Add Scenario sibling-block planner on integrated presentation model

crates/oa-core/src/language.rs

@@ -340,18 +340,6 @@ pub(crate) fn diagnostic(source: &str, error: Error) -> Diagnostic {
         },
     }
 }
-pub(crate) fn diagnostic_with_issue(
-    source: &str,
-    error: Error,
-    issue: Option<validation::Issue>,
-) -> Diagnostic {
-    let mut result = diagnostic(source, error);
-    if let Some(issue) = issue {
-        result.object_id = issue.element;
-        result.field = issue.field;
-    }
-    result
-}
 fn reserved(word: &str) -> bool {
     crate::reserved_alias(word)
         || declaration_kind(word).is_some()
@@ -634,7 +622,6 @@ fn parse_document(source: &str, limits: ParseLimits) -> Result<ParsedDocument, V
     if tokens.get(1).is_some_and(|t| t.text(source) == "2") {
         return v2_source::parse(source, tokens, limits);
     }
-    let mut migration_issue = None;
     Parser {
         source,
         tokens,
@@ -642,8 +629,8 @@ fn parse_document(source: &str, limits: ParseLimits) -> Result<ParsedDocument, V
         value_depth: 0,
         limits,
     }
-    .document(&mut migration_issue)
-    .map_err(|e| vec![diagnostic_with_issue(source, e, migration_issue)])
+    .document()
+    .map_err(|e| vec![diagnostic(source, e)])
 }
 fn offset_for(source: &str, line: usize, column: usize) -> usize {
     let mut offset = 0;
@@ -1462,10 +1449,7 @@ impl Parser<'_> {
             },
         }
     }
-    fn document(
-        &mut self,
-        migration_issue: &mut Option<validation::Issue>,
-    ) -> Result<ParsedDocument, Error> {
+    fn document(&mut self) -> Result<ParsedDocument, Error> {
         let unit = self.unit(true, false)?;
         let header = unit.header.expect("entry header");
         let mut aliases = BTreeMap::from([(header.project.alias.clone(), header.project.id)]);
@@ -1492,14 +1476,9 @@ impl Parser<'_> {
                     .map(|(key, span)| ((d.id, key.clone()), span.start)),
             );
         }
-        let decoded = resolve_declarations(
-            header.project,
-            &unit.declarations,
-            &aliases,
-            self.limits,
-            migration_issue,
-        )
-        .map_err(|(_, error)| error)?;
+        let decoded =
+            resolve_declarations(header.project, &unit.declarations, &aliases, self.limits)
+                .map_err(|(_, error)| error)?;
         Ok(ParsedDocument {
             project: decoded.project,
             migration: decoded.migration,
@@ -1703,7 +1682,6 @@ pub(crate) fn resolve_declarations(
     declarations: &[Declaration],
     aliases: &BTreeMap<String, Id>,
     limits: ParseLimits,
-    migration_issue: &mut Option<validation::Issue>,
 ) -> Result<crate::persistence::DecodeResult, (usize, Error)> {
     let legacy = project.schema_version == 3;
     let mut legacy_elements = serde_json::Map::new();
@@ -2011,38 +1989,6 @@ pub(crate) fn resolve_declarations(
             crate::persistence::migrate_v6(project, limits)
         })
         .map_err(|error| {
-            // These frozen admission checks formerly ran in final validation.
-            // Keep their diagnostic code and reference location after moving
-            // them before schema normalization.
-            if let crate::persistence::FileError::Model { issues, .. } = &error
-                && let Some(issue) = issues.first()
-                && let Some(code) = match issue.code.as_str() {
-                    "diagram_layer" => Some("diagram_layer"),
-                    "view_options" => Some("view_options"),
-                    _ => None,
-                }
-            {
-                let index = issue
-                    .element
-                    .and_then(|id| declarations.iter().position(|d| d.id == id))
-                    .unwrap_or(usize::MAX);
-                let offset = declarations.get(index).map_or(0, |d| {
-                    issue
-                        .field
-                        .as_ref()
-                        .and_then(|field| d.field_spans.get(field))
-                        .map_or(d.offset, |span| span.start)
-                });
-                *migration_issue = Some(issue.clone());
-                return (
-                    index,
-                    Error {
-                        code,
-                        offset,
-                        message: issue.message.clone(),
-                    },
-                );
-            }
             (
                 usize::MAX,
                 Error {

crates/oa-core/src/migration_v4.rs

@@ -69,8 +69,8 @@ impl Project4 {
         }
         crate::persistence::check_pre6_relations(self.relations.values())?;
         crate::persistence::check_pre6_elements(self.elements.values())?;
-        let mut project = Project {
-            schema_version: self.schema_version,
+        Ok(Project {
+            schema_version: SCHEMA_VERSION,
             id: self.id,
             alias: self.alias,
             name: self.name,
@@ -84,11 +84,7 @@ impl Project4 {
                 .into_iter()
                 .map(|(id, trace)| (id, trace.into()))
                 .collect(),
-        };
-        // Schema3's adapter also enters here, without calling `finish`.
-        crate::persistence::check_pre7_diagram_admission(&project)?;
-        project.schema_version = SCHEMA_VERSION;
-        Ok(project)
+        })
     }
 }
 
@@ -108,8 +104,6 @@ pub(crate) fn review_defaults(project: &Project, report: &mut MigrationReport) {
 }
 
 pub(crate) fn finish(mut project: Project, limits: ParseLimits) -> Result<DecodeResult, FileError> {
-    // Source4 enters here directly rather than through `Project4`.
-    crate::persistence::check_pre7_diagram_admission(&project)?;
     crate::persistence::check_pre6_relations(project.relations.values())?;
     crate::persistence::check_pre6_elements(project.elements.values())?;
     project.schema_version = SCHEMA_VERSION;

crates/oa-core/src/persistence.rs

@@ -341,50 +341,6 @@ pub(crate) fn check_pre6_baseline(baseline: &SemanticBaseline) -> Result<(), Fil
     }
     Ok(())
 }
-/// Frozen sources 3–6 admit opposite-layer placements and visibility references
-/// only in Traceability. Check before migration discards the advertised version;
-/// current ordinary projections may retain these records as latent presentation.
-pub(crate) fn check_pre7_diagram_admission(project: &Project) -> Result<(), FileError> {
-    let mut issues = Vec::new();
-    for diagram in project.diagrams.values() {
-        let option_issues = if diagram.projection == ProjectionKind::Traceability {
-            crate::view_options::validate_options_cross_layer(project, &diagram.view_options)
-        } else {
-            crate::view_options::validate_options(project, diagram.layer, &diagram.view_options)
-        };
-        for issue in option_issues {
-            validation::error(
-                &mut issues,
-                diagram.id,
-                "view_options",
-                issue.field,
-                issue.message,
-            );
-        }
-        for node in diagram.nodes.values() {
-            if !project.elements.get(&node.element).is_some_and(|element| {
-                diagram.projection == ProjectionKind::Traceability
-                    || element.layer() == diagram.layer
-            }) {
-                validation::error(
-                    &mut issues,
-                    node.id,
-                    "diagram_layer",
-                    "element",
-                    "Diagram nodes reference existing elements in the selected layer.",
-                );
-            }
-        }
-    }
-    if let Some(issue) = issues.into_iter().next() {
-        return Err(FileError::Model {
-            message: issue.message.clone(),
-            issues: vec![issue],
-        });
-    }
-    Ok(())
-}
-
 pub(crate) fn migrate_v5(
     mut project: Project,
     limits: crate::language::ParseLimits,
@@ -392,7 +348,6 @@ pub(crate) fn migrate_v5(
     if project.schema_version != 5 {
         return Err(FileError::Invalid("Expected schema_version 5.".into()));
     }
-    check_pre7_diagram_admission(&project)?;
     check_pre6_relations(project.relations.values())?;
     check_pre6_elements(project.elements.values())?;
     for baseline in project
@@ -465,7 +420,6 @@ pub(crate) fn migrate_v6(
     if project.schema_version != 6 {
         return Err(FileError::Invalid("Expected schema_version 6.".into()));
     }
-    check_pre7_diagram_admission(&project)?;
     reject_source7_fields(&serde_json::to_value(&project)?).map_err(FileError::Invalid)?;
     limits.check_model(&project).map_err(FileError::Limit)?;
     project.schema_version = SCHEMA_VERSION;

crates/oa-core/src/projection.rs

@@ -85,7 +85,6 @@ pub(crate) fn parents(p: &Project, d: &Diagram) -> BTreeMap<Id, Option<Id>> {
         .filter(|n| {
             p.elements.get(&n.element).is_some_and(|e| {
                 e.kind() != Kind::Port
-                    && (d.projection == ProjectionKind::Traceability || e.layer() == d.layer)
                     && d.projection.includes(e.kind())
                     && d.projection
                         .state_machine()

crates/oa-core/src/session.rs

@@ -589,17 +589,6 @@ fn apply_command(
                 .map(|d| d.id)
                 .ok_or_else(missing)?;
             if source != *diagram {
-                let destination = &p.diagrams[diagram];
-                let element = p.diagrams[&source].nodes[node].element;
-                if destination.projection != ProjectionKind::Traceability
-                    && p.elements
-                        .get(&element)
-                        .is_none_or(|e| e.layer() != destination.layer)
-                {
-                    return Err(ModelError(
-                        "Move the placement to a view in its layer or a traceability view.".into(),
-                    ));
-                }
                 let placement = p
                     .diagrams
                     .get_mut(&source)

crates/oa-core/src/source_project.rs

@@ -573,26 +573,16 @@ fn compile_once(
             span,
         }),
     };
-    let mut migration_issue = None;
-    let decoded = language::resolve_declarations(
-        header.project,
-        &declarations,
-        &aliases,
-        limits.model,
-        &mut migration_issue,
-    )
-    .map_err(|(index, error)| {
-        let path = declaration_paths.get(index).unwrap_or(&bundle.entry);
-        vec![SourceDiagnostic {
-            path: path.clone(),
-            diagnostic: language::diagnostic_with_issue(
-                &bundle.files[path],
-                error,
-                migration_issue,
-            ),
-            related: Vec::new(),
-        }]
-    })?;
+    let decoded =
+        language::resolve_declarations(header.project, &declarations, &aliases, limits.model)
+            .map_err(|(index, error)| {
+                let path = declaration_paths.get(index).unwrap_or(&bundle.entry);
+                vec![SourceDiagnostic {
+                    path: path.clone(),
+                    diagnostic: language::diagnostic(&bundle.files[path], error),
+                    related: Vec::new(),
+                }]
+            })?;
     let diagnostics = model_diagnostics(bundle, &index, &decoded.project);
     let errors: Vec<_> = diagnostics
         .iter()

crates/oa-core/src/validation.rs

@@ -620,14 +620,11 @@ pub fn validate(p: &Project) -> Vec<Issue> {
         text(&mut out, d.id, "name", &d.name);
         text(&mut out, d.id, "description", &d.description);
         crate::scenario_layout::validate_diagram(p, d, &mut out);
-        // Ordinary projections are reversible filters over the same authored view.
-        // Retain opposite-layer visibility choices when leaving Traceability.
-        let option_issues =
-            if d.projection.state_machine().is_none() && d.projection.scenario().is_none() {
-                crate::view_options::validate_options_cross_layer(p, &d.view_options)
-            } else {
-                crate::view_options::validate_options(p, d.layer, &d.view_options)
-            };
+        let option_issues = if d.projection == ProjectionKind::Traceability {
+            crate::view_options::validate_options_cross_layer(p, &d.view_options)
+        } else {
+            crate::view_options::validate_options(p, d.layer, &d.view_options)
+        };
         for issue in option_issues {
             error(&mut out, d.id, "view_options", issue.field, issue.message);
         }
@@ -801,10 +798,8 @@ pub fn validate(p: &Project) -> Vec<Issue> {
                 );
             }
             match p.elements.get(&n.element) {
-                Some(e)
-                    if (d.projection.state_machine().is_none()
-                        && d.projection.scenario().is_none())
-                        || e.layer() == d.layer => {}
+                Some(e) if d.projection == ProjectionKind::Traceability || e.layer() == d.layer => {
+                }
                 _ => error(
                     &mut out,
                     n.id,

crates/oa-core/src/view_options.rs

@@ -218,9 +218,7 @@ pub fn validate_options(p: &Project, layer: Layer, options: &ViewOptions) -> Vec
     validate_options_in(p, Some(layer), options)
 }
 
-/// Ordinary saved views retain references from either architecture layer so
-/// projection changes preserve authored visibility choices. Projection decides
-/// which layer is visible; typed State/Scenario views use layer-scoped validation.
+/// Traceability views admit references from either architecture layer.
 pub fn validate_options_cross_layer(p: &Project, options: &ViewOptions) -> Vec<OptionError> {
     validate_options_in(p, None, options)
 }

