document.revision(), revision);
+        assert_eq!(f.app.multiselect_snapshot().unwrap(), selection);
+        assert_eq!(f.app.draft.as_ref().unwrap().value, draft);
+        assert_eq!(f.app.pan, pan);
+    }
+}

crates/oa-desktop/src/diagram/attachment_tests.rs

@@ -421,14 +421,19 @@ fn coincident_attachment_handles_honor_explicit_end_choice() {
         EdgeEnd::Target,
     )));
     let c = canvas(&app, 1.);
+    let core_routed = Arc::new(route_diagram(
+        c.project,
+        &c.project.diagrams[&c.diagram],
+        &projection::project_view(c.project, c.diagram),
+    ));
     let mut scene = Scene {
+        label_layout: None,
+        profile: label_layout_experiment::Profile::Baseline,
+        font_version: None,
         work: None,
         view: projection::project_view(c.project, c.diagram),
-        routed: Arc::new(route_diagram(
-            c.project,
-            &c.project.diagrams[&c.diagram],
-            &projection::project_view(c.project, c.diagram),
-        )),
+        routed: core_routed.clone(),
+        core_routed,
     };
     let routed = Arc::make_mut(&mut scene.routed);
     let edge = routed.edges.get_mut(&c.selected).unwrap();

crates/oa-desktop/src/diagram/label_layout_experiment.rs

@@ -0,0 +1,767 @@
+//! Explicit, one-fixture visual experiment. No persisted formatting policy.
+use super::*;
+use iced::advanced::{graphics::text as graphics_text, text as shaped};
+use shaped::Paragraph as _;
+use std::sync::{Mutex, OnceLock};
+
+const DIAGRAM: u128 = 0x00000000003840008000000000000001;
+const EDGE: u128 = 0x63009b5f539e5914b630ec6b7fefb4d5;
+pub(super) fn edge_id() -> Id {
+    Id::from_u128(EDGE)
+}
+
+const NAME: &str = "Technician service conversation";
+const FONT_SIZE: f32 = 13.;
+const ADVANCE: f32 = 16.;
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub(super) enum Profile {
+    #[default]
+    Baseline,
+    E,
+    F,
+}
+pub(super) fn profile() -> Profile {
+    static PROFILE: OnceLock<Profile> = OnceLock::new();
+    *PROFILE.get_or_init(
+        || match std::env::var("ARCADIA_LABEL_EXPERIMENT").as_deref() {
+            Ok("E") => Profile::E,
+            Ok("F") => Profile::F,
+            _ => Profile::Baseline,
+        },
+    )
+}
+
+#[derive(Clone, Debug, PartialEq)]
+struct MeasuredLine {
+    text: &'static str,
+    width: f32,
+    baseline: f32,
+    family: String,
+}
+#[derive(Clone, Debug, PartialEq)]
+pub(super) struct Line {
+    pub text: &'static str,
+    pub position: Position,
+    pub baseline_y: f32,
+    pub width: f32,
+    pub family: String,
+}
+#[derive(Clone, Debug, PartialEq)]
+pub(super) struct Layout {
+    pub canonical_text: String,
+    pub lines: Vec<Line>,
+    pub geometry: routing::EdgeLabelGeometry,
+    /// Authored moves retain their shape even outside the automatic guard.
+    pub clear: bool,
+}
+
+pub(super) fn font_version(profile: Profile) -> Option<graphics_text::Version> {
+    (profile != Profile::Baseline).then(|| {
+        graphics_text::font_system()
+            .read()
+            .expect("Read font system")
+            .version()
+    })
+}
+
+fn measured(profile: Profile) -> Option<Arc<Vec<MeasuredLine>>> {
+    type Entry = (Profile, graphics_text::Version, Arc<Vec<MeasuredLine>>);
+    static CACHE: OnceLock<Mutex<Vec<Entry>>> = OnceLock::new();
+    let version = font_version(profile)?;
+    let mut cache = CACHE.get_or_init(|| Mutex::new(Vec::new())).lock().ok()?;
+    if let Some((_, _, lines)) = cache
+        .iter()
+        .find(|(p, v, _)| *p == profile && *v == version)
+    {
+        return Some(lines.clone());
+    }
+    let strings: &[&'static str] = match profile {
+        Profile::Baseline => return None,
+        Profile::E => &["Technician service", "conversation"],
+        Profile::F => &["Technician", "service", "conversation"],
+    };
+    let mut lines = Vec::new();
+    for &content in strings {
+        let paragraph = graphics_text::Paragraph::with_text(shaped::Text {
+            content,
+            bounds: Size::INFINITE,
+            size: FONT_SIZE.into(),
+            line_height: shaped::LineHeight::Absolute(ADVANCE.into()),
+            font: iced::Font::default(),
+            align_x: shaped::Alignment::Left,
+            align_y: iced::alignment::Vertical::Top,
+            shaping: shaped::Shaping::Basic,
+            wrapping: shaped::Wrapping::None,
+        });
+        let mut runs = paragraph.buffer().layout_runs();
+        let run = runs.next()?;
+        if runs.next().is_some() || run.rtl || run.glyphs.is_empty() {
+            return None;
+        }
+        let width = paragraph.min_width();
+        if !width.is_finite() || width <= 0. || paragraph.min_height() > ADVANCE + 0.01 {
+            return None;
+        }
+        // This fixed English witness must resolve to one actual font face.
+        // Mixed fallback is not silently exported as a generic SVG font.
+        let font_id = run.glyphs.first()?.font_id;
+        if run.glyphs.iter().any(|glyph| glyph.font_id != font_id) {
+            return None;
+        }
+        let family = graphics_text::font_system()
+            .write()
+            .ok()?
+            .raw()
+            .db()
+            .face(font_id)?
+            .families
+            .first()?
+            .0
+            .clone();
+        lines.push(MeasuredLine {
+            text: content,
+            width,
+            baseline: run.line_y,
+            family,
+        });
+    }
+    let lines = Arc::new(lines);
+    cache.retain(|(_, v, _)| *v == version);
+    cache.push((profile, version, lines.clone()));
+    Some(lines)
+}
+
+/// Runs before any scene consumer; never edits the model or any routed points.
+pub(super) fn apply(
+    project: &Project,
+    diagram: &Diagram,
+    view: &ProjectedView,
+    routed: &mut RoutedView,
+    profile: Profile,
+) -> Option<Layout> {
+    if profile == Profile::Baseline || diagram.id.as_u128() != DIAGRAM {
+        return None;
+    }
+    let id = Id::from_u128(EDGE);
+    let edge = routed.edges.get(&id)?;
+    if edge.label.text != NAME
+        || project.relations.get(&id)?.name != NAME
+        || edge.custom_suspended
+        || view
+            .nodes
+            .iter()
+            .any(|node| node.visual_parent.is_some() || node.collapsed)
+    {
+        return None;
+    }
+    let metrics = measured(profile)?;
+    let width = metrics.iter().map(|line| line.width).fold(0., f32::max) + 16.;
+    let height = 8. + ADVANCE * metrics.len() as f32;
+    let authored = diagram
+        .routes
+        .iter()
+        .find(|route| route.edge == id)
+        .and_then(|route| route.label.as_ref());
+    let fraction = authored.map_or(if profile == Profile::E { 0.5 } else { 0.55 }, |label| {
+        label.fraction
+    });
+    let anchor = routing::point_along_polyline(&edge.points, fraction)?;
+    let offset = authored.map_or(
+        Position {
+            x: if profile == Profile::E {
+                0.
+            } else {
+                18. + width / 2.
+            },
+            y: 0.,
+        },
+        |label| label.offset,
+    );
+    let center = Position {
+        x: anchor.x + offset.x,
+        y: anchor.y + offset.y,
+    };
+    let bounds = routing::RoutingBounds {
+        position: Position {
+            x: center.x - width / 2.,
+            y: center.y - height / 2.,
+        },
+        size: oa_core::Size { width, height },
+    };
+    let clear = guarded(project, view, routed, id, bounds, profile);
+    if authored.is_none() && !clear {
+        return None;
+    }
+    let geometry = routing::EdgeLabelGeometry {
+        text: edge.label.text.clone(),
+        fraction,
+        anchor,
+        center,
+        bounds,
+    };
+    let lines = metrics
+        .iter()
+        .enumerate()
+        .map(|(index, line)| {
+            let top = bounds.position.y + 4. + ADVANCE * index as f32;
+            Line {
+                text: line.text,
+                position: Position {
+                    x: center.x - line.width / 2.,
+                    y: top,
+                },
+                baseline_y: top + line.baseline,
+                width: line.width,
+                family: line.family.clone(),
+            }
+        })
+        .collect();
+    let layout = Layout {
+        canonical_text: edge.label.text.clone(),
+        lines,
+        geometry,
+        clear,
+    };
+    routed.edges.get_mut(&id)?.label = layout.geometry.clone();
+    // Retain conservative existing bounds; add authored placements outside them.
+    // The fixed automatic witnesses are inside the unchanged node extents.
+    let old = routed.bounds;
+    let left = old.position.x.min(bounds.position.x);
+    let top = old.position.y.min(bounds.position.y);
+    let right = (old.position.x + old.size.width).max(bounds.position.x + width);
+    let bottom = (old.position.y + old.size.height).max(bounds.position.y + height);
+    routed.bounds = routing::RoutingBounds {
+        position: Position { x: left, y: top },
+        size: oa_core::Size {
+            width: right - left,
+            height: bottom - top,
+        },
+    };
+    Some(layout)
+}
+
+fn rectangle(bounds: routing::RoutingBounds, padding: f32) -> Rectangle {
+    Rectangle {
+        x: bounds.position.x - padding,
+        y: bounds.position.y - padding,
+        width: bounds.size.width + 2. * padding,
+        height: bounds.size.height + 2. * padding,
+    }
+}
+fn overlap(a: Rectangle, b: Rectangle) -> bool {
+    a.x < b.x + b.width && a.x + a.width > b.x && a.y < b.y + b.height && a.y + a.height > b.y
+}
+fn crossing(bounds: Rectangle, span: &[Position]) -> bool {
+    let [a, b] = [span[0], span[1]];
+    if a.x == b.x {
+        a.x >= bounds.x
+            && a.x <= bounds.x + bounds.width
+            && a.y.min(b.y) <= bounds.y + bounds.height
+            && a.y.max(b.y) >= bounds.y
+    } else if a.y == b.y {
+        a.y >= bounds.y
+            && a.y <= bounds.y + bounds.height
+            && a.x.min(b.x) <= bounds.x + bounds.width
+            && a.x.max(b.x) >= bounds.x
+    } else {
+        // The bounded witness supports orthogonal geometry only.
+        true
+    }
+}
+fn guarded(
+    project: &Project,
+    view: &ProjectedView,
+    routed: &RoutedView,
+    id: Id,
+    bounds: routing::RoutingBounds,
+    profile: Profile,
+) -> bool {
+    let label = rectangle(bounds, 0.);
+    if view.nodes.iter().any(|node| {
+        overlap(
+            label,
+            Rectangle {
+                x: node.position.x - 12.,
+                y: node.position.y - 12.,
+                width: node.size.width + 24.,
+                height: node.size.height + 24.,
+            },
+        )
+    }) {
+        return false;
+    }
+    let stroke_bounds = rectangle(bounds, 3.);
+    let mut own_crossings = Vec::new();
+    for edge in routed.edges.values() {
+        if edge.id != id
+            && !edge.label.text.is_empty()
+            && overlap(label, rectangle(edge.label.bounds, 4.))
+        {
+            return false;
+        }
+        if let Some(relation) = project.relations.get(&edge.id) {
+            for end in routing::association_end_geometry(relation, edge) {
+                if !end.label.text.is_empty() && overlap(label, rectangle(end.label.bounds, 4.)) {
+                    return false;
+                }
+            }
+        }
+        for span in edge.points.windows(2) {
+            if crossing(stroke_bounds, span) {
+                if edge.id != id || profile == Profile::F {
+                    return false;
+                }
+                own_crossings.push(span);
+            }
+        }
+    }
+    if profile == Profile::E {
+        let [span] = own_crossings.as_slice() else {
+            return false;
+        };
+        let [a, b] = [span[0], span[1]];
+        // One complete straight crossing, not a bend, lead, tip, or shared run.
+        (a.x == b.x
+            && a.y.min(b.y) < stroke_bounds.y
+            && a.y.max(b.y) > stroke_bounds.y + stroke_bounds.height)
+            || (a.y == b.y
+                && a.x.min(b.x) < stroke_bounds.x
+                && a.x.max(b.x) > stroke_bounds.x + stroke_bounds.width)
+    } else {
+        true
+    }
+}
+
+impl Layout {
+    pub(super) fn canvas_lines(&self, color: Color) -> impl Iterator<Item = Text> + '_ {
+        self.lines.iter().map(move |line| Text {
+            content: line.text.into(),
+            position: point(line.position),
+            color,
+            size: FONT_SIZE.into(),
+            line_height: shaped::LineHeight::Absolute(ADVANCE.into()),
+            font: iced::Font::default(),
+            align_x: shaped::Alignment::Left,
+            align_y: iced::alignment::Vertical::Top,
+            shaping: shaped::Shaping::Basic,
+            max_width: f32::INFINITY,
+        })
+    }
+    pub(super) fn svg(&self) -> String {
+        let bounds = self.geometry.bounds;
+        let mut out = format!(
+            "<g data-label-experiment=\"wrapped\"><title>{}</title><rect x=\"{}\" y=\"{}\" width=\"{}\" height=\"{}\" fill=\"white\"/>",
+            escape(&self.canonical_text),
+            bounds.position.x,
+            bounds.position.y,
+            bounds.size.width,
+            bounds.size.height
+        );
+        for line in &self.lines {
+            out.push_str(&format!("<text x=\"{}\" y=\"{}\" font-family=\"{}\" font-size=\"13\" fill=\"#637487\">{}</text>",
+                line.position.x, line.baseline_y, escape(&line.family), escape(line.text)));
+        }
+        out.push_str("</g>");
+        out
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn fixture() -> (Project, Id) {
+        let p: Project = serde_json::from_slice(include_bytes!(
+            "../../../../harness/experiments/wrapped-label-20261001/fixture/eight-card.json"
+        ))
+        .unwrap();
+        (p, Id::from_u128(DIAGRAM))
+    }
+    fn canvas(p: &Project, diagram: Id) -> DiagramCanvas<'_> {
+        DiagramCanvas {
+            selection: None,
+            allocation: None,
+            project: p,
+            view_index: None,
+            diagram,
+            selected: edge_id(),
+            navigation_focus: None,
+            zoom: 1.,
+            pan: Vector::ZERO,
+            context: Context {
+                document: p.id,
+                diagram,
+                revision: 0,
+                epoch: 0,
+            },
+            selected_bend: None,
+            selected_attachment: None,
+            editable: true,
+            placing: false,
+            connection: None,
+        }
+    }
+    #[test]
+    fn baseline_is_exact_and_wrapping_changes_only_target_derived_geometry() {
+        let (p, id) = fixture();
+        let before = serde_json::to_vec(&p).unwrap();
+        let diagram = &p.diagrams[&id];
+        let view = project_view(&p, id);
+        let baseline = route_diagram(&p, diagram, &view);
+        assert_eq!(baseline.edges.len(), 12);
+        let mut unchanged = baseline.clone();
+        assert!(apply(&p, diagram, &view, &mut unchanged, Profile::Baseline).is_none());
+        assert_eq!(unchanged, baseline);
+        for profile in [Profile::E, Profile::F] {
+            let mut routed = baseline.clone();
+            let layout =
+                apply(&p, diagram, &view, &mut routed, profile).expect("Measured witness must fit");
+            assert!(layout.clear);
+            assert_eq!(layout.canonical_text, NAME);
+            assert_eq!(
+                layout
+                    .lines
+                    .iter()
+                    .map(|line| line.text)
+                    .collect::<Vec<_>>()
+                    .join(" "),
+                NAME
+            );
+            assert_eq!(routed.edges[&edge_id()].label.text, NAME);
+            for (id, old) in &baseline.edges {
+                assert_eq!(routed.edges[id].points, old.points);
+                if *id != edge_id() {
+                    assert_eq!(&routed.edges[id], old);
+                }
+            }
+            let mut restored = routed.clone();
+            restored.edges.get_mut(&edge_id()).unwrap().label =
+                baseline.edges[&edge_id()].label.clone();
+            assert_eq!(
+                restored, baseline,
+                "No paths, ports, solver state, other labels or scene extents change"
+            );
+            assert_eq!(
+                layout.geometry.bounds.size.height,
+                8. + ADVANCE * layout.lines.len() as f32
+            );
+            let max_width = layout
+                .lines
+                .iter()
+                .map(|line| line.width)
+                .fold(0., f32::max);
+            assert_eq!(layout.geometry.bounds.size.width, max_width + 16.);
+            assert!(
+                layout
+                    .lines
+                    .iter()
+                    .all(|line| !line.family.is_empty() && line.width > 0.)
+            );
+            if profile == Profile::F {
+                assert_eq!(layout.geometry.fraction, 0.55);
+                assert!(
+                    (layout.geometry.bounds.position.x - layout.geometry.anchor.x - 18.).abs()
+                        < 0.001
+                );
+                assert!(
+                    layout.geometry.bounds.size.width < 114.5,
+                    "Measured F loses own-is-closer margin"
+                );
+            } else {
+                assert_eq!(layout.geometry.fraction, 0.5);
+                assert_eq!(layout.geometry.center, layout.geometry.anchor);
+            }
+            println!(
+                "{profile:?}: bounds={:?}; lines={:?}",
+                layout.geometry.bounds, layout.lines
+            );
+        }
+        assert_eq!(serde_json::to_vec(&p).unwrap(), before);
+    }
+    #[test]
+    fn measured_backing_canvas_svg_picking_and_focus_share_geometry() {
+        let (p, id) = fixture();
+        let c = canvas(&p, id);
+        for profile in [Profile::E, Profile::F] {
+            let state = State::default();
+            let scene = c.scene_with_profile(&state, profile);
+            let layout = scene.label_layout.as_ref().unwrap();
+            let bounds = rectangle(layout.geometry.bounds, 0.);
+            let texts = layout.canvas_lines(Color::BLACK).collect::<Vec<_>>();
+            let svg = super::super::export_svg_with_profile(&p, id, profile).unwrap();
+            assert!(svg.contains(&layout.svg()));
+            assert_eq!(
+                crate::diagram_usage::edge_focus_bounds(&scene.routed.edges[&edge_id()]),
+                bounds
+            );
+            for (line, text) in layout.lines.iter().zip(texts) {
+                assert_eq!(text.content, line.text);
+                assert_eq!(text.position, point(line.position));
+                assert_eq!(text.size.0, FONT_SIZE);
+                assert_eq!(
+                    text.line_height,
+                    shaped::LineHeight::Absolute(ADVANCE.into())
+                );
+                assert!(line.position.x >= bounds.x + 7.99);
+                assert!(line.position.x + line.width <= bounds.x + bounds.width - 7.99);
+                assert_eq!(
+                    c.hit_label(
+                        &scene.routed,
+                        Point::new(line.position.x + line.width / 2., line.position.y + 8.)
+                    ),
+                    Some(edge_id())
+                );
+                assert!(svg.contains(&format!(
+                    "x=\"{}\" y=\"{}\" font-family=\"{}\"",
+                    line.position.x,
+                    line.baseline_y,
+                    escape(&line.family)
+                )));
+            }
+            assert_eq!(
+                c.hit_label(&scene.routed, Point::new(bounds.x + 1., bounds.y + 1.)),
+                Some(edge_id())
+            );
+        }
+    }
+    #[test]
+    fn automatic_guard_refuses_foreign_coincident_stroke_and_card() {
+        let (p, id) = fixture();
+        let diagram = &p.diagrams[&id];
+        let view = project_view(&p, id);
+        let baseline = route_diagram(&p, diagram, &view);
+        for profile in [Profile::E, Profile::F] {
+            let mut valid = baseline.clone();
+            let layout = apply(&p, diagram, &view, &mut valid, profile).unwrap();
+            let mut blocked = baseline.clone();
+            let foreign = blocked
+                .edges
+                .keys()
+                .copied()
+                .find(|id| *id != edge_id())
+                .unwrap();
+            let bounds = layout.geometry.bounds;
+            blocked.edges.get_mut(&foreign).unwrap().points = vec![
+                Position {
+                    x: layout.geometry.center.x,
+                    y: bounds.position.y - 40.,
+                },
+                Position {
+                    x: layout.geometry.center.x,
+                    y: bounds.position.y + bounds.size.height + 40.,
+                },
+            ];
+            let snapshot = blocked.clone();
+            assert!(apply(&p, diagram, &view, &mut blocked, profile).is_none());
+            assert_eq!(blocked, snapshot);
+            let mut occluded_view = view.clone();
+            occluded_view.nodes[0].position = bounds.position;
+            let mut routed = baseline.clone();
+            assert!(apply(&p, diagram, &occluded_view, &mut routed, profile).is_none());
+            assert_eq!(routed, baseline);
+        }
+    }
+    #[test]
+    fn authored_fraction_offset_keep_shape_even_during_conflicting_move() {
+        let (mut p, id) = fixture();
+        let view = project_view(&p, id);
+        for profile in [Profile::E, Profile::F] {
+            let original = route_diagram(&p, &p.diagrams[&id], &view);
+            let mut automatic = original.clone();
+            let initial = apply(&p, &p.diagrams[&id], &view, &mut automatic, profile).unwrap();
+            let offset = Position {
+                x: initial.geometry.center.x - initial.geometry.anchor.x + 17.,
+                y: -9.,
+            };
+            p.diagrams.get_mut(&id).unwrap().routes = vec![EdgeRoute {
+                edge: edge_id(),
+                source_attachment: None,
+                target_attachment: None,
+                waypoints: vec![],
+                label: Some(EdgeLabel {
+                    fraction: initial.geometry.fraction,
+                    offset,
+                }),
+            }];
+            let c = canvas(&p, id);
+            let state = State::default();
+            let scene = c.scene_with_profile(&state, profile);
+            let moved = scene.label_layout.as_ref().unwrap();
+            assert_eq!(
+                moved.lines.iter().map(|line| line.text).collect::<Vec<_>>(),
+                initial
+                    .lines
+                    .iter()
+                    .map(|line| line.text)
+                    .collect::<Vec<_>>()
+            );
+            assert_eq!(moved.geometry.fraction, initial.geometry.fraction);
+            assert!((moved.geometry.center.x - moved.geometry.anchor.x - offset.x).abs() < 0.001);
+            assert!((moved.geometry.center.y - moved.geometry.anchor.y - offset.y).abs() < 0.001);
+            let mut preview = State {
+                context: Some(c.context),
+                ..State::default()
+            };
+            preview.route_drag = Some(Gesture {
+                context: c.context,
+                start: point(moved.geometry.center),
+                handle: Handle::Label { original: offset },
+                route: p.diagrams[&id].routes[0].clone(),
+                changed: true,
+                baseline: scene.core_routed.clone(),
+            });
+            preview
+                .route_drag
+                .as_mut()
+                .unwrap()
+                .route
+                .label
+                .as_mut()
+                .unwrap()
+                .offset
+                .x += 100.;
+            let dragged = c.scene_with_profile(&preview, profile);
+            let layout = dragged.label_layout.as_ref().unwrap();
+            assert_eq!(layout.lines.len(), moved.lines.len());
+            assert!(
+                (layout.geometry.center.x - layout.geometry.anchor.x - offset.x - 100.).abs()
+                    < 0.001
+            );
+            for (id, edge) in &scene.routed.edges {
+                assert_eq!(dragged.routed.edges[id].points, edge.points);
+            }
+            p.diagrams.get_mut(&id).unwrap().routes.clear();
+        }
+    }
+    #[test]
+    fn different_edge_preview_guard_rejection_restores_complete_core_geometry() {
+        // Exercise the actual gesture capture and core preview, with a pure
+        // explicit profile. Moving another label onto the wrapped target must
+        // reject wrapping, leaving the full original one-line target geometry.
+        // All twelve point arrays and every other frozen label remain exact.
+        let (p, id) = fixture();
+        let view = project_view(&p, id);
+        let core = route_diagram(&p, &p.diagrams[&id], &view);
+        let foreign = core
+            .edges
+            .values()
+            .find(|edge| edge.id != edge_id() && !edge.label.text.is_empty())
+            .unwrap();
+        let original_offset = Position {
+            x: foreign.label.center.x - foreign.label.anchor.x,
+            y: foreign.label.center.y - foreign.label.anchor.y,
+        };
+        let c = DiagramCanvas {
+            selected: foreign.id,
+            ..canvas(&p, id)
+        };
+        for profile in [Profile::E, Profile::F] {
+            let mut state = State {
+                context: Some(c.context),
+                ..State::default()
+            };
+            let initial = c.scene_with_profile(&state, profile);
+            let target = initial
+                .label_layout
+                .as_ref()
+                .expect("Initial witness must wrap");
+            c.begin_route_with_profile(
+                &mut state,
+                point(foreign.label.center),
+                Handle::Label {
+                    original: original_offset,
+                },
+                EdgeRoute {
+                    edge: foreign.id,
+                    source_attachment: None,
+                    target_attachment: None,
+                    waypoints: vec![],
+                    label: Some(EdgeLabel {
+                        fraction: foreign.label.fraction,
+                        offset: original_offset,
+                    }),
+                },
+                profile,
+            );
+            state
+                .route_drag
+                .as_mut()
+                .unwrap()
+                .move_to(point(target.geometry.center), 1.);
+            let diagram = c.preview_diagram(&state);
+            let expected = routing::route_edge_preview(&p, &diagram, &view, &core, foreign.id);
+            let mut guard_probe = expected.clone();
+            assert!(
+                apply(&p, &diagram, &view, &mut guard_probe, profile).is_none(),
+                "Foreign label now overlaps target: wrapping must be refused"
+            );
+            assert_eq!(guard_probe, expected);
+            let actual = c.scene_with_profile(&state, profile);
+            assert!(actual.label_layout.is_none());
+            for (edge, before) in &core.edges {
+                assert_eq!(
+                    actual.routed.edges[edge].points, before.points,
+                    "Label drag must not reroute"
+                );
+                if *edge != foreign.id && *edge != edge_id() {
+                    assert_eq!(
+                        actual.routed.edges[edge].label, before.label,
+                        "Other labels remain frozen"
+                    );
+                }
+            }
+            assert_eq!(
+                actual.routed.edges[&edge_id()].label,
+                core.edges[&edge_id()].label,
+                "No Layout means original complete one-line target geometry, never stale wrapped hit bounds"
+            );
+            assert_eq!(
+                *actual.routed, expected,
+                "Fallback is the complete core preview result"
+            );
+        }
+    }
+    #[test]
+    fn scene_and_measurement_cache_reuse_and_geometry_invalidation() {
+        let (p, id) = fixture();
+        let c = canvas(&p, id);
+        let mut state = State::default();
+        let first = c.scene_with_profile(&state, Profile::F);
+        state.pointer = Some(Point::new(100., 200.));
+        let changed_camera = DiagramCanvas {
+            pan: Vector::new(40., 30.),
+            zoom: 0.5,
+            selected: p.id,
+            ..c
+        };
+        assert!(Arc::ptr_eq(
+            &first,
+            &changed_camera.scene_with_profile(&state, Profile::F)
+        ));
+        assert!(Arc::ptr_eq(
+            &measured(Profile::F).unwrap(),
+            &measured(Profile::F).unwrap()
+        ));
+        let other_profile = c.scene_with_profile(&state, Profile::E);
+        assert!(!Arc::ptr_eq(&first, &other_profile));
+        let next_revision = DiagramCanvas {
+            context: Context {
+                revision: 1,
+                ..c.context
+            },
+            ..c
+        };
+        assert!(!Arc::ptr_eq(
+            &other_profile,
+            &next_revision.scene_with_profile(&state, Profile::E)
+        ));
+        let plain = c.scene_with_profile(&state, Profile::Baseline);
+        assert!(plain.label_layout.is_none());
+        assert!(Arc::ptr_eq(&plain.core_routed, &plain.routed));
+        assert_eq!(
+            *plain.routed,
+            route_diagram(&p, &p.diagrams[&id], &plain.view)
+        );
+    }
+}