crates/oa-core/tests/legacy_diagram_admission.rs

@@ -1,205 +0,0 @@
-//! Current latent presentation must not broaden frozen source/JSON admission.
-use oa_core::{view_options::*, *};
-
-fn legacy_json(project: &Project, version: u32) -> Vec<u8> {
-    let mut value = serde_json::to_value(project).unwrap();
-    value["schema_version"] = version.into();
-    for diagram in value["diagrams"].as_object_mut().unwrap().values_mut() {
-        let fields = diagram.as_object_mut().unwrap();
-        fields.remove("layout");
-        if version < 6 {
-            fields.remove("view_options");
-        }
-    }
-    serde_json::to_vec(&value).unwrap()
-}
-
-fn model_issue(error: persistence::FileError) -> validation::Issue {
-    match error {
-        persistence::FileError::Model { mut issues, .. } => issues.remove(0),
-        other => panic!("Expected a located model issue, got {other:?}"),
-    }
-}
-
-#[test]
-fn frozen_3_through_6_reject_cross_layer_nodes_but_keep_mixed_traceability() {
-    let node_id = Id::parse_str("00000000-0000-4000-8000-000000000004").unwrap();
-    for version in 3..=6 {
-        let source = format!(
-            "arcadia {version}; project compat \"Compatibility\" id \"00000000-0000-4000-8000-000000000001\" {{\n\
-             sa_function work \"Counterpart\" id \"00000000-0000-4000-8000-000000000002\" {{}}\n\
-             diagram view \"OA concern\" id \"00000000-0000-4000-8000-000000000003\" {{ layer Oa; projection Traceability; }}\n\
-             node occurrence id \"00000000-0000-4000-8000-000000000004\" {{ diagram @view; element @work; }}\n}}"
-        );
-        let mixed = language::parse(&source).unwrap();
-        assert_eq!(
-            persistence::decode(&legacy_json(&mixed, version)).unwrap(),
-            mixed
-        );
-
-        let ordinary = source.replace("projection Traceability", "projection Overview");
-        let same_layer = ordinary.replace("layer Oa", "layer Sa");
-        let ordinary_project = language::parse(&same_layer).unwrap();
-        assert_eq!(
-            persistence::decode(&legacy_json(&ordinary_project, version)).unwrap(),
-            ordinary_project
-        );
-        let errors = language::parse(&ordinary).unwrap_err();
-        // Source3 already reported migration errors with the offending location.
-        let code = if version == 3 {
-            "migration_error"
-        } else {
-            "diagram_layer"
-        };
-        assert!(
-            errors.iter().any(|error| error.code == code
-                && error.line == 4
-                && error.message.contains("selected layer")),
-            "{version}: {errors:?}"
-        );
-
-        let mut latent = mixed.clone();
-        let diagram = latent.diagrams.values_mut().next().unwrap();
-        diagram.projection = ProjectionKind::Overview;
-        let node = diagram.nodes.values().next().unwrap().id;
-        assert_eq!(node, node_id);
-        if version >= 4 {
-            let diagnostic = errors
-                .iter()
-                .find(|error| error.code == "diagram_layer")
-                .unwrap();
-            assert_eq!(diagnostic.object_id, Some(node_id));
-            assert_eq!(diagnostic.field.as_deref(), Some("element"));
-            let bundle = source_project::SourceBundle {
-                entry: "model.arcadia".into(),
-                files: std::collections::BTreeMap::from([("model.arcadia".into(), ordinary)]),
-            };
-            let errors =
-                source_project::compile_bundle(&bundle, source_project::ProjectLimits::default())
-                    .unwrap_err();
-            let diagnostic = &errors
-                .iter()
-                .find(|error| error.diagnostic.code == "diagram_layer")
-                .unwrap()
-                .diagnostic;
-            assert_eq!(diagnostic.object_id, Some(node_id));
-            assert_eq!(diagnostic.field.as_deref(), Some("element"));
-        }
-        let issue = model_issue(persistence::decode(&legacy_json(&latent, version)).unwrap_err());
-        assert_eq!(issue.code, "diagram_layer");
-        assert_eq!(issue.element, Some(node));
-        assert_eq!(issue.field.as_deref(), Some("element"));
-        // The exact same record is valid under the current presentation contract.
-        assert_eq!(language::parse(&language::format(&latent)).unwrap(), latent);
-        assert_eq!(
-            persistence::decode(&serde_json::to_vec(&latent).unwrap()).unwrap(),
-            latent
-        );
-        let mut dangling = mixed;
-        dangling
-            .diagrams
-            .values_mut()
-            .next()
-            .unwrap()
-            .nodes
-            .values_mut()
-            .next()
-            .unwrap()
-            .element = Id::parse_str("00000000-0000-4000-8000-000000000005").unwrap();
-        let issue = model_issue(persistence::decode(&legacy_json(&dangling, version)).unwrap_err());
-        assert_eq!(issue.code, "diagram_layer");
-        assert_eq!(issue.element, Some(node));
-        assert_eq!(issue.field.as_deref(), Some("element"));
-    }
-}
-
-#[test]
-fn frozen_6_checks_every_layer_sensitive_saved_selector_before_upgrade() {
-    let mut project = Project::empty();
-    let a = project
-        .add_element(Kind::Activity, Layer::Oa, "A", None)
-        .unwrap();
-    let b = project
-        .add_element(Kind::Activity, Layer::Oa, "B", None)
-        .unwrap();
-    let edge = project.relate(RelationKind::Interaction, "Interaction", a, b);
-    let category = project
-        .add_element(Kind::ExchangeCategory, Layer::Oa, "Work category", None)
-        .unwrap();
-    let participant_category = project
-        .add_element(
-            Kind::ExchangeCategory,
-            Layer::Oa,
-            "Participant category",
-            None,
-        )
-        .unwrap();
-    *project
-        .elements
-        .get_mut(&participant_category)
-        .unwrap()
-        .shared_mut()
-        .unwrap() = SharedBody::ExchangeCategory {
-        family: ExchangeFamily::Participant,
-        exchanges: vec![],
-    };
-    let context = project
-        .add_element(Kind::Process, Layer::Oa, "Process", None)
-        .unwrap();
-    let diagram = project.ensure_diagram(Layer::Sa);
-    for (field, options) in [
-        (
-            "hidden_edges",
-            ViewOptions {
-                hidden_edges: vec![edge],
-                ..Default::default()
-            },
-        ),
-        (
-            "work_categories",
-            ViewOptions {
-                work_categories: CategorySelection::Any(vec![category]),
-                ..Default::default()
-            },
-        ),
-        (
-            "participant_categories",
-            ViewOptions {
-                participant_categories: CategorySelection::Any(vec![participant_category]),
-                ..Default::default()
-            },
-        ),
-        (
-            "work_contexts",
-            ViewOptions {
-                work_contexts: ContextSelection::Any(vec![context]),
-                ..Default::default()
-            },
-        ),
-    ] {
-        project.diagrams.get_mut(&diagram).unwrap().view_options = options;
-        let issue = model_issue(persistence::decode(&legacy_json(&project, 6)).unwrap_err());
-        assert_eq!(issue.code, "view_options");
-        assert_eq!(issue.element, Some(diagram));
-        assert_eq!(issue.field.as_deref(), Some(field));
-        let current_source = language::format(&project);
-        assert_eq!(language::parse(&current_source).unwrap(), project);
-        let source6 = current_source.replacen("arcadia 7;", "arcadia 6;", 1);
-        let errors = language::parse(&source6).unwrap_err();
-        let diagnostic = errors
-            .iter()
-            .find(|error| error.code == "view_options")
-            .unwrap();
-        assert_eq!(diagnostic.object_id, Some(diagram));
-        assert_eq!(diagnostic.field.as_deref(), Some(field));
-
-        project.diagrams.get_mut(&diagram).unwrap().projection = ProjectionKind::Traceability;
-        assert_eq!(
-            persistence::decode(&legacy_json(&project, 6)).unwrap(),
-            project
-        );
-        let source6 = language::format(&project).replacen("arcadia 7;", "arcadia 6;", 1);
-        assert_eq!(language::parse(&source6).unwrap(), project);
-        project.diagrams.get_mut(&diagram).unwrap().projection = ProjectionKind::Overview;
-    }
-}

crates/oa-core/tests/projection_switching.rs

@@ -1,156 +0,0 @@
-use oa_core::{source_project::*, view_options::*, *};
-
-fn fixture(layer: Layer) -> (Project, Id, Id, Id, Id) {
-    let mut p = Project::empty();
-    let oa = p
-        .add_element(Kind::Activity, Layer::Oa, "Assess alarm", None)
-        .unwrap();
-    let oa2 = p
-        .add_element(Kind::Activity, Layer::Oa, "Respond", None)
-        .unwrap();
-    let sa = p
-        .add_element(Kind::Function, Layer::Sa, "Assess alarm", None)
-        .unwrap();
-    let edge = p.relate(RelationKind::Interaction, "Alarm", oa, oa2);
-    let category = p
-        .add_element(Kind::ExchangeCategory, Layer::Oa, "Alarm data", None)
-        .unwrap();
-    *p.elements.get_mut(&category).unwrap().shared_mut().unwrap() = SharedBody::ExchangeCategory {
-        family: ExchangeFamily::Work,
-        exchanges: vec![edge],
-    };
-    let context = p
-        .add_element(Kind::Process, Layer::Oa, "Alarm handling", None)
-        .unwrap();
-    let d = p.ensure_diagram(layer);
-    p.diagrams.get_mut(&d).unwrap().projection = ProjectionKind::Traceability;
-    for (i, element) in [oa, oa2, sa].into_iter().enumerate() {
-        p.place(
-            d,
-            element,
-            Position {
-                x: 300. * i as f32,
-                y: 40.,
-            },
-        );
-    }
-    p.diagrams.get_mut(&d).unwrap().view_options = ViewOptions {
-        hidden_edges: vec![edge],
-        work_categories: CategorySelection::Any(vec![category]),
-        work_contexts: ContextSelection::Any(vec![context]),
-        ..Default::default()
-    };
-    validate_candidate(&p).unwrap();
-    (p, d, oa, sa, category)
-}
-
-#[test]
-fn projection_switching_preserves_complete_model_history_and_all_serializations() {
-    for layer in [Layer::Oa, Layer::Sa] {
-        let (baseline, diagram, _, _, _) = fixture(layer);
-        for projection in [
-            ProjectionKind::Overview,
-            ProjectionKind::Decomposition,
-            ProjectionKind::Allocation,
-            ProjectionKind::FunctionalDataflow,
-            ProjectionKind::Capabilities,
-        ] {
-            let mut expected = baseline.clone();
-            expected.diagrams.get_mut(&diagram).unwrap().projection = projection;
-            let mut session = Session::new(baseline.clone());
-            session
-                .execute(Command::EditDiagram(
-                    diagram,
-                    expected.diagrams[&diagram].clone(),
-                ))
-                .unwrap();
-            assert_eq!(session.project(), &expected);
-            let view = projection::project_view(session.project(), diagram);
-            assert!(
-                view.nodes
-                    .iter()
-                    .all(|n| expected.elements[&n.element].layer() == layer)
-            );
-            assert_eq!(
-                view,
-                projection::project_view_with_index(&expected, diagram, &ViewIndex::new(&expected))
-            );
-            let source = language::format(&expected);
-            assert_eq!(language::parse(&source).unwrap(), expected);
-            assert_eq!(
-                persistence::decode(&serde_json::to_vec(&expected).unwrap()).unwrap(),
-                expected
-            );
-            let bundle = format_bundle(&expected);
-            assert_eq!(
-                compile_bundle(&bundle, ProjectLimits::default())
-                    .unwrap()
-                    .decoded
-                    .project,
-                expected
-            );
-            session.undo();
-            assert_eq!(session.project(), &baseline);
-            assert!(!session.can_undo());
-            session.redo();
-            assert_eq!(session.project(), &expected);
-            session
-                .execute(Command::EditDiagram(
-                    diagram,
-                    baseline.diagrams[&diagram].clone(),
-                ))
-                .unwrap();
-            assert_eq!(session.project(), &baseline);
-            assert_eq!(
-                projection::project_view(session.project(), diagram),
-                projection::project_view(&baseline, diagram)
-            );
-        }
-    }
-}
-
-#[test]
-fn projection_switching_does_not_admit_missing_elements_or_invalid_filter_kinds() {
-    let (mut p, d, oa, _, category) = fixture(Layer::Sa);
-    p.diagrams.get_mut(&d).unwrap().projection = ProjectionKind::Allocation;
-    validate_candidate(&p).unwrap();
-    let valid = p.clone();
-    let node = p.diagrams[&d]
-        .nodes
-        .values()
-        .find(|n| n.element == oa)
-        .unwrap()
-        .id;
-    p.diagrams
-        .get_mut(&d)
-        .unwrap()
-        .nodes
-        .get_mut(&node)
-        .unwrap()
-        .element = Id::new_v4();
-    assert!(validate_candidate(&p).is_err());
-    p = valid.clone();
-    p.diagrams.get_mut(&d).unwrap().view_options.work_categories = CategorySelection::Any(vec![oa]);
-    assert!(validate_candidate(&p).is_err());
-    p = valid;
-    p.elements.remove(&category);
-    assert!(validate_candidate(&p).is_err());
-}
-
-#[test]
-fn projection_switching_keeps_typed_state_membership_strict() {
-    let (mut p, d, _, _, _) = fixture(Layer::Sa);
-    let system = p
-        .add_element(Kind::System, Layer::Sa, "System", None)
-        .unwrap();
-    let machine = p
-        .add_element(Kind::StateMachine, Layer::Sa, "Modes", Some(system))
-        .unwrap();
-    p.diagrams.get_mut(&d).unwrap().projection = ProjectionKind::StateMachine { machine };
-    assert!(
-        validation::validate(&p)
-            .iter()
-            .any(|i| i.code == "state_diagram_member")
-    );
-    assert!(validate_candidate(&p).is_err());
-}

crates/oa-core/tests/source6_view_contract.rs

@@ -67,18 +67,7 @@ fn source6_traceability_default_keeps_both_layers_and_indexed_projection_matches
             .any(|e| e.id == interaction)
     );
     p.diagrams.get_mut(&d).unwrap().projection = ProjectionKind::Overview;
-    validate_candidate(&p).unwrap();
-    let ordinary = projection::project_view_with_index(&p, d, &index);
-    assert!(
-        ordinary
-            .nodes
-            .iter()
-            .all(|n| p.elements[&n.element].layer() == Layer::Oa)
-    );
-    assert!(ordinary.edges.iter().any(|e| e.id == interaction));
-    assert!(!ordinary.edges.iter().any(|e| e.id == fe));
-    assert_eq!(p.diagrams[&d].nodes.len(), 4);
-    assert_eq!(p.diagrams[&d].view_options.hidden_edges, vec![fe]);
+    assert!(validate_candidate(&p).is_err());
     p.diagrams.get_mut(&d).unwrap().projection = ProjectionKind::Traceability;
     p.diagrams.get_mut(&d).unwrap().view_options.relation_kinds = RelationKinds::Only(vec![]);
     assert!(

crates/oa-desktop/src/app.rs

@@ -4,8 +4,6 @@ pub(crate) mod architecture_authoring;
 mod architecture_authoring_tests;
 #[cfg(test)]
 mod behavior_removal_tests;
-#[cfg(test)]
-mod canvas_selection_tests;
 mod checkpoints;
 #[cfg(test)]
 mod diagram_focus_tests;
@@ -383,7 +381,6 @@ pub enum Message {
     Behavior(crate::behavior::Event),
     Layer(Layer),
     Select(Id),
-    CanvasSelect(crate::route_edit::Context, Id),
     EditProperties(Id),
     SelectNode(Id),
     DiagramSelection(multiselect::Event),
@@ -1174,13 +1171,7 @@ impl App {
         if id != self.selected {
             self.selected_attachment = None;
         }
-        if self.selected == id
-            && !process_preview
-            && self
-                .project()
-                .layer_of(id)
-                .is_none_or(|layer| layer == self.layer)
-        {
+        if self.selected == id && !process_preview {
             return;
         }
         if !self.apply() {
@@ -1226,24 +1217,6 @@ impl App {
         }
         self.refresh_draft();
     }
-    /// Inspect an already validated canvas target without following its model layer.
-    fn inspect_canvas_target(&mut self, id: Id) -> bool {
-        if self.selected == id {
-            return true;
-        }
-        if !self.project().contains(id) || !self.apply() {
-            return false;
-        }
-        if !self.project().contains(id) {
-            return false;
-        }
-        self.selected = id;
-        self.selected_node = None;
-        self.selected_attachment = None;
-        self.selected_bend = None;
-        self.refresh_draft();
-        true
-    }
     fn reveal_explorer_selection(&mut self) {
         if let Some(group) = self.explorer_index.group(self.selected) {
             self.explorer_groups_collapsed.remove(&group);
@@ -1390,11 +1363,6 @@ impl App {
         {
             return Task::none();
         }
-        if let Message::CanvasSelect(captured, _) = &message
-            && (self.page != Page::Diagram || self.route_context() != Some(*captured))
-        {
-            return Task::none();
-        }
         // Selection can change without advancing the captured canvas context.
         if let Message::Route(
             crate::route_edit::Event::Commit(captured, changed, ..)
@@ -2150,7 +2118,6 @@ impl App {
             Message::Command(Command::Layout(diagram)) => self.saved_scenario_diagram(*diagram),
             Message::Projection(projection) => active || projection.scenario().is_some(),
             Message::SelectNode(_)
-            | Message::CanvasSelect(..)
             | Message::PlaceSelected
             | Message::HideSelected
             | Message::ToggleCollapse
@@ -2751,10 +2718,10 @@ impl App {
                                         e.kind() != Kind::Port && d.projection.includes(e.kind())
                                     })
                         });
-                if show_in_mixed_view || menu.request.canvas.is_some() {
-                    if !self.inspect_canvas_target(menu.request.object) {
-                        return Task::none();
-                    }
+                if show_in_mixed_view {
+                    self.selected = menu.request.object;
+                    self.selected_attachment = None;
+                    self.refresh_draft();
                 } else {
                     self.select(menu.request.object);
                 }
@@ -2766,15 +2733,7 @@ impl App {
                 }
                 self.reconcile_multiselect();
                 self.selected_bend = menu.request.bend.map(|i| (menu.request.object, i));
-                let action = match *action {
-                    Message::EditProperties(id)
-                        if menu.request.canvas.is_some() && id == menu.request.object =>
-                    {
-                        Message::InspectorTab(crate::navigation::InspectorTab::Properties)
-                    }
-                    action => action,
-                };
-                return self.update(action);
+                return self.update(*action);
             }
             Message::CreateContextElement(kind, child) => {
                 self.create_kind = kind;
@@ -2930,14 +2889,6 @@ impl App {
                 self.status = "Property draft reverted".into();
             }
             Message::Select(id) => self.select(id),
-            Message::CanvasSelect(context, id) => {
-                let view = project_view(self.project(), context.diagram);
-                if view.ports.iter().any(|port| port.element == id)
-                    || view.edges.iter().any(|edge| edge.id == id)
-                {
-                    self.inspect_canvas_target(id);
-                }
-            }
             Message::DiagramSelection(event) => self.multiselect_event(event),
             Message::EditProperties(id) => {
                 self.select(id);
@@ -3385,7 +3336,7 @@ impl App {
                     self.workflow = Some(crate::workflow::Workflow::relationship_kind(
                         self.project(),
                         self.selected,
-                        self.project().layer_of(self.selected).unwrap_or(self.layer),
+                        self.layer,
                         kind,
                         incoming,
                     ));
@@ -4411,18 +4362,13 @@ impl App {
             self.status = "Select an SA function or participant, then choose a typed port action in Properties.".into();
             return;
         }
-        let creation_layer = if child {
-            self.project().layer_of(self.selected).unwrap_or(self.layer)
-        } else {
-            self.layer
-        };
         let allocated = child
             && self.create_kind.is_work()
             && self
                 .project()
                 .elements
                 .get(&self.selected)
-                .is_some_and(|e| e.layer() == creation_layer && e.kind().is_performer());
+                .is_some_and(|e| e.layer() == self.layer && e.kind().is_performer());
         let parent = if child && !allocated {
             Some(self.selected)
         } else {
@@ -4430,7 +4376,7 @@ impl App {
         };
         let Some(e) = self.project().make_element(
             self.create_kind,
-            creation_layer,
+            self.layer,
             &format!("New {}", self.create_kind.label().to_lowercase()),
             parent,
         ) else {
@@ -4459,16 +4405,16 @@ impl App {
                 .project()
                 .diagrams
                 .values()
-                .find(|d| d.layer == creation_layer && d.projection == preferred)
+                .find(|d| d.layer == self.layer && d.projection == preferred)
                 .map(|d| d.id);
             if diagram_target.is_none() {
                 let view = Id::new_v4();
                 commands.push(Command::CreateDiagram(Diagram {
                     id: view,
                     alias: self.project().fresh_alias("engineering_view", "view", view),
-                    name: format!("{} {preferred}", creation_layer),
+                    name: format!("{} {preferred}", self.layer),
                     description: String::new(),
-                    layer: creation_layer,
+                    layer: self.layer,
                     projection: preferred,
                     layout: None,
                     routes: Vec::new(),
@@ -4601,13 +4547,7 @@ impl App {
             ));
         }
         if self.execute(Command::Batch(commands)) {
-            let changed_view = self.active_diagram != diagram_target;
             self.active_diagram = diagram_target;
-            if changed_view
-                && let Some(view) = diagram_target.and_then(|id| self.project().diagrams.get(&id))
-            {
-                self.layer = view.layer;
-            }
             self.selected = id;
             self.inspector_tab = crate::navigation::InspectorTab::Properties;
             self.refresh_draft();
@@ -4621,7 +4561,7 @@ impl App {
         self.workflow = Some(crate::workflow::Workflow::relationship(
             self.project(),
             self.selected,
-            self.project().layer_of(self.selected).unwrap_or(self.layer),
+            self.layer,
         ));
     }
     fn add_trace(&mut self) {
@@ -5146,9 +5086,17 @@ impl App {
                         &project_view(self.project(), context.diagram),
                         id,
                     );
-                    if !self.inspect_canvas_target(id) {
-                        self.connection = Some(session);
-                        return;
+                    if session.tool == crate::connection_tool::Tool::Allocation
+                        && self.project().diagrams[&context.diagram].projection
+                            == ProjectionKind::Traceability
+                    {
+                        // Mixed views can allocate either perspective. Choosing
+                        // a visible source must not navigate to its preferred view.
+                        self.selected = id;
+                        self.selected_attachment = None;
+                        self.refresh_draft();
+                    } else {
+                        self.select(id);
                     }
                     self.status = if session.candidates.is_empty() {
                         "No compatible targets are visible. Expand containers or show a compatible endpoint in this view; Esc cancels drawing.".into()