crates/oa-desktop/src/diagram/multiselect.rs

@@ -89,6 +89,10 @@ impl DiagramCanvas<'_> {
         bounds: Rectangle,
         cursor: mouse::Cursor,
     ) -> Option<Action<Message>> {
+        // The Allocation token owns all ordered motion/release while active.
+        if state.work.is_some() {
+            return None;
+        }
         let viewport = Viewport {
             zoom: self.zoom,
             pan: self.pan,
@@ -192,7 +196,9 @@ impl DiagramCanvas<'_> {
         let pointer = cursor.position()?;
         let local = Point::new(pointer.x - bounds.x, pointer.y - bounds.y);
         let scene = self.scene(state);
-        let target = if let Some(port) = self.hit_port(&scene.view, local) {
+        let target = if self.allocation_surface() {
+            self.allocation_press_target(&scene, local)
+        } else if let Some(port) = self.hit_port(&scene.view, local) {
             Some(Target::Port {
                 port: port.element,
                 placement: port.owner,
@@ -219,6 +225,9 @@ impl DiagramCanvas<'_> {
                 .and_capture(),
             );
         }
+        if self.allocation_handles_press(&target) {
+            return Some(self.begin_allocation(state, target, pointer, bounds));
+        }
         if selection.targets().len() <= 1 || !selection.contains(&target) {
             return None;
         }
@@ -230,12 +239,6 @@ impl DiagramCanvas<'_> {
             Some(
                 "Move requires only placed elements. Remove ports and connections from the selection.",
             )
-        } else if snapshot
-            .targets()
-            .iter()
-            .any(|t| matches!(t, Target::Placement(id) if self.work_eligible(*id)))
-        {
-            Some("Group allocation drag is not available yet. The selection was retained.")
         } else {
             None
         };

crates/oa-desktop/src/diagram/work_drag.rs

@@ -1,11 +1,13 @@
 use super::*;
-use crate::app::allocation_drag::{self as input, Event, Press, Stamp};
+use crate::app::allocation_drag::{self as input, Event, Mode, Press, Stamp};
+use crate::diagram_usage::Target as SelectionTarget;
 
 impl DiagramCanvas<'_> {
     pub(crate) fn work_dirty_point(&self, bounds: Rectangle, screen: Point) -> bool {
         let diagram = &self.project.diagrams[&self.diagram];
         let view = self.projected(diagram);
-        let routed = routing::route_diagram(self.project, diagram, &view);
+        let mut routed = routing::route_diagram(self.project, diagram, &view);
+        super::apply_label_experiment(self.project, diagram, &view, &mut routed);
         self.work_dirty_press(
             &view,
             &routed,
@@ -23,14 +25,83 @@ impl DiagramCanvas<'_> {
             .then_some(capability.state.preview.as_ref())
             .flatten()
     }
-    pub(super) fn work_eligible(&self, placement: Id) -> bool {
-        self.allocation.is_some()
-            && self.project.diagrams[&self.diagram].projection == ProjectionKind::Allocation
-            && self.project.diagrams[&self.diagram]
-                .nodes
-                .get(&placement)
-                .and_then(|n| self.project.elements.get(&n.element))
-                .is_some_and(|e| e.kind().is_work())
+    pub(super) fn allocation_surface(&self) -> bool {
+        self.project.diagrams[&self.diagram].projection == ProjectionKind::Allocation
+    }
+
+    // Dirty input must shield the complete visible handle, including its outer
+    // ring beyond the edge hit tolerance. This test deliberately ignores edit
+    // permission: the root shield constructs a non-editable canvas.
+    fn allocation_route_control(
+        &self,
+        view: &ProjectedView,
+        routed: &RoutedView,
+        world: Point,
+    ) -> bool {
+        let Some(edge) = routed
+            .edges
+            .get(&self.selected)
+            .filter(|e| !e.custom_suspended)
+        else {
+            return false;
+        };
+        let radius = 8. / self.zoom;
+        edge.pins
+            .iter()
+            .any(|pin| world.distance(point(*pin)) <= radius)
+            || [
+                (EdgeEnd::Source, edge.points.first()),
+                (EdgeEnd::Target, edge.points.last()),
+            ]
+            .into_iter()
+            .any(|(end, at)| {
+                at.is_some_and(|at| world.distance(point(*at)) <= radius)
+                    && route_edit::attachment_node(
+                        self.project,
+                        &self.project.diagrams[&self.diagram],
+                        view,
+                        self.selected,
+                        end,
+                    )
+                    .is_some()
+            })
+    }
+
+    /// Visible selected-route controls take precedence over underlying cards.
+    /// Returning the exact edge keeps Shift and owned movement admission aligned.
+    pub(super) fn allocation_press_target(
+        &self,
+        scene: &Scene,
+        local: Point,
+    ) -> Option<SelectionTarget> {
+        let world = self.world(local);
+        if self.editable && self.allocation_route_control(&scene.view, &scene.routed, world) {
+            return Some(SelectionTarget::Edge(self.selected));
+        }
+        if let Some(port) = self.hit_port(&scene.view, local) {
+            Some(SelectionTarget::Port {
+                port: port.element,
+                placement: port.owner,
+            })
+        } else if let Some(id) = self.hit(&scene.view, local) {
+            Some(SelectionTarget::Placement(id))
+        } else {
+            self.hit_label(&scene.routed, local)
+                .or_else(|| self.hit_association_label(&scene.routed, local))
+                .or_else(|| self.hit_edge(&scene.routed, local).map(|hit| hit.0))
+                .map(SelectionTarget::Edge)
+        }
+    }
+
+    pub(super) fn allocation_handles_press(&self, target: &SelectionTarget) -> bool {
+        self.allocation_surface()
+            && (self.allocation.is_some_and(|c| c.state.arrange_next)
+                || matches!(target, SelectionTarget::Placement(_))
+                || self.selection.is_some_and(|selection| {
+                    selection.scope() == crate::app::multiselect::context(self.context).scope
+                        && selection.targets().len() > 1
+                        && selection.contains(target)
+                }))
     }
     pub(super) fn work_dirty_press(
         &self,
@@ -42,26 +113,30 @@ impl DiagramCanvas<'_> {
             && !self.placing
             && self.connection.is_none()
             && self.project.diagrams[&self.diagram].projection == ProjectionKind::Allocation
-            && (self.hit(view, local).is_some()
+            && (self.allocation_route_control(view, routed, self.world(local))
+                || self.hit(view, local).is_some()
                 || self.hit_port(view, local).is_some()
                 || self.hit_edge(routed, local).is_some()
                 || self.hit_label(routed, local).is_some()
                 || self.hit_association_label(routed, local).is_some())
     }
-    pub(super) fn begin_work(
+    pub(super) fn begin_allocation(
         &self,
         state: &mut State,
-        node: Id,
+        target: SelectionTarget,
         screen: Point,
         bounds: Rectangle,
-        view: &ProjectedView,
-        routed: &RoutedView,
     ) -> Action<Message> {
-        let capability = self.allocation.unwrap();
         state.drag = None;
         state.preview = None;
         state.port_drag = None;
         state.route_drag = None;
+        state.attachment_viewport = None;
+        state.group = None;
+        *state.cache.borrow_mut() = None;
+        let Some(capability) = self.allocation else {
+            return Action::capture();
+        };
         if !capability.clean {
             return Action::publish(Message::WorkDrag(Event::Refused(
                 capability.state.epoch,
@@ -69,18 +144,15 @@ impl DiagramCanvas<'_> {
             )))
             .and_capture();
         }
-        let work = self.project.diagrams[&self.diagram].nodes[&node].element;
-        let scope = match crate::allocation_drag::capture(self.project, self.diagram, work, node) {
-            Ok(scope) => scope,
-            Err(reason) => {
-                return Action::publish(Message::WorkDrag(Event::Refused(
-                    capability.state.epoch,
-                    input::refusal(&reason),
-                )))
-                .and_capture();
-            }
+        let Some(selection) = self.selection.and_then(|selection| {
+            selection.snapshot(crate::app::multiselect::context(self.context))
+        }) else {
+            return Action::publish(Message::WorkDrag(Event::Refused(
+                capability.state.epoch,
+                "The selection changed. Start this drag again.".into(),
+            )))
+            .and_capture();
         };
-        let frozen = input::Frozen::capture(self.project, &scope, view, routed, self.zoom);
         let press = Arc::new(Press {
             stamp: Stamp {
                 context: self.context,
@@ -92,9 +164,13 @@ impl DiagramCanvas<'_> {
             },
             token: Id::new_v4(),
             start: screen,
-            scope,
-            frozen,
-            arrange: capability.state.arrange_next,
+            selection,
+            target,
+            mode: if capability.state.arrange_next {
+                Mode::Arrange
+            } else {
+                Mode::Assign
+            },
         });
         state.work = Some(press.clone());
         Action::publish(Message::WorkDrag(Event::Press(press))).and_capture()
@@ -165,8 +241,11 @@ impl canvas::Program<Message> for WorkFeedback<'_> {
         } else {
             style::TEAL
         };
+        let Some(frozen) = &feedback.frozen else {
+            return vec![];
+        };
         for index in &feedback.targets {
-            let target = &feedback.press.frozen.targets[*index];
+            let target = &frozen.targets[*index];
             let region = target.region;
             let top = Point::new(
                 region.x * self.0.zoom + self.0.pan.x,

crates/oa-desktop/src/diagram_usage.rs

@@ -327,7 +327,11 @@ pub(crate) fn saved_usages_for(p: &Project, subject: Id, only_diagram: Option<Id
                     "state machine view"
                 }
                 .into(),
-                bounds: routed_bounds(routing::route_diagram(p, diagram, &view).bounds),
+                bounds: {
+                    let mut routed = routing::route_diagram(p, diagram, &view);
+                    crate::diagram::apply_label_experiment(p, diagram, &view, &mut routed);
+                    routed_bounds(routed.bounds)
+                },
             });
         }
         for node in &view.nodes {
@@ -407,9 +411,13 @@ pub(crate) fn saved_usages_for(p: &Project, subject: Id, only_diagram: Option<Id
             }
         }
         if view.edges.iter().any(|edge| edge.id == subject)
-            && let Some(edge) = routing::route_diagram(p, diagram, &view)
-                .edges
-                .get(&subject)
+            && let Some(edge) = {
+                let mut routed = routing::route_diagram(p, diagram, &view);
+                crate::diagram::apply_label_experiment(p, diagram, &view, &mut routed);
+                routed
+            }
+            .edges
+            .get(&subject)
         {
             usages.push(Usage {
                 subject,

crates/oa-desktop/src/guide.rs

@@ -48,6 +48,11 @@ pub enum Event {
 
 pub(crate) const ARTICLE_SCROLL_ID: &str = "engineering-guide-article";
 
+mod context_help;
+pub(crate) use context_help::{
+    ContextScroll, context_scroll_key, context_scroll_task, protect_workspace,
+};
+
 impl State {
     /// Returns whether navigation selected a different article.
     pub fn update(&mut self, event: Event) -> bool {
@@ -263,7 +268,8 @@ fn article(topic: Topic) -> Article {
                             &[
                                 "Choose the Operational or System perspective. Create participants using Entity/Actor in OA or System/System actor in SA.",
                                 "In the diagram's side palette, choose Activity in OA or Function in SA, click its position, enter a name and press Enter. Escape cancels without creating an element. Select a card and press F2 to rename it in place. For semantic decomposition, use Model explorer, select existing work and use + In selected to create smaller work units.",
-                                "Right-click a participant and choose Add activity or Add function to create new work and its allocation together. In Architecture · allocated work, drag existing work into a performer to assign it, between performers to reassign it, or onto empty canvas to remove its direct assignment. + Relationship with Allocation and Model explorer's + Allocated provide explicit alternatives.",
+                                "To allocate existing leaf work in Containment, choose Allocation in the diagram palette. Click a visible performer, then the highlighted Activity or Function it performs. The work must belong to the performer's layer and have no direct performer yet. In a mixed OA ↔ SA traceability view, either layer's performer can be used and the current view stays open. Completing the allocation sets the application perspective to that view's layer; choosing only a source or canceling leaves the prior perspective unchanged. Escape cancels. This creates a responsibility relationship without changing the work's semantic parent.",
+                                "Right-click a participant and choose Add activity or Add function to create new work and its allocation together. In Architecture · allocated work, drag existing work into a performer to assign it, between performers to reassign it, or onto empty canvas to remove its direct assignment. Create relationship… with Allocation and Model explorer's + Allocated provide explicit alternatives.",
                                 "Choose Architecture · allocated work to review responsibilities. Choose Functional dataflow to review the activity/function hierarchy and its exchanges independently.",
                             ],
                         ),
@@ -307,9 +313,9 @@ fn article(topic: Topic) -> Article {
                             "Choose and edit the relationship you mean",
                             &[
                                 "Use the diagram selector or + View to work with a focused diagram. View properties edits its name, perspective, projection and Saved view visibility. Apply changes commits the view settings.",
-                                "Choose Containment for semantic children, Architecture · allocated work for responsibilities, Functional dataflow for work and exchanges, or Missions & capabilities for outcomes. All relationships is a broader exploration view; OA ↔ SA traceability displays counterparts.",
-                                "Select an element and edit Semantic parent to change ownership. Use an Allocation relationship to change responsibility. Apply changes validates the semantic change.",
-                                "Scroll to zoom and use Fit to frame the current view. In allocated-work views, dragging work changes its assignment and placement together. Choose Arrange next drag or press Alt+A to move work without changing responsibility for that one drag; Escape cancels the armed action. Auto-layout arranges the whole view. Export SVG produces a shareable view.",
+                                "Choose Containment for semantic children, Architecture · allocated work for responsibilities, Functional dataflow for work and exchanges, or Missions & capabilities for outcomes. All relationships explores one layer; OA ↔ SA traceability can show placed elements from both layers and their correspondence lines alongside ordinary relationships.",
+                                "Select an element and edit Semantic parent to change ownership. Use the Allocation palette tool to connect a performer to existing unallocated leaf work in Containment. The relationship can appear as a line there; Architecture · allocated work shows responsibility through nesting instead. Saved visibility filters can hide a line without removing the relationship.",
+                                "Scroll to zoom and use Fit to frame the current view. In allocated-work views, dragging work changes its assignment and placement together. Choose Arrange or press Alt+A to move work without changing responsibility for that one drag; Escape cancels the armed action. Auto-layout arranges the whole view. Export SVG produces a shareable view.",
                                 "Select a diagram node to access Placement, Fold / unfold and Hide. With the canvas focused, Delete hides its placement; Shift+Delete asks to remove the model element. Other views retain a hidden element. Undo restores either change.",
                             ],
                         ),
@@ -317,11 +323,23 @@ fn article(topic: Topic) -> Article {
                             "Keep diagrams readable",
                             "Use separate views for responsibility, decomposition and cross-layer coverage. Place existing elements with Show in this diagram. A placement's Diagram field can relocate it while preserving its identity and artifact references. Do not duplicate a semantic element merely to show it in another view.",
                         ),
+                        walkthrough(
+                            "Show a correspondence between OA and SA",
+                            &[
+                                "Choose OA ↔ SA traceability in View content. Changing this setting does not create counterparts or add their placements, so an existing single-layer diagram can initially look unchanged.",
+                                "Use Review layer traces to inspect named Operational and System endpoints and the meaning of their link. This opens the model's layer-trace list with no search restriction; traces between relationships are reviewed here rather than drawn between element cards.",
+                                "In the chosen architecture view, use Add existing elements. The chooser offers compatible elements from both layers. Select an existing endpoint and click its position in the canvas; repeat for the other end if needed. This adds a placement, not a new semantic element or trace. For port correspondences, place the ports' owners.",
+                                "The view shows correspondence lines alongside ordinary relationships. The shown-line count reflects the current projection and visibility settings, not trace coverage. If a line is hidden, use View visibility and inspect Saved view visibility; placing an endpoint does not remove explicit hides or filters.",
+                                "If the counterpart is already placed, use Include already shown (Locate) in the chooser. Undo restores an added placement; saving preserves each view's placements independently. Use the Traceability page's existing counterpart or manual-trace workflow when the semantic link itself does not yet exist.",
+                            ],
+                        ),
                         walkthrough(
                             "Move work between performers",
                             &[
                                 "Finish or cancel property and source edits, then drag an Activity or Function body in Architecture · allocated work. Aim at exposed performer space, including a collapsed performer's header. Read Destination above the canvas and the outlined target before releasing; release outside the canvas or press Escape to cancel.",
-                                "The move preserves work ownership and identities. A uniformly assigned work group moves its leaves together; a group distributed across performers asks you to choose a leaf. Role responsibilities remain explicit: an outward drag that would leave a role-derived performer explains why it cannot remove that responsibility.",
+                                "Use Shift-click to add or remove cards from the selection, or right-click a card and choose Add to selection. Drag any selected work card to assign the whole work selection to one performer. Independent work can start on different performers. The inspector keeps its primary element during the drag; right-click a selected card and choose Inspect this element to change that primary without losing the group.",
+                                "The move preserves work ownership and identities. A composite work card moves its leaves together when they have one coherent responsibility; if its own leaves are distributed across performers, choose specific leaves instead. Role responsibilities remain explicit: an outward drag that would leave a role-derived performer explains why it cannot remove that responsibility.",
+                                "To move work and performers together without changing responsibility, select their cards and choose Arrange or press Alt+A. This moves the selected work subtrees and each selected performer's contained cards together, if the complete layout stays readable and clear. Ports and connections cannot join a placement move. Dragging only performer cards normally moves them and their contained cards without changing assignments.",
                                 "Make room when work cards would overlap, and move the view or zoom in if the moving work is not readable. The destination name stays above the canvas while the target outline stays fixed during the drag. Hover Destination to inspect a long name: outside the canvas, the tooltip explicitly identifies the last target, and releasing cancels. Return to the canvas to choose the drop. A refused drop keeps the model and history unchanged. One Undo reverses an accepted assignment and placement together; Save all writes the corresponding source changes.",
                             ],
                         ),
@@ -450,6 +468,10 @@ fn article(topic: Topic) -> Article {
                     summary: "An operational Process or system Functional chain connects contributions of existing work and exchanges, including alternatives and reusable procedures. It explains how work contributes to an outcome.",
                     keywords: "process functional chain ordered occurrence sequence path involvement dataflow exchange repeated steps caller contextual qualified assembly common work focus reuse",
                     sections: &[
+                        explain(
+                            "Select a group",
+                            "Use Select, then Shift-click to add or remove contributions from the selection. Drag selected local cards to reorder them in the same column. Reused previews are read-only; open their referenced definition to edit. Properties affect only the primary selected item. Help or F1 opens this guide without leaving the diagram; Close or Escape returns to editing.",
+                        ),
                         walkthrough(
                             "Describe a path through exchanges",
                             &[
@@ -556,6 +578,10 @@ fn article(topic: Topic) -> Article {
                     summary: "Describe the conditions in which the operation or system behaves differently. States and modes belong to regions within a state machine.",
                     keywords: "state machine mode region initial final transition trigger guard effect entry exit do availability degraded nominal diagram draw reconnect local internal timed fold unfold placement pan zoom undo",
                     sections: &[
+                        explain(
+                            "Select a group",
+                            "Choose Select / move, then Shift-click to add or remove elements from the selection. Properties affect only the primary selected item; Hide selected removes placements from this view. Help or F1 opens this guide without leaving the diagram; Close or Escape returns to editing.",
+                        ),
                         walkthrough(
                             "Build a state machine",
                             &[
@@ -1143,6 +1169,14 @@ fn topic_button(topic: Topic, selected: bool) -> iced::widget::Button<'static, M
 }
 
 fn article_view(topic: Topic) -> Element<'static, Message> {
+    article_content(topic, true)
+}
+
+pub(crate) fn context_view(state: &State) -> Element<'static, Message> {
+    article_content(state.topic, false)
+}
+
+fn article_content(topic: Topic, navigation: bool) -> Element<'static, Message> {
     let article = article(topic);
     let mut content = column![
         text(topic.category()).size(11).color(style::MUTED),
@@ -1181,14 +1215,14 @@ fn article_view(topic: Topic) -> Element<'static, Message> {
         }
         content = content.push(container(body).padding(20).width(Fill).style(style::card));
     }
-    if let Some((page, label)) = article.destination {
+    if navigation && let Some((page, label)) = article.destination {
         content = content.push(
             button(text(label).size(13))
                 .padding([11, 15])
                 .on_press(Message::Page(page)),
         );
     }
-    if topic == Topic::FirstProject {
+    if navigation && topic == Topic::FirstProject {
         content = content.push(text("For a worked model, open the water-pressure walkthrough. Copy the whole examples/release1 folder and open the copied project.arcadia before editing; read its README.md. If you use Save as, also copy evidence/ beside the new entry: Save as copies model source, not external artifact targets.").size(13));
         content = content.push(
             button(text("Open water-pressure walkthrough").size(13))

crates/oa-desktop/src/guide/context_help.rs

@@ -0,0 +1,282 @@
+//! Modal reading input and preservation of the mounted editing workspace.
+use super::ARTICLE_SCROLL_ID;
+use crate::app::Message;
+use iced::Element;
+
+#[derive(Debug, Clone, Copy)]
+pub(crate) enum ContextScroll {
+    LineUp,
+    LineDown,
+    PageUp,
+    PageDown,
+    Home,
+    End,
+}
+
+pub(crate) fn context_scroll_key(
+    event: iced::Event,
+    status: iced::event::Status,
+    _: iced::window::Id,
+) -> Option<Message> {
+    use iced::keyboard::{Event, Key, key::Named};
+    let iced::Event::Keyboard(Event::KeyPressed { key, modifiers, .. }) = event else {
+        return None;
+    };
+    if status == iced::event::Status::Captured || !modifiers.is_empty() {
+        return None;
+    }
+    let scroll = match key {
+        Key::Named(Named::ArrowUp) => ContextScroll::LineUp,
+        Key::Named(Named::ArrowDown) => ContextScroll::LineDown,
+        Key::Named(Named::PageUp) => ContextScroll::PageUp,
+        Key::Named(Named::PageDown) => ContextScroll::PageDown,
+        Key::Named(Named::Home) => ContextScroll::Home,
+        Key::Named(Named::End) => ContextScroll::End,
+        _ => return None,
+    };
+    Some(Message::ContextHelpScroll(scroll))
+}
+
+pub(crate) fn context_scroll_task(scroll: ContextScroll) -> iced::Task<Message> {
+    struct Scroll(ContextScroll);
+    impl<T> iced::advanced::widget::Operation<T> for Scroll {
+        fn traverse(
+            &mut self,
+            visit: &mut dyn FnMut(&mut dyn iced::advanced::widget::Operation<T>),
+        ) {
+            visit(self);
+        }
+        fn scrollable(
+            &mut self,
+            id: Option<&iced::advanced::widget::Id>,
+            bounds: iced::Rectangle,
+            content_bounds: iced::Rectangle,
+            _: iced::Vector,
+            state: &mut dyn iced::advanced::widget::operation::Scrollable,
+        ) {
+            use iced::advanced::widget::operation::scrollable::{AbsoluteOffset, RelativeOffset};
+            if id != Some(&iced::advanced::widget::Id::new(ARTICLE_SCROLL_ID)) {
+                return;
+            }
+            match self.0 {
+                ContextScroll::Home | ContextScroll::End => state.snap_to(RelativeOffset {
+                    x: None,
+                    y: Some(if matches!(self.0, ContextScroll::End) {
+                        1.
+                    } else {
+                        0.
+                    }),
+                }),
+                scroll => {
+                    let y = match scroll {
+                        ContextScroll::LineUp => -40.,
+                        ContextScroll::LineDown => 40.,
+                        ContextScroll::PageUp => -bounds.height * 0.9,
+                        ContextScroll::PageDown => bounds.height * 0.9,
+                        _ => unreachable!(),
+                    };
+                    // Iced clamps this movement to the actual content bounds.
+                    state.scroll_by(AbsoluteOffset { x: 0., y }, bounds, content_bounds);
+                }
+            }
+        }
+    }
+    iced::advanced::widget::operate(Scroll(scroll))
+}
+
+/// Keep the mounted editor and its caret, but prevent modal input from reaching
+/// widget-internal state before the App message guard can reject edits.
+pub(crate) fn protect_workspace<'a, R: iced::advanced::renderer::Renderer + 'a>(
+    help_open: bool,
+    content: Element<'a, Message, iced::Theme, R>,
+) -> Element<'a, Message, iced::Theme, R> {
+    Element::new(WorkspaceInput { help_open, content })
+}
+
+struct WorkspaceInput<'a, R> {
+    help_open: bool,
+    content: Element<'a, Message, iced::Theme, R>,
+}
+
+#[derive(Default)]
+struct WorkspaceInputState {
+    help_open: bool,
+}
+
+impl<R: iced::advanced::renderer::Renderer> iced::advanced::Widget<Message, iced::Theme, R>
+    for WorkspaceInput<'_, R>
+{
+    fn tag(&self) -> iced::advanced::widget::tree::Tag {
+        iced::advanced::widget::tree::Tag::of::<WorkspaceInputState>()
+    }
+    fn state(&self) -> iced::advanced::widget::tree::State {
+        iced::advanced::widget::tree::State::new(WorkspaceInputState::default())
+    }
+    fn children(&self) -> Vec<iced::advanced::widget::Tree> {
+        vec![iced::advanced::widget::Tree::new(self.content.as_widget())]
+    }
+    fn diff(&self, tree: &mut iced::advanced::widget::Tree) {
+        tree.diff_children(std::slice::from_ref(&self.content));
+    }
+    fn size(&self) -> iced::Size<iced::Length> {
+        self.content.as_widget().size()
+    }
+    fn size_hint(&self) -> iced::Size<iced::Length> {
+        self.content.as_widget().size_hint()
+    }
+    fn layout(
+        &mut self,
+        tree: &mut iced::advanced::widget::Tree,
+        renderer: &R,
+        limits: &iced::advanced::layout::Limits,
+    ) -> iced::advanced::layout::Node {
+        self.content
+            .as_widget_mut()
+            .layout(&mut tree.children[0], renderer, limits)
+    }
+    fn operate(
+        &mut self,
+        tree: &mut iced::advanced::widget::Tree,
+        layout: iced::advanced::Layout<'_>,
+        renderer: &R,
+        operation: &mut dyn iced::advanced::widget::Operation,
+    ) {
+        self.content
+            .as_widget_mut()
+            .operate(&mut tree.children[0], layout, renderer, operation);
+    }
+    fn update(
+        &mut self,
+        tree: &mut iced::advanced::widget::Tree,
+        event: &iced::Event,
+        layout: iced::advanced::Layout<'_>,
+        cursor: iced::mouse::Cursor,
+        renderer: &R,
+        clipboard: &mut dyn iced::advanced::Clipboard,
+        shell: &mut iced::advanced::Shell<'_, Message>,
+        viewport: &iced::Rectangle,
+    ) {
+        let entering = {
+            let state = tree.state.downcast_mut::<WorkspaceInputState>();
+            let entering = self.help_open && !state.help_open;
+            state.help_open = self.help_open;
+            entering
+        };
+        if entering {
+            // Retire held gestures without executing their release actions.
+            // Text controls keep their real caret/focus; drawing tools remain
+            // selected, but an old drag cannot resume when Help is dismissed.
+            for event in [
+                iced::mouse::Event::CursorLeft,
+                iced::mouse::Event::ButtonReleased(iced::mouse::Button::Left),
+                iced::mouse::Event::ButtonReleased(iced::mouse::Button::Middle),
+                iced::mouse::Event::ButtonReleased(iced::mouse::Button::Right),
+            ] {
+                let mut discarded = Vec::new();
+                let mut cancellation = iced::advanced::Shell::new(&mut discarded);
+                self.content.as_widget_mut().update(
+                    &mut tree.children[0],
+                    &iced::Event::Mouse(event),
+                    layout,
+                    iced::mouse::Cursor::Unavailable,
+                    renderer,
+                    clipboard,
+                    &mut cancellation,
+                    viewport,
+                );
+                shell.request_redraw_at(cancellation.redraw_request());
+                if cancellation.is_layout_invalid() {
+                    shell.invalidate_layout();
+                }
+                if cancellation.are_widgets_invalid() {
+                    shell.invalidate_widgets();
+                }
+            }
+        }
+        if self.help_open
+            && matches!(
+                event,
+                iced::Event::Keyboard(
+                    iced::keyboard::Event::KeyPressed { .. }
+                        | iced::keyboard::Event::KeyReleased { .. }
+                ) | iced::Event::Mouse(_)
+                    | iced::Event::Touch(_)
+                    | iced::Event::InputMethod(_)
+            )
+        {
+            return;
+        }
+        // ModifiersChanged and passive window/redraw events still reach the
+        // editor, so releasing Shift during Help cannot stick on return.
+        self.content.as_widget_mut().update(
+            &mut tree.children[0],
+            event,
+            layout,
+            cursor,
+            renderer,
+            clipboard,
+            shell,
+            viewport,
+        );
+    }
+    fn draw(
+        &self,
+        tree: &iced::advanced::widget::Tree,
+        renderer: &mut R,
+        theme: &iced::Theme,
+        style: &iced::advanced::renderer::Style,
+        layout: iced::advanced::Layout<'_>,
+        cursor: iced::mouse::Cursor,
+        viewport: &iced::Rectangle,
+    ) {
+        self.content.as_widget().draw(
+            &tree.children[0],
+            renderer,
+            theme,
+            style,
+            layout,
+            cursor,
+            viewport,
+        );
+    }
+    fn mouse_interaction(
+        &self,
+        tree: &iced::advanced::widget::Tree,
+        layout: iced::advanced::Layout<'_>,
+        cursor: iced::mouse::Cursor,
+        viewport: &iced::Rectangle,
+        renderer: &R,
+    ) -> iced::mouse::Interaction {
+        if self.help_open {
+            iced::mouse::Interaction::None
+        } else {
+            self.content.as_widget().mouse_interaction(
+                &tree.children[0],
+                layout,
+                cursor,
+                viewport,
+                renderer,
+            )
+        }
+    }
+    fn overlay<'b>(
+        &'b mut self,
+        tree: &'b mut iced::advanced::widget::Tree,
+        layout: iced::advanced::Layout<'b>,
+        renderer: &R,
+        viewport: &iced::Rectangle,
+        translation: iced::Vector,
+    ) -> Option<iced::advanced::overlay::Element<'b, Message, iced::Theme, R>> {
+        if self.help_open {
+            None
+        } else {
+            self.content.as_widget_mut().overlay(
+                &mut tree.children[0],
+                layout,
+                renderer,
+                viewport,
+                translation,
+            )
+        }
+    }
+}