crates/oa-desktop/src/app/allocation_drag_full_tree_tests.rs

@@ -89,10 +89,7 @@ async fn refused_click_keeps_field(mounted: &mut Mounted, f: &mut Fixture, field
     );
     assert!(!messages.iter().any(|m| matches!(
         m,
-        Message::Select(_)
-            | Message::CanvasSelect(..)
-            | Message::SelectNode(_)
-            | Message::MoveNode(..)
+        Message::Select(_) | Message::SelectNode(_) | Message::MoveNode(..)
     )));
     assert_eq!(f.app.document.bundle(), &before);
     assert_eq!((f.app.selected, f.app.selected_node), selected);

crates/oa-desktop/src/app/allocation_drag_tests.rs

@@ -237,10 +237,7 @@ fn mounted_dirty_property_press_does_not_select_apply_or_destroy_draft() {
         ));
         assert!(!events.iter().any(|m| matches!(
             m,
-            Message::Select(_)
-                | Message::CanvasSelect(..)
-                | Message::SelectNode(_)
-                | Message::MoveNode(..)
+            Message::Select(_) | Message::SelectNode(_) | Message::MoveNode(..)
         )));
         send(&mut f.app, events);
         assert_eq!((f.app.selected, f.app.selected_node), selection);

crates/oa-desktop/src/app/allocation_drag_tests/group.rs

@@ -1,7 +1,6 @@
 use super::*;
 use crate::app::multiselect::{self, Choice};
 use crate::diagram_usage::Target as SelectionTarget;
-use iced::widget::text_editor;
 
 #[path = "group/connection_lifetime.rs"]
 mod connection_lifetime;

crates/oa-desktop/src/app/architecture_authoring/palette.rs

@@ -1,6 +1,5 @@
 //! Compact neutral tool palette. Tool state never changes its allocated width.
 use super::*;
-use crate::connection_tool::Tool;
 use iced::{
     Point, Rectangle, Size, Theme, mouse,
     widget::{
@@ -12,7 +11,7 @@ use iced::{
 #[derive(Clone, Copy)]
 enum Icon {
     Element(Kind),
-    Connection(Tool),
+    Arrow,
     Existing,
     Select,
     Collapse(bool),
@@ -77,59 +76,10 @@ impl canvas::Program<Message> for Icon {
                     );
                 }
             }
-            Self::Connection(connection) => match connection {
-                // The OA and SA work-flow tools share a visual family; they
-                // never coexist in a palette. Keep their small glyph legible.
-                Tool::Interaction | Tool::FunctionalExchange => {
-                    for x in [1., 11.] {
-                        f.stroke(
-                            &Path::rounded_rectangle(
-                                Point::new(x, 5.),
-                                Size::new(4., 6.),
-                                1.5.into(),
-                            ),
-                            stroke,
-                        );
-                    }
-                    f.stroke(&line(&[(5., 8.), (10., 8.)]), stroke);
-                    f.stroke(&line(&[(7.5, 5.5), (10., 8.), (7.5, 10.5)]), stroke);
-                }
-                Tool::CommunicationMean => {
-                    // Participant endpoints, without implying a fixed direction.
-                    for x in [1., 11.] {
-                        f.stroke(
-                            &Path::rectangle(Point::new(x, 4.), Size::new(4., 8.)),
-                            stroke,
-                        );
-                    }
-                    f.stroke(&line(&[(5., 8.), (11., 8.)]), stroke);
-                }
-                Tool::BoundaryExchange => {
-                    // Ports on facing participant boundaries. Standard exchanges
-                    // are unoriented, so the generic tool has no arrowhead.
-                    for x in [2., 14.] {
-                        f.stroke(&line(&[(x, 2.), (x, 14.)]), stroke);
-                    }
-                    for x in [1., 12.] {
-                        f.stroke(
-                            &Path::rectangle(Point::new(x, 6.), Size::new(3., 4.)),
-                            stroke,
-                        );
-                    }
-                    f.stroke(&line(&[(4., 8.), (12., 8.)]), stroke);
-                }
-                Tool::Allocation => {
-                    // Work enters a performer: allocation can appear as nesting
-                    // rather than a relationship line in allocated-work views.
-                    f.stroke(&line(&[(1., 2.), (1., 14.), (15., 14.), (15., 2.)]), stroke);
-                    f.stroke(
-                        &Path::rounded_rectangle(Point::new(5., 9.), Size::new(6., 3.), 1.into()),
-                        stroke,
-                    );
-                    f.stroke(&line(&[(8., 1.), (8., 7.)]), stroke);
-                    f.stroke(&line(&[(5., 4.), (8., 7.), (11., 4.)]), stroke);
-                }
-            },
+            Self::Arrow => {
+                f.stroke(&line(&[(1., 8.), (14., 8.), (10., 4.)]), stroke);
+                f.stroke(&line(&[(14., 8.), (10., 12.)]), stroke);
+            }
             Self::Existing => {
                 f.stroke(
                     &Path::rectangle(Point::new(1., 1.), Size::new(10., 10.)),
@@ -284,7 +234,7 @@ pub fn view(app: &App) -> Element<'_, Message> {
         }
         content = content.push(tool(
             app,
-            Icon::Connection(*connection),
+            Icon::Arrow,
             connection.label(),
             Message::Connection(crate::connection_edit::Event::Choose(Some(*connection))),
             app.connection