crates/oa-desktop/src/model_menu.rs

@@ -18,6 +18,7 @@ pub struct Request {
     pub route_segment: Option<(usize, Position)>,
     pub creation_point: Option<Position>,
     pub canvas: Option<route_edit::Context>,
+    pub process: Option<Box<crate::behavior::topology::Context>>,
     pub source_file: Option<String>,
 }
 impl Request {
@@ -32,6 +33,7 @@ impl Request {
             route_segment: None,
             creation_point: None,
             canvas: None,
+            process: None,
             source_file: None,
         }
     }
@@ -61,6 +63,10 @@ impl Opened {
             || request
                 .canvas
                 .is_some_and(|c| Some(c) != current_canvas(app))
+            || request
+                .process
+                .as_deref()
+                .is_some_and(|c| Some(*c) != app.topology_context())
         {
             return None;
         }
@@ -88,6 +94,11 @@ impl Opened {
                 .request
                 .canvas
                 .is_none_or(|c| Some(c) == current_canvas(app))
+            && self
+                .request
+                .process
+                .as_deref()
+                .is_none_or(|c| Some(*c) == app.topology_context())
             && self
                 .request
                 .source_file
@@ -101,10 +112,24 @@ fn target_matches(app: &App, request: &Request) -> bool {
     let Some(target) = request.selection_target.as_deref() else {
         return true;
     };
-    if request.canvas.is_none() || !app.multiselect_target_visible(target) {
+    if (request.canvas.is_none() && request.process.is_none())
+        || !app.multiselect_target_visible(target)
+    {
         return false;
     }
     match target {
+        Target::ProcessOccurrence(endpoint) => {
+            request.process.is_some()
+                && request.canvas.is_none()
+                && request.placement.is_none()
+                && endpoint.occurrence == request.object
+        }
+        Target::ProcessLink(id) | Target::ProcessPreviewLink { relation: id, .. } => {
+            request.process.is_some()
+                && request.canvas.is_none()
+                && request.placement.is_none()
+                && *id == request.object
+        }
         Target::Placement(id) => {
             request.placement == Some(*id)
                 && request
@@ -132,7 +157,9 @@ fn current_canvas(app: &App) -> Option<route_edit::Context> {
 
 fn current_diagram(app: &App) -> Option<Id> {
     if app.page == Page::Behavior {
-        app.state_context().map(|context| context.diagram)
+        app.topology_context()
+            .map(|context| context.owner)
+            .or_else(|| app.state_context().map(|context| context.diagram))
     } else {
         app.active_diagram
     }
@@ -156,6 +183,7 @@ pub fn trigger(app: &App) -> iced::Element<'_, Message> {
                 request.canvas = app.route_context();
             } else if app.page == Page::Behavior {
                 request.canvas = app.state_context();
+                request.process = app.topology_context().map(Box::new);
                 if let Some(target) = app.diagram_selection.as_ref().and_then(|s| s.primary()) {
                     request.selection_target = Some(Box::new(target.clone()));
                     request.placement = match target {
@@ -233,7 +261,7 @@ pub fn popup(app: &App) -> Option<Menu<Message>> {
         });
     }
     let mut entries = vec![Entry::title(crate::views::short(p.named(id), 38))];
-    if request.canvas.is_some()
+    if (request.canvas.is_some() || request.process.is_some())
         && let Some(context) = app.multiselect_context()
     {
         use crate::app::multiselect::{Choice, Event as SelectionEvent};
@@ -311,11 +339,20 @@ pub fn popup(app: &App) -> Option<Menu<Message>> {
                     )),
                     true,
                 ));
-                entries.push(item(
-                    "Hide selected placements",
-                    Message::DiagramSelection(SelectionEvent::Hide(snapshot.clone())),
-                    crate::app::multiselect::placements(&snapshot).is_some(),
-                ));
+                if request.process.is_some() {
+                    entries.push(Entry::title(
+                        "Drag contributions within one column to reorder",
+                    ));
+                    entries.push(Entry::disabled(
+                        "Hide unavailable · cards are model contributions",
+                    ));
+                } else {
+                    entries.push(item(
+                        "Hide selected placements",
+                        Message::DiagramSelection(SelectionEvent::Hide(snapshot.clone())),
+                        crate::app::multiselect::placements(&snapshot).is_some(),
+                    ));
+                }
                 entries.push(Entry::disabled(
                     "Delete selected from model (not yet available)",
                 ));
@@ -327,6 +364,35 @@ pub fn popup(app: &App) -> Option<Menu<Message>> {
                 });
             }
             entries.push(Entry::separator());
+            if let Some(context) = request.process.as_deref().copied() {
+                let endpoint = match request.selection_target.as_deref() {
+                    Some(Target::ProcessOccurrence(endpoint))
+                        if !endpoint.references.is_empty() =>
+                    {
+                        Some(endpoint.clone())
+                    }
+                    Some(Target::ProcessPreviewLink { source, .. }) => Some(source.clone()),
+                    _ => None,
+                };
+                if let Some(endpoint) = endpoint {
+                    entries.push(Entry::title("Reused contents · read-only in this process"));
+                    entries.push(item(
+                        "Open referenced definition",
+                        Message::TopologyCanvas(
+                            crate::behavior::topology::CanvasEvent::OpenQualified(
+                                context, endpoint,
+                            ),
+                        ),
+                        true,
+                    ));
+                    return Some(Menu {
+                        token: opened.token,
+                        anchor: request.anchor,
+                        entries,
+                        on_close: Message::Menu(Event::Close),
+                    });
+                }
+            }
         }
     }
     if app.page == Page::Behavior
@@ -603,7 +669,8 @@ pub fn popup(app: &App) -> Option<Menu<Message>> {
                 entries.push(item(
                     "Show in this diagram",
                     Message::PlaceSelected,
-                    d.layer == e.layer() && d.projection.includes(e.kind()),
+                    (d.layer == e.layer() || d.projection == ProjectionKind::Traceability)
+                        && d.projection.includes(e.kind()),
                 ));
             }
         }
@@ -734,6 +801,7 @@ fn relation_actions(kind: Kind) -> &'static [(&'static str, RelationKind, bool)]
 #[cfg(test)]
 mod tests {
     use super::*;
+    include!("model_menu_traceability_tests.rs");
     fn send(app: &mut App, message: Message) {
         let _ = app.update(message);
     }

crates/oa-desktop/src/model_menu_traceability_tests.rs

@@ -0,0 +1,62 @@
+#[test]
+fn traceability_show_menu_matches_cross_layer_and_port_placement_eligibility() {
+    let mut project = Project::empty();
+    let sa = project
+        .add_element(Kind::Function, Layer::Sa, "Counterpart", None)
+        .unwrap();
+    let port = Id::new_v4();
+    project.elements.insert(
+        port,
+        Element {
+            id: port,
+            alias: "legacy_port".into(),
+            name: "Port".into(),
+            description: String::new(),
+            parent: Some(sa),
+            body: ElementBody::shared_in(
+                Layer::Sa,
+                SharedBody::Port {
+                    contract: PortContract::Legacy,
+                    legacy: Some(LegacyPortContract {
+                        direction: PortDirection::InOut,
+                        interface: None,
+                    }),
+                },
+            ),
+        },
+    );
+    let diagram = project.ensure_diagram(Layer::Oa);
+    oa_core::validate_candidate(&project).unwrap();
+    for projection in [ProjectionKind::Overview, ProjectionKind::Traceability] {
+        let mut p = project.clone();
+        p.diagrams.get_mut(&diagram).unwrap().projection = projection;
+        let mut app = App::with_project(p);
+        app.page = Page::Diagram;
+        app.layer = Layer::Oa;
+        app.active_diagram = Some(diagram);
+        for object in [sa, port] {
+            send(&mut app, open(object, Point::ORIGIN));
+            let action = popup(&app)
+                .unwrap()
+                .entries
+                .into_iter()
+                .find_map(|e| match e {
+                    Entry::Action { label, message, .. } if label == "Show in this diagram" => {
+                        Some(message)
+                    }
+                    _ => None,
+                });
+            if object == port {
+                assert!(
+                    action.is_none(),
+                    "Ports never acquire independent node placements"
+                );
+            } else {
+                assert_eq!(
+                    action.expect("non-port placement entry").is_some(),
+                    projection == ProjectionKind::Traceability
+                );
+            }
+        }
+    }
+}

crates/oa-desktop/src/views.rs

@@ -25,6 +25,23 @@ pub fn action<'a>(s: &str, m: Message) -> widget::Button<'a, Message> {
         .on_press(m)
         .style(style::nav)
 }
+
+/// Optional instructions belong beside the work, without taking a canvas row.
+/// The button also opens keyboard-accessible help; the tooltip is only a preview.
+pub(crate) fn diagram_help<'a>(
+    topic: crate::guide::Topic,
+    hint: impl Into<String>,
+) -> View<'a, Message> {
+    tooltip(
+        action("Help · F1", Message::ContextHelp(topic)),
+        container(text(hint.into()).size(12))
+            .padding(10)
+            .max_width(360)
+            .style(style::card),
+        tooltip::Position::Bottom,
+    )
+    .into()
+}
 pub fn short(s: &str, limit: usize) -> String {
     let s = s.split_whitespace().collect::<Vec<_>>().join(" ");
     if s.graphemes(true).count() > limit {
@@ -240,11 +257,23 @@ pub fn view(app: &App) -> View<'_, Message> {
     if !matches!(app.page, Page::Home | Page::Text | Page::Guide) {
         body = body.push(inspector(app));
     }
+    let diagram_feedback = diagram_feedback(app);
+    // Keep operation outcomes visible even while a drawing hint is active.
+    let (status, status_detail) = if app.busy {
+        ("Working…".into(), "Working…".into())
+    } else if let Some(feedback) = diagram_feedback.filter(|feedback| *feedback != app.status) {
+        (
+            format!("{} · {}", short(&app.status, 60), short(&feedback, 80)),
+            format!("{}\n{}", app.status, feedback),
+        )
+    } else {
+        (short(&app.status, 145), app.status.clone())
+    };
     let footer = container(
         row![
             container(tooltip(
-                text(short(if app.busy { "Working…" } else { &app.status }, 145)).size(11),
-                container(text(if app.busy { "Working…" } else { &app.status }).size(12))
+                text(status).size(11).wrapping(widget::text::Wrapping::None),
+                container(text(status_detail).size(12))
                     .padding(10)
                     .max_width(600)
                     .style(style::card),
@@ -267,6 +296,25 @@ pub fn view(app: &App) -> View<'_, Message> {
     .padding([4, 16])
     .style(style::panel);
     let root = crate::allocation_input::root(app, column![header, task_nav, body, footer]);
+    let root = crate::guide::protect_workspace(app.context_help, root);
+    if app.context_help {
+        return modal_width(
+            root,
+            column![
+                row![
+                    text("Diagram help").size(18),
+                    Space::new().width(Fill),
+                    action("Close · Esc", Message::CloseContextHelp),
+                ]
+                .align_y(iced::Center),
+                crate::guide::context_view(&app.guide),
+            ]
+            .spacing(12)
+            .height((app.window_size.height - 140.).max(300.))
+            .into(),
+            (app.window_size.width - 80.).min(900.),
+        );
+    }
     if app.architecture.as_ref().is_some_and(|s| s.modal()) {
         return modal_width(
             root,
@@ -362,7 +410,8 @@ pub fn view(app: &App) -> View<'_, Message> {
             (app.window_size.width - 32.).clamp(120., 760.),
         );
     }
-    root
+    // Match modal_width's first child so help does not recreate the editor tree.
+    widget::stack![root].into()
 }
 fn modal<'a>(base: View<'a, Message>, content: View<'a, Message>) -> View<'a, Message> {
     modal_width(base, content, 800.)
@@ -447,7 +496,7 @@ fn diagram(app: &App) -> View<'_, Message> {
         .active_diagram
         .and_then(|id| app.project().diagrams.get(&id))
         .map(|d| d.projection);
-    let modes = row![
+    let mut modes = row![
         label("View content"),
         pick_list(
             [
@@ -462,7 +511,15 @@ fn diagram(app: &App) -> View<'_, Message> {
             Message::Projection
         )
         .padding(8)
-        .text_size(12)
+        .text_size(12),
+        diagram_help(
+            crate::guide::Topic::Nesting,
+            if projection == Some(ProjectionKind::Traceability) {
+                "Shows OA and SA elements with correspondence lines. Place both ends of a trace to show it; port traces use their owner cards. Open Help for trace visibility and editing controls."
+            } else {
+                "Shift-click to add or remove selection. Right-click for actions; drag to arrange; scroll to zoom. Drag a connection line, bend or label to move it; Insert adds a bend and Escape cancels. Open Help for full editing controls."
+            },
+        )
     ]
     .spacing(10)
     .align_y(iced::Center);
@@ -555,6 +612,26 @@ fn diagram(app: &App) -> View<'_, Message> {
         .center(Fill)
         .into()
     };
+    if projection == Some(ProjectionKind::Allocation) {
+        modes = modes.push(tooltip(
+            action(
+                if app.allocation_drag.arrange_next {
+                    "Arrange ✓"
+                } else {
+                    "Arrange"
+                },
+                Message::WorkDrag(crate::app::allocation_drag::Event::ArrangeNext),
+            ),
+            container(text(format!(
+                "Arrange next drag · {}. Move work within its current allocation; Escape cancels.",
+                crate::allocation_input::ARRANGE_SHORTCUT
+            )))
+            .padding(10)
+            .max_width(420)
+            .style(style::card),
+            tooltip::Position::Bottom,
+        ));
+    }
     let mut tools = column![toolbar].spacing(8);
     if app.active_diagram.is_some() {
         tools = tools.push(modes);
@@ -568,60 +645,50 @@ fn diagram(app: &App) -> View<'_, Message> {
             .feedback
             .as_ref()
             .map(|feedback| feedback.destination_identity())
-            .unwrap_or_else(|| "None · drag work to choose".into());
+            .unwrap_or_else(|| "—".into());
         let inspection = app
             .allocation_drag
             .feedback
             .as_ref()
             .map(|feedback| feedback.inspection_identity())
             .unwrap_or_else(|| destination.clone());
-        tools = tools.push(
-            container(tooltip(
-                text(format!("Destination: {}", short(&destination, 28)))
-                    .size(13)
-                    .wrapping(widget::text::Wrapping::None),
-                container(text(inspection).size(13))
-                    .padding(10)
-                    .max_width(420)
-                    .style(style::card),
-                tooltip::Position::Top,
-            ))
-            .id("allocation-destination")
-            .height(26)
-            .width(Fill)
-            .clip(true),
-        );
-        tools = tools.push(
-            row![
-                action(
-                    &format!(
-                        "{} · {}",
-                        if app.allocation_drag.arrange_next {
-                            "Arrange next drag: armed"
-                        } else {
-                            "Arrange next drag"
-                        },
-                        crate::allocation_input::ARRANGE_SHORTCUT
-                    ),
-                    Message::WorkDrag(crate::app::allocation_drag::Event::ArrangeNext)
-                ),
-                label("Drag work into a performer to assign · out to remove assignment")
-            ]
-            .spacing(8)
-            .align_y(iced::Center),
-        );
+        let destination_control = container(tooltip(
+            text(format!("Destination: {}", short(&destination, 28)))
+                .size(13)
+                .wrapping(widget::text::Wrapping::None),
+            container(text(inspection).size(13))
+                .padding(10)
+                .max_width(420)
+                .style(style::card),
+            tooltip::Position::Top,
+        ))
+        .id("allocation-destination")
+        .height(26)
+        .width(Fill)
+        .clip(true);
+        tools = tools.push(destination_control);
     }
     if let Some(diagram) = app.active_diagram {
         let view = oa_core::projection::project_view(app.project(), diagram);
-        let edge = view.edges.iter().find(|edge| edge.id == app.selected);
-        let promoted = edge.is_some_and(|edge| {
-            oa_core::projection::edge_endpoint_placements(
-                app.project(),
-                &app.project().diagrams[&diagram],
-                edge.id,
-            )
-            .is_some_and(|(source, target)| source != edge.source || target != edge.target)
-        });
+        if projection == Some(ProjectionKind::Traceability) {
+            let correspondence_lines = view.edges.iter().filter(|edge| edge.trace).count();
+            tools = tools.push(
+                row![
+                    label(format!("{correspondence_lines} trace lines")),
+                    action(
+                        "Add existing elements…",
+                        Message::Architecture(crate::app::architecture_authoring::Event::Existing(
+                            None
+                        ))
+                    ),
+                    action("Review layer traces", Message::ReviewLayerTraces),
+                    action("View visibility…", Message::Select(diagram)),
+                ]
+                .spacing(7)
+                .align_y(iced::Center)
+                .wrap(),
+            );
+        }
         let selection = app.multiselect_snapshot();
         let count = selection.as_ref().map_or(0, |s| s.targets().len());
         let mut selection_controls =
@@ -640,68 +707,92 @@ fn diagram(app: &App) -> View<'_, Message> {
             }
             selection_controls = selection_controls
                 .push(action(
-                    "Clear selection",
+                    "Clear",
                     Message::DiagramSelection(crate::app::multiselect::Event::Clear(
                         snapshot.context(),
                     )),
                 ))
                 .push(
                     label(format!(
-                        "Properties edit only {}",
-                        short(app.project().named(app.selected), 36)
+                        "Properties: {} only",
+                        short(app.project().named(app.selected), 14)
                     ))
                     .wrapping(widget::text::Wrapping::None),
                 );
         }
-        let hint = if let Some(feedback) = &app.allocation_drag.feedback {
-            feedback.text.as_str()
-        } else if let Some(session) = &app.connection {
-            if session.source.is_some() {
-                if session.candidates.is_empty() {
-                    "No compatible targets are visible. Expand containers or show an endpoint · Esc cancels"
-                } else {
-                    "Choose a highlighted target · middle-drag or arrow keys pan · Esc cancels"
-                }
-            } else {
-                session.tool.hint()
-            }
-        } else if count > 1 {
-            if selection
-                .as_ref()
-                .is_some_and(|s| crate::app::multiselect::placements(s).is_some())
-                && projection != Some(ProjectionKind::Allocation)
-            {
-                "Shift-click to add/remove · drag selected to move · right-click for actions · scroll to zoom"
-            } else {
-                "Shift-click to add/remove · right-click for selection actions · Esc clears selection"
-            }
-        } else if promoted {
-            "Expand endpoint containers to edit this connection route"
-        } else if edge.is_some() {
-            "Right-click for routing · drag line / bend / label · Insert adds a bend · Esc cancels"
-        } else {
-            "Shift-click to add/remove · right-click for actions · drag to arrange · scroll to zoom"
-        };
-        // Selection changes must not resize the measured canvas or refit its
-        // camera. Reserve both rows even when no group actions are available.
+        // Selection never moves the canvas. General controls live in Help;
+        // active gesture feedback uses the persistent application status bar.
         tools = tools.push(
-            container(
-                column![
-                    selection_controls,
-                    label(hint).wrapping(widget::text::Wrapping::None)
-                ]
-                .spacing(3),
-            )
-            .height(56)
-            .width(Fill)
-            .clip(true),
+            container(selection_controls)
+                .height(32)
+                .width(Fill)
+                .clip(true),
         );
     }
     column![container(tools).padding(14), canvas].into()
 }
 
+fn diagram_feedback(app: &App) -> Option<String> {
+    if app.page != Page::Diagram {
+        return None;
+    }
+    if let Some(feedback) = &app.allocation_drag.feedback {
+        return Some(feedback.text.clone());
+    }
+    if let Some(session) = &app.connection {
+        return Some(
+            if session.source.is_none() {
+                session.tool.hint()
+            } else if session.candidates.is_empty() {
+                "No compatible targets visible. Expand containers or show an endpoint · Esc cancels"
+            } else {
+                "Choose a highlighted target · Esc cancels"
+            }
+            .into(),
+        );
+    }
+    let diagram = app.active_diagram?;
+    let view = oa_core::projection::project_view(app.project(), diagram);
+    let edge = view.edges.iter().find(|edge| edge.id == app.selected)?;
+    let (source, target) = oa_core::projection::edge_endpoint_placements(
+        app.project(),
+        &app.project().diagrams[&diagram],
+        edge.id,
+    )?;
+    (source != edge.source || target != edge.target)
+        .then(|| "Expand endpoint containers to edit this connection route".into())
+}
+
 fn inspector(app: &App) -> View<'_, Message> {
     let p = app.project();
+    if let Some(target) = app.process_preview_primary() {
+        let endpoint = match target {
+            crate::diagram_usage::Target::ProcessOccurrence(endpoint) => endpoint.clone(),
+            crate::diagram_usage::Target::ProcessPreviewLink { source, .. } => source.clone(),
+            _ => unreachable!(),
+        };
+        let context = app.topology_context().unwrap();
+        return container(
+            column![
+                text(p.named(app.selected)).size(17),
+                label("Reused contents · read-only here"),
+                label("Open the referenced definition to edit this contribution or connection."),
+                action(
+                    "Open referenced definition",
+                    Message::TopologyCanvas(crate::behavior::topology::CanvasEvent::OpenQualified(
+                        context, endpoint
+                    ))
+                ),
+                crate::model_menu::trigger(app),
+            ]
+            .spacing(12),
+        )
+        .padding(14)
+        .width(320)
+        .height(Fill)
+        .style(style::panel)
+        .into();
+    }
     if app.source_dirty() {
         let mut notice = column![
             text("Source drafts pending").size(17),

crates/vendor/iced_widget/ARCADIA-PATCH.md

@@ -7,7 +7,10 @@ https://raw.githubusercontent.com/iced-rs/iced/54abf81d13fec06d4d9ac754b03ce2c33
 SHA-256 `fc9086ba4eba4b77e4c603906362742bc3715ffa2c7810c6074fe7780d3a0398`.
 
 All copied src/assets and Cargo manifests retain their upstream bytes except
-`src/text_editor.rs`, which adds one documented read-only `Content::with_editor`
+the three modules described below. Their original files are identified in
+UPSTREAM-MANIFEST.json.
+
+`src/text_editor.rs` adds one documented read-only `Content::with_editor`
 callback. Original file SHA-256:
 `cecf8686c90aa92066d55075beba545dfb7dd5a44bad0c1519fcb110a56070e1`.
 The callback borrows the existing renderer editor and releases the borrow when
@@ -19,6 +22,20 @@ measurement. The isolated Windows CPU experiment verified the exact painted
 editor identity and geometry plus retained Word/Line selection and scroll;
 application integration/native validation are separately required.
 