crates/oa-desktop/src/app/canvas_selection_tests.rs

@@ -1,544 +0,0 @@
-//! Canvas inspection retains the displayed mixed-layer surface; navigation follows the model.
-use super::*;
-use crate::diagram_usage::Target;
-use crate::model_menu::{Event as MenuEvent, Request};
-
-struct Fixture {
-    app: App,
-    diagram: Id,
-    process: Id,
-    placement: Id,
-    edge: Id,
-}
-
-fn fixture() -> Fixture {
-    let mut p = Project::empty();
-    let process = p
-        .add_element(Kind::Process, Layer::Oa, "Operational process", None)
-        .unwrap();
-    let capability = p
-        .add_element(Kind::Capability, Layer::Oa, "Operational capability", None)
-        .unwrap();
-    let edge = p.relate(
-        RelationKind::ChainInvolvement,
-        "Enables",
-        process,
-        capability,
-    );
-    p.ensure_diagram(Layer::Oa);
-    let diagram = p.ensure_diagram(Layer::Sa);
-    p.diagrams.get_mut(&diagram).unwrap().projection = ProjectionKind::Traceability;
-    let placement = p.place(diagram, process, Position { x: 0., y: 0. });
-    p.place(diagram, capability, Position { x: 500., y: 0. });
-    let mut app = App::with_project(p);
-    app.page = Page::Diagram;
-    app.layer = Layer::Sa;
-    app.active_diagram = Some(diagram);
-    app.selected = diagram;
-    app.refresh_draft();
-    app.reconcile_multiselect();
-    assert!(
-        project_view(app.project(), diagram)
-            .edges
-            .iter()
-            .any(|e| e.id == edge)
-    );
-    Fixture {
-        app,
-        diagram,
-        process,
-        placement,
-        edge,
-    }
-}
-
-fn assert_surface(f: &Fixture) {
-    assert_eq!(f.app.page, Page::Diagram);
-    assert_eq!(f.app.layer, Layer::Sa);
-    assert_eq!(f.app.active_diagram, Some(f.diagram));
-}
-
-#[test]
-fn mixed_projection_switch_restores_all_authored_content_and_one_step_history() {
-    let mut f = fixture();
-    let before = f.app.document.snapshot();
-    let mut expected = before.decoded.project.clone();
-    expected.diagrams.get_mut(&f.diagram).unwrap().projection = ProjectionKind::Allocation;
-    let _ = f
-        .app
-        .update(Message::Projection(ProjectionKind::Allocation));
-    assert_surface(&f);
-    assert_eq!(f.app.project(), &expected);
-    assert!(project_view(f.app.project(), f.diagram).nodes.is_empty());
-    assert_eq!(f.app.project().diagrams[&f.diagram].nodes.len(), 2);
-    let switched = f.app.document.snapshot();
-    let _ = f.app.update(Message::Undo);
-    assert_eq!(f.app.project(), &before.decoded.project);
-    assert_eq!(f.app.document.bundle(), &before.bundle);
-    assert!(!f.app.document.can_undo());
-    let _ = f.app.update(Message::Redo);
-    assert_eq!(f.app.project(), &switched.decoded.project);
-    assert_eq!(f.app.document.bundle(), &switched.bundle);
-    let _ = f
-        .app
-        .update(Message::Projection(ProjectionKind::Traceability));
-    assert_surface(&f);
-    assert_eq!(f.app.project(), &before.decoded.project);
-    assert!(
-        project_view(f.app.project(), f.diagram)
-            .edges
-            .iter()
-            .any(|e| e.id == f.edge)
-    );
-}
-
-#[test]
-fn mixed_canvas_edge_and_group_inspection_preserve_surface_and_history() {
-    for grouped in [false, true] {
-        let mut f = fixture();
-        let before = f.app.document.snapshot();
-        let revision = f.app.document.revision();
-        if grouped {
-            let _ = f
-                .app
-                .update(Message::DiagramSelection(multiselect::Event::Choose(
-                    f.app.multiselect_context().unwrap(),
-                    Target::Placement(f.placement),
-                    multiselect::Choice::Replace,
-                )));
-        }
-        let message = if grouped {
-            Message::DiagramSelection(multiselect::Event::Choose(
-                f.app.multiselect_context().unwrap(),
-                Target::Edge(f.edge),
-                multiselect::Choice::Add,
-            ))
-        } else {
-            Message::CanvasSelect(f.app.route_context().unwrap(), f.edge)
-        };
-        let _ = f.app.update(message);
-        assert_surface(&f);
-        assert_eq!(f.app.selected, f.edge);
-        assert_eq!(f.app.draft.as_ref().unwrap().original, f.edge);
-        assert_eq!(
-            f.app.multiselect_snapshot().unwrap().primary(),
-            Some(&Target::Edge(f.edge))
-        );
-        assert_eq!(
-            f.app.multiselect_snapshot().unwrap().targets().len(),
-            if grouped { 2 } else { 1 }
-        );
-        assert_eq!(f.app.project(), &before.decoded.project);
-        assert_eq!(f.app.document.bundle(), &before.bundle);
-        assert_eq!(f.app.document.revision(), revision);
-        assert!(!f.app.document.can_undo());
-    }
-}
-
-fn invoke(f: &mut Fixture, object: Id, placement: Option<Id>, action: Message) {
-    let mut request = Request::object(object, iced::Point::ORIGIN);
-    request.canvas = f.app.route_context();
-    request.placement = placement;
-    let _ = f.app.update(Message::Menu(MenuEvent::Open(request)));
-    let token = f.app.model_menu.as_ref().unwrap().token;
-    let _ = f
-        .app
-        .update(Message::Menu(MenuEvent::Invoke(token, Box::new(action))));
-}
-
-#[test]
-fn mixed_canvas_context_properties_and_hide_keep_the_captured_surface() {
-    let mut f = fixture();
-    let edge = f.edge;
-    invoke(&mut f, edge, None, Message::EditProperties(edge));
-    assert_surface(&f);
-    assert_eq!(f.app.selected, edge);
-    assert!(!f.app.document.can_undo());
-    let before = f.app.document.snapshot();
-    let process = f.process;
-    let placement = f.placement;
-    invoke(&mut f, process, Some(placement), Message::HideSelected);
-    assert_surface(&f);
-    assert!(
-        !f.app.project().diagrams[&f.diagram]
-            .nodes
-            .contains_key(&placement)
-    );
-    assert!(f.app.project().elements.contains_key(&process));
-    let _ = f.app.update(Message::Undo);
-    assert_eq!(f.app.project(), &before.decoded.project);
-    assert_eq!(f.app.document.bundle(), &before.bundle);
-}
-
-#[test]
-fn mixed_canvas_explicit_navigation_still_follows_the_target_layer() {
-    let mut f = fixture();
-    let process = f.process;
-    let edge = f.edge;
-    invoke(&mut f, edge, None, Message::Select(process));
-    assert_eq!(f.app.selected, process);
-    assert_eq!(f.app.layer, Layer::Oa);
-    assert_ne!(f.app.active_diagram, Some(f.diagram));
-}
-
-#[test]
-fn explicit_navigation_to_the_inspected_cross_layer_object_follows_its_layer() {
-    let mut f = fixture();
-    let _ = f.app.update(Message::CanvasSelect(
-        f.app.route_context().unwrap(),
-        f.edge,
-    ));
-    assert_surface(&f);
-    assert_eq!(f.app.selected, f.edge);
-    let before = f.app.document.snapshot();
-    let _ = f.app.update(Message::Select(f.edge));
-    assert_eq!(f.app.selected, f.edge);
-    assert_eq!(f.app.layer, Layer::Oa);
-    assert_ne!(f.app.active_diagram, Some(f.diagram));
-    assert_eq!(f.app.project(), &before.decoded.project);
-    assert_eq!(f.app.document.bundle(), &before.bundle);
-    assert!(!f.app.document.can_undo());
-}
-
-#[test]
-fn mixed_canvas_invalid_draft_and_stale_packets_preserve_selection() {
-    let mut f = fixture();
-    let context = f.app.route_context().unwrap();
-    let _ = f.app.update(Message::Field("/id".into(), "-".into()));
-    let draft = serde_json::to_value(f.app.draft.as_ref().unwrap().recovery_snapshot()).unwrap();
-    let _ = f.app.update(Message::CanvasSelect(context, f.edge));
-    assert_eq!(f.app.selected, f.diagram);
-    assert_surface(&f);
-    assert_eq!(
-        serde_json::to_value(f.app.draft.as_ref().unwrap().recovery_snapshot()).unwrap(),
-        draft
-    );
-    let _ = f
-        .app
-        .update(Message::DiagramSelection(multiselect::Event::Choose(
-            f.app.multiselect_context().unwrap(),
-            Target::Edge(f.edge),
-            multiselect::Choice::Replace,
-        )));
-    assert_eq!(f.app.selected, f.diagram);
-    assert_eq!(
-        serde_json::to_value(f.app.draft.as_ref().unwrap().recovery_snapshot()).unwrap(),
-        draft
-    );
-    let _ = f.app.update(Message::RevertProperties);
-    f.app.canvas_epoch += 1;
-    let _ = f.app.update(Message::CanvasSelect(context, f.edge));
-    assert_eq!(f.app.selected, f.diagram);
-    assert!(!f.app.document.can_undo());
-}
-
-#[test]
-fn cross_layer_port_inspection_and_connection_start_retain_the_view() {
-    let mut p = Project::empty();
-    let owner = p
-        .add_element(Kind::Function, Layer::Sa, "Send", None)
-        .unwrap();
-    let port = Id::new_v4();
-    let element = make_port(
-        &p,
-        port,
-        owner,
-        "Output",
-        PortContract::FunctionOutput {
-            outgoing_items: vec![],
-        },
-    )
-    .unwrap();
-    p.elements.insert(port, element);
-    p.ensure_diagram(Layer::Sa);
-    let diagram = p.ensure_diagram(Layer::Oa);
-    p.diagrams.get_mut(&diagram).unwrap().projection = ProjectionKind::Traceability;
-    let placement = p.place(diagram, owner, Position { x: 0., y: 0. });
-    let mut app = App::with_project(p);
-    app.page = Page::Diagram;
-    app.layer = Layer::Oa;
-    app.active_diagram = Some(diagram);
-    app.selected = diagram;
-    app.refresh_draft();
-    app.reconcile_multiselect();
-    assert!(
-        project_view(app.project(), diagram)
-            .ports
-            .iter()
-            .any(|p| p.element == port)
-    );
-    let _ = app.update(Message::CanvasSelect(app.route_context().unwrap(), port));
-    assert_eq!(app.selected, port);
-    assert_eq!(app.active_diagram, Some(diagram));
-    assert_eq!(app.layer, Layer::Oa);
-    assert_eq!(
-        app.multiselect_snapshot().unwrap().primary(),
-        Some(&Target::Port { port, placement })
-    );
-    // Reset inspection so the endpoint path cannot pass by selecting the same ID.
-    app.selected = diagram;
-    app.refresh_draft();
-    let context = app.route_context().unwrap();
-    // Mixed canvases can retain a tool from either perspective.
-    app.connection = Some(crate::connection_edit::Session::new(
-        app.project(),
-        &project_view(app.project(), diagram),
-        context,
-        crate::connection_tool::Tool::FunctionalExchange,
-    ));
-    let _ = app.update(Message::Connection(
-        crate::connection_edit::Event::Endpoint(context, port),
-    ));
-    assert_eq!(app.selected, port);
-    assert_eq!(app.layer, Layer::Oa);
-    assert_eq!(app.active_diagram, Some(diagram));
-    assert_eq!(app.connection.as_ref().unwrap().source, Some(port));
-    assert!(!app.document.can_undo());
-}
-
-fn authoring_fixture(performer: bool) -> (Fixture, Id) {
-    let mut f = fixture();
-    let mut project = f.app.project().clone();
-    let owner = project
-        .add_element(
-            if performer {
-                Kind::Entity
-            } else {
-                Kind::Activity
-            },
-            Layer::Oa,
-            "Operational owner",
-            None,
-        )
-        .unwrap();
-    let target = project
-        .add_element(Kind::Activity, Layer::Oa, "Operational target", None)
-        .unwrap();
-    let placement = project.place(f.diagram, owner, Position { x: 0., y: 400. });
-    project.place(f.diagram, target, Position { x: 500., y: 400. });
-    f.app = App::with_project(project);
-    f.app.page = Page::Diagram;
-    f.app.layer = Layer::Sa;
-    f.app.active_diagram = Some(f.diagram);
-    f.app.selected = f.diagram;
-    f.app.refresh_draft();
-    f.app.reconcile_multiselect();
-    f.process = owner;
-    f.placement = placement;
-    (f, target)
-}
-
-fn assert_source_pair(app: &App) {
-    let compiled = oa_core::source_project::compile_bundle(
-        app.document.bundle(),
-        oa_core::source_project::ProjectLimits::default(),
-    )
-    .unwrap();
-    assert_eq!(&compiled.decoded.project, app.project());
-    assert_eq!(&compiled.bundle, app.document.bundle());
-}
-
-#[test]
-fn mixed_canvas_relationship_actions_keep_operational_source_and_commit_one_step() {
-    for context_action in [false, true] {
-        let (mut f, target) = authoring_fixture(false);
-        let before = f.app.document.snapshot();
-        let owner = f.process;
-        let placement = f.placement;
-        if context_action {
-            invoke(
-                &mut f,
-                owner,
-                Some(placement),
-                Message::AddRelationKind(RelationKind::Interaction, false),
-            );
-        } else {
-            let _ = f.app.update(Message::SelectNode(placement));
-            let _ = f.app.update(Message::AddRelation);
-        }
-        assert_surface(&f);
-        let Some(crate::workflow::Workflow::Relation(relation)) = &f.app.workflow else {
-            panic!("relationship form did not open: {}", f.app.status);
-        };
-        assert_eq!(
-            relation.source.as_ref().map(|source| source.id),
-            Some(owner)
-        );
-        assert_eq!(relation.kind, RelationKind::Interaction);
-        let saved = f
-            .app
-            .workflow
-            .as_ref()
-            .unwrap()
-            .recovery_snapshot()
-            .unwrap();
-        assert_eq!(saved["Relation"]["layer"], "Oa");
-        let _ = f
-            .app
-            .update(Message::Workflow(crate::workflow::Event::Target(Choice {
-                id: target,
-                label: "Operational target".into(),
-            })));
-        let _ = f
-            .app
-            .update(Message::Workflow(crate::workflow::Event::Apply));
-        assert!(f.app.workflow.is_none(), "{}", f.app.status);
-        let created: Vec<_> = f
-            .app
-            .project()
-            .relations
-            .values()
-            .filter(|relation| !before.decoded.project.relations.contains_key(&relation.id))
-            .collect();
-        assert_eq!(created.len(), 1);
-        assert_eq!(
-            (created[0].kind(), created[0].source(), created[0].target()),
-            (RelationKind::Interaction, owner, target)
-        );
-        assert_source_pair(&f.app);
-        let _ = f.app.update(Message::Undo);
-        assert_eq!(f.app.project(), &before.decoded.project);
-        assert_eq!(f.app.document.bundle(), &before.bundle);
-        assert!(!f.app.document.can_undo());
-    }
-}
-
-#[test]
-fn mixed_canvas_add_child_command_uses_parent_layer_for_containment_and_allocation() {
-    for performer in [false, true] {
-        let (mut f, _) = authoring_fixture(performer);
-        let before = f.app.document.snapshot();
-        let owner = f.process;
-        let placement = f.placement;
-        invoke(
-            &mut f,
-            owner,
-            Some(placement),
-            Message::CreateContextElement(Kind::Activity, true),
-        );
-        assert_surface(&f);
-        let created: Vec<_> = f
-            .app
-            .project()
-            .elements
-            .values()
-            .filter(|element| !before.decoded.project.elements.contains_key(&element.id))
-            .collect();
-        assert_eq!(created.len(), 1, "{}", f.app.status);
-        let child = created[0].id;
-        assert_eq!(created[0].kind(), Kind::Activity);
-        assert_eq!(created[0].layer(), Layer::Oa);
-        assert_eq!(
-            created[0].parent,
-            if performer { None } else { Some(owner) }
-        );
-        let allocations: Vec<_> = f
-            .app
-            .project()
-            .relations
-            .values()
-            .filter(|relation| !before.decoded.project.relations.contains_key(&relation.id))
-            .collect();
-        assert_eq!(allocations.len(), usize::from(performer));
-        if performer {
-            assert_eq!(
-                (
-                    allocations[0].kind(),
-                    allocations[0].source(),
-                    allocations[0].target()
-                ),
-                (RelationKind::Allocation, owner, child)
-            );
-        }
-        assert!(
-            f.app.project().diagrams[&f.diagram]
-                .nodes
-                .values()
-                .any(|node| node.element == child)
-        );
-        assert_source_pair(&f.app);
-        let _ = f.app.update(Message::Undo);
-        assert_eq!(f.app.project(), &before.decoded.project);
-        assert_eq!(f.app.document.bundle(), &before.bundle);
-        assert!(!f.app.document.can_undo());
-    }
-}
-
-#[test]
-fn mixed_canvas_root_creation_still_uses_the_active_perspective() {
-    let (mut f, _) = authoring_fixture(false);
-    let _ = f.app.update(Message::SelectNode(f.placement));
-    let before = f.app.document.snapshot();
-    let _ = f
-        .app
-        .update(Message::CreateContextElement(Kind::Function, false));
-    assert_surface(&f);
-    let created: Vec<_> = f
-        .app
-        .project()
-        .elements
-        .values()
-        .filter(|element| !before.decoded.project.elements.contains_key(&element.id))
-        .collect();
-    assert_eq!(created.len(), 1, "{}", f.app.status);
-    assert_eq!(created[0].kind(), Kind::Function);
-    assert_eq!(created[0].layer(), Layer::Sa);
-    assert_eq!(created[0].parent, None);
-    assert_source_pair(&f.app);
-    let _ = f.app.update(Message::Undo);
-    assert_eq!(f.app.project(), &before.decoded.project);
-    assert_eq!(f.app.document.bundle(), &before.bundle);
-}
-
-#[test]
-fn child_creation_navigates_to_a_parent_layer_preferred_view_only_when_needed() {
-    for existing_preferred in [false, true] {
-        let (mut f, _) = authoring_fixture(false);
-        let mut project = f.app.project().clone();
-        for diagram in project
-            .diagrams
-            .values_mut()
-            .filter(|d| d.layer == Layer::Oa)
-        {
-            diagram.projection = if existing_preferred {
-                ProjectionKind::Allocation
-            } else {
-                ProjectionKind::Overview
-            };
-        }
-        project.diagrams.get_mut(&f.diagram).unwrap().projection = ProjectionKind::Capabilities;
-        f.app = App::with_project(project);
-        let _ = f.app.update(Message::Select(f.process));
-        let _ = f.app.update(Message::Diagram(Choice {
-            id: f.diagram,
-            label: "System capabilities".into(),
-        }));
-        assert_eq!(f.app.selected, f.process);
-        assert_eq!(f.app.layer, Layer::Sa);
-        assert_eq!(f.app.active_diagram, Some(f.diagram));
-        let before = f.app.document.snapshot();
-        let _ = f
-            .app
-            .update(Message::CreateContextElement(Kind::Activity, true));
-        assert_eq!(f.app.layer, Layer::Oa, "{}", f.app.status);
-        let diagram = f.app.active_diagram.unwrap();
-        assert_ne!(diagram, f.diagram);
-        assert_eq!(f.app.project().diagrams[&diagram].layer, Layer::Oa);
-        assert_eq!(
-            f.app.project().diagrams[&diagram].projection,
-            ProjectionKind::Allocation
-        );
-        assert_eq!(
-            f.app.project().diagrams.len(),
-            before.decoded.project.diagrams.len() + usize::from(!existing_preferred)
-        );
-        assert_eq!(
-            f.app.project().elements[&f.app.selected].parent,
-            Some(f.process)
-        );
-        assert_source_pair(&f.app);
-        let _ = f.app.update(Message::Undo);
-        assert_eq!(f.app.project(), &before.decoded.project);
-        assert_eq!(f.app.document.bundle(), &before.bundle);
-    }
-}

crates/oa-desktop/src/app/state_picker_escape_tests.rs

@@ -10,11 +10,6 @@ async fn press_escape(mounted: &mut Mounted, app: &mut App) -> Vec<Message> {
         std::slice::from_ref(&input),
         mouse::Cursor::Unavailable,
     );
-    assert_eq!(
-        statuses,
-        [iced::event::Status::Captured],
-        "the mounted picker must capture Escape before App subscriptions"
-    );
     crate::app::escape::tests::subscriptions(app, input, statuses[0], &mut messages);
     for message in messages.iter().cloned() {
         let task = app.update(message);
@@ -46,11 +41,17 @@ async fn mounted_state_missing_picker_escape_preserves_exact_document_then_reope
     send(&mut app, Message::BehaviorDiagram(choice));
     let mut mounted = Mounted::new(&mut app).await;
     assert_eq!(state_edit::unplaced(app.project(), diagram), vec![f.b]);
-    // Locate the stable picker slot itself: selection controls may sit between
-    // it and the canvas. The single menu option opens below this slot.
-    let bounds = mounted.geometry(&app).bounds("state-missing-picker");
-    let picker = bounds.center();
-    let option = iced::Point::new(picker.x, bounds.y + bounds.height * 1.5);
+    let focus_id = iced::advanced::widget::Id::from("diagram-keyboard-owner");
+    let (_, canvas, _) = mounted
+        .geometry(&app)
+        .focused
+        .into_iter()
+        .find(|(id, _, _)| id.as_ref() == Some(&focus_id))
+        .unwrap();
+    // The existing picker is immediately above the measured canvas, separated
+    // by 8px. Its 12px text and 8px padding give a 31.6px row.
+    let picker = iced::Point::new(canvas.center_x(), canvas.y - 24.);
+    let option = iced::Point::new(picker.x, canvas.y + 8.);
     let before = app.document.snapshot();
     let original = app.project().clone();
     let source = app.document.bundle().clone();

crates/oa-desktop/src/behavior/scenario.rs

@@ -6,6 +6,7 @@ use iced::widget::{Column, column, text_input};
 use std::{cell::RefCell, collections::BTreeSet};
 mod camera;
 pub(crate) mod focus;
+pub(crate) mod group_reorder;
 pub(crate) mod spacing;
 use super::scenario_layout::{
     Representation,
@@ -1253,26 +1254,21 @@ pub(crate) fn reorder(
     occurrence: Id,
     slot: Slot,
 ) -> Result<Command, String> {
-    let to = slot_index(p, owner, slot)?;
-    if p.elements.get(&occurrence).and_then(|e| e.parent) != Some(slot.parent) {
-        return Err(
-            "Reorder inside the occurrence's current sequence; dragging never changes its operand."
-                .into(),
-        );
+    let prepared = group_reorder::Prepared::new(
+        std::sync::Arc::new(p.clone()),
+        owner,
+        &[crate::diagram_usage::Target::ScenarioObject(occurrence)],
+    )?;
+    match prepared.plan(slot)? {
+        group_reorder::Plan::Change(command) => Ok(*command),
+        group_reorder::Plan::Noop => Ok(Command::SetSteps(
+            slot.parent,
+            p.elements[&slot.parent]
+                .steps()
+                .expect("admitted sequence")
+                .clone(),
+        )),
     }
-    let mut steps = p.elements[&slot.parent]
-        .steps()
-        .expect("slot validated")
-        .clone();
-    let from = steps
-        .iter()
-        .position(|id| *id == occurrence)
-        .ok_or("This occurrence is not in the sequence.")?;
-    steps.remove(from);
-    steps.insert(to - usize::from(from < to), occurrence);
-    let command = Command::SetSteps(slot.parent, steps);
-    execute_batch(p, std::slice::from_ref(&command)).map_err(|error| error.to_string())?;
-    Ok(command)
 }
 fn compatible_binding(p: &Project, referenced: Id, local: Id) -> bool {
     represented(p, referenced)

crates/oa-desktop/src/behavior/scenario/group_reorder.rs

@@ -0,0 +1,179 @@
+//! Frozen, all-or-nothing reorder of one immediate Scenario sequence.
+use super::Slot;
+use crate::diagram_usage::Target;
+use oa_core::{Command, Id, Kind, OccurrenceBody, Project, SharedBody, execute_batch};
+use std::{collections::BTreeSet, sync::Arc};
+
+#[derive(Debug)]
+pub(crate) enum Plan {
+    Noop,
+    Change(Box<Command>),
+}
+
+pub(crate) struct Prepared {
+    project: Arc<Project>,
+    parent: Id,
+    original: Vec<Id>,
+    selected: BTreeSet<Id>,
+}
+
+fn step_body(project: &Project, id: Id) -> Option<&OccurrenceBody> {
+    match project.elements.get(&id)?.shared()? {
+        SharedBody::Occurrence { body, .. }
+            if matches!(
+                body,
+                OccurrenceBody::Exchange { .. }
+                    | OccurrenceBody::Action { .. }
+                    | OccurrenceBody::State { .. }
+                    | OccurrenceBody::ScenarioUse { .. }
+                    | OccurrenceBody::Fragment { .. }
+            ) =>
+        {
+            Some(body)
+        }
+        _ => None,
+    }
+}
+
+// Follow the same structural edges that make rows visible; parent pointers alone
+// would admit children of an operand omitted from its fragment's branch list.
+fn reachable_parent(project: &Project, owner: Id, wanted: Id) -> bool {
+    let mut pending = vec![owner];
+    let mut visited = BTreeSet::new();
+    while let Some(parent) = pending.pop() {
+        if !visited.insert(parent) {
+            continue;
+        }
+        if parent == wanted {
+            return true;
+        }
+        let Some(steps) = project.elements.get(&parent).and_then(|e| e.steps()) else {
+            continue;
+        };
+        for id in steps {
+            if project.elements.get(id).and_then(|e| e.parent) != Some(parent) {
+                continue;
+            }
+            if let Some(OccurrenceBody::Fragment { branches, .. }) = step_body(project, *id) {
+                pending.extend(branches.iter().copied().filter(|branch| {
+                    project.elements.get(branch).is_some_and(|element| {
+                        element.parent == Some(*id)
+                            && matches!(
+                                element.shared(),
+                                Some(SharedBody::Occurrence {
+                                    body: OccurrenceBody::Branch { .. },
+                                    ..
+                                })
+                            )
+                    })
+                }));
+            }
+        }
+    }
+    false
+}
+
+impl Prepared {
+    pub(crate) fn new(
+        project: Arc<Project>,
+        owner: Id,
+        targets: &[Target],
+    ) -> Result<Self, String> {
+        if project.elements.get(&owner).map(|e| e.kind()) != Some(Kind::Scenario) {
+            return Err("This scenario no longer exists.".into());
+        }
+        let mut selected = BTreeSet::new();
+        let mut parent = None;
+        for target in targets {
+            let Target::ScenarioObject(id) = target else {
+                return Err("Select only ordered occurrences in this scenario.".into());
+            };
+            if !selected.insert(*id) || step_body(&project, *id).is_none() {
+                return Err(
+                    "Every selected subject must be a unique ordered scenario occurrence.".into(),
+                );
+            }
+            let actual = project.elements[id]
+                .parent
+                .ok_or("The occurrence has no sequence.")?;
+            if parent.is_some_and(|parent| parent != actual) {
+                return Err(
+                    "Reorder inside one immediate sequence; dragging never changes operands."
+                        .into(),
+                );
+            }
+            parent = Some(actual);
+        }
+        let parent = parent.ok_or("Select at least one occurrence.")?;
+        if !reachable_parent(&project, owner, parent) {
+            return Err("The selected sequence is not reachable in this scenario.".into());
+        }
+        let original = project.elements[&parent]
+            .steps()
+            .ok_or("The parent is not a sequence.")?
+            .clone();
+        let mut listed = BTreeSet::new();
+        for id in &original {
+            if !listed.insert(*id)
+                || step_body(&project, *id).is_none()
+                || project.elements[id].parent != Some(parent)
+            {
+                return Err("The complete sequence must contain unique, existing occurrences of this parent.".into());
+            }
+        }
+        if !selected.is_subset(&listed) {
+            return Err("A selected occurrence is not in this sequence.".into());
+        }
+        // Cache a validated immutable baseline, including descendants and other
+        // sequences. Advisory authoring diagnostics deliberately remain allowed.
+        oa_core::session::validate_candidate(&project).map_err(|e| e.to_string())?;
+        Ok(Self {
+            project,
+            parent,
+            original,
+            selected,
+        })
+    }
+
+    pub(crate) fn plan(&self, slot: Slot) -> Result<Plan, String> {
+        if slot.parent != self.parent {
+            return Err("Reorder inside the occurrence's current sequence; dragging never changes its operand.".into());
+        }
+        if let Some(anchor) = slot.before {
+            if !self.original.contains(&anchor) {
+                return Err("The insertion slot changed. Choose its position again.".into());
+            }
+            if self.selected.contains(&anchor) {
+                return Ok(Plan::Noop);
+            }
+        }
+        let mut steps: Vec<_> = self
+            .original
+            .iter()
+            .copied()
+            .filter(|id| !self.selected.contains(id))
+            .collect();
+        let at = slot.before.map_or(steps.len(), |anchor| {
+            steps
+                .iter()
+                .position(|id| *id == anchor)
+                .expect("admitted anchor")
+        });
+        steps.splice(
+            at..at,
+            self.original
+                .iter()
+                .copied()
+                .filter(|id| self.selected.contains(id)),
+        );
+        if steps == self.original {
+            return Ok(Plan::Noop);
+        }
+        let command = Command::SetSteps(self.parent, steps);
+        execute_batch(&self.project, std::slice::from_ref(&command)).map_err(|e| e.to_string())?;
+        Ok(Plan::Change(Box::new(command)))
+    }
+}
+
+#[cfg(test)]
+mod tests;