+`src/pick_list.rs` shares its open flag with the menu overlay and supplies a
+base-event fallback for a picker opened earlier in the same event batch.
+Escape dismisses the open picker, captures the key, requests redraw and sends
+its optional close notification without selecting an option.
+
+`src/overlay/menu.rs` adds the private opt-in bridge used by PickList. It handles
+Escape before controls underneath the overlay receive it. Once its owner is
+closed, the retained overlay ignores later queued events and no longer draws
+or reports a mouse interaction. This prevents a queued click from selecting
+an option after dismissal and prevents duplicate close notifications. Other
+Menu consumers retain their existing behavior unless they opt into the bridge.
+The application-level Escape routing and its regression tests are separate
+from these vendored modules; source description alone is not runtime evidence.
+
 UPSTREAM-MANIFEST.json records all files from the local pinned registry source,
 including registry bookkeeping and the upstream crate lockfile not copied here.
 Those omitted files are not package inputs. The workspace root Cargo.lock and
@@ -26,6 +43,8 @@ local patch path identify the resolved dependency; this patched package is not
 the unmodified registry checksum. Keep LICENSE and this provenance in source
 captures and generated dependency notices.
 
-On upgrades compare the pristine upstream module and replay only this accessor.
-Recheck actual editor layout, selection/input continuity and annotation tests.
-Remove this patch if upstream provides equivalent read-only layout access.
+On upgrades compare all three modules with their pristine upstream versions
+and reassess each change. Recheck actual editor layout, selection/input
+continuity, annotations, picker dismissal, same-batch queued input and close
+notification behavior. Remove each local change when upstream provides its
+equivalent behavior.

crates/vendor/iced_widget/src/overlay/menu.rs

@@ -1,6 +1,7 @@
 //! Build and show dropdown menus.
 use crate::core::alignment;
 use crate::core::border::{self, Border};
+use crate::core::keyboard;
 use crate::core::layout::{self, Layout};
 use crate::core::mouse;
 use crate::core::overlay;
@@ -15,6 +16,7 @@ use crate::core::{
 };
 use crate::core::{Element, Shell, Widget};
 use crate::scrollable::{self, Scrollable};
+use std::cell::Cell;
 
 /// A list of selectable options.
 pub struct Menu<
@@ -34,6 +36,7 @@ pub struct Menu<
     hovered_option: &'a mut Option<usize>,
     on_selected: Box<dyn FnMut(T) -> Message + 'a>,
     on_option_hovered: Option<&'a dyn Fn(T) -> Message>,
+    escape: Option<(&'a Cell<bool>, Option<Message>)>,
     width: f32,
     padding: Padding,
     text_size: Option<Pixels>,
@@ -68,6 +71,7 @@ where
             hovered_option,
             on_selected: Box::new(on_selected),
             on_option_hovered,
+            escape: None,
             width: 0.0,
             padding: Padding::ZERO,
             text_size: None,
@@ -78,6 +82,17 @@ where
         }
     }
 
+    // PickList owns this flag. Other Menu consumers retain their existing
+    // keyboard behavior unless they explicitly opt into this private bridge.
+    pub(crate) fn close_on_escape(
+        mut self,
+        open: &'a Cell<bool>,
+        on_close: Option<Message>,
+    ) -> Self {
+        self.escape = Some((open, on_close));
+        self
+    }
+
     /// Sets the width of the [`Menu`].
     pub fn width(mut self, width: f32) -> Self {
         self.width = width;
@@ -170,6 +185,7 @@ where
     viewport: Rectangle,
     tree: &'a mut Tree,
     list: Scrollable<'a, Message, Theme, Renderer>,
+    escape: Option<(&'a Cell<bool>, Option<Message>)>,
     width: f32,
     target_height: f32,
     class: &'a <Theme as Catalog>::Class<'b>,
@@ -198,6 +214,7 @@ where
             hovered_option,
             on_selected,
             on_option_hovered,
+            escape,
             width,
             padding,
             font,
@@ -228,6 +245,7 @@ where
             viewport,
             tree: &mut state.tree,
             list,
+            escape,
             width,
             target_height,
             class,
@@ -278,6 +296,31 @@ where
         clipboard: &mut dyn Clipboard,
         shell: &mut Shell<'_, Message>,
     ) {
+        // UserInterface may retain this overlay for the rest of an event batch.
+        // A dismissed owner must not select an option on a queued later click.
+        if self.escape.as_ref().is_some_and(|(open, _)| !open.get()) {
+            return;
+        }
+        // Consume dismissal in the overlay so Iced never sends the same key
+        // into focused controls or canvases beneath this picker. The shared
+        // owner flag also prevents duplicate close notifications in one batch.
+        if matches!(
+            event,
+            Event::Keyboard(keyboard::Event::KeyPressed {
+                key: keyboard::Key::Named(keyboard::key::Named::Escape),
+                ..
+            })
+        ) && let Some((open, on_close)) = &mut self.escape
+            && open.replace(false)
+        {
+            if let Some(message) = on_close.take() {
+                shell.publish(message);
+            }
+            shell.capture_event();
+            shell.request_redraw();
+            return;
+        }
+
         let bounds = layout.bounds();
 
         self.list.update(
@@ -292,6 +335,9 @@ where
         cursor: mouse::Cursor,
         renderer: &Renderer,
     ) -> mouse::Interaction {
+        if self.escape.as_ref().is_some_and(|(open, _)| !open.get()) {
+            return mouse::Interaction::None;
+        }
         self.list.mouse_interaction(
             self.tree,
             layout,
@@ -309,6 +355,9 @@ where
         layout: Layout<'_>,
         cursor: mouse::Cursor,
     ) {
+        if self.escape.as_ref().is_some_and(|(open, _)| !open.get()) {
+            return;
+        }
         let bounds = layout.bounds();
 
         let style = Catalog::style(theme, self.class);

crates/vendor/iced_widget/src/pick_list.rs

@@ -78,6 +78,7 @@ use crate::core::{
 use crate::overlay::menu::{self, Menu};
 
 use std::borrow::Borrow;
+use std::cell::Cell;
 use std::f32;
 
 /// A widget for selecting a single value from a list of options.
@@ -448,12 +449,24 @@ where
         let state = tree.state.downcast_mut::<State<Renderer::Paragraph>>();
 
         match event {
+            Event::Keyboard(keyboard::Event::KeyPressed {
+                key: keyboard::Key::Named(keyboard::key::Named::Escape),
+                ..
+            }) if state.is_open.replace(false) => {
+                // The picker may have opened earlier in this base-event batch,
+                // after UserInterface collected its overlays.
+                if let Some(on_close) = &self.on_close {
+                    shell.publish(on_close.clone());
+                }
+                shell.capture_event();
+                shell.request_redraw();
+            }
             Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left))
             | Event::Touch(touch::Event::FingerPressed { .. }) => {
-                if state.is_open {
+                if state.is_open.get() {
                     // Event wasn't processed by overlay, so cursor was clicked either outside its
                     // bounds or on the drop-down, either way we close the overlay.
-                    state.is_open = false;
+                    state.is_open.set(false);
 
                     if let Some(on_close) = &self.on_close {
                         shell.publish(on_close.clone());
@@ -463,7 +476,7 @@ where
                 } else if cursor.is_over(layout.bounds()) {
                     let selected = self.selected.as_ref().map(Borrow::borrow);
 
-                    state.is_open = true;
+                    state.is_open.set(true);
                     state.hovered_option = self
                         .options
                         .borrow()
@@ -482,7 +495,7 @@ where
             }) => {
                 if state.keyboard_modifiers.command()
                     && cursor.is_over(layout.bounds())
-                    && !state.is_open
+                    && !state.is_open.get()
                 {
                     fn find_next<'a, T: PartialEq>(
                         selected: &'a T,
@@ -528,7 +541,7 @@ where
         let status = {
             let is_hovered = cursor.is_over(layout.bounds());
 
-            if state.is_open {
+            if state.is_open.get() {
                 Status::Opened { is_hovered }
             } else if is_hovered {
                 Status::Hovered
@@ -612,7 +625,7 @@ where
                 shaping,
             }) => Some((*font, *code_point, *size, *line_height, *shaping)),
             Handle::Dynamic { open, closed } => {
-                if state.is_open {
+                if state.is_open.get() {
                     Some((
                         open.font,
                         open.code_point,
@@ -703,7 +716,7 @@ where
         let state = tree.state.downcast_mut::<State<Renderer::Paragraph>>();
         let font = self.font.unwrap_or_else(|| renderer.default_font());
 
-        if state.is_open {
+        if state.is_open.get() {
             let bounds = layout.bounds();
 
             let on_select = &self.on_select;
@@ -713,13 +726,14 @@ where
                 self.options.borrow(),
                 &mut state.hovered_option,
                 |option| {
-                    state.is_open = false;
+                    state.is_open.set(false);
 
                     (on_select)(option)
                 },
                 None,
                 &self.menu_class,
             )
+            .close_on_escape(&state.is_open, self.on_close.clone())
             .width(bounds.width)
             .padding(self.padding)
             .font(font)
@@ -763,7 +777,7 @@ where
 struct State<P: text::Paragraph> {
     menu: menu::State,
     keyboard_modifiers: keyboard::Modifiers,
-    is_open: bool,
+    is_open: Cell<bool>,
     hovered_option: Option<usize>,
     options: Vec<paragraph::Plain<P>>,
     placeholder: paragraph::Plain<P>,
@@ -775,7 +789,7 @@ impl<P: text::Paragraph> State<P> {
         Self {
             menu: menu::State::default(),
             keyboard_modifiers: keyboard::Modifiers::default(),
-            is_open: bool::default(),
+            is_open: Cell::new(false),
             hovered_option: Option::default(),
             options: Vec::new(),
             placeholder: paragraph::Plain::default(),

docs/architecture.md

@@ -2,6 +2,8 @@
 
 The normative contract is [language.rst](language.rst); [scope.md](scope.md) explains deliberate differences from the complete Arcadia/Capella ecosystem. V2 uses one typed model and one validated mutation boundary across the desktop, text editor and REST service.
 
+Desktop changes follow the [editing workspace UX review criteria](ui-review.md) for concise persistent content, contextual help, visible actionable feedback and native interaction review.
+
 ## Crate boundaries
 
 | Crate | Responsibility | Does not depend on |

docs/preview-human-checks.md

@@ -0,0 +1,55 @@
+# Testing the integrated Windows preview
+
+Extract the complete published ZIP and run `arcadia-studio.exe`, keeping its DLL
+beside it. Copy a complete example folder before editing, including all source
+includes and evidence files. When reporting a problem, include the preview
+version, example and steps that reproduce it. These checks describe expected
+behavior; the release's VALIDATION document records what was actually verified.
+
+1. **Text and diagrams together.** Select a source block and use Tab/Shift+Tab,
+   then source Undo/Redo. Apply, return to a saved graphical view, move a
+   placement, Save all and reopen. Both accepted edits should persist. In a
+   Scenario view, choose S/Select and 100% before dragging a lifeline header.
+2. **Scenario arrangements.** Rename one saved arrangement in Properties,
+   switch to another, and check that its name and layout remain independent.
+   Select a call and switch arrangements: that call should remain selected when
+   both contain it. Return through Details to the intended editable properties.
+3. **Draft recovery.** Change a service-call value without applying it, switch
+   Properties to Connections and back, and confirm the draft remains. Revert
+   should restore the accepted value. Incompatible operation/field choices
+   should explain the problem and retain the draft. Check that Apply/Revert
+   remain reachable after resizing the window.
+4. **Attachments, bends and ports.** Move an ordinary edge attachment, add and
+   move a State bend, and move an SA semantic port. Check Undo/Redo and reopen.
+   A second saved view should remain independent, and endpoint identities should
+   not change merely because their presentation moved.
+5. **Multiple selection.** In ordinary and State diagrams select a group, move
+   it, and use Undo/Redo. In Process views reorder supported sibling cards and
+   inspect exact reused occurrences with Open/Back. In Allocation views exercise
+   group assignment and explicit Arrange; an unsupported mixed selection should
+   be refused as a whole. Aggregate semantic deletion remains unavailable.
+6. **Direct Allocation drawing.** Choose Allocation, click a performer and a
+   highlighted unallocated leaf activity/function. Check the intended relation
+   and nesting, then Undo/Redo. An occupied or incompatible target should be
+   refused; Escape should cancel the pending drawing action.
+7. **Traceability.** Open a mixed OA/SA Traceability view, use Add existing
+   elements and place both ends of a correspondence. The selected mixed view
+   should remain active. Review layer traces for correspondences whose endpoints
+   are not represented as cards in that view.
+8. **Counterpart review.** Explicitly choose an existing counterpart and inspect
+   its Name/Description conflicts. Keep target should preserve the target's
+   engineering text. Scroll the review in a shorter window: counts, unresolved
+   guidance and Apply/Cancel should remain reachable. Cancel once, repeat and
+   Apply, then Save/reopen. An unchanged subsequent Apply should not duplicate
+   the target or its trace.
+9. **Picker Escape and Text navigation.** Open a picker inside a pending form:
+   the first Escape should close the picker and retain the form. A subsequent
+   Escape should follow the form's ordinary cancellation behavior. Also exercise
+   source declaration/reference navigation, Back, Find and alias-rename preview;
+   cancel once before confirming a rename on the copied example.
+
+Inspect the known limitations in the release notes. In particular, crossed
+Process routes and multiline State labels can be crowded. Report these as visual
+readability problems even if the saved connection records remain correct. This
+preview does not imply complete OA/SA, source8 or accessibility acceptance.
+Linux builds remain deferred at the user's request.

docs/ui-review.md

@@ -0,0 +1,27 @@
+# Editing workspace UX review
+
+These development criteria implement the [project goal](../PROJECT_GOAL.md): reduce system engineers' cognitive load, keep graphical editing intuitive, and provide concise, navigable built-in help. They also address the user's request tracked in Gitea issue #39 to prevent persistent instructional text from consuming editing space. They are review criteria, not a claim that any particular build has passed them.
+
+## Persistent content and progressive disclosure
+
+Populated editing workspaces prioritize model content, controls, current state and actionable feedback. General explanations, gesture tutorials and repeated shortcut lists belong in contextual Help, tooltips or explicitly opened details. Do not add permanent instructional paragraphs above a populated canvas merely to explain a feature.
+
+Keep essential control labels and relevant status visible. Offer concise next-step guidance in empty states and while a user is performing a multi-step action. Put longer explanations behind a clearly labeled disclosure near the relevant control or context. Essential instructions must be accessible through an explicit keyboard-reachable route; a hover-only tooltip is insufficient. Reuse the built-in guide for broader modeling explanations.
+
+Distinguish instruction from information needed to act safely. Current errors, pending edits, failed operations, fallback rendering, unavailable actions and recovery steps must remain apparent. Preserve consequential distinctions such as editing a shared definition, changing semantic order rather than saved positions, or applying properties to only one member of a selection. Long diagnostic detail may be disclosed on demand, but its visible summary must identify the problem and a usable next step.
+
+## Stable editing context
+
+Selection changes and gesture feedback must not unexpectedly move or resize the canvas, reset its camera, or change the interpretation of the pointer. Compact existing stable layout slots instead of conditionally removing them when their content is absent. Opening and closing help must preserve the model, selection and pending drafts, and return the user to a usable editing context. Explicitly requested panel changes may resize the workspace; verify their effect on focus and navigation.
+
+## Native review
+
+Exercise the changed workspace in the actual built application at its configured minimum window size and a representative normal size. Include an independent reviewer for material interaction or layout changes, following [the working agreement](../AGENTS.md). Review representative populated models as well as relevant empty, pending, failure and recovery states.
+
+- Inspect whether instructional prose or unused space displaces useful model content. Compare before/after screenshots at the same window size, display scaling, model and panel state when assessing space savings.
+- Perform the affected workflow: select, edit, navigate, cancel and recover as applicable. Change between empty, single and multiple selections; exercise affected gestures and inspect camera and pointer stability.
+- Find and use the disclosed guidance by keyboard as well as pointer. Check focus, dismissal, return to editing, and preservation of drafts.
+- Trigger relevant disabled or rejected operations. Confirm their reason and recovery action remain visible, accurate and reachable.
+- Check text, controls, panels and warnings for clipping, overlap, excessive scrolling and lost actions at the minimum size. Do not trade recovered space for unreadable text or unexplained symbols.
+
+Record the tested code version, runtime environment, workflows, observations and representative screenshots in the change's review evidence. Screenshots support layout findings; they do not establish working interaction, accessibility or state preservation. Fix material findings and recheck affected behavior before treating the change as verified.

docs/windows-packaging.md

@@ -2,6 +2,10 @@
 
 The standard build target is x86_64 MSVC. The optional gnullvm build uses LLVM-MinGW UCRT and currently needs `libunwind.dll` alongside both executables. Packaging is a separate operation on already-built inputs; it neither builds nor launches applications and does not confer release acceptance.
 
+For feature checks after extracting the integrated preview, use the
+[human testing checklist](preview-human-checks.md) alongside the release's exact
+validation record and known limitations.
+
 Run from a Git checkout with Windows PowerShell 5.1 or PowerShell 7 and Python 3.11+ (standard library only). Build and test first using the [README](../README.md). Select the actual output directory explicitly; a native-host Cargo build normally uses `target/release`, while an explicit `--target` uses `target/<target>/release`. `-Python <executable>` selects Python when it is not named `python` on PATH; it collects/checks the package-local documentation closure without running binaries.
 
 Packaging also needs the build's matching `cargo` and `rustc` on the packaging process PATH, the locked dependency sources/archive cache, and installed Rust target libraries and copyright reports. The script invokes only read-only `cargo metadata --locked --offline --filter-platform <target>` and Rust version/sysroot queries. It does not download dependencies or build. These tools are packaging prerequisites; the extracted application does not require them.

harness/DECISIONS.md

@@ -1,5 +1,28 @@
 # Architectural and product decisions
 
+## Measured label wrapping remains experimental — 2026-10-01
+
+Preserve the isolated E/F prototypes and their
+[validation, locked readings and conservation oracles](experiments/wrapped-label-20261001/validation.md)
+without promoting either placement rule. E centers two measured lines on the
+own stroke; F offsets three lines beside it. Both reduce backing width using
+actual Iced shaping and conserve canonical model data and route geometry. F's
+first reader still misidentified two exchanges; both readers retained a plausible
+wrong conversation ownership. The experiments therefore do not meet dependable
+association at Fit, despite correct E endpoint guesses. Separate readers and a
+single fixture do not establish causal superiority or general usability.
+
+Keep raw routing distinct from derived presentation during gesture previews:
+the adversarial different-edge test exposed stale wrapped bounds after guard
+refusal, fixed by retaining the original core RoutedView. This is reusable
+architecture evidence, not acceptance of private fixture-specific layout code.
+Saved fraction/offset survive under F, but ordinary reopening derives one line;
+external profiles cannot provide a production formatting contract. A general
+format/layout proposal requires explicit persistence semantics, shared consumer
+bounds, native representative workflows and glyph/performance evidence. Further
+work should address view scale and ambiguous stroke ownership rather than tune
+this same label scene until it looks successful.
+
 ## Private source composition decision — 2026-09-23
 
 Adopt the opaque validated original-span rename batch as the next private

harness/STATE.md

@@ -1,14 +1,62 @@
-# Verified branch checkpoint — 2026-09-23 UTC
+# Isolated measured-label experiment checkpoint — 2026-10-01 PDT
 
-This describes Codex-956atf's contribution, not a combined release.
-[PROJECT_GOAL.md](../PROJECT_GOAL.md) remains authoritative. The complete OA/SA
-application is unfinished; published previews and finite prototypes are intermediate.
+This branch adds the private E/F label experiment at
+`d0896ced75fea73bcda6bd14f259a34503840704` to the compact Help foundation below.
+[Validation and retained raw evidence](experiments/wrapped-label-20261001/validation.md)
+cover actual measured Iced layout, 126 focused tests, native first readings,
+selection/edit/Undo/Redo, exact exports and saved-F reopening. An independent
+review verified complete Project conservation and unchanged paths/drawing bytes.
+Neither candidate established reliable first-reading label ownership, and
+ordinary reopening loses the externally selected wrapping. Both remain excluded
+from production and releases. This branch is experimental evidence, not an
+integrated product checkpoint or complete OA/SA acceptance. Live #38 ownership
+and next actions remain in Gitea.
 
-**Linux/WSL builds and checks remain deferred until the user explicitly reports
-networking resolved.** No guest setup, diagnosis, restart or cache transfer is
-active. The VPN remains untouched.
+# Verified Windows source checkpoint — 2026-10-01 PDT
 
-## Current integrated candidate and evidence
+This branch combines the released integrated foundation
+`715036e132677dd2bc2fb37ed316d93dc9987aec` with compact diagram controls and
+contextual Help production source `6e7c4ddaf0775198384a8c4882809ea8e14b2976`.
+[PROJECT_GOAL.md](../PROJECT_GOAL.md) remains authoritative; complete OA/SA
+acceptance is unfinished.
+
+**Linux/WSL builds remain excluded by the user's explicit request.**
+
+## Verified capabilities and evidence
+
+The [frozen integrated Windows preview](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/releases/tag/v0.2.0-preview.integrated.20260924)
+provides the accepted 715 foundation and its combined test/package evidence.
+It remains unchanged. The older pending-build description previously at the top
+of this file is superseded by that published result.
+
+The [compact Help contribution](compact-help-validation-20261001.md) removes
+permanent canvas tutorial prose, keeps stable concise selection rows and full
+allocation destinations, and supports contextual Help/F1 with keyboard reading,
+exact caret/draft preservation and safe gesture retirement. Final focused gates
+pass 125 tests; the earlier full-suite result retains its separate source scope.
+[Fresh package validation](release-compact-help-validation-20261001.md) verifies
+actual extracted desktop/server behavior, Save/Undo/Redo/reopen and complete
+source/model oracles. This is a scoped development preview, not complete release
+or acceptance of the separately owned follow-up union.
+The [scoped compact Help Windows preview](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/releases/tag/v0.2.0-preview.compact-help.20261001)
+is published from evidence checkpoint `f1fdca371394aec1148e67f33f4d8c6b53a0c350`.
+Its ZIP, checksum and validation attachment were downloaded and matched after
+publication; [publication receipts](experiments/compact-help-20261001/publication.md)
+retain the exact asset hashes and provenance.
+
+Dense diagrams, remaining Scenario group adapters, quantities/calculations/
+constraints, maintained libraries, broad accessibility/DPI and full OA/SA
+acceptance remain unfinished. The independent projection/navigation, outgoing-drag,
+icon, grid/performance and State-label contributions are outside this code.
+A protected Save As destination collision has misleading external-change wording;
+[issue 46](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/46)
+records it. Files remain protected and normal/fresh-destination recovery is
+verified. Live ownership, integration and release coordination remain in Gitea.
+
+## Contribution-specific verification
+
+The following records retain their original source and runtime scope; they are
+not relabeled as acceptance of the combined source above.
 
 Branch `codex/behavior-authoring-20260910`, published as `codex/release1-956atf`.
 Integrated code checkpoint **4ffff0d9d94bd1875e6b316b84ac11e5c5c9657c** combines