crates/oa-desktop/src/behavior/scenario/group_reorder/tests.rs

@@ -0,0 +1,720 @@
+use super::*;
+use crate::{behavior::topology::occurrence, document::Document};
+use oa_core::{FragmentOperator, Layer, LifelineBinding, MessageKind, language};
+
+fn add(p: &mut Project, parent: Id, name: &str, body: OccurrenceBody) -> Id {
+    let e = occurrence(p, parent, name, body);
+    let id = e.id;
+    p.elements.insert(id, e);
+    p.elements
+        .get_mut(&parent)
+        .unwrap()
+        .steps_mut()
+        .unwrap()
+        .push(id);
+    id
+}
+fn row(p: &mut Project, parent: Id, name: &str) -> Id {
+    add(
+        p,
+        parent,
+        name,
+        OccurrenceBody::Action {
+            action: None,
+            lifeline: None,
+        },
+    )
+}
+fn operand(p: &mut Project, parent: Id, operator: FragmentOperator) -> (Id, Id) {
+    let fragment = add(
+        p,
+        parent,
+        "Fragment",
+        OccurrenceBody::Fragment {
+            operator,
+            branches: vec![],
+        },
+    );
+    let branch = occurrence(
+        p,
+        fragment,
+        "Operand",
+        OccurrenceBody::Branch {
+            guard: "ready".into(),
+            occurrences: vec![],
+        },
+    );
+    let id = branch.id;
+    p.elements.insert(id, branch);
+    if let Some(SharedBody::Occurrence {
+        body: OccurrenceBody::Fragment { branches, .. },
+        ..
+    }) = p.elements.get_mut(&fragment).unwrap().shared_mut()
+    {
+        branches.push(id);
+    }
+    (fragment, id)
+}
+fn prepare(p: &Project, owner: Id, ids: &[Id]) -> Result<Prepared, String> {
+    Prepared::new(
+        Arc::new(p.clone()),
+        owner,
+        &ids.iter()
+            .copied()
+            .map(Target::ScenarioObject)
+            .collect::<Vec<_>>(),
+    )
+}
+fn slot(parent: Id, before: Option<Id>) -> Slot {
+    Slot { parent, before }
+}
+fn ordered(p: &Project, parent: Id, ids: &[Id]) -> Project {
+    let mut expected = p.clone();
+    *expected
+        .elements
+        .get_mut(&parent)
+        .unwrap()
+        .steps_mut()
+        .unwrap() = ids.to_vec();
+    expected
+}
+fn exact_transaction(p: &Project, plan: Plan, expected: Project) {
+    let Plan::Change(command) = plan else {
+        panic!("expected a change")
+    };
+    assert_eq!(
+        execute_batch(p, std::slice::from_ref(&command)).unwrap(),
+        expected
+    );
+    let mut doc = Document::from_project(p.clone(), Default::default()).unwrap();
+    let original_source = doc.bundle().clone();
+    doc.execute(*command).unwrap();
+    assert_eq!(doc.project(), &expected);
+    assert_eq!(
+        language::parse(&language::format(doc.project())).unwrap(),
+        expected
+    );
+    let changed_source = doc.bundle().clone();
+    assert_eq!(
+        Document::from_bundle(changed_source.clone(), Default::default())
+            .unwrap()
+            .project(),
+        &expected
+    );
+    assert!(doc.undo());
+    assert_eq!(doc.project(), p);
+    assert_eq!(doc.bundle(), &original_source);
+    assert!(!doc.can_undo());
+    assert!(doc.redo());
+    assert_eq!(doc.project(), &expected);
+    assert_eq!(doc.bundle(), &changed_source);
+    assert!(!doc.can_redo());
+}
+fn four(nested: bool) -> (Project, Id, Id, [Id; 4]) {
+    four_in_layer(nested, Layer::Oa)
+}
+fn four_in_layer(nested: bool, layer: Layer) -> (Project, Id, Id, [Id; 4]) {
+    let mut p = Project::empty();
+    let owner = p
+        .add_element(oa_core::Kind::Scenario, layer, "Scenario", None)
+        .unwrap();
+    let parent = if nested {
+        operand(&mut p, owner, FragmentOperator::Alternative).1
+    } else {
+        owner
+    };
+    let ids = ["A", "B", "C", "D"].map(|name| row(&mut p, parent, name));
+    oa_core::session::validate_candidate(&p).unwrap();
+    (p, owner, parent, ids)
+}
+
+#[test]
+fn root_and_operand_use_semantic_block_order_with_exact_history() {
+    for (nested, layer) in [
+        (false, Layer::Oa),
+        (true, Layer::Oa),
+        (false, Layer::Sa),
+        (true, Layer::Sa),
+    ] {
+        let (p, owner, parent, [a, b, c, d]) = four_in_layer(nested, layer);
+        let prepared = prepare(&p, owner, &[c, a]).unwrap();
+        exact_transaction(
+            &p,
+            prepared.plan(slot(parent, Some(d))).unwrap(),
+            ordered(&p, parent, &[b, a, c, d]),
+        );
+        exact_transaction(
+            &p,
+            prepared.plan(slot(parent, None)).unwrap(),
+            ordered(&p, parent, &[b, d, a, c]),
+        );
+    }
+}
+
+#[test]
+fn singleton_wrapper_noop_preserves_existing_redo_and_source() {
+    for nested in [false, true] {
+        let (p, owner, parent, [a, b, c, d]) = four(nested);
+        let mut doc = Document::from_project(p.clone(), Default::default()).unwrap();
+        let change = super::super::reorder(doc.project(), owner, a, slot(parent, None)).unwrap();
+        doc.execute(change).unwrap();
+        assert_eq!(doc.project(), &ordered(&p, parent, &[b, c, d, a]));
+        let changed = doc.bundle().clone();
+        assert!(doc.undo());
+        let source = doc.bundle().clone();
+        let revision = doc.revision();
+        for before in [Some(a), Some(b)] {
+            let noop =
+                super::super::reorder(doc.project(), owner, a, slot(parent, before)).unwrap();
+            doc.execute(noop).unwrap();
+            assert_eq!(doc.project(), &p);
+            assert_eq!(doc.bundle(), &source);
+            assert_eq!(doc.revision(), revision);
+            assert!(!doc.can_undo());
+            assert!(doc.can_redo());
+        }
+        assert!(doc.redo());
+        assert_eq!(doc.bundle(), &changed);
+    }
+}
+
+#[test]
+fn selected_anchor_and_exact_noop_preserve_redo_and_frozen_snapshot() {
+    let (p, owner, parent, [a, b, c, d]) = four(false);
+    let prepared = prepare(&p, owner, &[c, a]).unwrap();
+    let mut doc = Document::from_project(p.clone(), Default::default()).unwrap();
+    let Plan::Change(command) = prepared.plan(slot(parent, Some(d))).unwrap() else {
+        panic!()
+    };
+    doc.execute(*command).unwrap();
+    let changed = doc.bundle().clone();
+    assert!(doc.undo());
+    let source = doc.bundle().clone();
+    let revision = doc.revision();
+    for plan in [
+        prepared.plan(slot(parent, Some(c))),
+        prepare(&p, owner, &[a])
+            .unwrap()
+            .plan(slot(parent, Some(b))),
+        prepare(&p, owner, &[c, d])
+            .unwrap()
+            .plan(slot(parent, None)),
+    ] {
+        assert!(matches!(plan.unwrap(), Plan::Noop));
+        assert_eq!(doc.project(), &p);
+        assert_eq!(doc.bundle(), &source);
+        assert_eq!(doc.revision(), revision);
+        assert!(doc.can_redo());
+    }
+    assert!(doc.redo());
+    assert_eq!(doc.bundle(), &changed);
+    // The earlier prepared value still plans from its original owned snapshot.
+    exact_transaction(
+        &p,
+        prepared.plan(slot(parent, Some(d))).unwrap(),
+        ordered(&p, parent, &[b, a, c, d]),
+    );
+}
+
+#[test]
+fn admission_rejects_every_invalid_member_list_and_destination_before_noop() {
+    let (p, owner, parent, [a, b, c, d]) = four(false);
+    for ids in [vec![], vec![a, a], vec![a, Id::new_v4()]] {
+        assert!(prepare(&p, owner, &ids).is_err());
+    }
+    for target in [Target::Whole, Target::Placement(a)] {
+        assert!(
+            Prepared::new(
+                Arc::new(p.clone()),
+                owner,
+                &[Target::ScenarioObject(a), target]
+            )
+            .is_err()
+        );
+    }
+    let mut with_line = p.clone();
+    let line = with_line
+        .add_element(Kind::Lifeline, Layer::Oa, "Line", Some(owner))
+        .unwrap();
+    assert!(prepare(&with_line, owner, &[a, line]).is_err());
+    let mut nested = p.clone();
+    let (fragment, branch) = operand(&mut nested, owner, FragmentOperator::Alternative);
+    let child = row(&mut nested, branch, "Child");
+    assert!(prepare(&nested, owner, &[a, child]).is_err());
+    assert!(prepare(&nested, owner, &[fragment, child]).is_err());
+    let prepared = prepare(&p, owner, &[a, c]).unwrap();
+    assert!(prepared.plan(slot(branch, Some(a))).is_err());
+    assert!(prepared.plan(slot(parent, Some(Id::new_v4()))).is_err());
+    for list in [vec![a, b, c, b], vec![a, Id::new_v4(), c, d]] {
+        assert!(prepare(&ordered(&p, parent, &list), owner, &[a, c]).is_err());
+    }
+    let mut wrong_parent = p.clone();
+    wrong_parent.elements.get_mut(&b).unwrap().parent = Some(branch);
+    assert!(prepare(&wrong_parent, owner, &[a, c]).is_err());
+    for body in [
+        OccurrenceBody::Control {
+            kind: oa_core::ControlKind::Choice,
+        },
+        OccurrenceBody::SequenceReference { sequence: None },
+    ] {
+        let mut wrong_type = p.clone();
+        if let Some(SharedBody::Occurrence { body: actual, .. }) =
+            wrong_type.elements.get_mut(&b).unwrap().shared_mut()
+        {
+            *actual = body;
+        }
+        assert!(prepare(&wrong_type, owner, &[a, c]).is_err());
+    }
+    if let Some(SharedBody::Occurrence {
+        body: OccurrenceBody::Fragment { branches, .. },
+        ..
+    }) = nested.elements.get_mut(&fragment).unwrap().shared_mut()
+    {
+        branches.clear();
+    }
+    assert!(
+        prepare(&nested, owner, &[child]).is_err(),
+        "parent ancestry cannot admit omitted operand"
+    );
+}
+
+#[test]
+fn unlisted_warning_child_is_preserved_but_cannot_be_selected() {
+    let (mut p, owner, parent, [a, b, c, d]) = four(false);
+    let hidden = row(&mut p, parent, "Hidden draft");
+    p.elements
+        .get_mut(&parent)
+        .unwrap()
+        .steps_mut()
+        .unwrap()
+        .pop();
+    assert!(
+        oa_core::validation::validate(&p)
+            .iter()
+            .any(|i| i.code == "unordered_occurrence")
+    );
+    assert!(prepare(&p, owner, &[hidden]).is_err());
+    exact_transaction(
+        &p,
+        prepare(&p, owner, &[c, a])
+            .unwrap()
+            .plan(slot(parent, Some(d)))
+            .unwrap(),
+        ordered(&p, parent, &[b, a, c, d]),
+    );
+}
+
+#[test]
+fn call_reply_moves_as_explicit_stable_pair_and_invalid_baseline_refuses_noop() {
+    let f = super::super::direct_tests::fixture();
+    let mut p = f.project;
+    let x = row(&mut p, f.owner, "X");
+    let y = row(&mut p, f.owner, "Y");
+    p = ordered(&p, f.owner, &[f.call, x, f.reply, y]);
+    let prepared = prepare(&p, f.owner, &[f.reply, f.call]).unwrap();
+    exact_transaction(
+        &p,
+        prepared.plan(slot(f.owner, None)).unwrap(),
+        ordered(&p, f.owner, &[x, y, f.call, f.reply]),
+    );
+    assert!(
+        prepare(&p, f.owner, &[f.reply])
+            .unwrap()
+            .plan(slot(f.owner, Some(f.call)))
+            .unwrap_err()
+            .contains("reply_order")
+    );
+    let invalid = ordered(&p, f.owner, &[f.reply, x, f.call, y]);
+    assert!(prepare(&invalid, f.owner, &[x]).is_err());
+}
+
+#[test]
+fn nested_fragment_descendant_reply_is_validated_and_subtree_preserved() {
+    let f = super::super::direct_tests::fixture();
+    let mut p = f.project;
+    let x = row(&mut p, f.owner, "X");
+    let (fragment, outer) = operand(&mut p, f.owner, FragmentOperator::Alternative);
+    let (_, inner) = operand(&mut p, outer, FragmentOperator::Parallel);
+    p.elements.get_mut(&f.reply).unwrap().parent = Some(inner);
+    p.elements
+        .get_mut(&inner)
+        .unwrap()
+        .steps_mut()
+        .unwrap()
+        .push(f.reply);
+    let y = row(&mut p, f.owner, "Y");
+    p = ordered(&p, f.owner, &[f.call, x, fragment, y]);
+    let prepared = prepare(&p, f.owner, &[fragment, x]).unwrap();
+    assert!(
+        prepared
+            .plan(slot(f.owner, Some(f.call)))
+            .unwrap_err()
+            .contains("reply_order")
+    );
+    exact_transaction(
+        &p,
+        prepared.plan(slot(f.owner, None)).unwrap(),
+        ordered(&p, f.owner, &[f.call, y, x, fragment]),
+    );
+}
+
+#[test]
+fn nested_lifetime_and_opaque_local_bindings_are_checked_without_expansion() {
+    let f = super::super::direct_tests::fixture();
+    let mut p = execute_batch(
+        &f.project,
+        &[Command::Delete(f.reply), Command::Delete(f.call)],
+    )
+    .unwrap();
+    let create = add(
+        &mut p,
+        f.owner,
+        "Create",
+        OccurrenceBody::Exchange {
+            exchange: None,
+            sender: Some(f.sender),
+            receiver: Some(f.receiver),
+            message_kind: MessageKind::Create,
+            reply_to: None,
+            values: vec![],
+            operation: None,
+        },
+    );
+    let x = row(&mut p, f.owner, "X");
+    let (fragment, outer) = operand(&mut p, f.owner, FragmentOperator::Alternative);
+    let (_, inner) = operand(&mut p, outer, FragmentOperator::Parallel);
+    add(
+        &mut p,
+        inner,
+        "Use local",
+        OccurrenceBody::Action {
+            action: None,
+            lifeline: Some(f.receiver),
+        },
+    );
+    let y = row(&mut p, f.owner, "Y");
+    let prepared = prepare(&p, f.owner, &[fragment, x]).unwrap();
+    assert!(
+        prepared
+            .plan(slot(f.owner, Some(create)))
+            .unwrap_err()
+            .contains("lifeline_lifetime")
+    );
+    exact_transaction(
+        &p,
+        prepared.plan(slot(f.owner, None)).unwrap(),
+        ordered(&p, f.owner, &[create, y, x, fragment]),
+    );
+    let definition = p
+        .add_element(Kind::Scenario, Layer::Oa, "Definition", None)
+        .unwrap();
+    let represented = match p.elements[&f.receiver].shared().unwrap() {
+        SharedBody::Lifeline { represented } => *represented,
+        _ => panic!(),
+    };
+    let remote = p
+        .add_element(Kind::Lifeline, Layer::Oa, "Formal", Some(definition))
+        .unwrap();
+    *p.elements.get_mut(&remote).unwrap().shared_mut().unwrap() =
+        SharedBody::Lifeline { represented };
+    let uses = ["First use", "Second use"].map(|name| {
+        add(
+            &mut p,
+            f.owner,
+            name,
+            OccurrenceBody::ScenarioUse {
+                scenario: Some(definition),
+                bindings: vec![LifelineBinding {
+                    referenced: remote,
+                    local: f.receiver,
+                }],
+            },
+        )
+    });
+    let prepared = prepare(&p, f.owner, &[uses[1], uses[0]]).unwrap();
+    assert!(
+        prepared
+            .plan(slot(f.owner, Some(create)))
+            .unwrap_err()
+            .contains("lifeline_lifetime")
+    );
+    exact_transaction(
+        &p,
+        prepared.plan(slot(f.owner, Some(x))).unwrap(),
+        ordered(&p, f.owner, &[create, uses[0], uses[1], x, fragment, y]),
+    );
+}
+
+fn delete_line(p: &mut Project, parent: Id, sender: Id, receiver: Id) {
+    add(
+        p,
+        parent,
+        "Delete participant",
+        OccurrenceBody::Exchange {
+            exchange: None,
+            sender: Some(sender),
+            receiver: Some(receiver),
+            message_kind: MessageKind::Delete,
+            reply_to: None,
+            values: vec![],
+            operation: None,
+        },
+    );
+}
+
+fn second_operand(p: &mut Project, fragment: Id) -> Id {
+    let branch = occurrence(
+        p,
+        fragment,
+        "Other operand",
+        OccurrenceBody::Branch {
+            guard: "otherwise".into(),
+            occurrences: vec![],
+        },
+    );
+    let id = branch.id;
+    p.elements.insert(id, branch);
+    let Some(SharedBody::Occurrence {
+        body: OccurrenceBody::Fragment { branches, .. },
+        ..
+    }) = p.elements.get_mut(&fragment).unwrap().shared_mut()
+    else {
+        panic!()
+    };
+    branches.push(id);
+    id
+}
+
+#[test]
+fn conditional_delete_rejects_moving_an_earlier_use_after_the_fragment() {
+    let f = super::super::direct_tests::fixture();
+    let mut p = f.project;
+    let use_line = add(
+        &mut p,
+        f.owner,
+        "Use participant",
+        OccurrenceBody::Action {
+            action: None,
+            lifeline: Some(f.receiver),
+        },
+    );
+    let x = row(&mut p, f.owner, "X");
+    let (_, branch) = operand(&mut p, f.owner, FragmentOperator::Alternative);
+    delete_line(&mut p, branch, f.sender, f.receiver);
+    row(&mut p, f.owner, "Y");
+    oa_core::session::validate_candidate(&p).unwrap();
+    let prepared = prepare(&p, f.owner, &[x, use_line]).unwrap();
+    assert!(
+        prepared
+            .plan(slot(f.owner, None))
+            .unwrap_err()
+            .contains("lifeline_lifetime")
+    );
+}
+
+#[test]
+fn exclusive_operand_move_is_legal_but_parallel_baseline_is_invalid() {
+    for operator in [FragmentOperator::Alternative, FragmentOperator::Parallel] {
+        let f = super::super::direct_tests::fixture();
+        let mut p = f.project;
+        let (fragment, left) = operand(&mut p, f.owner, operator);
+        let right = second_operand(&mut p, fragment);
+        delete_line(&mut p, left, f.sender, f.receiver);
+        let use_line = add(
+            &mut p,
+            right,
+            "Use participant",
+            OccurrenceBody::Action {
+                action: None,
+                lifeline: Some(f.receiver),
+            },
+        );
+        let x = row(&mut p, right, "X");
+        let y = row(&mut p, right, "Y");
+        if operator == FragmentOperator::Alternative {
+            oa_core::session::validate_candidate(&p).unwrap();
+            exact_transaction(
+                &p,
+                prepare(&p, f.owner, &[x, use_line])
+                    .unwrap()
+                    .plan(slot(right, None))
+                    .unwrap(),
+                ordered(&p, right, &[y, use_line, x]),
+            );
+        } else {
+            // This is an invalid input control, not a valid model broken by reorder.
+            assert!(
+                oa_core::session::validate_candidate(&p)
+                    .unwrap_err()
+                    .to_string()
+                    .contains("lifeline_lifetime")
+            );
+            assert!(prepare(&p, f.owner, &[x, use_line]).is_err());
+        }
+    }
+}
+
+#[test]
+fn repeated_reply_warning_does_not_block_independent_sibling_reorder() {
+    let f = super::super::direct_tests::fixture();
+    let mut p = f.project;
+    let (_, branch) = operand(&mut p, f.owner, FragmentOperator::Loop);
+    p.elements
+        .get_mut(&f.owner)
+        .unwrap()
+        .steps_mut()
+        .unwrap()
+        .retain(|id| *id != f.reply);
+    p.elements.get_mut(&f.reply).unwrap().parent = Some(branch);
+    p.elements
+        .get_mut(&branch)
+        .unwrap()
+        .steps_mut()
+        .unwrap()
+        .push(f.reply);
+    let x = row(&mut p, branch, "X");
+    let y = row(&mut p, branch, "Y");
+    let z = row(&mut p, branch, "Z");
+    let warning = |project: &Project| {
+        oa_core::validation::validate(project).iter().any(|issue| {
+            issue.element == Some(f.reply)
+                && issue.code == "reply_repetition"
+                && issue.severity == oa_core::validation::Severity::Warning
+        })
+    };
+    assert!(warning(&p));
+    let expected = ordered(&p, branch, &[f.reply, y, x, z]);
+    assert!(warning(&expected));
+    exact_transaction(
+        &p,
+        prepare(&p, f.owner, &[z, x])
+            .unwrap()
+            .plan(slot(branch, None))
+            .unwrap(),
+        expected,
+    );
+}
+
+#[test]
+fn semantic_reorder_preserves_affected_and_unrelated_authored_layouts() {
+    use oa_core::{
+        Diagram, DiagramLayout, OccurrenceEndpoint, ProjectionKind, ScenarioLanePosition,
+        ScenarioLayout, ScenarioMessagePosition,
+    };
+    let f = super::super::direct_tests::fixture();
+    let mut p = f.project;
+    let x = row(&mut p, f.owner, "X");
+    let y = row(&mut p, f.owner, "Y");
+    p = ordered(&p, f.owner, &[f.call, x, f.reply, y]);
+    for (alias, offset) in [("group_saved_a", 0.), ("group_saved_b", 1500.)] {
+        let id = Id::new_v4();
+        p.diagrams.insert(
+            id,
+            Diagram {
+                id,
+                alias: alias.into(),
+                name: alias.into(),
+                description: "Preserve my layout".into(),
+                layer: Layer::Oa,
+                projection: ProjectionKind::Scenario { scenario: f.owner },
+                view_options: Default::default(),
+                nodes: Default::default(),
+                routes: vec![],
+                layout: Some(DiagramLayout::Scenario(ScenarioLayout {
+                    lanes: vec![
+                        ScenarioLanePosition {
+                            lifeline: f.sender,
+                            x: -300. + offset,
+                        },
+                        ScenarioLanePosition {
+                            lifeline: f.receiver,
+                            x: 700. + offset,
+                        },
+                    ],
+                    messages: vec![
+                        ScenarioMessagePosition {
+                            address: OccurrenceEndpoint {
+                                references: vec![],
+                                occurrence: f.call,
+                            },
+                            send_y: 123. + offset,
+                        },
+                        ScenarioMessagePosition {
+                            address: OccurrenceEndpoint {
+                                references: vec![],
+                                occurrence: f.reply,
+                            },
+                            send_y: 567. + offset,
+                        },
+                    ],
+                })),
+            },
+        );
+    }
+    let unrelated = p
+        .add_element(Kind::Scenario, Layer::Oa, "Unrelated scenario", None)
+        .unwrap();
+    let line = p
+        .add_element(
+            Kind::Lifeline,
+            Layer::Oa,
+            "Unrelated clock",
+            Some(unrelated),
+        )
+        .unwrap();
+    let timer = add(
+        &mut p,
+        unrelated,
+        "Wait",
+        OccurrenceBody::Exchange {
+            exchange: None,
+            sender: Some(line),
+            receiver: None,
+            message_kind: MessageKind::Timer {
+                expression: "5 s".into(),
+            },
+            reply_to: None,
+            values: vec![],
+            operation: None,
+        },
+    );
+    let diagram = Id::new_v4();
+    p.diagrams.insert(
+        diagram,
+        Diagram {
+            id: diagram,
+            alias: "group_unrelated_saved".into(),
+            name: "Unrelated arrangement".into(),
+            description: "Do not touch this view".into(),
+            layer: Layer::Oa,
+            projection: ProjectionKind::Scenario {
+                scenario: unrelated,
+            },
+            view_options: Default::default(),
+            nodes: Default::default(),
+            routes: vec![],
+            layout: Some(DiagramLayout::Scenario(ScenarioLayout {
+                lanes: vec![ScenarioLanePosition {
+                    lifeline: line,
+                    x: -123.,
+                }],
+                messages: vec![ScenarioMessagePosition {
+                    address: OccurrenceEndpoint {
+                        references: vec![],
+                        occurrence: timer,
+                    },
+                    send_y: 987.,
+                }],
+            })),
+        },
+    );
+    oa_core::session::validate_candidate(&p).unwrap();
+    exact_transaction(
+        &p,
+        prepare(&p, f.owner, &[f.reply, f.call])
+            .unwrap()
+            .plan(slot(f.owner, None))
+            .unwrap(),
+        ordered(&p, f.owner, &[x, y, f.call, f.reply]),
+    );
+}

crates/oa-desktop/src/behavior/state_view.rs

@@ -187,7 +187,7 @@ pub fn view<'a>(app: &'a App, machine: Id, mut out: Column<'a, Message>) -> Elem
     .into();
     out = out.push(
         column![
-            container(missing_controls).id("state-missing-picker"),
+            missing_controls,
             selection_controls(app),
             crate::diagram::focus::wrap(
                 canvas.map(event),

crates/oa-desktop/src/diagram.rs

@@ -993,10 +993,7 @@ impl canvas::Program<Message> for DiagramCanvas<'_> {
                             world,
                         ));
                     }
-                    return Some(
-                        Action::publish(Message::CanvasSelect(self.context, port.element))
-                            .and_capture(),
-                    );
+                    return Some(Action::publish(Message::Select(port.element)).and_capture());
                 }
                 if let Some(id) = self.hit(view, p) {
                     let position = self
@@ -1013,7 +1010,7 @@ impl canvas::Program<Message> for DiagramCanvas<'_> {
                     .hit_label(&scene.routed, p)
                     .or_else(|| self.hit_association_label(&scene.routed, p))
                 {
-                    Some(Action::publish(Message::CanvasSelect(self.context, id)).and_capture())
+                    Some(Action::publish(Message::Select(id)).and_capture())
                 } else if let Some((id, segment)) = self.hit_edge(&scene.routed, p) {
                     if id == self.selected
                         && self.editable
@@ -1029,7 +1026,7 @@ impl canvas::Program<Message> for DiagramCanvas<'_> {
                         self.begin_route(state, world, Handle::Bend(index), route);
                         Some(Action::capture())
                     } else {
-                        Some(Action::publish(Message::CanvasSelect(self.context, id)).and_capture())
+                        Some(Action::publish(Message::Select(id)).and_capture())
                     }
                 } else {
                     state.pan_start = Some((mouse::Button::Left, p));
@@ -2444,7 +2441,7 @@ mod tests {
         .unwrap()
         .into_inner()
         .0;
-        assert!(matches!(selected,Some(Message::CanvasSelect(_, id)) if id==port.element));
+        assert!(matches!(selected,Some(Message::Select(id)) if id==port.element));
         let request = canvas.context_request(
             &state,
             click,
@@ -3057,7 +3054,7 @@ mod tests {
                 let mut state = State::default();
                 assert_eq!(canvas.hit_association_label(&routed, at), Some(edge));
                 assert!(
-                    matches!(pointer(&canvas,&mut state,mouse::Event::ButtonPressed(mouse::Button::Left),at),Some(Message::CanvasSelect(_, id)) if id==edge)
+                    matches!(pointer(&canvas,&mut state,mouse::Event::ButtonPressed(mouse::Button::Left),at),Some(Message::Select(id)) if id==edge)
                 );
                 assert!(
                     state.route_drag.is_none(),
@@ -3107,7 +3104,7 @@ mod tests {
         let center = scene.routed.edges[&edge].label.center;
         let screen = point(center) + canvas.pan;
         assert!(
-            matches!(pointer(&canvas,&mut state,mouse::Event::ButtonPressed(mouse::Button::Left),screen),Some(Message::CanvasSelect(_, id)) if id==edge)
+            matches!(pointer(&canvas,&mut state,mouse::Event::ButtonPressed(mouse::Button::Left),screen),Some(Message::Select(id)) if id==edge)
         );
         canvas.selected = edge;
         pointer(

crates/oa-desktop/src/diagram/pointer_tests.rs

@@ -179,7 +179,7 @@ fn coalesced_port_drag_commits_once_through_app_and_source_history() {
             zoom,
         );
         assert_eq!(messages.len(), 2);
-        assert!(matches!(&messages[0],Message::CanvasSelect(_, id)if *id==output));
+        assert!(matches!(&messages[0],Message::Select(id)if *id==output));
         assert!(
             matches!(&messages[1],Message::PortAnchor(port_edit::Event::Commit(_,_,anchor))if anchor.port==output&&anchor.side==PortAnchorSide::Top)
         );
@@ -251,7 +251,7 @@ fn menu_captured_motion_must_not_turn_following_click_into_old_port_drag() {
         b,
     );
     let picked = match &press {
-        Message::CanvasSelect(_, id) => Some(*id),
+        Message::Select(id) => Some(*id),
         _ => None,
     };
     let release_debug = format!("{release:?}");
@@ -300,7 +300,7 @@ fn drag_from_already_selected_stationary_port_keeps_source_between_batches() {
     .filter_map(|e| event(&c, &mut state, e, b))
     .collect();
     assert!(
-        matches!(messages.first(),Some(Message::CanvasSelect(_, id)) if *id==output),
+        matches!(messages.first(),Some(Message::Select(id)) if *id==output),
         "Stationary source was lost between batches: {messages:?}"
     );
     assert!(

crates/oa-desktop/src/diagram/port_hit_tests.rs

@@ -165,7 +165,7 @@ fn nested_owner_palette_selection_drag_and_context_menu_pick_the_same_port() {
         .unwrap()
         .into_inner()
         .0;
-        assert!(matches!(press, Some(Message::CanvasSelect(_, id)) if id == port.element));
+        assert!(matches!(press, Some(Message::Select(id)) if id == port.element));
         assert_eq!(state.port_drag.as_ref().unwrap().anchor.port, port.element);
         let menu = canvas.context_request(&state, at, bounds);
         assert_eq!(menu.object, port.element);

crates/oa-desktop/src/diagram/port_labels.rs

@@ -375,7 +375,7 @@ mod tests {
                 messages.extend(message);
             }
         }
-        assert!(matches!(messages.first(), Some(Message::CanvasSelect(_, id)) if *id == port));
+        assert!(matches!(messages.first(), Some(Message::Select(id)) if *id == port));
         assert!(
             matches!(messages.last(), Some(Message::PortAnchor(crate::port_edit::Event::Commit(_, _, anchor))) if anchor.port == port && anchor.side == PortAnchorSide::Top)
         );

crates/oa-desktop/src/guide.rs

@@ -322,7 +322,6 @@ fn article(topic: Topic) -> Article {
                             "Show a correspondence between OA and SA",
                             &[
                                 "Choose OA ↔ SA traceability in View content. Changing this setting does not create counterparts or add their placements, so an existing single-layer diagram can initially look unchanged.",
-                                "Switching back to Architecture or another single-layer projection shows only that view's layer. The other layer's placements, routing and saved visibility remain stored; return to OA ↔ SA traceability to show them again, subject to the view's filters. Selecting a displayed card, port or line and opening its Properties keeps the current view and perspective.",
                                 "Use Review layer traces to inspect named Operational and System endpoints and the meaning of their link. This opens the model's layer-trace list with no search restriction; traces between relationships are reviewed here rather than drawn between element cards.",
                                 "In the chosen architecture view, use Add existing elements. The chooser offers compatible elements from both layers. Select an existing endpoint and click its position in the canvas; repeat for the other end if needed. This adds a placement, not a new semantic element or trace. For port correspondences, place the ports' owners.",
                                 "The view shows correspondence lines alongside ordinary relationships. The shown-line count reflects the current projection and visibility settings, not trace coverage. If a line is hidden, use View visibility and inspect Saved view visibility; placing an endpoint does not remove explicit hides or filters.",

crates/oa-server/tests/http/source6_views.rs

@@ -372,150 +372,3 @@ async fn source6_http_explicit_communication_ports_preview_apply_and_restart_pre
     assert_pair(&reopened);
     server.stop().await;
 }
-
-#[tokio::test]
-async fn mixed_traceability_projection_roundtrip_preserves_dormant_http_state() {
-    let f = fixture();
-    let mut model = compile_bundle(&f.bundle, ProjectLimits::default())
-        .unwrap()
-        .decoded
-        .project;
-    let view = model.diagrams.get_mut(&f.diagram).unwrap();
-    view.layer = Layer::Sa;
-    view.projection = ProjectionKind::Traceability;
-    // The OA placements and category are intentionally opposite the view's layer.
-    view.view_options.hidden_edges = vec![f.mean];
-    for (index, element) in f.sa.into_iter().enumerate() {
-        model.place(
-            f.diagram,
-            element,
-            Position {
-                x: index as f32 * 400.,
-                y: 300.,
-            },
-        );
-    }
-    let mut bundle = f.bundle.clone();
-    bundle.files.insert(
-        bundle.entry.clone(),
-        format!(
-            "// Authored source-6 engineering rationale\n{}",
-            oa_core::language::format(&model).replacen(
-                "{\n",
-                "{\n    include \"notes.arcadia\";\n",
-                1
-            )
-        ),
-    );
-    let directory = tempfile::tempdir().unwrap();
-    let server = TestServer::start(directory.path(), None).await;
-    let original = import(&server, &bundle).await;
-    assert_pair(&original);
-    let resource = original.resource_id;
-    let mixed = oa_core::projection::project_view(&original.model, f.diagram);
-    assert!(
-        f.oa.iter()
-            .chain(&f.sa)
-            .all(|id| mixed.nodes.iter().any(|n| n.element == *id))
-    );
-
-    let mut ordinary = original.model.diagrams[&f.diagram].clone();
-    ordinary.projection = ProjectionKind::Allocation;
-    let response = transact(
-        &server,
-        &original,
-        vec![Command::EditDiagram(f.diagram, ordinary.clone())],
-    )
-    .await;
-    let status = response.status();
-    let etag = response
-        .headers()
-        .get("etag")
-        .map(|v| v.to_str().unwrap().to_owned());
-    let result: Value = response.json().await.unwrap();
-    assert_eq!(status, StatusCode::OK, "{result}");
-    assert_eq!(result["changed"], true);
-    assert_eq!(result["dry_run"], false);
-    assert_eq!(result["revision"], original.revision + 1);
-    let changed = server.get(resource).await;
-    assert_eq!(etag.as_deref(), Some(changed.etag().as_str()));
-    let mut expected = original.model.clone();
-    expected.diagrams.insert(f.diagram, ordinary.clone());
-    assert_eq!(
-        changed.model, expected,
-        "only the projection changes; dormant state is retained"
-    );
-    assert_pair(&changed);
-    assert_eq!(
-        changed.source_project.files["notes.arcadia"],
-        bundle.files["notes.arcadia"]
-    );
-    assert!(
-        changed.source_project.files[&bundle.entry]
-            .starts_with("// Authored source-6 engineering rationale\n")
-    );
-    let projected = oa_core::projection::project_view(&changed.model, f.diagram);
-    assert!(projected.nodes.iter().all(|n| !f.oa.contains(&n.element)));
-    assert!(
-        f.sa.iter()
-            .all(|id| projected.nodes.iter().any(|n| n.element == *id))
-    );
-
-    // A dormant option still must name an existing category. Rejection must not
-    // advance the ETag or rewrite either side of the persisted model/source pair.
-    let disk = directory.path().join(format!("{resource}.json"));
-    let accepted_bytes = std::fs::read(&disk).unwrap();
-    ordinary.view_options.participant_categories = CategorySelection::Any(vec![Id::new_v4()]);
-    let rejected = transact(
-        &server,
-        &changed,
-        vec![Command::EditDiagram(f.diagram, ordinary)],
-    )
-    .await;
-    assert_eq!(rejected.status(), StatusCode::UNPROCESSABLE_ENTITY);
-    let retained = server.get(resource).await;
-    assert_eq!(retained.etag(), changed.etag());
-    assert_eq!(
-        serde_json::to_value(&retained).unwrap(),
-        serde_json::to_value(&changed).unwrap()
-    );
-    assert_eq!(std::fs::read(&disk).unwrap(), accepted_bytes);
-    server.stop().await;
-
-    let server = TestServer::start(directory.path(), None).await;
-    let reopened = server.get(resource).await;
-    assert_eq!(
-        serde_json::to_value(&reopened).unwrap(),
-        serde_json::to_value(&changed).unwrap()
-    );
-    assert_pair(&reopened);
-    let response = transact(
-        &server,
-        &reopened,
-        vec![Command::EditDiagram(
-            f.diagram,
-            original.model.diagrams[&f.diagram].clone(),
-        )],
-    )
-    .await;
-    let status = response.status();
-    let result: Value = response.json().await.unwrap();
-    assert_eq!(status, StatusCode::OK, "{result}");
-    assert_eq!(result["changed"], true);
-    assert_eq!(result["revision"], changed.revision + 1);
-    let restored = server.get(resource).await;
-    assert_eq!(restored.model, original.model);
-    assert_pair(&restored);
-    assert_eq!(
-        restored.source_project.files["notes.arcadia"],
-        bundle.files["notes.arcadia"]
-    );
-    let projected = oa_core::projection::project_view(&restored.model, f.diagram);
-    assert!(
-        f.oa.iter()
-            .chain(&f.sa)
-            .all(|id| projected.nodes.iter().any(|n| n.element == *id))
-    );
-    assert!(!projected.edges.iter().any(|edge| edge.id == f.mean));
-    server.stop().await;
-}

crates/oa-server/tests/semantic_schema.py

@@ -147,7 +147,7 @@ schemas["ViewOptions"] = obj({
     "coverage": {**ref("Coverage"), "default": "All"},
     "work_contexts": {**ref("ContextSelection"), "default": "All"},
     "exchange_labels": {**ref("ExchangeLabels"), "default": "Name"}}, [])
-schemas["ViewOptions"]["description"] = "Presentation only. Independent predicates intersect; category members union within a family. Only([]) hides all relations and traces. Any([]) remains an explicit empty selection. String projections preserve both-layer hidden/category/context references and latent placements; only Traceability renders both layers. Typed StateMachine/Scenario views retain layer-scoped admission. Filtering preserves unfiltered automatic port positions."
+schemas["ViewOptions"]["description"] = "Presentation only. Independent predicates intersect; category members union within a family. Only([]) hides all relations and traces. Any([]) remains an explicit empty selection. Traceability permits both-layer hidden/category/context references; ordinary projections require the diagram layer. Filtering preserves unfiltered automatic port positions."
 schemas["Diagram"]["properties"]["view_options"] = {**ref("ViewOptions"), "default": {}}
 
 def upsert_variant(variants, name, value):

docs/api.rst

@@ -570,15 +570,8 @@ retain their identities and contracts; migration does not silently replace them.
 ``coverage`` and ``work_contexts``, and ``Name`` for ``exchange_labels``.
 ``{"Only":[]}`` hides all relation and trace lines; ``{"Any":[]}`` preserves
 an explicit empty category/context selection. Category members union within
-each family, and independent filters intersect. String projections permit saved
-references and placements from both layers. Only ``Traceability`` renders both;
-other string projections filter to the diagram's declared layer. ``EditDiagram``
-may change between these projections without deleting latent placements, routes
-or visibility choices. Returning to Traceability restores their applicability.
-Typed StateMachine/Scenario views retain their strict membership and layer checks.
-Missing objects, wrong reference kinds/families and duplicate selections remain
-invalid. Frozen versions 1–6 keep their prior layer admission before migration;
-older version-7 implementations may reject these newly accepted ordinary views.
+each family, and independent filters intersect. ``Traceability`` permits
+references from both layers; ordinary projections require the diagram's layer.
 These presentation choices preserve semantic records, routes, placements and
 the automatic port positions derived from unfiltered eligible exchanges.
 

docs/language.rst

@@ -409,12 +409,8 @@ filters rather than widening them to All.
 
 Traceability views retain their established two-layer projection: default options
 preserve eligible OA and SA lines. Their hidden-edge, category and context
-references may therefore select either layer. Ordinary string projections retain
-these references from either layer as saved presentation choices; they still
-render only their declared layer. Switching projections MUST preserve those
-choices, including explicit empty selections. Existing-object, reference-kind,
-family and uniqueness constraints still apply. Typed StateMachine and Scenario
-views retain layer-scoped reference admission. A filter never hides the other
+references may therefore select either layer. All ordinary projections require
+these references in the declared diagram layer. A filter never hides the other
 layer merely because the Traceability diagram has an OA or SA layer label.
 
 Versions 1–5 reject the new relation, category constructor, diagram field (even
@@ -1077,20 +1073,6 @@ capabilities with their involvement, exploitation, include, extend and
 generalization links. Decomposition and Overview retain general containment;
 Overview also exposes all relationships. These string projections hide
 inapplicable placements without deleting them or changing semantic records.
-This includes opposite-layer placements retained after leaving Traceability.
-Changing between string projections changes only the projection value; placement
-identities, positions, sizes, collapsed state, port anchors, routes and visibility
-choices remain authored. Returning to Traceability restores their applicability.
-Ordinary views MUST NOT render opposite-layer nodes, parents, ports or lines.
-This current-version admission correction does not broaden frozen source/JSON
-versions 1–6: their layer-scoped placement and visibility checks remain required
-before migration. Earlier version-7 implementations can reject ordinary views
-containing these retained opposite-layer records.
-
-The explicit RelocateNode operation moves a placement to a different diagram
-only when its element belongs to the destination layer or the destination is
-Traceability. Retaining an existing hidden placement through a projection change
-does not authorize a relocation that immediately hides it in another layer.
 
 A StateMachine projection MUST reference an existing StateMachine in the
 diagram's layer. Its placements MUST refer to that machine, its Regions, or

docs/openapi.json

@@ -12490,7 +12490,7 @@
         },
         "required": [],
         "additionalProperties": false,
-        "description": "Presentation only. Independent predicates intersect; category members union within a family. Only([]) hides all relations and traces. Any([]) remains an explicit empty selection. String projections preserve both-layer hidden/category/context references and latent placements; only Traceability renders both layers. Typed StateMachine/Scenario views retain layer-scoped admission. Filtering preserves unfiltered automatic port positions."
+        "description": "Presentation only. Independent predicates intersect; category members union within a family. Only([]) hides all relations and traces. Any([]) remains an explicit empty selection. Traceability permits both-layer hidden/category/context references; ordinary projections require the diagram layer. Filtering preserves unfiltered automatic port positions."
       },
       "CommunicationPortChoice": {
         "oneOf": [

harness/STATE.md

@@ -9,8 +9,7 @@ excluded by the user's explicit request, including after networking recovers.**
 
 ## Assembled source and acceptance boundary
 
-Combined code through **4deced53b98cd4d7649ba7aa60fa4b9b30d2f3b8**, plus the
-test-only import correction from **7c2b06b63f8a0fe14b3f001996bdf965b36a4e85**, adds the reviewed
+Combined code **4deced53b98cd4d7649ba7aa60fa4b9b30d2f3b8** adds the reviewed
 Connection/Route early-admission correction to the assembled Scenario/Text,
 ordinary/State/Process/Allocation selection, direct drawing, Traceability and
 picker changes. The [source handoff](prerelease-integrated-source-20260924.md)
@@ -22,16 +21,7 @@ claim combined Cargo, native, packaged or release acceptance. The independent
 further material source defect in its stated scope. A subsequent peer compile
 found a missing `projection::` qualification in the new Route test helper;
 the current code includes that one-line correction. The original compile failed
-before running tests. The first combined compile at `897d9f04` subsequently
-found a missing `text_editor` import in the Allocation Text Apply regression;
-the current source includes that one-line correction too. Both failures remain
-recorded in the source handoff. The subsequent full test run at `8ddfadf4`
-failed the mounted State picker fixture: added selection controls invalidated
-its canvas-relative clicks. Source successor `a9cd364eacbbffa0693bab05b5a2b65f9d105535`
-measures an identified fixed-height picker slot and checks Escape capture,
-retaining the exact preservation/reopen/Place/Undo assertions. The source
-handoff links the preserved failed and interrupted attempts. Corrected combined
-Windows execution and package acceptance remain pending.
+before running tests. Combined execution remains pending.
 
 Live build, final-source and publication results belong in
 [issue37](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/37).

harness/connection-icons-20260925.md

@@ -1,11 +0,0 @@
-# Connection tool icons
-
-Branch candidate for [#41](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/41), based on published Windows preview source `715036e132677dd2bc2fb37ed316d93dc9987aec`. This is not integrated or native acceptance.
-
-The reported collapsed palette repeats one arrow for three different tools. Extend the existing Rust/Iced canvas glyphs at their actual 16×16 size: work endpoints plus an arrow for Interaction/Functional exchange, neutral participant endpoints for Communication means, facing component ports for Boundary exchange, and work entering a performer for Allocation. The first pair never coexist in one perspective. Unoriented generic tools must not imply a fixed direction.
-
-Letter badges were rejected as language-dependent and cramped. Different arrow/dash styles risk confusing tool identity with relation direction. Native endpoint/container shapes fit the existing icon system without font or asset dependencies. Preserve button dimensions, explicit labels/tooltips, ordering, messages, availability and selection rules.
-
-Independent source critique found no blocker and confirmed the tool semantics and Iced API use. Actual-size legibility remains unverified, particularly the exchange arrow, port details and possible download/import interpretation of Allocation. Verify enabled, disabled, hovered and selected palettes in both perspectives, expansion/collapse, tool activation, representative relation creation and cancellation. Existing keyboard/accessibility behavior must be checked, not inferred from hover labels. Reuse semantic connection tests; geometry hashes alone are not an identification or usability evaluator.
-
-Linux remains excluded by the existing user pause. Live ownership and integration status belong to the linked issue.

harness/multiselect-contract-20260923.md

@@ -62,9 +62,11 @@ command or source schema is unnecessary. Preview and commit must consume the
 same plan; tests independently construct expected geometry rather than merely
 comparing those two uses of the implementation.
 