harness/allocation-arrange-amendment-20260923.md

@@ -0,0 +1,69 @@
+# Explicit Allocation Arrange amendment — 2026-09-23
+
+**Status: accepted design; pure planner verified, App integration and native acceptance pending.** Codex-9e8r6t /root adopts this bounded policy after reviewing the actual OA/SA experiment, its independent critique and corrected geometry oracles. No user-owned application specification is changed.
+
+User-derived basis: [PROJECT_GOAL](../PROJECT_GOAL.md), [multiselect contract](multiselect-contract-20260923.md). Existing authority: [Allocation drag v2](release-activity-allocation-drag-contract-v2-20260911.md) and its linked destination-feedback amendment. [Experiment and planner evidence](allocation-arrange-planner-20260923.md) records the decision history, exact source, results and limits.
+
+## Scope of the change
+
+Explicit **Arrange only** supports one or more selected work/performer placements through one declared footprint and one combined geometry check. A distributed work root does not fail Arrange solely because its allocation summary is MixedOrUnresolved or its semantic descendants occupy different visual performer groups. Its affected projected footprint must still translate rigidly and satisfy all geometry/readability checks below.
+
+This narrowly supersedes v2's mixed-composite/coherence pre-veto **only for explicit Arrange**. Ordinary work-body assignment is unchanged: work-only groups use one frozen common destination, normalize work ancestry, and admit each root under existing role/coherence rules. A mixed/distributed composite still refuses ordinary assignment; different valid initial performers on independent roots do not alone require refusal. Same-effective-performer role-only roots gain no direct Allocation, unsupported role exits refuse wholly, and no drag changes semantic work ownership. Ordinary mixed work/performer selection cannot partially assign its eligible members. Offer Arrange only when its own full-set admission is available.
+
+Arrange admission cannot depend on having two selected items. C alone and {A,C} use the same rule; adding A changes the actual movement footprint rather than unlocking an otherwise identical operation. Existing ordinary performer arrangement remains governed by its existing behavior; this amendment defines the explicit mode consistently across cardinalities.
+
+## Exact target and footprint definitions
+
+1. Validate every original typed target before normalization: exact placement/lifetime in the same active Allocation diagram and layer, currently visible, eligible work or performer kind, and core-valid accepted Project. Any stale, missing, foreign, port, edge or grouping-relation member refuses the whole action. Same-element duplicate placement in one diagram is malformed input. Preserve exact selected membership and primary separately from planning roots.
+2. Normalize explicitly selected work roots by same-kind semantic ancestry. For each root, S contains its recursive same-kind work closure. Q is all existing active-diagram placements of the union S, including folded descendants. Unplaced work contributes no fabricated placement.
+3. V contains each explicitly selected performer placement and its accepted visual descendants, including folded descendants. R = Q ∪ V. Capture this union once; do not acquire semantic ancestors/siblings or new semantic roots merely because a work placement is an incidental visual descendant. Each R placement moves once. Authored placements outside R and every other diagram remain exact.
+4. The press anchor must be an exact selected placement. Snap its requested position once on the existing ten-world-unit grid and apply that one delta to all R. Another selected anchor may change the snapped delta but never the mode or R. Preserve authored sizes, fold states and port anchors. Arrange authorizes no destination unfold, reparenting, packing, Fit or automatic topology change.
+5. Preserve every engineering record, including Allocations, RoleAssignments, RoleRealizations and semantic parents. Resolve routes using accepted actual endpoint owners and the complete R delta map: internal pins with both owners moving by the same nonzero delta translate once; one-ended pins remain fixed. Relative labels and attachments remain exact.
+
+## Combined geometry and its deliberate diagnostic boundary
+
+Project the complete accepted and candidate diagrams using the appropriate semantic index. Check the entire resulting visible scene, not only moved cards. An unselected performer enclosure may change its derived bounds even though its authored record is untouched. Such growth is allowed only if the complete candidate meets model bounds and the existing unrelated-overlap rule: no new or enlarged positive-area overlap beyond the current 0.01 area tolerance; visual ancestor/descendant containment is exempt.
+
+Also compare accepted/candidate diagnostic scenes. In each scene, temporarily unfold R and the visual ancestors necessary to reveal R; use the corresponding accepted/candidate visual ancestry. Include stationary geometry revealed by that required expansion. These temporary Diagram changes are never committed. A moved hidden child cannot evade collision checking through a selected performer's fold.
+
+**Unrelated stationary folded interiors are outside this diagnostic domain.** Do not unfold every container in the diagram. Their visible collapsed headers still participate in the ordinary scene check. This limit prevents invisible distant contents from becoming an unexplained blocker; it does not promise that future expansion will be free of overlap. A stricter all-unfolded policy is a different candidate, not an implicit interpretation of this amendment.
+
+Every R node's affected diagnostic footprint must preserve size and translate by the common delta. No automatic convergence/reflow is licensed by removing the semantic pre-veto. Check the required originally selected headers for visibility and containment in the captured viewport; a normalized-away selected descendant cannot silently disappear. Any unsupported footprint, unreadable selection, invalid bounds or new/enlarged unrelated overlap refuses the complete action. Show the actual combined candidate and affected counts; do not present independently valid singleton ghosts as evidence of group feasibility.
+
+## Valid and refused examples
+
+| Example | Required result under this amendment |
+| --- | --- |
+| Composite C contains x on A and y on B; select C; enough room for one rigid delta | Arrange may move Q={C,x,y}, preserving A/B authored positions and every allocation. Their derived enclosures may grow if the complete scenes remain admissible. Ordinary assignment still refuses the distributed root. |
+| Same model, select {A,C} | R additionally includes A and its accepted visual descendants. Move each union member once. The operation is not equivalent to C alone. |
+| Select parent C and its already covered child x | Validate both selected targets, deduplicate planning scope, move each placement once, retain the two exact selection identities/primary. |
+| X's translated bounds enter Y's old bounds, while both selected roots move clear together | Check simultaneous candidate geometry. Do not refuse because an independent singleton-X check treated Y as stationary. |
+| Unselected B's projected enclosure grows into stationary Z although no R card intersects Z | Refuse. Unchanged authored B geometry is not evidence that its derived enclosure is harmless. |
+| Folded selected A hides moved x, which newly intersects a stationary visible obstacle | Required diagnostic expansion detects the collision and refuses. |
+| Unrelated folded D hides Z that intersects moved x only in an all-unfolded alternative | Z alone does not block under this diagnostic policy. Required visible/R-plus-ancestor checks must still pass; retain D/Z authored records and D's fold. Future expansion may reveal overlap. |
+| Selection includes a work card plus port, edge or grouping-relation target | Whole-set refusal; no eligible-subset fallback. |
+| Snapped zero delta, unchanged semantics/folds/routes | No command and no history entry. Arrange never changes assignment merely because a pointer crosses a performer. |
+
+## Lifecycle, source and history
+
+Retain v2's clean-owner, dirty-pointer shielding, modal/tool priority and frozen camera/input lifetime. ArrangeNext is explicit and consumed once at press, whether the anchor is work or performer. Preserve the selected set and primary on selected-member press while distinguishing stationary release from group drag; a drag cannot become a singleton click after crossing the three-screen-pixel threshold and returning near its origin. Mode and footprint cannot change midway through a token.
+
+Capture exact selection generation with document/revision, active diagram/layer, epoch, bounds/pan/zoom and accepted scope. Dirty source/property/behavior input, owner/tool/lifetime change, Fit/resize, Escape, focus loss or outside/hidden release cancels without partial movement. Retiring a token is irreversible even when numeric values later return. Unsupported mixtures never fall through to legacy MoveNode, assignment, reconnection or deletion.
+
+Preview is immutable. On release, revalidate the same capability/snapshot, recompute combined geometry and compare the complete prepared Project with an independently constructed expected Project containing only the permitted R/route edits. Execute one Batch through normal Document source admission. Source failure/refusal leaves accepted source, selection/primary and history unchanged; successful movement is one Undo/Redo step with exact source roundtrip. Geometry detector assertions alone do not establish any of these transaction/lifecycle properties.
+
+## Choice rationale and rejected alternatives
+
+Retaining strict v2 is the smallest implementation but rejects a semantics-preserving explicit layout solely for distribution; until this amendment is implemented, its refusal remains truthful. Visual-selected-only translation is rejected because it omits required semantic/folded descendants. Sequential singleton planning is rejected because geometry, routes, deduplication and final expected Projects are not compositional. Universal unfolding is deliberately not chosen for this bounded mode; it introduces invisible unrelated geometry into admission. Packing/reflow and arbitrary convergence remain separate layout work.
+
+## Evidence and acceptance still required
+
+The [experiment/planner report](allocation-arrange-planner-20260923.md) is authoritative for exact runs, source identities, independent review and retained failures. It distinguishes actual projection/source/history evidence from policy predictions and App acceptance. Its independent expected geometry accounts for SA function ports; collision detection is not presented as atomic UI refusal.
+
+Production integration still requires:
+
+- Whole original typed-set admission, token/selection-generation, dirty/stale/source-failure, one-shot mode, irreversible threshold, cancellation and minimum-readable-text-scale checks.
+- OA/SA native workflows anchored on performer and work members, truthful counts/preview/refusal, one Undo/Redo, Save/reopen and exact unrelated-record preservation.
+- Separate ordinary work-only group assignment with per-root responsibility rules and one combined candidate/geometry gate.
+
+This amendment defines a bounded Arrange capability. It does not establish all Allocation group interactions, general convergence, grouping removal, routing usability or completion of the multiselect issue.

harness/allocation-arrange-evidence-20260923/.gitattributes

@@ -0,0 +1 @@
+** -text whitespace=cr-at-eol

harness/allocation-arrange-evidence-20260923/checks/README.md

@@ -0,0 +1,24 @@
+# Allocation captured-gate evidence tools
+
+Adapted from the reviewed Process prepare/verify/selfcheck tools. Read-only preparation consumes explicitly selected **closed** runs in CHECKOUT/.local/allocation-group-gates. No Cargo, source execution, checkout, GUI, network or archived helper execution occurs.
+
+```powershell
+python -B prepare.py --root CHECKOUT --runs experiment-1 experiment-2 experiment-3 planner-document-1 probe-lint-1 format-1 --check-only
+```
+
+Keep failed experiment-2: verification preserves its recorded compile failure rather than converting archive consistency into test success. The example selects the first six closed gates. Later closed planner runs can be explicitly listed with the same interface; the final package manifest is authoritative for its exact inventory. No implicit discovery includes active directories.
+
+To create a portable package, replace --check-only with `--output NEW_DIRECTORY`. Existing output refuses. The exact seven raw files are required, with only `source-proof.json` accepted as an optional eighth file. No raw byte normalization or receipt rewriting occurs. Maps and nested input ZIPs deduplicate by SHA-256; other logical raw files keep their names. All original helper bytes, failed-run streams and optional proof bytes remain archived. The Allocation-specific manifest kind distinguishes this extension from the seven-file Process schema.
+
+The gate.py and source-proof.py helper catalog is preserved. Every gate's recorded helper must match available bytes; use repeatable `--helper PATH` for older captures. If a proof exists, its exact comparator bytes must be available at the default `.local/process-source-evidence-tools/verify.py` or a repeatable `--comparator PATH`. They are archived under their content hash and never executed.
+
+An optional source proof is independently pinned in the manifest with its full named commit. Verification binds it to the enclosing run, exact result receipt, captured map/count, completed gate time, status and comparator bytes/hash. Captured HEAD is preserved as historical metadata and is not substituted for the named source commit. This packager checks historical proof consistency; it does **not** repeat Git blob comparison. A source proof on a failed gate is source-identity evidence only, never a passing-test claim.
+
+```powershell
+python -B PACKAGE/verify.py
+python -B selfcheck.py --root CHECKOUT --runs experiment-1 experiment-2 experiment-3 planner-document-1 probe-lint-1 format-1 --output TOOLS/NEW_SELFCHECK_DIRECTORY
+```
+
+The verifier checks pins, exact ZIP inventory, process/start/result relationships, streams, command/exit identities, source capsules, vendor inventory and Cargo artifact relationships. Selfchecks compare packaged raw bytes to originals, reject existing output, and mutate only in-memory copies to test stream/helper/exit/capsule/proof corruption. The package contains tools, manifest, files.json and evidence.zip; selfcheck is a preparation utility, not packaged runtime input.
+
+Limits: internal consistency is not external authentication, hermetic build proof, native usability, a new source comparison or production acceptance. Review exact run results and source identity separately. Run with `python -B` to avoid incidental bytecode writes.

harness/allocation-arrange-evidence-20260923/checks/files.json

@@ -0,0 +1,22 @@
+{
+  "prepare.py": {
+    "bytes": 6316,
+    "sha256": "aa52592fb8e373c2a90007e187734d29129d38d9fce9dc45461482c7f6376bff"
+  },
+  "verify.py": {
+    "bytes": 11440,
+    "sha256": "584187370a1076e13190914158fc72a9ab65f07e72cc6a0d3b5c319f3dc7f05f"
+  },
+  "README.md": {
+    "bytes": 3284,
+    "sha256": "3ff0a61fb15ca26e54b8903962c99ba7802a87f0204e7b71f2d04c812b9588b7"
+  },
+  "manifest.json": {
+    "bytes": 31065,
+    "sha256": "a993618118369f293569ffdf10c6c05ded4fe8f105df50838c56dca25e0b9eab"
+  },
+  "evidence.zip": {
+    "bytes": 20799621,
+    "sha256": "a3fdde41e8e8cb4c2c2381a28628b5c9687461c18a17008bb1294a33ab962bfd"
+  }
+}

harness/allocation-arrange-evidence-20260923/checks/manifest.json

@@ -0,0 +1,719 @@
+{
+  "schema": 1,
+  "kind": "allocation-multiselect-cargo-gates",
+  "runs": {
+    "experiment-1": {
+      "command": [
+        "cargo",
+        "test",
+        "-p",
+        "oa-desktop",
+        "--bin",
+        "arcadia-studio",
+        "--message-format=json",
+        "--",
+        "mixed_arrange_experiment",
+        "--nocapture",
+        "--test-threads=1"
+      ],
+      "head": "6d99aacab8ca1a91c857a2179baa14d80a2901e9",
+      "exitCode": 0,
+      "inputCount": 743,
+      "helper": "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py",
+      "sourceProof": {
+        "commit": "3a7923b96d671041cbc747a614cbd0fad6b6b3d3",
+        "pin": {
+          "bytes": 591,
+          "sha256": "ca8e9265a34d465c365a5ba1472d80fef8720a4fb56d82dc7cfaa0a7fa9e391b"
+        },
+        "comparator": "comparators/7805832d5f563ab2d7a50dd3de700792b5d6f459c68f7b1d8bcfcc9800fa0c3a.py"
+      }
+    },
+    "experiment-2": {
+      "command": [
+        "cargo",
+        "test",
+        "-p",
+        "oa-desktop",
+        "--example",
+        "allocation_policy_probe",
+        "--message-format=json",
+        "--",
+        "mixed_arrange_experiment",
+        "--nocapture",
+        "--test-threads=1"
+      ],
+      "head": "3a7923b96d671041cbc747a614cbd0fad6b6b3d3",
+      "exitCode": 101,
+      "inputCount": 744,
+      "helper": "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py"
+    },
+    "experiment-3": {
+      "command": [
+        "cargo",
+        "test",
+        "-p",
+        "oa-desktop",
+        "--example",
+        "allocation_policy_probe",
+        "--message-format=json",
+        "--",
+        "mixed_arrange_experiment",
+        "--nocapture",
+        "--test-threads=1"
+      ],
+      "head": "3a7923b96d671041cbc747a614cbd0fad6b6b3d3",
+      "exitCode": 0,
+      "inputCount": 744,
+      "helper": "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py",
+      "sourceProof": {
+        "commit": "8dbbaf262e3b8d26a32d6c30f0cc5f963fab47a0",
+        "pin": {
+          "bytes": 591,
+          "sha256": "e1e330d2dc4fee475991d0ba1a1bb75fae77c13d5874689af26987be12db0aae"
+        },
+        "comparator": "comparators/7805832d5f563ab2d7a50dd3de700792b5d6f459c68f7b1d8bcfcc9800fa0c3a.py"
+      }
+    },
+    "planner-document-1": {
+      "command": [
+        "cargo",
+        "test",
+        "-p",
+        "oa-desktop",
+        "--example",
+        "allocation_policy_probe",
+        "--message-format=json",
+        "--",
+        "--test-threads=1"
+      ],
+      "head": "3a7923b96d671041cbc747a614cbd0fad6b6b3d3",
+      "exitCode": 0,
+      "inputCount": 744,
+      "helper": "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py",
+      "sourceProof": {
+        "commit": "8dbbaf262e3b8d26a32d6c30f0cc5f963fab47a0",
+        "pin": {
+          "bytes": 597,
+          "sha256": "c64e4c556e27e6a6fbc8be463738783bcd5afa40959d4cec87801a53c8b08773"
+        },
+        "comparator": "comparators/7805832d5f563ab2d7a50dd3de700792b5d6f459c68f7b1d8bcfcc9800fa0c3a.py"
+      }
+    },
+    "probe-lint-1": {
+      "command": [
+        "cargo",
+        "clippy",
+        "-p",
+        "oa-desktop",
+        "--example",
+        "allocation_policy_probe",
+        "--tests",
+        "--message-format=json",
+        "--",
+        "-D",
+        "warnings"
+      ],
+      "head": "3a7923b96d671041cbc747a614cbd0fad6b6b3d3",
+      "exitCode": 0,
+      "inputCount": 744,
+      "helper": "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py",
+      "sourceProof": {
+        "commit": "8dbbaf262e3b8d26a32d6c30f0cc5f963fab47a0",
+        "pin": {
+          "bytes": 591,
+          "sha256": "d49e047e0bfe3591836e702141be0f3935b94ecff11d5eb4bcd26658e153ccb8"
+        },
+        "comparator": "comparators/7805832d5f563ab2d7a50dd3de700792b5d6f459c68f7b1d8bcfcc9800fa0c3a.py"
+      }
+    },
+    "format-1": {
+      "command": [
+        "cargo",
+        "fmt",
+        "--all",
+        "--",
+        "--check"
+      ],
+      "head": "3a7923b96d671041cbc747a614cbd0fad6b6b3d3",
+      "exitCode": 0,
+      "inputCount": 744,
+      "helper": "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py",
+      "sourceProof": {
+        "commit": "8dbbaf262e3b8d26a32d6c30f0cc5f963fab47a0",
+        "pin": {
+          "bytes": 587,
+          "sha256": "26071a3c7f146022eebe2f22c50debf0c5f3f554cd561516d1a473be31a88f0d"
+        },
+        "comparator": "comparators/7805832d5f563ab2d7a50dd3de700792b5d6f459c68f7b1d8bcfcc9800fa0c3a.py"
+      }
+    },
+    "arrange-planner-1": {
+      "command": [
+        "cargo",
+        "test",
+        "-p",
+        "oa-desktop",
+        "--example",
+        "allocation_policy_probe",
+        "--message-format=json",
+        "--",
+        "--test-threads=1"
+      ],
+      "head": "8dbbaf262e3b8d26a32d6c30f0cc5f963fab47a0",
+      "exitCode": 101,
+      "inputCount": 746,
+      "helper": "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py"
+    },
+    "arrange-planner-2": {
+      "command": [
+        "cargo",
+        "test",
+        "-p",
+        "oa-desktop",
+        "--example",
+        "allocation_policy_probe",
+        "--message-format=json",
+        "--",
+        "--test-threads=1"
+      ],
+      "head": "8dbbaf262e3b8d26a32d6c30f0cc5f963fab47a0",
+      "exitCode": 101,
+      "inputCount": 746,
+      "helper": "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py"
+    },
+    "arrange-planner-3": {
+      "command": [
+        "cargo",
+        "test",
+        "-p",
+        "oa-desktop",
+        "--example",
+        "allocation_policy_probe",
+        "--message-format=json",
+        "--",
+        "--test-threads=1"
+      ],
+      "head": "8dbbaf262e3b8d26a32d6c30f0cc5f963fab47a0",
+      "exitCode": 0,
+      "inputCount": 746,
+      "helper": "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py"
+    },
+    "arrange-planner-4": {
+      "command": [
+        "cargo",
+        "test",
+        "-p",
+        "oa-desktop",
+        "--example",
+        "allocation_policy_probe",
+        "--message-format=json",
+        "--",
+        "--test-threads=1"
+      ],
+      "head": "8dbbaf262e3b8d26a32d6c30f0cc5f963fab47a0",
+      "exitCode": 0,
+      "inputCount": 746,
+      "helper": "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py",
+      "sourceProof": {
+        "commit": "9b83f7ca0dcd34056765b9399863a21da72c3a9f",
+        "pin": {
+          "bytes": 596,
+          "sha256": "cbf8c9171bb6debd47397e48a62231f8295f86c7b79bfd3c36ad885689c742e6"
+        },
+        "comparator": "comparators/7805832d5f563ab2d7a50dd3de700792b5d6f459c68f7b1d8bcfcc9800fa0c3a.py"
+      }
+    },
+    "arrange-lint-1": {
+      "command": [
+        "cargo",
+        "clippy",
+        "-p",
+        "oa-desktop",
+        "--example",
+        "allocation_policy_probe",
+        "--tests",
+        "--message-format=json",
+        "--",
+        "-D",
+        "warnings"
+      ],
+      "head": "8dbbaf262e3b8d26a32d6c30f0cc5f963fab47a0",
+      "exitCode": 0,
+      "inputCount": 746,
+      "helper": "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py",
+      "sourceProof": {
+        "commit": "9b83f7ca0dcd34056765b9399863a21da72c3a9f",
+        "pin": {
+          "bytes": 593,
+          "sha256": "d476324a632b56df88343b7bc90c89fc14ee70b30fe91c0be55de01c0de5c846"
+        },
+        "comparator": "comparators/7805832d5f563ab2d7a50dd3de700792b5d6f459c68f7b1d8bcfcc9800fa0c3a.py"
+      }
+    },
+    "arrange-format-1": {
+      "command": [
+        "cargo",
+        "fmt",
+        "--all",
+        "--",
+        "--check"
+      ],
+      "head": "9b83f7ca0dcd34056765b9399863a21da72c3a9f",
+      "exitCode": 0,
+      "inputCount": 746,
+      "helper": "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py",
+      "sourceProof": {
+        "commit": "9b83f7ca0dcd34056765b9399863a21da72c3a9f",
+        "pin": {
+          "bytes": 595,
+          "sha256": "03ae19dca92db8cdde62c5a0f63c6c5789d75a977079bbd1d84c76c91d775f08"
+        },
+        "comparator": "comparators/7805832d5f563ab2d7a50dd3de700792b5d6f459c68f7b1d8bcfcc9800fa0c3a.py"
+      }
+    }
+  },
+  "captureHelpers": {
+    "gate.py": "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py",
+    "source-proof.py": "helpers/58597566ae1cb5c4021ddc7e86635b76d127bdb63b5d3026c427771aae7e2119.py"
+  },
+  "logicalFiles": {
+    "cargo/arrange-format-1/inputs.json": "capsules/c8192fd84fba63fa576975e9fd44f0fa2d6c8ed2e6b5ada3fd4bee076d36f686.json",
+    "cargo/arrange-format-1/inputs.zip": "capsules/29ab4dce454ec8dd92208620e6f8eb0749b6fd72c1687bf1d19264c77159e4f1.zip",
+    "cargo/arrange-format-1/process.json": "cargo/arrange-format-1/process.json",
+    "cargo/arrange-format-1/result.json": "cargo/arrange-format-1/result.json",
+    "cargo/arrange-format-1/source-proof.json": "cargo/arrange-format-1/source-proof.json",
+    "cargo/arrange-format-1/started.json": "cargo/arrange-format-1/started.json",
+    "cargo/arrange-format-1/stderr.log": "cargo/arrange-format-1/stderr.log",
+    "cargo/arrange-format-1/stdout.log": "cargo/arrange-format-1/stdout.log",
+    "cargo/arrange-lint-1/inputs.json": "capsules/c8192fd84fba63fa576975e9fd44f0fa2d6c8ed2e6b5ada3fd4bee076d36f686.json",
+    "cargo/arrange-lint-1/inputs.zip": "capsules/29ab4dce454ec8dd92208620e6f8eb0749b6fd72c1687bf1d19264c77159e4f1.zip",
+    "cargo/arrange-lint-1/process.json": "cargo/arrange-lint-1/process.json",
+    "cargo/arrange-lint-1/result.json": "cargo/arrange-lint-1/result.json",
+    "cargo/arrange-lint-1/source-proof.json": "cargo/arrange-lint-1/source-proof.json",
+    "cargo/arrange-lint-1/started.json": "cargo/arrange-lint-1/started.json",
+    "cargo/arrange-lint-1/stderr.log": "cargo/arrange-lint-1/stderr.log",
+    "cargo/arrange-lint-1/stdout.log": "cargo/arrange-lint-1/stdout.log",
+    "cargo/arrange-planner-1/inputs.json": "capsules/084e4bd0288b35761193f3e28cdc580fa545de80f9147ef0ba997d090f0ba2a1.json",
+    "cargo/arrange-planner-1/inputs.zip": "capsules/3c0175ff95e0639f8e400e41f6014f8b0223672494682b4f39a8ca8d45ff898f.zip",
+    "cargo/arrange-planner-1/process.json": "cargo/arrange-planner-1/process.json",
+    "cargo/arrange-planner-1/result.json": "cargo/arrange-planner-1/result.json",
+    "cargo/arrange-planner-1/started.json": "cargo/arrange-planner-1/started.json",
+    "cargo/arrange-planner-1/stderr.log": "cargo/arrange-planner-1/stderr.log",
+    "cargo/arrange-planner-1/stdout.log": "cargo/arrange-planner-1/stdout.log",
+    "cargo/arrange-planner-2/inputs.json": "capsules/f2ffd9ca8ee08a31769e1a5f460f5edd1a78e539463e25c1dcec8c7065829619.json",
+    "cargo/arrange-planner-2/inputs.zip": "capsules/5c2134898d477eca46ed26eff9a9833de4005660eb7ee89a124eacba21a9b18e.zip",
+    "cargo/arrange-planner-2/process.json": "cargo/arrange-planner-2/process.json",
+    "cargo/arrange-planner-2/result.json": "cargo/arrange-planner-2/result.json",
+    "cargo/arrange-planner-2/started.json": "cargo/arrange-planner-2/started.json",
+    "cargo/arrange-planner-2/stderr.log": "cargo/arrange-planner-2/stderr.log",
+    "cargo/arrange-planner-2/stdout.log": "cargo/arrange-planner-2/stdout.log",
+    "cargo/arrange-planner-3/inputs.json": "capsules/d918a5797a645d1483139139b1a56a558f5c54fe5f797433cbaa7ed5c34c07a0.json",
+    "cargo/arrange-planner-3/inputs.zip": "capsules/0b08fc45ecc1d38421d9c5b42e65d2b577d4641d0addb0e04043815e76b4b50f.zip",
+    "cargo/arrange-planner-3/process.json": "cargo/arrange-planner-3/process.json",
+    "cargo/arrange-planner-3/result.json": "cargo/arrange-planner-3/result.json",
+    "cargo/arrange-planner-3/started.json": "cargo/arrange-planner-3/started.json",
+    "cargo/arrange-planner-3/stderr.log": "cargo/arrange-planner-3/stderr.log",
+    "cargo/arrange-planner-3/stdout.log": "cargo/arrange-planner-3/stdout.log",
+    "cargo/arrange-planner-4/inputs.json": "capsules/c8192fd84fba63fa576975e9fd44f0fa2d6c8ed2e6b5ada3fd4bee076d36f686.json",
+    "cargo/arrange-planner-4/inputs.zip": "capsules/29ab4dce454ec8dd92208620e6f8eb0749b6fd72c1687bf1d19264c77159e4f1.zip",
+    "cargo/arrange-planner-4/process.json": "cargo/arrange-planner-4/process.json",
+    "cargo/arrange-planner-4/result.json": "cargo/arrange-planner-4/result.json",
+    "cargo/arrange-planner-4/source-proof.json": "cargo/arrange-planner-4/source-proof.json",
+    "cargo/arrange-planner-4/started.json": "cargo/arrange-planner-4/started.json",
+    "cargo/arrange-planner-4/stderr.log": "cargo/arrange-planner-4/stderr.log",
+    "cargo/arrange-planner-4/stdout.log": "cargo/arrange-planner-4/stdout.log",
+    "cargo/experiment-1/inputs.json": "capsules/fc74b619bba31bed7a075cf519456d32f7ccffd1e06624bdb92ad309d55cac45.json",
+    "cargo/experiment-1/inputs.zip": "capsules/f2e0d3cfeff569cc7794d56f1c439ae1fe1eac15269ee0c8edd58bc80aacaa2d.zip",
+    "cargo/experiment-1/process.json": "cargo/experiment-1/process.json",
+    "cargo/experiment-1/result.json": "cargo/experiment-1/result.json",
+    "cargo/experiment-1/source-proof.json": "cargo/experiment-1/source-proof.json",
+    "cargo/experiment-1/started.json": "cargo/experiment-1/started.json",
+    "cargo/experiment-1/stderr.log": "cargo/experiment-1/stderr.log",
+    "cargo/experiment-1/stdout.log": "cargo/experiment-1/stdout.log",
+    "cargo/experiment-2/inputs.json": "capsules/4e26f58e200b8c7b825f3c96e2f1df0bdc56f9f02aa8e1d58866b00a81275cdc.json",
+    "cargo/experiment-2/inputs.zip": "capsules/c2e6e9747e345dba2f35c79b00dd1302c59072a848f18534016acf2e81454acd.zip",
+    "cargo/experiment-2/process.json": "cargo/experiment-2/process.json",
+    "cargo/experiment-2/result.json": "cargo/experiment-2/result.json",
+    "cargo/experiment-2/started.json": "cargo/experiment-2/started.json",
+    "cargo/experiment-2/stderr.log": "cargo/experiment-2/stderr.log",
+    "cargo/experiment-2/stdout.log": "cargo/experiment-2/stdout.log",
+    "cargo/experiment-3/inputs.json": "capsules/acd1c8c1f4f2f529455431bbe4193acb25ab8d69bf72ff543265007847b808eb.json",
+    "cargo/experiment-3/inputs.zip": "capsules/8fd3ea41c3f5278bbb3986de804cc93229084b00096c131acd09ba8705db502e.zip",
+    "cargo/experiment-3/process.json": "cargo/experiment-3/process.json",
+    "cargo/experiment-3/result.json": "cargo/experiment-3/result.json",
+    "cargo/experiment-3/source-proof.json": "cargo/experiment-3/source-proof.json",
+    "cargo/experiment-3/started.json": "cargo/experiment-3/started.json",
+    "cargo/experiment-3/stderr.log": "cargo/experiment-3/stderr.log",
+    "cargo/experiment-3/stdout.log": "cargo/experiment-3/stdout.log",
+    "cargo/format-1/inputs.json": "capsules/acd1c8c1f4f2f529455431bbe4193acb25ab8d69bf72ff543265007847b808eb.json",
+    "cargo/format-1/inputs.zip": "capsules/8fd3ea41c3f5278bbb3986de804cc93229084b00096c131acd09ba8705db502e.zip",
+    "cargo/format-1/process.json": "cargo/format-1/process.json",
+    "cargo/format-1/result.json": "cargo/format-1/result.json",
+    "cargo/format-1/source-proof.json": "cargo/format-1/source-proof.json",
+    "cargo/format-1/started.json": "cargo/format-1/started.json",
+    "cargo/format-1/stderr.log": "cargo/format-1/stderr.log",
+    "cargo/format-1/stdout.log": "cargo/format-1/stdout.log",
+    "cargo/planner-document-1/inputs.json": "capsules/acd1c8c1f4f2f529455431bbe4193acb25ab8d69bf72ff543265007847b808eb.json",
+    "cargo/planner-document-1/inputs.zip": "capsules/8fd3ea41c3f5278bbb3986de804cc93229084b00096c131acd09ba8705db502e.zip",
+    "cargo/planner-document-1/process.json": "cargo/planner-document-1/process.json",
+    "cargo/planner-document-1/result.json": "cargo/planner-document-1/result.json",
+    "cargo/planner-document-1/source-proof.json": "cargo/planner-document-1/source-proof.json",
+    "cargo/planner-document-1/started.json": "cargo/planner-document-1/started.json",
+    "cargo/planner-document-1/stderr.log": "cargo/planner-document-1/stderr.log",
+    "cargo/planner-document-1/stdout.log": "cargo/planner-document-1/stdout.log",
+    "cargo/probe-lint-1/inputs.json": "capsules/acd1c8c1f4f2f529455431bbe4193acb25ab8d69bf72ff543265007847b808eb.json",
+    "cargo/probe-lint-1/inputs.zip": "capsules/8fd3ea41c3f5278bbb3986de804cc93229084b00096c131acd09ba8705db502e.zip",
+    "cargo/probe-lint-1/process.json": "cargo/probe-lint-1/process.json",
+    "cargo/probe-lint-1/result.json": "cargo/probe-lint-1/result.json",
+    "cargo/probe-lint-1/source-proof.json": "cargo/probe-lint-1/source-proof.json",
+    "cargo/probe-lint-1/started.json": "cargo/probe-lint-1/started.json",
+    "cargo/probe-lint-1/stderr.log": "cargo/probe-lint-1/stderr.log",
+    "cargo/probe-lint-1/stdout.log": "cargo/probe-lint-1/stdout.log",
+    "comparators/7805832d5f563ab2d7a50dd3de700792b5d6f459c68f7b1d8bcfcc9800fa0c3a.py": "comparators/7805832d5f563ab2d7a50dd3de700792b5d6f459c68f7b1d8bcfcc9800fa0c3a.py",
+    "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py": "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py",
+    "helpers/58597566ae1cb5c4021ddc7e86635b76d127bdb63b5d3026c427771aae7e2119.py": "helpers/58597566ae1cb5c4021ddc7e86635b76d127bdb63b5d3026c427771aae7e2119.py"
+  },
+  "members": {
+    "capsules/084e4bd0288b35761193f3e28cdc580fa545de80f9147ef0ba997d090f0ba2a1.json": {
+      "bytes": 124966,
+      "sha256": "084e4bd0288b35761193f3e28cdc580fa545de80f9147ef0ba997d090f0ba2a1"
+    },
+    "capsules/0b08fc45ecc1d38421d9c5b42e65d2b577d4641d0addb0e04043815e76b4b50f.zip": {
+      "bytes": 2998637,
+      "sha256": "0b08fc45ecc1d38421d9c5b42e65d2b577d4641d0addb0e04043815e76b4b50f"
+    },
+    "capsules/29ab4dce454ec8dd92208620e6f8eb0749b6fd72c1687bf1d19264c77159e4f1.zip": {
+      "bytes": 2999625,
+      "sha256": "29ab4dce454ec8dd92208620e6f8eb0749b6fd72c1687bf1d19264c77159e4f1"
+    },
+    "capsules/3c0175ff95e0639f8e400e41f6014f8b0223672494682b4f39a8ca8d45ff898f.zip": {
+      "bytes": 2998617,
+      "sha256": "3c0175ff95e0639f8e400e41f6014f8b0223672494682b4f39a8ca8d45ff898f"
+    },
+    "capsules/4e26f58e200b8c7b825f3c96e2f1df0bdc56f9f02aa8e1d58866b00a81275cdc.json": {
+      "bytes": 124628,
+      "sha256": "4e26f58e200b8c7b825f3c96e2f1df0bdc56f9f02aa8e1d58866b00a81275cdc"
+    },
+    "capsules/5c2134898d477eca46ed26eff9a9833de4005660eb7ee89a124eacba21a9b18e.zip": {
+      "bytes": 2998623,
+      "sha256": "5c2134898d477eca46ed26eff9a9833de4005660eb7ee89a124eacba21a9b18e"
+    },
+    "capsules/8fd3ea41c3f5278bbb3986de804cc93229084b00096c131acd09ba8705db502e.zip": {
+      "bytes": 2992280,
+      "sha256": "8fd3ea41c3f5278bbb3986de804cc93229084b00096c131acd09ba8705db502e"
+    },
+    "capsules/acd1c8c1f4f2f529455431bbe4193acb25ab8d69bf72ff543265007847b808eb.json": {
+      "bytes": 124628,
+      "sha256": "acd1c8c1f4f2f529455431bbe4193acb25ab8d69bf72ff543265007847b808eb"
+    },
+    "capsules/c2e6e9747e345dba2f35c79b00dd1302c59072a848f18534016acf2e81454acd.zip": {
+      "bytes": 2992231,
+      "sha256": "c2e6e9747e345dba2f35c79b00dd1302c59072a848f18534016acf2e81454acd"
+    },
+    "capsules/c8192fd84fba63fa576975e9fd44f0fa2d6c8ed2e6b5ada3fd4bee076d36f686.json": {
+      "bytes": 124966,
+      "sha256": "c8192fd84fba63fa576975e9fd44f0fa2d6c8ed2e6b5ada3fd4bee076d36f686"
+    },
+    "capsules/d918a5797a645d1483139139b1a56a558f5c54fe5f797433cbaa7ed5c34c07a0.json": {
+      "bytes": 124966,
+      "sha256": "d918a5797a645d1483139139b1a56a558f5c54fe5f797433cbaa7ed5c34c07a0"
+    },
+    "capsules/f2e0d3cfeff569cc7794d56f1c439ae1fe1eac15269ee0c8edd58bc80aacaa2d.zip": {
+      "bytes": 2990212,
+      "sha256": "f2e0d3cfeff569cc7794d56f1c439ae1fe1eac15269ee0c8edd58bc80aacaa2d"
+    },
+    "capsules/f2ffd9ca8ee08a31769e1a5f460f5edd1a78e539463e25c1dcec8c7065829619.json": {
+      "bytes": 124966,
+      "sha256": "f2ffd9ca8ee08a31769e1a5f460f5edd1a78e539463e25c1dcec8c7065829619"
+    },
+    "capsules/fc74b619bba31bed7a075cf519456d32f7ccffd1e06624bdb92ad309d55cac45.json": {
+      "bytes": 124458,
+      "sha256": "fc74b619bba31bed7a075cf519456d32f7ccffd1e06624bdb92ad309d55cac45"
+    },
+    "cargo/arrange-format-1/process.json": {
+      "bytes": 116,
+      "sha256": "2eb27eb4ad4b1d6cdb493ece9df3247de50b4f494522a7fc0cd75cf286847507"
+    },
+    "cargo/arrange-format-1/result.json": {
+      "bytes": 1871,
+      "sha256": "a5f6e31729519aa3fc064d675731a79c9d93297f713a39afad04de9c8fedeaa8"
+    },
+    "cargo/arrange-format-1/source-proof.json": {
+      "bytes": 595,
+      "sha256": "03ae19dca92db8cdde62c5a0f63c6c5789d75a977079bbd1d84c76c91d775f08"
+    },
+    "cargo/arrange-format-1/started.json": {
+      "bytes": 1483,
+      "sha256": "098fd74217e751dc4aa4767f6d59b24ca65bc834dfe7a9dee8330f557baef8ce"
+    },
+    "cargo/arrange-format-1/stderr.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "cargo/arrange-format-1/stdout.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "cargo/arrange-lint-1/process.json": {
+      "bytes": 213,
+      "sha256": "930d2a3b839ac22ae66dbf283634878a90bff77cd3f21c3efbefed87d2561f1b"
+    },
+    "cargo/arrange-lint-1/result.json": {
+      "bytes": 2005,
+      "sha256": "278a880fc03cd922c0055b84cf364c0f17ee6217f0cfa1d75ca3f52399e96aad"
+    },
+    "cargo/arrange-lint-1/source-proof.json": {
+      "bytes": 593,
+      "sha256": "d476324a632b56df88343b7bc90c89fc14ee70b30fe91c0be55de01c0de5c846"
+    },
+    "cargo/arrange-lint-1/started.json": {
+      "bytes": 1610,
+      "sha256": "8171889b3bebe97b49b4f2214bfe732f2651a1c827c3777ea91fa57235e73fc2"
+    },
+    "cargo/arrange-lint-1/stderr.log": {
+      "bytes": 137,
+      "sha256": "412177405c27599386afb28d603f0895c31becfc6b6de4ebb5a4063734ba94a7"
+    },
+    "cargo/arrange-lint-1/stdout.log": {
+      "bytes": 268845,
+      "sha256": "f6b71a7a22bd4af2205cde4becc7e1e017ad4d78013944cb2b5218fc32d2e4b8"
+    },
+    "cargo/arrange-planner-1/process.json": {
+      "bytes": 202,
+      "sha256": "ffeb3bed75938dc4335bd6253783601f21c72999cad952dd191ca7243bf4c506"
+    },
+    "cargo/arrange-planner-1/result.json": {
+      "bytes": 1987,
+      "sha256": "6e71d9a4f75ce5aeb7714aeffb23f622d4b3a1b267601e45368fcc3597742f47"
+    },
+    "cargo/arrange-planner-1/started.json": {
+      "bytes": 1589,
+      "sha256": "be88ce011f96d06e07ba02b5e485fe365940a8fb8aa19158ba82e46f5abbb94c"
+    },
+    "cargo/arrange-planner-1/stderr.log": {
+      "bytes": 179,
+      "sha256": "fff43766ea766c831cd1963c57fd67791b065badb93ec96b62e8546233f3109c"
+    },
+    "cargo/arrange-planner-1/stdout.log": {
+      "bytes": 295296,
+      "sha256": "427033f5308ecb85e754d6a5fc21ea56d0276edaa0d0d0bf41bf234d9cb452e1"
+    },
+    "cargo/arrange-planner-2/process.json": {
+      "bytes": 202,
+      "sha256": "d1e6c39dcdf512da2c2ad457200cd14d3f989048d0244c7eb784c7547f2db63f"
+    },
+    "cargo/arrange-planner-2/result.json": {
+      "bytes": 1987,
+      "sha256": "ccea0caeaf49f4bb0db9ac790cac9fef2138cff072c4d7104fea5597412260b3"
+    },
+    "cargo/arrange-planner-2/started.json": {
+      "bytes": 1589,
+      "sha256": "22c4c2579b3d16b61929323cb7f8c2be55f4402d8091dcba20b3dc539cb65b87"
+    },
+    "cargo/arrange-planner-2/stderr.log": {
+      "bytes": 180,
+      "sha256": "e96d24ab1396169886e66c47bfc8ad423c47eb1ba04f23cb0b993a42fcd00672"
+    },
+    "cargo/arrange-planner-2/stdout.log": {
+      "bytes": 304852,
+      "sha256": "b1de0cb57b6c9d8a1163635bb9428c9058989f3a3e04f771c6d52ec3e98bb38d"
+    },
+    "cargo/arrange-planner-3/process.json": {
+      "bytes": 202,
+      "sha256": "3d40643702d3e4cd5f1c77665d6a6fe7489a8962ad4831a4bf36176716fc3806"
+    },
+    "cargo/arrange-planner-3/result.json": {
+      "bytes": 3388,
+      "sha256": "281bd88cc0e8908b12e11ca8c32c87b904e9aa511022d5737aa208f6d09d5516"
+    },
+    "cargo/arrange-planner-3/started.json": {
+      "bytes": 1589,
+      "sha256": "97f7f2fb041de0bcfb4c55fc998c33181d50a15aad3f1ef9d98e9f8ae81c91af"
+    },
+    "cargo/arrange-planner-3/stderr.log": {
+      "bytes": 323,
+      "sha256": "c02d99f2243e3b34e2ca3512d4b18ecd60cd27eb1066e2336df3f88908ef26af"
+    },
+    "cargo/arrange-planner-3/stdout.log": {
+      "bytes": 300602,
+      "sha256": "b681a64a77fb83078b2aef1035c3ce5a7a7fc4c0cc439795eb5ad476216a8bea"
+    },
+    "cargo/arrange-planner-4/process.json": {
+      "bytes": 202,
+      "sha256": "ce53d413817d6ba48cd361c9d97989c65f53b9ced8fa772870c0162a0725c44b"
+    },
+    "cargo/arrange-planner-4/result.json": {
+      "bytes": 3388,
+      "sha256": "71ff6ed0ff007f15dc0c9d574981c7fb765771baa0370b69f2868822c3b0cd76"
+    },
+    "cargo/arrange-planner-4/source-proof.json": {
+      "bytes": 596,
+      "sha256": "cbf8c9171bb6debd47397e48a62231f8295f86c7b79bfd3c36ad885689c742e6"
+    },
+    "cargo/arrange-planner-4/started.json": {
+      "bytes": 1589,
+      "sha256": "9686ab1af2b7131de0656d131eadb217b869eeeeeef860c94025e42c4a102ae7"
+    },
+    "cargo/arrange-planner-4/stderr.log": {
+      "bytes": 324,
+      "sha256": "8ba7a613f49ce57efa9a35742c9bfe8acf9c1536ebb9a9f1873f5d0ca9a3301b"
+    },
+    "cargo/arrange-planner-4/stdout.log": {
+      "bytes": 300969,
+      "sha256": "e0cd9d35beeb9f48ee7e97fee96d7bda700c96786a1c7199c4c38170d9b71bc2"
+    },
+    "cargo/experiment-1/process.json": {
+      "bytes": 232,
+      "sha256": "021352da56436e72c00da14992f8a94d26efd0893af5d7230b97d1f0af97927a"
+    },
+    "cargo/experiment-1/result.json": {
+      "bytes": 3364,
+      "sha256": "a82c43d59954773907d5268395e40c9829793fb2d4db5387cb306fd5b39edd01"
+    },
+    "cargo/experiment-1/source-proof.json": {
+      "bytes": 591,
+      "sha256": "ca8e9265a34d465c365a5ba1472d80fef8720a4fb56d82dc7cfaa0a7fa9e391b"
+    },
+    "cargo/experiment-1/started.json": {
+      "bytes": 1629,
+      "sha256": "b2bd9e31d8242956809a0d3b6a3cf506f910539d776d9cc0c8131102b1846081"
+    },
+    "cargo/experiment-1/stderr.log": {
+      "bytes": 288,
+      "sha256": "c8e5c4c82f33c431eca2fdec4dee37250fcaadd4871cb896520ee779a3523924"
+    },
+    "cargo/experiment-1/stdout.log": {
+      "bytes": 293505,
+      "sha256": "a5fb7e62505efc44ff3d17f11437ede717eedd05e639d9c19db8e80d52699c70"
+    },
+    "cargo/experiment-2/process.json": {
+      "bytes": 245,
+      "sha256": "2b60185d235cf572b2a1ed79795dbf0868fbc6cfc532edd895d51dd09eb889cd"
+    },
+    "cargo/experiment-2/result.json": {
+      "bytes": 2040,
+      "sha256": "746b1a53511248914d647ac51db2c222d7378cedc7e59e91ef8beea8eb043315"
+    },
+    "cargo/experiment-2/started.json": {
+      "bytes": 1642,
+      "sha256": "4cd8ca5c534c16594c52e4fe46f641652e88146afbf025c63a140670cd3e6174"
+    },
+    "cargo/experiment-2/stderr.log": {
+      "bytes": 200,
+      "sha256": "75cc2e0e245d1c80b04a4a2c2d822a925df836958c4b5c887c1a8f11f99f1f63"
+    },
+    "cargo/experiment-2/stdout.log": {
+      "bytes": 355372,
+      "sha256": "c513f481adcaedc4461b2d37ea2a30a72b1b49d20cf66fce587bdbead9cdc3fa"
+    },
+    "cargo/experiment-3/process.json": {
+      "bytes": 245,
+      "sha256": "159f9bea3bea574f63fd1f2a505e245c1839ded6943abf33f0228a08b55f7b9a"
+    },
+    "cargo/experiment-3/result.json": {
+      "bytes": 3439,
+      "sha256": "dffdc1b4b417888f83c87118e981be7a9aa5b1a1dfddb9c3a166ac149013f937"
+    },
+    "cargo/experiment-3/source-proof.json": {
+      "bytes": 591,
+      "sha256": "e1e330d2dc4fee475991d0ba1a1bb75fae77c13d5874689af26987be12db0aae"
+    },
+    "cargo/experiment-3/started.json": {
+      "bytes": 1642,
+      "sha256": "26a7b07180d4a82b3e73ab2bd3435b5dc88f5bf4b3d9657a1e3e4a87e9502415"
+    },
+    "cargo/experiment-3/stderr.log": {
+      "bytes": 323,
+      "sha256": "21871e9ad66301bf27eecf78b22ea4ff2171bf37ed32d5fdc3bd15f1148f6791"
+    },
+    "cargo/experiment-3/stdout.log": {
+      "bytes": 293837,
+      "sha256": "f618b8bff61a3d7dd50d3a427c9a42b4650cedb308752343b3878a997c146e5c"
+    },
+    "cargo/format-1/process.json": {
+      "bytes": 116,
+      "sha256": "e513f657fb6f90a0774e327591f0e5c4e500a36fc09dbbd632758412c5191e31"
+    },
+    "cargo/format-1/result.json": {
+      "bytes": 1872,
+      "sha256": "26947da874f10973bb5f7f00692b354cf1e9680d1a8743d7185ddfbab8ba690a"
+    },
+    "cargo/format-1/source-proof.json": {
+      "bytes": 587,
+      "sha256": "26071a3c7f146022eebe2f22c50debf0c5f3f554cd561516d1a473be31a88f0d"
+    },
+    "cargo/format-1/started.json": {
+      "bytes": 1483,
+      "sha256": "a6cd6be75c5aa87e5dbdebd5e91f1dea44272d5a8bc359133f0bba88093c99d1"
+    },
+    "cargo/format-1/stderr.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "cargo/format-1/stdout.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "cargo/planner-document-1/process.json": {
+      "bytes": 202,
+      "sha256": "62b9efe10f28e06ae1889aec50c64d08122e7c59498bea461a0d246fd8191f86"
+    },
+    "cargo/planner-document-1/result.json": {
+      "bytes": 3387,
+      "sha256": "c1fcf4c5ba394dd060a7480c6528d3003fbbe28d0393f31f6b29af97ab6e0f96"
+    },
+    "cargo/planner-document-1/source-proof.json": {
+      "bytes": 597,
+      "sha256": "c64e4c556e27e6a6fbc8be463738783bcd5afa40959d4cec87801a53c8b08773"
+    },
+    "cargo/planner-document-1/started.json": {
+      "bytes": 1589,
+      "sha256": "46e446a7aef0bcf53433f6da250773ec1b1180eeebc5423659240d2d9f57993d"
+    },
+    "cargo/planner-document-1/stderr.log": {
+      "bytes": 247,
+      "sha256": "a9712b2a81ccf9c8b139170c92ed4d0477596d634c30fd0b0d71c362fafdff93"
+    },
+    "cargo/planner-document-1/stdout.log": {
+      "bytes": 299855,
+      "sha256": "ce239ba7364a035c08c0bf4c46174d0c0eb63f0bf2e9233bddac2b74e2f31de7"
+    },
+    "cargo/probe-lint-1/process.json": {
+      "bytes": 212,
+      "sha256": "a2bfa1d2452c0ca13feebd54840af0425817d114cd864c04e26c87a5229538a1"
+    },
+    "cargo/probe-lint-1/result.json": {
+      "bytes": 2004,
+      "sha256": "2bdac177fc3ce3c4f6536a3348ec516e0a08fe1a478dd5382b70dc64a41d1385"
+    },
+    "cargo/probe-lint-1/source-proof.json": {
+      "bytes": 591,
+      "sha256": "d49e047e0bfe3591836e702141be0f3935b94ecff11d5eb4bcd26658e153ccb8"
+    },
+    "cargo/probe-lint-1/started.json": {
+      "bytes": 1610,
+      "sha256": "682ae85b82b0551aec98da64192baa124e9dc9b7b2efa302b09cfeec24e395a4"
+    },
+    "cargo/probe-lint-1/stderr.log": {
+      "bytes": 137,
+      "sha256": "6cef38e57b28fdf01ceda8d4115372f4b9957505bbe28f9b6062e6c93c8feebc"
+    },
+    "cargo/probe-lint-1/stdout.log": {
+      "bytes": 268846,
+      "sha256": "38245fd5fc2ba8b6aac057f12438497e67a77a4fe96b2ca6f5aa6e1db36084f5"
+    },
+    "comparators/7805832d5f563ab2d7a50dd3de700792b5d6f459c68f7b1d8bcfcc9800fa0c3a.py": {
+      "bytes": 10094,
+      "sha256": "7805832d5f563ab2d7a50dd3de700792b5d6f459c68f7b1d8bcfcc9800fa0c3a"
+    },
+    "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py": {
+      "bytes": 3827,
+      "sha256": "1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20"
+    },
+    "helpers/58597566ae1cb5c4021ddc7e86635b76d127bdb63b5d3026c427771aae7e2119.py": {
+      "bytes": 1399,
+      "sha256": "58597566ae1cb5c4021ddc7e86635b76d127bdb63b5d3026c427771aae7e2119"
+    }
+  }
+}

harness/allocation-arrange-evidence-20260923/checks/prepare.py

@@ -0,0 +1,110 @@
+"""Package explicitly selected closed gate captures without running Cargo."""
+from pathlib import Path
+import argparse
+import json
+import zipfile
+from verify import RAW_FILES, pin, parsed, need, run_name, verify_data, verify_package
+
+HERE = Path(__file__).resolve().parent
+
+
+def collect(root, runs, helpers, comparators=()):
+    gates = root / ".local/allocation-group-gates"
+    candidates = [gates / name for name in ("gate.py", "source-proof.py")] + helpers
+    helper_bytes = [path.read_bytes() for path in candidates]
+    comparator_paths = [root / ".local/process-source-evidence-tools/verify.py", *comparators]
+    comparator_bytes = [path.read_bytes() for path in comparator_paths if path.is_file()]
+    payload, logical, specs = {}, {}, {}
+    def add(name, data):
+        stored = ("capsules/" + pin(data)["sha256"] + Path(name).suffix
+                  if name.rsplit("/", 1)[1] in {"inputs.json", "inputs.zip"} else name)
+        need(stored not in payload or payload[stored] == data, "deduplication collision")
+        payload[stored] = data
+        logical[name] = stored
+    helper_catalog = {}
+    for name, data in zip(("gate.py", "source-proof.py"), helper_bytes):
+        helper = "helpers/" + pin(data)["sha256"] + ".py"
+        add(helper, data)
+        helper_catalog[name] = helper
+    for run in runs:
+        folder = gates / run
+        need(folder.is_dir(), "run directory missing: " + run)
+        paths = list(folder.iterdir())
+        names = {path.name for path in paths}
+        need(all(path.is_file() and not path.is_symlink() for path in paths)
+             and names in (RAW_FILES, RAW_FILES | {"source-proof.json"}), "exact closed raw files required: " + run)
+        raw = {path.name: path.read_bytes() for path in paths}
+        result = parsed(raw["result.json"])
+        need("finish" in result and result["inputsUnchanged"] is True, "unfinished/changed run refused: " + run)
+        matches = [data for data in helper_bytes if pin(data) == result["helper"]]
+        need(bool(matches), "exact historical helper unavailable for " + run + "; supply --helper PATH")
+        helper = "helpers/" + result["helper"]["sha256"] + ".py"
+        add(helper, matches[0])
+        for name, data in sorted(raw.items()):
+            add("cargo/" + run + "/" + name, data)
+        specs[run] = {key: result[key] for key in ("command", "head", "exitCode", "inputCount")}
+        specs[run]["helper"] = helper
+        if "source-proof.json" in raw:
+            proof = parsed(raw["source-proof.json"])
+            matches = [data for data in comparator_bytes if pin(data) == proof["comparator"]]
+            need(bool(matches), "exact source comparator unavailable for " + run + "; supply --comparator PATH")
+            comparator = "comparators/" + proof["comparator"]["sha256"] + ".py"
+            add(comparator, matches[0])
+            specs[run]["sourceProof"] = {"commit": proof["commit"], "pin": pin(raw["source-proof.json"]), "comparator": comparator}
+    manifest = {"schema": 1, "kind": "allocation-multiselect-cargo-gates", "runs": specs,
+                "captureHelpers": helper_catalog,
+                "logicalFiles": dict(sorted(logical.items())),
+                "members": {name: pin(data) for name, data in sorted(payload.items())}}
+    summary = verify_data(manifest, payload.__getitem__)
+    return payload, manifest, summary
+
+
+def write_json(path, value):
+    with path.open("xb") as output:
+        output.write((json.dumps(value, indent=2) + "\n").encode("utf-8"))
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--root", type=Path, required=True, help="checkout holding .local/allocation-group-gates")
+    parser.add_argument("--runs", nargs="+", required=True, help="explicit run names, including failures to retain")
+    parser.add_argument("--helper", type=Path, action="append", default=[], help="additional exact historical helper (repeatable)")
+    parser.add_argument("--comparator", type=Path, action="append", default=[], help="additional exact historical source comparator (repeatable)")
+    parser.add_argument("--output", type=Path, help="fresh, nonexistent package directory (required unless --check-only)")
+    parser.add_argument("--check-only", action="store_true", help="validate raw captures in memory without creating an archive")
+    args = parser.parse_args()
+    need(all(run_name(run) for run in args.runs) and len(args.runs) == len(set(args.runs)), "unique safe run names required")
+    need(args.check_only or args.output is not None, "--output is required unless --check-only")
+    if not args.check_only:
+        need(not args.output.exists(), "output must be a fresh directory: " + str(args.output))
+    payload, manifest, summary = collect(args.root.resolve(), args.runs, args.helper, args.comparator)
+    if args.check_only:
+        print("PASS raw consistency; no package written:", summary)
+        return
+    out = args.output.resolve()
+    out.mkdir(parents=True, exist_ok=False)
+    for name in ("evidence.zip", "manifest.json", "files.json"):
+        need(not (out / name).exists(), "existing package output refused: " + name)
+    for name in ("prepare.py", "verify.py", "README.md"):
+        data = (HERE / name).read_bytes()
+        destination = out / name
+        if destination.exists():
+            need(destination.read_bytes() == data, "different existing package tool: " + name)
+        else:
+            with destination.open("xb") as output:
+                output.write(data)
+    with zipfile.ZipFile(out / "evidence.zip", "x", compression=zipfile.ZIP_DEFLATED, compresslevel=9) as archive:
+        for name, data in sorted(payload.items()):
+            info = zipfile.ZipInfo(name, date_time=(2026, 9, 23, 0, 0, 0))
+            info.compress_type = zipfile.ZIP_DEFLATED
+            info.external_attr = 0o100644 << 16
+            archive.writestr(info, data)
+    write_json(out / "manifest.json", manifest)
+    names = ("prepare.py", "verify.py", "README.md", "manifest.json", "evidence.zip")
+    write_json(out / "files.json", {name: pin((out / name).read_bytes()) for name in names})
+    need(verify_package(out) == summary, "written package differs from validated captures")
+    print("PASS package readback:", out, summary)
+
+
+if __name__ == "__main__":
+    main()