-Process and Scenario layouts are derived from semantic order, not free XY node
-placements. Their group drag must reorder a stable block while retaining its
-internal order and applicable owner/column/operand boundaries. Existing topology
+Process reorder and Scenario occurrence reorder change semantic sequence order.
+Saved Scenario presentations can additionally store lane/message coordinates;
+semantic group reordering preserves those authored records. A sequence group drag
+must reorder a stable block while retaining its internal order and applicable
+owner/column/operand boundaries. Existing topology
 and temporal/lifecycle validation remains authoritative. Qualified reused
 Process content must not silently edit the reusable definition. These adapters
 are required work for the issue, not waived because ordinary diagrams are easier.
@@ -84,8 +86,11 @@ The [explicit Arrange amendment](allocation-arrange-amendment-20260923.md) defin
 the bounded one-or-more work/performer footprint and diagnostic collision domain.
 Its [pure planner evidence](allocation-arrange-planner-20260923.md) and the
 [ordinary assignment foundation](allocation-assignment-planner-20260923.md)
-establish bounded source/planner behavior. App/native group input acceptance
-remains pending.
+establish bounded source/planner behavior. The [Allocation App/native checkpoint](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/57aec979f640ba1b8aa6fcbb7d9e26b29cf51596/harness/allocation-group-app-20260924.md)
+adds bounded Windows group assignment, explicit Arrange and ordinary performer
+acceptance; its limitations and source identity remain explicit. The
+[Scenario reorder policy](scenario-group-reorder-policy-20260924.md) defines the
+strict sibling-block increment without implying adapter or removal acceptance.
 
 ## Related group actions
 

harness/prerelease-integrated-source-20260924.md

@@ -80,30 +80,6 @@ actionable defect in the stated boundary. These do not substitute for the final
 combined execution. The vendor patch-description correction is incorporated at
 `17eaa03fd69741dff746f21d150dc04c341411b3`.
 
-## Mounted State picker correction
-
-The combined Windows test run at `8ddfadf440b5c208b1adb6b211a97ba0c99cff04`
-failed the mounted State missing-picker Escape regression. The test located the
-picker relative to the canvas, but the integrated selection toolbar adds 56px
-plus an 8px gap between them. Both the opening and option clicks were stale.
-Parent and independent source inspection agreed on this fixture defect; they
-found no reason to change the production Escape policy from this failure.
-
-Successor `a9cd364eacbbffa0693bab05b5a2b65f9d105535` adds a zero-padding
-identified container around the existing fixed-height picker slot. The fixture
-measures that slot, checks Escape capture before App subscriptions, and retains
-zero messages, exact document/source/selection/camera/revision/history,
-reopen-and-Place, and exact source Undo checks. The option coordinate assumes
-this fixture's single downward-opening menu at 1800 by 1100; it is not a general
-overlay geometry evaluator. No production Escape handler changes.
-
-The peer records 2,199 passes, one failure and eight ignores for that failed
-full run, with lint and product builds not run. The earlier final-02 attempt
-was interrupted during harness listing before test bodies; neither attempt is
-a passed gate. [Preserved attempts and v2 recipe](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/184c1307d1ae3d49007480020fa1c080c94ececa/harness/prerelease37-windows-gates-20260924/attempts-8dd)
-retain their distinct boundaries. The corrected source requires current
-combined Windows gates and packaged native acceptance.
-
 ## Combined gates and package handoff
 
 The first peer compilation exposed E0425 in the new Route fixture: its
@@ -114,16 +90,6 @@ single test line. Production code is unchanged. This concrete finding supersedes
 the earlier `9e99618c` build handoff; the failed compile ran no tests and remains
 part of the peer's evidence. Source review and formatting did not catch it.
 
-The first combined Windows attempt on `897d9f04` then found E0433 in the
-Allocation Text Apply test added at `542b10ac`: the test's module lacked
-`iced::widget::text_editor`. The current successor incorporates peer
-`7c2b06b63f8a0fe14b3f001996bdf965b36a4e85`, adding that import only. Production
-code remains unchanged. The failed combined compile ran no tests, lint or
-product build; its 3,709 source inputs stayed unchanged and formatting passed.
-[Preserved failure evidence](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/2bd0e615204be728b5c2b77cc7e28504c18a2277/harness/prerelease37-windows-gates-20260924/README.md)
-records that distinct failure. The corrected successor requires fresh combined
-execution; no earlier pass is substituted.
-
 Codex-ytr83r owns the exact-candidate Windows build/package on its separate
 machine. Codex-9e8r6t owns independent source/seam review and a downloaded-package
 check. Codex-956atf remains the sole integration, tag and release publication owner.

harness/projection-navigation-20260925.md

@@ -1,87 +0,0 @@
-# Projection switching and canvas inspection
-
-Branch contribution for [#42](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/42)
-and [#43](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/43),
-based on published preview `715036e132677dd2bc2fb37ed316d93dc9987aec`.
-Owner: Codex-ytr83r, session 01a0d706. This is a candidate, not integrated
-acceptance or a replacement release. Live status belongs to the linked issues.
-
-## Decision and alternatives
-
-String projections are presentation filters over one authored diagram. Preserve
-opposite-layer placements, routes and visibility selections when switching away
-from Traceability; ordinary projections render only their declared layer. This
-extends the existing documented preservation of inapplicable element kinds.
-Deleting incompatible placements loses authored arrangements; automatically
-creating a second view fragments the user's work and makes repeated switching
-ambiguous. Neither alternative satisfies reversible view switching as directly.
-
-Missing identities and wrong reference kinds/families remain errors. StateMachine
-and Scenario keep strict typed membership. Frozen versions 1–6 retain their old
-layer admission before migration. The current version-7 correction adds no fields
-or wire shapes; older version-7 readers may reject newly admitted latent records.
-That compatibility limit must remain explicit until coordinated version adoption.
-The explicit RelocateNode operation continues to require a compatible destination
-layer or Traceability view; retaining latent records is distinct from moving a
-placement into an incompatible destination.
-
-Canvas inspection carries the originating route context and preserves view/layer.
-Explicit model navigation continues to follow the target layer. Draft validation
-and stale-context rejection apply before inspection. Existing production group
-selection already retained the canvas; fallback edge/port selection and canvas
-context actions require the correction. The published Windows baseline reproduces both reported failure states;
-source diagnosis and those baseline results do not establish patched acceptance.
-Contextual child/relationship creation must derive the semantic layer from the
-selected object, while root creation continues to use the active perspective.
-
-## Acceptance
-
-- OA and SA switches through all ordinary projections preserve the complete model
-  except projection, source/JSON/bundle round trips, and one-step Undo/Redo.
-- Returning to Traceability restores applicable placements; parent, port and edge
-  projection never leaks an opposite-layer record into an ordinary view.
-- Invalid references and State/Scenario membership still reject; source and JSON
-  versions 3–6 retain their old layer checks and located diagnostic identities.
-- Actual canvas clicks, context Properties/Hide and explicit navigation exercise
-  the intended selection distinction; stale packets and invalid drafts preserve
-  selection and source/history.
-- Windows native selection, projection switching, Save, Undo/Redo and fresh reopen
-  are checked against predeclared full-model/source expectations. Compilation and
-  automated handler tests do not substitute for this acceptance.
-
-Linux remains excluded by the existing user pause. Independent design critique
-identified saved visibility selectors and frozen migration as additional admission
-paths; both are included. At published candidate `603a59c1785dbcca324dae063ecc3405d9519a30`, 41 targeted core checks pass: legacy admission (2), projection switching (3), review regressions (15), source-6 view contract (8), and state diagrams (13). Tracked inputs were unchanged across the run. Whole-workspace formatting also passed at that commit. The first `0341bca` core attempt failed a generated-UUID test oracle; explicit fixture identities corrected the evaluator, without relaxing the admission assertion.
-
-The desktop attempt at `603a59c` was deliberately interrupted before test execution after independent source review found canvas Properties redispatch and contextual relationship/child semantic-layer defects. Its source inputs remained unchanged; no desktop passing result is claimed. The Properties issue arose from fixing explicit navigation to an already-inspected opposite-layer object. Keep both regressions: contextual Properties stays in the view, explicit navigation follows the object's layer.
-
-Published-preview executable SHA256 `2c03bd6cc3f1110c219e4f57ab94874a121590f83779239a93289b7170664399` reproduces edge selection changing SA to OA, and Architecture switching refused with `diagram_layer`. The isolated valid fixture remained byte-for-byte unchanged after the trial. An earlier fixture used reserved alias `capability` and was rejected; it was corrected before either reproduction. Initial native-dialog capture/input failures also remain separate from application acceptance. Independent evidence review confirmed the resulting screenshot states and persisted byte equality; screenshots alone do not capture the complete action sequence or transient state history.
-
-The frozen full-workspace attempt at `3a7221b80cfa7924921b3b77f2dd35550247f595`
-closed with unchanged tracked inputs and Cargo exit101: core/CLI groups passed616
-with1 existing ignore; desktop passed1538, failed1 and retained7 existing ignores.
-The sole failure was the new preferred-view test's setup, before child creation:
-`Message::Projection` edits and selects the diagram, so the test's expectation
-that the parent remained selected was false. An exact isolated rerun and source
-review confirmed this. The correction initializes the projection in the fixture,
-then uses explicit parent selection and the ordinary diagram picker to establish
-independent semantic inspection. Production navigation is unchanged. All other
-new canvas tests passed, including Properties, explicit navigation, relationship
-Apply/history, child/root semantic layer, and projection/source/history checks.
-The command remains a failed workspace run; server tests and doctests were not
-reached. Its planned Clippy/build stages were consequently not launched.
-
-The same source's formatting check found one multiline icon call requiring a
-single line. The follow-up applies that formatting correction and adds in-app
-help describing preserved cross-layer content and contextual inspection. Those
-are the only production-file changes after the full suite; the remaining change
-corrects the test setup. Follow-up canvas/server/doctest, formatting, strict
-Clippy and native-build results must be recorded separately, with their exact
-source pin. Reuse successful unchanged core/desktop evidence within these limits;
-do not turn the failed workspace command into a pass.
-
-Candidate Windows GUI save/history/reopen, HTTP regression, the corrected test
-and final checks remain outstanding. Raw local evidence is not yet a
-peer-consumable handoff; publish the consolidated evidence before integration.
-
-Scope boundary: contextual relationship forms retain the canvas while opening; successful Apply retains the existing explicit post-review navigation. The generic child-creation handler is tested for containment and allocation, but the separate architecture palette/performer workflow still offers creation kinds for the diagram layer. Thus an OA performer displayed in an SA Traceability view has no Add activity menu entry; this inherited limitation is not claimed repaired here.

harness/scenario-group-reorder-policy-20260924.md

@@ -0,0 +1,43 @@
+# Scenario group reorder policy
+
+Derived from [issue 29](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/29) and the [multiple-selection contract](multiselect-contract-20260923.md). Accepted design for the next Scenario adapter; this document alone establishes no implementation, native, integration or release acceptance. The original decision inspected `495464e84b5bae8ddad93e9fc69ef353e7f1c884`; the post-prerelease port additionally inspects the combined base `897d9f049406d5be597543eb0a6755b796259302` and preserves its saved Scenario presentation model.
+
+## Operation and identity
+
+A Scenario drag changes semantic sequence order. It moves the exact selected local occurrences as one stable block inside their common immediate Scenario or Branch parent. It does not edit free XY positions, migrate operands, change a referenced definition or automatically select dependencies.
+
+Saved Scenario layouts are separate presentation records. Semantic reorder preserves all authored lane/message coordinates, metadata and other views exactly, even when the changed order requires derived presentation to accommodate those preferences. A future group presentation move is a separate capability; this increment does not silently reinterpret stored coordinates as sequence order. App admission must distinguish the active saved/derived representation and its visit lifetime, including a same-owner representation round trip.
+
+Eligible bodies are Exchange (including lifecycle and timer messages), Action, State, ScenarioUse and Fragment. A Fragment moves as one occurrence; its branches and descendant lists remain unchanged. Lifelines, Branch headers, Process-only occurrence bodies and other typed targets are unsupported movement members. Cross-parent sets and a Fragment plus one of its descendants refuse as a whole. These objects may still be selected and inspected; selection is not movement permission.
+
+Every original target must exist, have its actual eligible body, belong to the same immediate parent and occur exactly once in that parent's list. Check the entire edited list, including unselected entries, for duplicate/missing IDs, body and parent mismatches. The selected parent must be reachable from the active Scenario through the actual sequence lists and Fragment branch lists. An ancestor pointer alone cannot authorize a hidden Branch omitted from its Fragment. The App must also admit against exact current rendered visibility.
+
+An unlisted child is a supported warning-only authoring state: leave it unlisted and unchanged. Integrity of the edited list does not require every parented element to appear in it. Missing optional reference/binding information or loop warnings must not become blanket movement errors. The existing full-project error validator remains authoritative.
+
+## Stable-block transformation
+
+Let `S` be the original parent list and `T` the exact selected set. Form `B` by retaining members of `T` in their order in `S`; form `R` from the other members. The destination is an exact `Slot { parent, before }`.
+
+1. Complete typed/list/reachability admission and validate the unchanged baseline before any no-op result.
+2. Require the destination's same parent and an existing exact anchor, or append.
+3. If the anchor is selected, leave `S` exactly unchanged. Do not normalize to a neighboring row or compact a noncontiguous selection.
+4. Otherwise insert all of `B` before the anchor in `R`, or append. Exact unchanged order is a no-op.
+5. Validate the complete executed candidate. On success use one `SetSteps` transaction; on error change nothing.
+
+For `S=[A,B,C,D]`, selecting C then A and dropping before D produces `[B,A,C,D]`, regardless of primary or pressed member. Dropping that same set before C leaves `[A,B,C,D]`. Selecting `[Call,Reply]` preserves that internal order; it never implicitly selects another reply or expands a referenced Scenario.
+
+Full candidate validation includes unselected descendants. Moving a Fragment ahead of an external Call can invalidate a nested Reply; moving an occurrence with local lifeline use before Create or after a possibly coexecuting Delete must be refused. ALT exclusivity and PAR coexecution cannot be inferred from painted row order. Opaque ScenarioUse bindings remain local lifetime uses under the existing validator, without interprocedural expansion.
+
+## Gesture and transaction requirements
+
+Capture immutable model and exact selection identity before movement. Cache proposals by distinct Slot, not pointer pixels. Before release, verify document, surface, revision, epoch, selection generation and complete membership; refuse a stale set before reconciliation can prune it. Recompute against the same accepted snapshot and execute once through Document. Successful source updates, Undo and Redo each remain one transaction. Refusal and no-op preserve model, source, history branch, selection and primary.
+
+Use the nearest displayed slot, then apply parent admission. A farther legal slot must not replace a nearer invalid operand destination. Feedback identifies the selected count, destination/parent and refusal or no-change reason. A Fragment's interior can contain invalid operand slots even when a header anchor would be a no-op. Pointer/camera/focus lifetime, real selection modifiers and native readability need separate adapter verification; a passing pure planner does not establish them.
+
+## Alternatives and acceptance
+
+Contiguous-only selection rejects useful sibling groups without simplifying nested temporal validation. Stable semantic ordering is therefore preferred. Parent/child normalization silently drops selected intent, while automatic call/reply expansion has no unique closure in the presence of alternative replies, loops and nested fragments. Strict refusal keeps this first increment precise. Revisit these decisions only with an explicit user workflow and a compatible whole-set specification.
+
+Discriminating evaluators include literal whole-Project transformations at root and operand levels, noncontiguous order versus click order, selected-anchor/unchanged no-op with existing redo, malformed unselected entries, omitted Branch reachability, warning-only unlisted children, nested reply/lifetime failures and legal nested-fragment movement. Successful cases must preserve every other sequence, binding, relation, value, ID and metadata record. Use independent source round trips and one-step Document history, not preview/commit agreement alone.
+
+Aggregate removal remains separate required work. Until it exists, an interface displaying a group must refuse legacy primary-only Remove/Delete/reorder actions. Live ownership and progress remain in issue 29.