harness/allocation-arrange-evidence-20260923/checks/verify.py

@@ -0,0 +1,194 @@
+"""Offline consistency checks only; never execute or extract archived inputs."""
+from pathlib import Path, PurePosixPath
+from datetime import datetime
+import argparse
+import hashlib
+import io
+import json
+import math
+import re
+import stat
+import zipfile
+
+RAW_FILES = {"started.json", "process.json", "result.json", "stdout.log", "stderr.log", "inputs.json", "inputs.zip"}
+OUTER_FILES = {"prepare.py", "verify.py", "README.md", "manifest.json", "evidence.zip"}
+
+
+def need(condition, message):
+    if not condition:
+        raise ValueError(message)
+
+
+def pin(data):
+    return {"bytes": len(data), "sha256": hashlib.sha256(data).hexdigest()}
+
+
+def valid_pin(value):
+    return (isinstance(value, dict) and set(value) == {"bytes", "sha256"}
+            and type(value["bytes"]) is int and value["bytes"] >= 0
+            and isinstance(value["sha256"], str)
+            and re.fullmatch(r"[0-9a-f]{64}", value["sha256"]) is not None)
+
+
+def safe(name):
+    return (isinstance(name, str) and bool(name) and "\\" not in name and ":" not in name
+            and all(ord(char) >= 32 for char in name)
+            and not PurePosixPath(name).is_absolute()
+            and all(part not in ("", ".", "..") for part in name.split("/")))
+
+
+def run_name(name):
+    return isinstance(name, str) and re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9._-]*", name) is not None
+
+
+def parsed(data):
+    def pairs(items):
+        result = {}
+        for key, value in items:
+            need(key not in result, "duplicate JSON key: " + key)
+            result[key] = value
+        return result
+    def constant(value):
+        raise ValueError("nonfinite JSON constant: " + value)
+    return json.loads(data, object_pairs_hook=pairs, parse_constant=constant)
+
+
+def inventory(archive, expected):
+    names = archive.namelist()
+    need(len(names) == len(set(names)) and set(names) == set(expected), "exact ZIP membership")
+    for entry in archive.infolist():
+        need(safe(entry.filename) and not entry.is_dir(), "unsafe ZIP member: " + entry.filename)
+        need(not stat.S_ISLNK(entry.external_attr >> 16), "ZIP symlink: " + entry.filename)
+        need(valid_pin(expected[entry.filename]), "invalid member pin: " + entry.filename)
+        need(entry.file_size == expected[entry.filename]["bytes"], "ZIP recorded size: " + entry.filename)
+
+
+def ordered_times(*values):
+    times = [datetime.fromisoformat(value) for value in values]
+    return all(value.utcoffset() is not None for value in times) and times == sorted(times)
+
+
+def verify_data(manifest, read):
+    """Shared read-only verifier for packaged bytes or prepare's in-memory payload."""
+    need(manifest["schema"] == 1 and manifest["kind"] == "allocation-multiselect-cargo-gates", "manifest schema")
+    runs, logical, stored = manifest["runs"], manifest["logicalFiles"], manifest["members"]
+    helpers = manifest["captureHelpers"]
+    need(isinstance(helpers, dict) and set(helpers) == {"gate.py", "source-proof.py"}, "capture helper names")
+    need(all(isinstance(name, str) and re.fullmatch(r"helpers/[0-9a-f]{64}\.py", name)
+             for name in helpers.values()), "capture helper mapping")
+    need(isinstance(runs, dict) and bool(runs) and all(run_name(run) for run in runs), "explicit run inventory")
+    need(all(safe(name) for name in logical) and all(safe(name) for name in stored), "unsafe manifest path")
+    need(set(logical.values()) == set(stored), "unreferenced or absent stored members")
+    for name, expected in stored.items():
+        need(valid_pin(expected) and pin(read(name)) == expected, "stored member hash: " + name)
+    expected_logical = {"cargo/" + run + "/" + name for run in runs for name in RAW_FILES}
+    expected_logical.update(spec["helper"] for spec in runs.values())
+    expected_logical.update(helpers.values())
+    for run, spec in runs.items():
+        if "sourceProof" in spec:
+            proof_spec = spec["sourceProof"]
+            need(set(proof_spec) == {"commit", "pin", "comparator"}, run + ": exact source proof spec")
+            need(isinstance(proof_spec["commit"], str) and re.fullmatch(r"[0-9a-f]{40}", proof_spec["commit"]), run + ": named full source commit")
+            need(valid_pin(proof_spec["pin"]), run + ": source proof pin")
+            need(isinstance(proof_spec["comparator"], str) and re.fullmatch(r"comparators/[0-9a-f]{64}\.py", proof_spec["comparator"]), run + ": comparator path")
+            expected_logical.update({"cargo/" + run + "/source-proof.json", proof_spec["comparator"]})
+    need(set(logical) == expected_logical, "exact logical raw/helper inventory")
+    for name, destination in logical.items():
+        if name.startswith("cargo/") and name.rsplit("/", 1)[1] in {"inputs.json", "inputs.zip"}:
+            expected = "capsules/" + stored[destination]["sha256"] + PurePosixPath(name).suffix
+            need(destination == expected, "input capsule mapping: " + name)
+        else:
+            need(destination == name, "only input maps/archives may be deduplicated: " + name)
+    def raw(name):
+        return read(logical[name])
+    for name, helper in helpers.items():
+        need(helper == "helpers/" + pin(raw(helper))["sha256"] + ".py", "named helper hash: " + name)
+    seen_capsules = set()
+    for run, spec in runs.items():
+        prefix = "cargo/" + run + "/"
+        start = parsed(raw(prefix + "started.json"))
+        process = parsed(raw(prefix + "process.json"))
+        result = parsed(raw(prefix + "result.json"))
+        required_start = {"start", "command", "cwd", "head", "scope", "inputs", "archive",
+                          "inputCount", "environment", "helper", "cargo", "rustc"}
+        need(required_start <= start.keys(), run + ": incomplete start receipt")
+        need(all(result.get(key) == value for key, value in start.items()), run + ": start/result relationship")
+        command = result["command"]
+        need(isinstance(command, list) and command and command[0] == "cargo"
+             and all(isinstance(arg, str) for arg in command), run + ": Cargo command")
+        need(command == process["command"] == spec["command"], run + ": command relationship")
+        need(result["head"] == spec["head"] and re.fullmatch(r"(?:[0-9a-f]{40}|[0-9a-f]{64})", result["head"]), run + ": HEAD")
+        need(type(result["exitCode"]) is int and result["exitCode"] == spec["exitCode"], run + ": recorded exit")
+        need(result["inputsUnchanged"] is True, run + ": changed inputs refused")
+        need(type(result["seconds"]) in (int, float) and math.isfinite(result["seconds"])
+             and result["seconds"] >= 0, run + ": duration")
+        need(type(process["pid"]) is int and process["pid"] > 0, run + ": process identity")
+        need(ordered_times(start["start"], process["observed"], result["finish"]), run + ": completed timestamp order")
+        for field, filename in [("inputs", "inputs.json"), ("archive", "inputs.zip"), ("stdout", "stdout.log"), ("stderr", "stderr.log")]:
+            need(result[field] == pin(raw(prefix + filename)), run + ": " + field + " pin")
+        need(valid_pin(result["helper"]) and result["helper"] == pin(raw(spec["helper"])), run + ": helper pin")
+        need(spec["helper"] == "helpers/" + result["helper"]["sha256"] + ".py", run + ": helper mapping")
+        inputs = parsed(raw(prefix + "inputs.json"))
+        need(isinstance(inputs, dict) and all(safe(name) for name in inputs), run + ": safe input inventory")
+        need(type(result["inputCount"]) is int and len(inputs) == result["inputCount"] == spec["inputCount"], run + ": input counts")
+        if "sourceProof" in spec:
+            proof_spec = spec["sourceProof"]
+            proof_bytes = raw(prefix + "source-proof.json")
+            proof = parsed(proof_bytes)
+            need(pin(proof_bytes) == proof_spec["pin"], run + ": source proof pinned bytes")
+            need(proof["run"] == run and proof["commit"] == proof_spec["commit"], run + ": proof run/commit identity")
+            need(proof["status"] == "PASS exact captured input inventory and Git blob bytes", run + ": source proof status")
+            need(proof["inputCount"] == len(inputs) and proof["inputMap"] == result["inputs"], run + ": proof input relationship")
+            need(proof["result"] == pin(raw(prefix + "result.json")), run + ": proof result relationship")
+            need(ordered_times(result["finish"], proof["verified"]), run + ": proof time after closed gate")
+            comparator = proof_spec["comparator"]
+            need(valid_pin(proof["comparator"]) and pin(raw(comparator)) == proof["comparator"], run + ": comparator bytes")
+            need(comparator == "comparators/" + proof["comparator"]["sha256"] + ".py", run + ": comparator identity")
+        need(sum(name.startswith("crates/vendor/iced_widget/") for name in inputs) == 71, run + ": vendor count")
+        capsule = (logical[prefix + "inputs.json"], logical[prefix + "inputs.zip"])
+        if capsule not in seen_capsules:
+            with zipfile.ZipFile(io.BytesIO(raw(prefix + "inputs.zip"))) as source:
+                inventory(source, inputs)
+                for name, expected in inputs.items():
+                    need(pin(source.read(name)) == expected, run + ": source hash " + name)
+            seen_capsules.add(capsule)
+        artifacts = []
+        for line in raw(prefix + "stdout.log").decode("utf-8", errors="replace").splitlines():
+            try:
+                value = json.loads(line)
+            except json.JSONDecodeError:
+                continue
+            if isinstance(value, dict) and value.get("reason") == "compiler-artifact" and value.get("executable"):
+                artifacts.append(value)
+        need(isinstance(result["artifacts"], list), run + ": artifact records")
+        need(artifacts == [record["cargo"] for record in result["artifacts"]], run + ": Cargo JSON artifact relationship")
+        for record in result["artifacts"]:
+            need(set(record) == {"cargo", "readback"}
+                 and (record["readback"] is None or valid_pin(record["readback"])), run + ": artifact readback pin")
+        print(run, "recorded exit", result["exitCode"], "inputs", len(inputs), "executable records", len(artifacts))
+    return {"runs": len(runs), "recordedFailures": sum(spec["exitCode"] != 0 for spec in runs.values()),
+            "logicalFiles": len(logical), "storedMembers": len(stored), "sourceCapsulePairs": len(seen_capsules),
+            "captureHelpers": helpers, "sourceProofs": sum("sourceProof" in spec for spec in runs.values())}
+
+
+def verify_package(root):
+    files = parsed((root / "files.json").read_bytes())
+    need(set(files) == OUTER_FILES, "outer file inventory")
+    for name, expected in files.items():
+        need(valid_pin(expected) and pin((root / name).read_bytes()) == expected, "outer hash: " + name)
+    manifest = parsed((root / "manifest.json").read_bytes())
+    with zipfile.ZipFile(root / "evidence.zip") as archive:
+        inventory(archive, manifest["members"])
+        return verify_data(manifest, archive.read)
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("package", nargs="?", type=Path, default=Path(__file__).resolve().parent)
+    args = parser.parse_args()
+    print("PASS offline consistency:", verify_package(args.package))
+    print("Historical receipts only; no source/binary execution or native acceptance claim.")
+
+
+if __name__ == "__main__":
+    main()

harness/allocation-arrange-evidence-20260923/reviews/README.md

@@ -0,0 +1,26 @@
+# Preserved independent review records
+
+[reviews.zip](reviews.zip) contains six exact historical Markdown records,
+pinned by [members.json](members.json). Their original context was
+`.local/allocation-group-design/` in the reviewed checkout. Relative links and
+line references inside this historical archive retain that context and reviewed
+source version; they are not links to an installed peer workspace.
+
+| Record | Scope |
+| --- | --- |
+| critique.md | Initial combined assignment/Arrange proposal criticism |
+| fresh-policy-critique.md | Independent policy alternatives and falsifiers |
+| experiment/v2-review.md | Four-family experiment; SA port sizing oracle defect |
+| selection-boundary.md | Exact typed App selection versus pure placement API |
+| input-boundaries.md | Pending click, irreversible threshold and input integration obligations |
+| arrange-planner-review.md | Fresh pure-planner review plus R1/R2 test-disposition addendum |
+
+The [accepted contract](../../allocation-arrange-amendment-20260923.md) and
+[result report](../../allocation-arrange-planner-20260923.md) are authoritative for
+current decisions and acceptance. Historical recommendations or proposed APIs
+inside the archive do not supersede them. Root verified reported execution
+separately; review authors did not independently run Cargo or native workflows.
+
+The report records remaining P3 coverage suggestions and App/native gaps.
+The archive preserves earlier findings even when the dated addendum addresses
+them. [files.json](files.json) pins this index, the archive and its member map.

harness/allocation-arrange-evidence-20260923/reviews/files.json

@@ -0,0 +1,14 @@
+{
+  "README.md": {
+    "bytes": 1576,
+    "sha256": "b25dc1db4a8a46f5f41381426a237f1a21f21f8b18c0bbfc8590b6f91804d03b"
+  },
+  "reviews.zip": {
+    "bytes": 28248,
+    "sha256": "d9202f0c6b82ad383de3b4e9e84bb0457f62ae53f1511c458294b0593753e2f1"
+  },
+  "members.json": {
+    "bytes": 831,
+    "sha256": "2edee904da60ca409192a6152952b556d61bcb36cddcfcfce29fd65476a4fba7"
+  }
+}

harness/allocation-arrange-evidence-20260923/reviews/members.json

@@ -0,0 +1,26 @@
+{
+  "critique.md": {
+    "bytes": 8955,
+    "sha256": "a69c27b472f27e06567a216836b42c1593956f23616a6d12ef6ec61c1cf29bdb"
+  },
+  "fresh-policy-critique.md": {
+    "bytes": 15227,
+    "sha256": "d9ce5c5e6b3f61c8f5933424e178a476f65e262a8990380021c461fd7bcbe38b"
+  },
+  "experiment/v2-review.md": {
+    "bytes": 5901,
+    "sha256": "46439cdf44cef6d95b8b45df1ba93fd27ca9b78c9470e4c5b9e166ce3082a1f2"
+  },
+  "selection-boundary.md": {
+    "bytes": 6420,
+    "sha256": "f7971131bac65cde48810abb629695a5a3d0a0aa5b8d115b5fa141b8c3fe5988"
+  },
+  "input-boundaries.md": {
+    "bytes": 16200,
+    "sha256": "81a2b55d3dde1f658bf10811d06fa0bf1759afc90aa616a376a754cec5af6d22"
+  },
+  "arrange-planner-review.md": {
+    "bytes": 13461,
+    "sha256": "6171cd269a261ebf255fd75b04a155b78cdb359940b164557a3bc2409b7df3b8"
+  }
+}

harness/allocation-arrange-planner-20260923.md

@@ -0,0 +1,136 @@
+# Allocation Arrange policy and pure planner — 2026-09-23
+
+Codex-9e8r6t contribution to [issue 29](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/29), above Process delivery `6d99aacab8ca1a91c857a2179baa14d80a2901e9`.
+**Pure planner verified; App integration and native acceptance remain open.**
+This is not a release or full Allocation/multiselect completion claim.
+
+## Result and decision
+
+The [accepted amendment](allocation-arrange-amendment-20260923.md) defines explicit
+Arrange for one or more work/performer placements. It preserves engineering
+records and moves one union: semantic descendants of explicitly selected work
+plus accepted visual descendants of explicitly selected performers. It does not
+acquire incidental semantic parents or siblings. Ordinary assignment retains its
+existing per-root responsibility and coherence rules.
+
+The experiment compared strict refusal, visible-selected-only movement and this
+combined footprint. Strict refusal discarded valid semantics-preserving layouts;
+visible-only movement omitted hidden/semantic descendants. Actual OA/SA examples
+support the bounded union policy, subject to complete geometry checks. There is
+no automatic packing, convergence, semantic reparenting or target unfolding.
+
+Both visible and required diagnostic scenes check **all** unrelated card pairs.
+An unselected performer's derived enclosure can grow into an obstacle even when
+none of the moved cards touches it. Diagnostics unfold affected placements and
+their required visual ancestors; unrelated stationary folded interiors remain
+outside that domain. The experiment explicitly distinguishes this policy from
+universal unfolding. Future expansion can reveal overlap.
+
+At source **9b83f7ca0dcd34056765b9399863a21da72c3a9f**,
+[`arrange.rs`](../crates/oa-desktop/src/allocation_drag/arrange.rs) implements
+immutable capture/place/finish, exact original placement identities, one snapped
+anchor delta, route translation using actual accepted endpoint owners, combined
+projection, every selected header, stale/tamper rejection and an exact final
+Project comparison. Motion reuses the semantic index and captured footprint;
+it does not clone/validate a Project per pointer position. Pairwise collision
+cost remains real; no large-scene latency benchmark is claimed.
+
+The planner's ID map is deliberately not an input capability. App must validate
+the entire original typed selection before conversion, retaining its exact
+snapshot/generation and clean-owner lifetime. The new module is not yet connected
+to App; its temporary dead-code annotation states that boundary. The only change
+to singleton capture extracts its already-validated fact collector; ordinary
+singleton policy is unchanged.
+
+## Exact verification
+
+All twelve closed runs are preserved in the [portable evidence](allocation-arrange-evidence-20260923/checks/README.md).
+Every run reports unchanged captured inputs, including all 71 patched Iced files.
+Recorded compile failures remain failures. Historical HEAD alone does not identify
+uncommitted captured inputs; named source proofs compare the complete relevant
+Git inventory and every blob byte with the captured map.
+
+| Gates | Observed result | Exact source |
+| --- | --- | --- |
+| experiment-1 | 2 OA experiment tests pass | 743 blobs at `3a7923b96d671041cbc747a614cbd0fad6b6b3d3` |
+| experiment-2 | Compile failure: imported module resolved desktop-wide tests | Captured capsule retained; no named-commit proof |
+| experiment-3 | Four OA/SA experiment families pass, 57 filtered | 744 blobs at `8dbbaf262e3b8d26a32d6c30f0cc5f963fab47a0` |
+| planner-document-1 | All 61 planner/Document module tests pass | Same `8dbbaf2` bytes |
+| probe-lint-1 / format-1 | Strict scoped Clippy and workspace format pass | Same `8dbbaf2` bytes |
+| arrange-planner-1 / -2 | Compile failures: missing explicit module path, then test temporary-array borrow | Both exact capsules retained |
+| arrange-planner-3 | 67 tests pass, 2.44s | Earlier captured planner/tests; not labelled as `8dbbaf2` |
+| arrange-planner-4 | **70 tests pass**, 2.77s | 746 blobs at `9b83f7ca0dcd34056765b9399863a21da72c3a9f` |
+| arrange-lint-1 / arrange-format-1 | Strict scoped Clippy and workspace format pass | Same `9b83f7c` bytes |
+
+The final input-map SHA-256 is
+`c8192fd84fba63fa576975e9fd44f0fa2d6c8ed2e6b5ada3fd4bee076d36f686`.
+The 70 include nine new Arrange test families and the existing 61 module tests.
+Literal full-Project oracles check engineering records, sizes/folds, other views,
+internal and one-ended saved routes. Actual Document execution checks compiled
+source, reopen and one exact Undo/Redo. Further cases exercise either selected
+anchor, parent/child deduplication, role-only work, unplaced leaves, simultaneous
+vacated-space movement, preexisting-overlap preservation versus growth, hidden
+collision versus unselected enclosure growth, no-op, stale/tampered results and
+all selected headers. These are pure/source checks, not native gesture evidence.
+
+The first experiment's untouched fresh-Document assertion was not atomic refusal
+evidence; the successor removed that overstatement. Independent review also
+corrected SA oracle literals before execution: FunctionalExchange auto-ports
+raise projected work height from OA 94 to SA 132, enclosure height 218 to 256,
+and the hidden overlap area 13696 to 20116. Production sizing was not changed to
+fit an oracle.
+
+## Independent review and remaining checks
+
+[Preserved reviews](allocation-arrange-evidence-20260923/reviews/README.md) record
+policy criticism, the SA oracle finding, the selection boundary and fresh planner
+review. No concrete planner defect was found. Review R1/R2 led to independent
+collision-cause discriminators, a singleton-refuses/combined-passes vacated-space
+case, and unchanged-overlap versus enlargement controls. The final planner
+production bytes are unchanged from the reviewed 67-test capture; only
+`arrange_tests.rs` differs in the 70-test capture.
+
+Deeper nested folded ancestry, explicit endpoint attachment fixtures and broader
+tamper/non-grid cases remain protective P3 coverage suggestions, not reproduced
+defects or completed checks. App must retain minimum readable text scale; the
+pure planner validates world-space header containment and finite positive zoom.
+
+App integration must still prove exact whole typed-set admission, deferred
+selected-member click collapse, an irreversible drag threshold, one-shot Arrange
+on both performer/work anchors, dirty/source-failure preservation, stale selection
+generation, cancellation, frozen geometry and truthful preview/counts. Ordinary
+work-only group assignment needs its own combined semantic candidate. OA/SA native
+workflows, actual Save/reopen, Scenario group operations and aggregate deletion
+remain open. Existing Process routing overlap is not solved here. Linux/WSL
+verification remains user-paused.
+
+## Reproduction and portable records
+
+Verified on Windows x86_64 gnullvm, Rust/Cargo 1.98.1, LLVM-MinGW20260826,
+one build job and incremental compilation disabled. Initialize the documented
+project toolchain/DLL environment before invoking Cargo. From the named source:
+
+```powershell
+$env:CARGO_BUILD_JOBS='1'
+$env:CARGO_INCREMENTAL='0'
+cargo test -p oa-desktop --example allocation_policy_probe --message-format=json -- --test-threads=1
+cargo clippy -p oa-desktop --example allocation_policy_probe --tests --message-format=json -- -D warnings
+cargo fmt --all -- --check
+python -B harness/allocation-arrange-evidence-20260923/checks/verify.py
+```
+
+The focused example imports the actual planner and Document modules. It does not
+replace desktop/App/native acceptance. The initial full desktop experiment
+reported 30m42s compile time; the focused successor reported 7.11s. This useful
+iteration improvement is not a controlled benchmark: target graphs, warm artifacts
+and machine state differ.
+
+The package retains twelve runs, three compile failures, eight named source
+proofs, 95 logical files in 85 stored members and seven deduplicated source
+capsule pairs. Offline verification checks exact inventories, pins, streams,
+receipts, source capsule contents and proof relationships; it does not execute
+archived code, independently authenticate logs or repeat Git comparisons.
+The packager's corruption checks rejected eleven changed relationships and an
+attempt to overwrite an existing output. Root verified all eleven exact staged
+evidence files in a fresh export: the portable checks verifier and every review
+archive/member pin passed without consulting working-copy evidence bytes.

harness/allocation-assignment-evidence-20260923/.gitattributes

@@ -0,0 +1 @@
+** -text whitespace=cr-at-eol

harness/allocation-assignment-evidence-20260923/checks/README.md

@@ -0,0 +1,24 @@
+# Allocation captured-gate evidence tools
+
+Adapted from the reviewed Process prepare/verify/selfcheck tools. Read-only preparation consumes explicitly selected **closed** runs in CHECKOUT/.local/allocation-group-gates. No Cargo, source execution, checkout, GUI, network or archived helper execution occurs.
+
+```powershell
+python -B prepare.py --root CHECKOUT --runs experiment-1 experiment-2 experiment-3 planner-document-1 probe-lint-1 format-1 --check-only
+```
+
+Keep failed experiment-2: verification preserves its recorded compile failure rather than converting archive consistency into test success. The example selects the first six closed gates. Later closed planner runs can be explicitly listed with the same interface; the final package manifest is authoritative for its exact inventory. No implicit discovery includes active directories.
+
+To create a portable package, replace --check-only with `--output NEW_DIRECTORY`. Existing output refuses. The exact seven raw files are required, with only `source-proof.json` accepted as an optional eighth file. No raw byte normalization or receipt rewriting occurs. Maps and nested input ZIPs deduplicate by SHA-256; other logical raw files keep their names. All original helper bytes, failed-run streams and optional proof bytes remain archived. The Allocation-specific manifest kind distinguishes this extension from the seven-file Process schema.
+
+The gate.py and source-proof.py helper catalog is preserved. Every gate's recorded helper must match available bytes; use repeatable `--helper PATH` for older captures. If a proof exists, its exact comparator bytes must be available at the default `.local/process-source-evidence-tools/verify.py` or a repeatable `--comparator PATH`. They are archived under their content hash and never executed.
+
+An optional source proof is independently pinned in the manifest with its full named commit. Verification binds it to the enclosing run, exact result receipt, captured map/count, completed gate time, status and comparator bytes/hash. Captured HEAD is preserved as historical metadata and is not substituted for the named source commit. This packager checks historical proof consistency; it does **not** repeat Git blob comparison. A source proof on a failed gate is source-identity evidence only, never a passing-test claim.
+
+```powershell
+python -B PACKAGE/verify.py
+python -B selfcheck.py --root CHECKOUT --runs experiment-1 experiment-2 experiment-3 planner-document-1 probe-lint-1 format-1 --output TOOLS/NEW_SELFCHECK_DIRECTORY
+```
+
+The verifier checks pins, exact ZIP inventory, process/start/result relationships, streams, command/exit identities, source capsules, vendor inventory and Cargo artifact relationships. Selfchecks compare packaged raw bytes to originals, reject existing output, and mutate only in-memory copies to test stream/helper/exit/capsule/proof corruption. The package contains tools, manifest, files.json and evidence.zip; selfcheck is a preparation utility, not packaged runtime input.
+
+Limits: internal consistency is not external authentication, hermetic build proof, native usability, a new source comparison or production acceptance. Review exact run results and source identity separately. Run with `python -B` to avoid incidental bytecode writes.

harness/allocation-assignment-evidence-20260923/checks/files.json

@@ -0,0 +1,22 @@
+{
+  "prepare.py": {
+    "bytes": 6316,
+    "sha256": "aa52592fb8e373c2a90007e187734d29129d38d9fce9dc45461482c7f6376bff"
+  },
+  "verify.py": {
+    "bytes": 11440,
+    "sha256": "584187370a1076e13190914158fc72a9ab65f07e72cc6a0d3b5c319f3dc7f05f"
+  },
+  "README.md": {
+    "bytes": 3284,
+    "sha256": "3ff0a61fb15ca26e54b8903962c99ba7802a87f0204e7b71f2d04c812b9588b7"
+  },
+  "manifest.json": {
+    "bytes": 17748,
+    "sha256": "f053e2f1492ee4fdfa2d4dfd7e48c5768d098cf96b629471699810d06cb61537"
+  },
+  "evidence.zip": {
+    "bytes": 8984108,
+    "sha256": "51b898205ee7a2907ce746389882f0607f7ad7290a1759b392cd307ef9e9ef5a"
+  }
+}

harness/allocation-assignment-evidence-20260923/checks/manifest.json

@@ -0,0 +1,396 @@
+{
+  "schema": 1,
+  "kind": "allocation-multiselect-cargo-gates",
+  "runs": {
+    "assignment-planner-1": {
+      "command": [
+        "cargo",
+        "test",
+        "-p",
+        "oa-desktop",
+        "--example",
+        "allocation_policy_probe",
+        "--message-format=json",
+        "--",
+        "--test-threads=1"
+      ],
+      "head": "eed80ffd6e94c7127491de1fd45c0415685f6328",
+      "exitCode": 0,
+      "inputCount": 749,
+      "helper": "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py"
+    },
+    "assignment-planner-2": {
+      "command": [
+        "cargo",
+        "test",
+        "-p",
+        "oa-desktop",
+        "--example",
+        "allocation_policy_probe",
+        "--message-format=json",
+        "--",
+        "--test-threads=1"
+      ],
+      "head": "eed80ffd6e94c7127491de1fd45c0415685f6328",
+      "exitCode": 0,
+      "inputCount": 750,
+      "helper": "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py"
+    },
+    "assignment-lint-1": {
+      "command": [
+        "cargo",
+        "clippy",
+        "-p",
+        "oa-desktop",
+        "--example",
+        "allocation_policy_probe",
+        "--tests",
+        "--message-format=json",
+        "--",
+        "-D",
+        "warnings"
+      ],
+      "head": "eed80ffd6e94c7127491de1fd45c0415685f6328",
+      "exitCode": 0,
+      "inputCount": 750,
+      "helper": "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py"
+    },
+    "assignment-format-1": {
+      "command": [
+        "cargo",
+        "fmt",
+        "--all",
+        "--",
+        "--check"
+      ],
+      "head": "eed80ffd6e94c7127491de1fd45c0415685f6328",
+      "exitCode": 0,
+      "inputCount": 750,
+      "helper": "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py"
+    },
+    "assignment-planner-3": {
+      "command": [
+        "cargo",
+        "test",
+        "-p",
+        "oa-desktop",
+        "--example",
+        "allocation_policy_probe",
+        "--message-format=json",
+        "--",
+        "--test-threads=1"
+      ],
+      "head": "33e880103c5fa935a4431ec3dc089e2c4c92f680",
+      "exitCode": 0,
+      "inputCount": 750,
+      "helper": "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py",
+      "sourceProof": {
+        "commit": "33e880103c5fa935a4431ec3dc089e2c4c92f680",
+        "pin": {
+          "bytes": 599,
+          "sha256": "3b249398b0ade218ec9737677e1021e21eae7aa03deeb6bc071e0e7e7fe6182b"
+        },
+        "comparator": "comparators/7805832d5f563ab2d7a50dd3de700792b5d6f459c68f7b1d8bcfcc9800fa0c3a.py"
+      }
+    },
+    "assignment-lint-2": {
+      "command": [
+        "cargo",
+        "clippy",
+        "-p",
+        "oa-desktop",
+        "--example",
+        "allocation_policy_probe",
+        "--tests",
+        "--message-format=json",
+        "--",
+        "-D",
+        "warnings"
+      ],
+      "head": "33e880103c5fa935a4431ec3dc089e2c4c92f680",
+      "exitCode": 0,
+      "inputCount": 750,
+      "helper": "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py",
+      "sourceProof": {
+        "commit": "33e880103c5fa935a4431ec3dc089e2c4c92f680",
+        "pin": {
+          "bytes": 596,
+          "sha256": "3a8f4d17bc6e696f8c0a1373f739650da5aa5b84683478c697e71b280d07b430"
+        },
+        "comparator": "comparators/7805832d5f563ab2d7a50dd3de700792b5d6f459c68f7b1d8bcfcc9800fa0c3a.py"
+      }
+    },
+    "assignment-format-2": {
+      "command": [
+        "cargo",
+        "fmt",
+        "--all",
+        "--",
+        "--check"
+      ],
+      "head": "33e880103c5fa935a4431ec3dc089e2c4c92f680",
+      "exitCode": 0,
+      "inputCount": 750,
+      "helper": "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py",
+      "sourceProof": {
+        "commit": "33e880103c5fa935a4431ec3dc089e2c4c92f680",
+        "pin": {
+          "bytes": 598,
+          "sha256": "41553cf5d5e5f6414930ad088fa82515630d3478da53a5ac961c8bf4191d1bc6"
+        },
+        "comparator": "comparators/7805832d5f563ab2d7a50dd3de700792b5d6f459c68f7b1d8bcfcc9800fa0c3a.py"
+      }
+    }
+  },
+  "captureHelpers": {
+    "gate.py": "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py",
+    "source-proof.py": "helpers/58597566ae1cb5c4021ddc7e86635b76d127bdb63b5d3026c427771aae7e2119.py"
+  },
+  "logicalFiles": {
+    "cargo/assignment-format-1/inputs.json": "capsules/e41e7d1a2b9519b78730821f96c1bf7ca8431935fe67efa203daa80d3f15c437.json",
+    "cargo/assignment-format-1/inputs.zip": "capsules/b471d434d8eac790ef7cc9073be0d395c9c9ad1472ba06a05b5818269ef03dfe.zip",
+    "cargo/assignment-format-1/process.json": "cargo/assignment-format-1/process.json",
+    "cargo/assignment-format-1/result.json": "cargo/assignment-format-1/result.json",
+    "cargo/assignment-format-1/started.json": "cargo/assignment-format-1/started.json",
+    "cargo/assignment-format-1/stderr.log": "cargo/assignment-format-1/stderr.log",
+    "cargo/assignment-format-1/stdout.log": "cargo/assignment-format-1/stdout.log",
+    "cargo/assignment-format-2/inputs.json": "capsules/ce988ecaeaca395d0f120844db7e3da90d039633beef10d2d4a8b8f19e92ee27.json",
+    "cargo/assignment-format-2/inputs.zip": "capsules/ae03a0a847a5c2000ba46e356e3dcd13a219e5fb699be8ad71a619b593e13c23.zip",
+    "cargo/assignment-format-2/process.json": "cargo/assignment-format-2/process.json",
+    "cargo/assignment-format-2/result.json": "cargo/assignment-format-2/result.json",
+    "cargo/assignment-format-2/source-proof.json": "cargo/assignment-format-2/source-proof.json",
+    "cargo/assignment-format-2/started.json": "cargo/assignment-format-2/started.json",
+    "cargo/assignment-format-2/stderr.log": "cargo/assignment-format-2/stderr.log",
+    "cargo/assignment-format-2/stdout.log": "cargo/assignment-format-2/stdout.log",
+    "cargo/assignment-lint-1/inputs.json": "capsules/e41e7d1a2b9519b78730821f96c1bf7ca8431935fe67efa203daa80d3f15c437.json",
+    "cargo/assignment-lint-1/inputs.zip": "capsules/b471d434d8eac790ef7cc9073be0d395c9c9ad1472ba06a05b5818269ef03dfe.zip",
+    "cargo/assignment-lint-1/process.json": "cargo/assignment-lint-1/process.json",
+    "cargo/assignment-lint-1/result.json": "cargo/assignment-lint-1/result.json",
+    "cargo/assignment-lint-1/started.json": "cargo/assignment-lint-1/started.json",
+    "cargo/assignment-lint-1/stderr.log": "cargo/assignment-lint-1/stderr.log",
+    "cargo/assignment-lint-1/stdout.log": "cargo/assignment-lint-1/stdout.log",
+    "cargo/assignment-lint-2/inputs.json": "capsules/ce988ecaeaca395d0f120844db7e3da90d039633beef10d2d4a8b8f19e92ee27.json",
+    "cargo/assignment-lint-2/inputs.zip": "capsules/ae03a0a847a5c2000ba46e356e3dcd13a219e5fb699be8ad71a619b593e13c23.zip",
+    "cargo/assignment-lint-2/process.json": "cargo/assignment-lint-2/process.json",
+    "cargo/assignment-lint-2/result.json": "cargo/assignment-lint-2/result.json",
+    "cargo/assignment-lint-2/source-proof.json": "cargo/assignment-lint-2/source-proof.json",
+    "cargo/assignment-lint-2/started.json": "cargo/assignment-lint-2/started.json",
+    "cargo/assignment-lint-2/stderr.log": "cargo/assignment-lint-2/stderr.log",
+    "cargo/assignment-lint-2/stdout.log": "cargo/assignment-lint-2/stdout.log",
+    "cargo/assignment-planner-1/inputs.json": "capsules/4e237aa6ba6359490d65efd40e15a697991ce53350af2080503c0635d2d9de3e.json",
+    "cargo/assignment-planner-1/inputs.zip": "capsules/1bb6e8b18022977f43e29bd44d25238acbf8c424bd4bf736474fce74bd8de8bc.zip",
+    "cargo/assignment-planner-1/process.json": "cargo/assignment-planner-1/process.json",
+    "cargo/assignment-planner-1/result.json": "cargo/assignment-planner-1/result.json",
+    "cargo/assignment-planner-1/started.json": "cargo/assignment-planner-1/started.json",
+    "cargo/assignment-planner-1/stderr.log": "cargo/assignment-planner-1/stderr.log",
+    "cargo/assignment-planner-1/stdout.log": "cargo/assignment-planner-1/stdout.log",
+    "cargo/assignment-planner-2/inputs.json": "capsules/e41e7d1a2b9519b78730821f96c1bf7ca8431935fe67efa203daa80d3f15c437.json",
+    "cargo/assignment-planner-2/inputs.zip": "capsules/b471d434d8eac790ef7cc9073be0d395c9c9ad1472ba06a05b5818269ef03dfe.zip",
+    "cargo/assignment-planner-2/process.json": "cargo/assignment-planner-2/process.json",
+    "cargo/assignment-planner-2/result.json": "cargo/assignment-planner-2/result.json",
+    "cargo/assignment-planner-2/started.json": "cargo/assignment-planner-2/started.json",
+    "cargo/assignment-planner-2/stderr.log": "cargo/assignment-planner-2/stderr.log",
+    "cargo/assignment-planner-2/stdout.log": "cargo/assignment-planner-2/stdout.log",
+    "cargo/assignment-planner-3/inputs.json": "capsules/ce988ecaeaca395d0f120844db7e3da90d039633beef10d2d4a8b8f19e92ee27.json",
+    "cargo/assignment-planner-3/inputs.zip": "capsules/ae03a0a847a5c2000ba46e356e3dcd13a219e5fb699be8ad71a619b593e13c23.zip",
+    "cargo/assignment-planner-3/process.json": "cargo/assignment-planner-3/process.json",
+    "cargo/assignment-planner-3/result.json": "cargo/assignment-planner-3/result.json",
+    "cargo/assignment-planner-3/source-proof.json": "cargo/assignment-planner-3/source-proof.json",
+    "cargo/assignment-planner-3/started.json": "cargo/assignment-planner-3/started.json",
+    "cargo/assignment-planner-3/stderr.log": "cargo/assignment-planner-3/stderr.log",
+    "cargo/assignment-planner-3/stdout.log": "cargo/assignment-planner-3/stdout.log",
+    "comparators/7805832d5f563ab2d7a50dd3de700792b5d6f459c68f7b1d8bcfcc9800fa0c3a.py": "comparators/7805832d5f563ab2d7a50dd3de700792b5d6f459c68f7b1d8bcfcc9800fa0c3a.py",
+    "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py": "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py",
+    "helpers/58597566ae1cb5c4021ddc7e86635b76d127bdb63b5d3026c427771aae7e2119.py": "helpers/58597566ae1cb5c4021ddc7e86635b76d127bdb63b5d3026c427771aae7e2119.py"
+  },
+  "members": {
+    "capsules/1bb6e8b18022977f43e29bd44d25238acbf8c424bd4bf736474fce74bd8de8bc.zip": {
+      "bytes": 3008043,
+      "sha256": "1bb6e8b18022977f43e29bd44d25238acbf8c424bd4bf736474fce74bd8de8bc"
+    },
+    "capsules/4e237aa6ba6359490d65efd40e15a697991ce53350af2080503c0635d2d9de3e.json": {
+      "bytes": 125475,
+      "sha256": "4e237aa6ba6359490d65efd40e15a697991ce53350af2080503c0635d2d9de3e"
+    },
+    "capsules/ae03a0a847a5c2000ba46e356e3dcd13a219e5fb699be8ad71a619b593e13c23.zip": {
+      "bytes": 3013577,
+      "sha256": "ae03a0a847a5c2000ba46e356e3dcd13a219e5fb699be8ad71a619b593e13c23"
+    },
+    "capsules/b471d434d8eac790ef7cc9073be0d395c9c9ad1472ba06a05b5818269ef03dfe.zip": {
+      "bytes": 3013606,
+      "sha256": "b471d434d8eac790ef7cc9073be0d395c9c9ad1472ba06a05b5818269ef03dfe"
+    },
+    "capsules/ce988ecaeaca395d0f120844db7e3da90d039633beef10d2d4a8b8f19e92ee27.json": {
+      "bytes": 125659,
+      "sha256": "ce988ecaeaca395d0f120844db7e3da90d039633beef10d2d4a8b8f19e92ee27"
+    },
+    "capsules/e41e7d1a2b9519b78730821f96c1bf7ca8431935fe67efa203daa80d3f15c437.json": {
+      "bytes": 125659,
+      "sha256": "e41e7d1a2b9519b78730821f96c1bf7ca8431935fe67efa203daa80d3f15c437"
+    },
+    "cargo/assignment-format-1/process.json": {
+      "bytes": 116,
+      "sha256": "ea332ddf4129442f2a8f19b150a6c2fc21a41299eadc32287ba6ba67769e2b58"
+    },
+    "cargo/assignment-format-1/result.json": {
+      "bytes": 1872,
+      "sha256": "46047bb39986083c89d12751153b678eedd660963b9dafb02c1738986f0dd47a"
+    },
+    "cargo/assignment-format-1/started.json": {
+      "bytes": 1484,
+      "sha256": "3657a2a7ac270bca405c128328557fb5e1725f913ae0c9c5baa1ba08269bb501"
+    },
+    "cargo/assignment-format-1/stderr.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "cargo/assignment-format-1/stdout.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "cargo/assignment-format-2/process.json": {
+      "bytes": 116,
+      "sha256": "8371d4a455f0dd7678c5b8fb91f679355c05f9f0594985460aee9796bd6adc65"
+    },
+    "cargo/assignment-format-2/result.json": {
+      "bytes": 1872,
+      "sha256": "319d67031a3f30f70b21f869d755b91196ce0be68d8132775288b3d86b223d06"
+    },
+    "cargo/assignment-format-2/source-proof.json": {
+      "bytes": 598,
+      "sha256": "41553cf5d5e5f6414930ad088fa82515630d3478da53a5ac961c8bf4191d1bc6"
+    },
+    "cargo/assignment-format-2/started.json": {
+      "bytes": 1483,
+      "sha256": "a59985096b89da3518c367131b3ec257596725d18f62307bfc174ccb7969c362"
+    },
+    "cargo/assignment-format-2/stderr.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "cargo/assignment-format-2/stdout.log": {
+      "bytes": 0,
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+    },
+    "cargo/assignment-lint-1/process.json": {
+      "bytes": 213,
+      "sha256": "b14d908c775b772f6993b40965a21ae894a406665fa5c2794ebfdb7ffe082769"
+    },
+    "cargo/assignment-lint-1/result.json": {
+      "bytes": 2006,
+      "sha256": "a8c6cc8a726c9bee821b2c12a0768d860bb1c40261783bcc23da2ea19a677959"
+    },
+    "cargo/assignment-lint-1/started.json": {
+      "bytes": 1610,
+      "sha256": "3f42270e22476b1698f19cfdc8cd6c78b0754480b613963d582d98d89bf541f6"
+    },
+    "cargo/assignment-lint-1/stderr.log": {
+      "bytes": 137,
+      "sha256": "d64f9789f0e3e22b0c98af77d19231a9026083ad317f6b2f989ebebd556f1269"
+    },
+    "cargo/assignment-lint-1/stdout.log": {
+      "bytes": 268845,
+      "sha256": "98a24be8306e586a1acb6a72c3e62005afc0db01fa4ec0b242c420aafadcf779"
+    },
+    "cargo/assignment-lint-2/process.json": {
+      "bytes": 212,
+      "sha256": "17b1f10f739cdf456da58ef2dcd9c15a8569132904876b8e2289ea543f1217d7"
+    },
+    "cargo/assignment-lint-2/result.json": {
+      "bytes": 2005,
+      "sha256": "ec3bc72c846cc08188ff95d38aa743c52ac9ec2c616fb8acb7566a6619490b68"
+    },
+    "cargo/assignment-lint-2/source-proof.json": {
+      "bytes": 596,
+      "sha256": "3a8f4d17bc6e696f8c0a1373f739650da5aa5b84683478c697e71b280d07b430"
+    },
+    "cargo/assignment-lint-2/started.json": {
+      "bytes": 1610,
+      "sha256": "afdad6e675e3351c749dccea6759c01f8b303a0d598f41592f62beecbc94fdf7"
+    },
+    "cargo/assignment-lint-2/stderr.log": {
+      "bytes": 137,
+      "sha256": "6ceb01ea1a2f7759c0f7e4fcc98504fae7f6f9cb758b16a2701f804c88ec401d"
+    },
+    "cargo/assignment-lint-2/stdout.log": {
+      "bytes": 268845,
+      "sha256": "8b993ec00e2a4a58b15af1e57051906cbee8d3d51f4314b71f71af28f582a675"
+    },
+    "cargo/assignment-planner-1/process.json": {
+      "bytes": 202,
+      "sha256": "1aec12d9a133576033cb736bdec098873005e8b248e09157a3e7608c2d551fdc"
+    },
+    "cargo/assignment-planner-1/result.json": {
+      "bytes": 3388,
+      "sha256": "b1bc1f3f3013c9df43f7af3cef801e0b977ec484457cfc314e4aa2f1c8d6db98"
+    },
+    "cargo/assignment-planner-1/started.json": {
+      "bytes": 1589,
+      "sha256": "75d0eeca99ff5f2819a0302cbdc739d2377a2f524890f448f040585288680d2e"
+    },
+    "cargo/assignment-planner-1/stderr.log": {
+      "bytes": 324,
+      "sha256": "8ee7484db45f8ddf1bf0057317feb689990758c35dc0946c12e0eef0de08e808"
+    },
+    "cargo/assignment-planner-1/stdout.log": {
+      "bytes": 301624,
+      "sha256": "7be201e6c1a812d8a32d73e75999e5e50a07af2f11eebc77f442aee44f64e5af"
+    },
+    "cargo/assignment-planner-2/process.json": {
+      "bytes": 202,
+      "sha256": "5837e6b91cbd5c6c95bbeaf08ac89a47149e84c4c3f20004457e80c316e388c9"
+    },
+    "cargo/assignment-planner-2/result.json": {
+      "bytes": 3387,
+      "sha256": "2dd1c6036eb805cd8e95050661e3dce9d132f9071186165097d4212f2b8253c0"
+    },
+    "cargo/assignment-planner-2/started.json": {
+      "bytes": 1589,
+      "sha256": "a4384901a0d3a29631a29d5e91b6d3dc944cefca1bb7653901d351a7bd906ec1"
+    },
+    "cargo/assignment-planner-2/stderr.log": {
+      "bytes": 324,
+      "sha256": "a046d75d45956402707b7c1089ec5005b0ba640857473e1f284a8f377f896f2c"
+    },
+    "cargo/assignment-planner-2/stdout.log": {
+      "bytes": 302839,
+      "sha256": "1905a2726b6e9c388566af75d7705b3916ade3a7d2c9dab772bffbb5b115762b"
+    },
+    "cargo/assignment-planner-3/process.json": {
+      "bytes": 202,
+      "sha256": "ec191e2d953d52f6da8c54bc6e9dfa5638273eb6c351823fc4871628320b3bab"
+    },
+    "cargo/assignment-planner-3/result.json": {
+      "bytes": 3388,
+      "sha256": "117bcfa31629682df708dfebb892464f01060888388ea680a231b12cd447db67"
+    },
+    "cargo/assignment-planner-3/source-proof.json": {
+      "bytes": 599,
+      "sha256": "3b249398b0ade218ec9737677e1021e21eae7aa03deeb6bc071e0e7e7fe6182b"
+    },
+    "cargo/assignment-planner-3/started.json": {
+      "bytes": 1589,
+      "sha256": "30cf725d9475a24b177c2dbddb3f59b7d298343556598bc0e760d51ad7e111e5"
+    },
+    "cargo/assignment-planner-3/stderr.log": {
+      "bytes": 324,
+      "sha256": "d3a0110134db80cd8715e6081027595056203feada2278053fdc62ae75c6df31"
+    },
+    "cargo/assignment-planner-3/stdout.log": {
+      "bytes": 302839,
+      "sha256": "aa832fe75c46be8990d0c679e6e321494c0ea6638657634010bae7022b7a2ee9"
+    },
+    "comparators/7805832d5f563ab2d7a50dd3de700792b5d6f459c68f7b1d8bcfcc9800fa0c3a.py": {
+      "bytes": 10094,
+      "sha256": "7805832d5f563ab2d7a50dd3de700792b5d6f459c68f7b1d8bcfcc9800fa0c3a"
+    },
+    "helpers/1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20.py": {
+      "bytes": 3827,
+      "sha256": "1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20"
+    },
+    "helpers/58597566ae1cb5c4021ddc7e86635b76d127bdb63b5d3026c427771aae7e2119.py": {
+      "bytes": 1399,
+      "sha256": "58597566ae1cb5c4021ddc7e86635b76d127bdb63b5d3026c427771aae7e2119"
+    }
+  }
+}

harness/allocation-assignment-evidence-20260923/checks/prepare.py

@@ -0,0 +1,110 @@
+"""Package explicitly selected closed gate captures without running Cargo."""
+from pathlib import Path
+import argparse
+import json
+import zipfile
+from verify import RAW_FILES, pin, parsed, need, run_name, verify_data, verify_package
+
+HERE = Path(__file__).resolve().parent
+
+
+def collect(root, runs, helpers, comparators=()):
+    gates = root / ".local/allocation-group-gates"
+    candidates = [gates / name for name in ("gate.py", "source-proof.py")] + helpers
+    helper_bytes = [path.read_bytes() for path in candidates]
+    comparator_paths = [root / ".local/process-source-evidence-tools/verify.py", *comparators]
+    comparator_bytes = [path.read_bytes() for path in comparator_paths if path.is_file()]
+    payload, logical, specs = {}, {}, {}
+    def add(name, data):
+        stored = ("capsules/" + pin(data)["sha256"] + Path(name).suffix
+                  if name.rsplit("/", 1)[1] in {"inputs.json", "inputs.zip"} else name)
+        need(stored not in payload or payload[stored] == data, "deduplication collision")
+        payload[stored] = data
+        logical[name] = stored
+    helper_catalog = {}
+    for name, data in zip(("gate.py", "source-proof.py"), helper_bytes):
+        helper = "helpers/" + pin(data)["sha256"] + ".py"
+        add(helper, data)
+        helper_catalog[name] = helper
+    for run in runs:
+        folder = gates / run
+        need(folder.is_dir(), "run directory missing: " + run)
+        paths = list(folder.iterdir())
+        names = {path.name for path in paths}
+        need(all(path.is_file() and not path.is_symlink() for path in paths)
+             and names in (RAW_FILES, RAW_FILES | {"source-proof.json"}), "exact closed raw files required: " + run)
+        raw = {path.name: path.read_bytes() for path in paths}
+        result = parsed(raw["result.json"])
+        need("finish" in result and result["inputsUnchanged"] is True, "unfinished/changed run refused: " + run)
+        matches = [data for data in helper_bytes if pin(data) == result["helper"]]
+        need(bool(matches), "exact historical helper unavailable for " + run + "; supply --helper PATH")
+        helper = "helpers/" + result["helper"]["sha256"] + ".py"
+        add(helper, matches[0])
+        for name, data in sorted(raw.items()):
+            add("cargo/" + run + "/" + name, data)
+        specs[run] = {key: result[key] for key in ("command", "head", "exitCode", "inputCount")}
+        specs[run]["helper"] = helper
+        if "source-proof.json" in raw:
+            proof = parsed(raw["source-proof.json"])
+            matches = [data for data in comparator_bytes if pin(data) == proof["comparator"]]
+            need(bool(matches), "exact source comparator unavailable for " + run + "; supply --comparator PATH")
+            comparator = "comparators/" + proof["comparator"]["sha256"] + ".py"
+            add(comparator, matches[0])
+            specs[run]["sourceProof"] = {"commit": proof["commit"], "pin": pin(raw["source-proof.json"]), "comparator": comparator}
+    manifest = {"schema": 1, "kind": "allocation-multiselect-cargo-gates", "runs": specs,
+                "captureHelpers": helper_catalog,
+                "logicalFiles": dict(sorted(logical.items())),
+                "members": {name: pin(data) for name, data in sorted(payload.items())}}
+    summary = verify_data(manifest, payload.__getitem__)
+    return payload, manifest, summary
+
+
+def write_json(path, value):
+    with path.open("xb") as output:
+        output.write((json.dumps(value, indent=2) + "\n").encode("utf-8"))
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--root", type=Path, required=True, help="checkout holding .local/allocation-group-gates")
+    parser.add_argument("--runs", nargs="+", required=True, help="explicit run names, including failures to retain")
+    parser.add_argument("--helper", type=Path, action="append", default=[], help="additional exact historical helper (repeatable)")
+    parser.add_argument("--comparator", type=Path, action="append", default=[], help="additional exact historical source comparator (repeatable)")
+    parser.add_argument("--output", type=Path, help="fresh, nonexistent package directory (required unless --check-only)")
+    parser.add_argument("--check-only", action="store_true", help="validate raw captures in memory without creating an archive")
+    args = parser.parse_args()
+    need(all(run_name(run) for run in args.runs) and len(args.runs) == len(set(args.runs)), "unique safe run names required")
+    need(args.check_only or args.output is not None, "--output is required unless --check-only")
+    if not args.check_only:
+        need(not args.output.exists(), "output must be a fresh directory: " + str(args.output))
+    payload, manifest, summary = collect(args.root.resolve(), args.runs, args.helper, args.comparator)
+    if args.check_only:
+        print("PASS raw consistency; no package written:", summary)
+        return
+    out = args.output.resolve()
+    out.mkdir(parents=True, exist_ok=False)
+    for name in ("evidence.zip", "manifest.json", "files.json"):
+        need(not (out / name).exists(), "existing package output refused: " + name)
+    for name in ("prepare.py", "verify.py", "README.md"):
+        data = (HERE / name).read_bytes()
+        destination = out / name
+        if destination.exists():
+            need(destination.read_bytes() == data, "different existing package tool: " + name)
+        else:
+            with destination.open("xb") as output:
+                output.write(data)
+    with zipfile.ZipFile(out / "evidence.zip", "x", compression=zipfile.ZIP_DEFLATED, compresslevel=9) as archive:
+        for name, data in sorted(payload.items()):
+            info = zipfile.ZipInfo(name, date_time=(2026, 9, 23, 0, 0, 0))
+            info.compress_type = zipfile.ZIP_DEFLATED
+            info.external_attr = 0o100644 << 16
+            archive.writestr(info, data)
+    write_json(out / "manifest.json", manifest)
+    names = ("prepare.py", "verify.py", "README.md", "manifest.json", "evidence.zip")
+    write_json(out / "files.json", {name: pin((out / name).read_bytes()) for name in names})
+    need(verify_package(out) == summary, "written package differs from validated captures")
+    print("PASS package readback:", out, summary)
+
+
+if __name__ == "__main__":
+    main()