Sync agent instructions from main

Publish verified canvas and repair Windows prerelease checkpoint
Record verified Windows canvas and repair package acceptance
2026-09-13 11:38:55 +03:00 · 2026-09-12 05:06:18 -07:00 · 2026-09-12 04:59:48 -07:00 · 2026-09-12 04:26:03 -07:00 · 2026-09-12 04:06:16 -07:00 · 2026-09-12 04:02:45 -07:00
1724 changed files with 176360 additions and 3673 deletions
@@ -20,6 +20,9 @@ harness/fixtures/release1-native/** -text
 harness/fixtures/interface-operation-probe/** -text
 harness/history/2026-09-06-ledgers-before-consolidation/** -text
 harness/history/2026-09-10-ledgers-before-continuation-refresh/** -text
+harness/history/2026-09-10-ledgers-before-second-consolidation/** -text whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol
+harness/experiments/textual-authoring-20260911-local/** -text whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol
+harness/history/2026-09-11-ytr83r-integration/** -text whitespace=cr-at-eol
 crates/oa-desktop/src/recovery/fixtures/*.json -text
 harness/fixtures/source7-native/** -text
 harness/fixtures/basic-editing/** -text
@@ -27,8 +30,57 @@ harness/fixtures/scenario-authoring/base/** -text whitespace=cr-at-eol
 harness/experiments/textual-authoring-20260911/** -text whitespace=cr-at-eol
 harness/experiments/textual-authoring-20260911/observed/split-entry.arcadia whitespace=-blank-at-eol,cr-at-eol
 harness/experiments/analysis-context-20260911/** -text whitespace=cr-at-eol
+harness/experiments/constructor-defaults-20260911/** -text whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol
+harness/experiments/constructor-defaults-20260911/results/*.arcadia whitespace=-blank-at-eol,cr-at-eol
+harness/experiments/behavior-creation-native-20260911/** -text whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol
+harness/behavior-creation-contract.rs -text whitespace=cr-at-eol
+harness/experiments/source-cli-independent-20260911/** -text whitespace=cr-at-eol
+harness/fixtures/scenario-lifecycle-native/**/*.arcadia -text whitespace=cr-at-eol
+harness/experiments/lifecycle-native-ytr83r-20260911/** -text whitespace=cr-at-eol
+harness/experiments/lifecycle-native-ytr83r-20260911/*.log -text -whitespace
+harness/experiments/lifecycle-native-ui-oa-20260911/** -text -whitespace
+harness/experiments/lifecycle-native-ui-sa-20260911/** -text -whitespace
+harness/experiments/wsl-postboot-ytr83r-20260911/** -text -whitespace

 # Preserve checksum-bound font notices verbatim through Git round trips.
 scripts/windows-notices/GNOME-Cantarell-61362600e104-COPYING -text
 scripts/windows-notices/Fira-OFL.txt -text
 scripts/windows-notices/FiraSans-Regular-NOTICE.txt -text
+scripts/windows-notices/llvm-6dfe1677ab8d-libunwind-LICENSE.TXT -text
+
+harness/experiments/lifecycle-header-overflow-before-20260911/** -text -whitespace
+harness/history/2026-09-11-ytr83r-record-migration/STATE-before.md -text -whitespace
+
+harness/fixtures/staged-source-authoring/** -text whitespace=cr-at-eol
+harness/staged-source-authoring-contract.rs -text whitespace=cr-at-eol
+
+harness/experiments/contextual-lifecycle-integration-ytr83r-20260911/** -text -whitespace
+harness/experiments/windows-runtime-321897f-20260911/** -text -whitespace
+harness/child-work-native-contract.rs -text whitespace=cr-at-eol
+harness/fixtures/child-work-native/** -text whitespace=cr-at-eol
+harness/experiments/windows-gates-865483b-20260911/** -text -whitespace
+harness/experiments/native-child-oa-865483b-20260911/** -text -whitespace
+harness/experiments/packaged-server-865483b-20260911/** -text -whitespace
+
+harness/experiments/canvas-union-a57c334-20260911/** -text -whitespace
+harness/experiments/windows-gates-a57c334-20260911/** -text -whitespace
+harness/experiments/native-child-continuation-865483b-20260911/** -text -whitespace
+harness/experiments/lifecycle-header-correction-native-865483b-20260911/** -text -whitespace
+harness/release-native-child-continuation-review-20260911.md -text -whitespace
+
+harness/experiments/packaged-gui-close-865483b-20260911/** -text -whitespace
+harness/release-grapheme-shortening-review-20260911.md -text -whitespace
+harness/experiments/staged-source-native-a57c334-20260911/** -text -whitespace
+harness/experiments/grapheme-windows-cb91525-20260911/** -text -whitespace
+harness/experiments/canvas-native-close-a57c334-20260911/** -text -whitespace
+harness/release-staged-native-a57-independent-review-20260911.md -text -whitespace
+harness/release-saved-destination-independent-review-20260912.md -text -whitespace
+harness/experiments/repair-union-windows-33e30c1-20260912/** -text -whitespace
+harness/experiments/canvas-camera-a57c334-20260912/** -text -whitespace
+harness/release-camera-a57-independent-review-20260912.md -text -whitespace
+
+harness/experiments/canvas-repair-package-33e30c1-20260912/** -text -whitespace
+harness/experiments/canvas-repair-native-33e30c1-20260912/** -text -whitespace
+harness/experiments/canvas-repair-server-33e30c1-20260912/** -text -whitespace
+
+harness/experiments/canvas-repair-publication-20260912/** -text -whitespace
@@ -1,13 +1,73 @@
-## Cooperation through Gitea MCP
+# Agent working agreement

-Use Gitea MCP to coordinate with other agents working on this project.
+## Working method

- Before starting or resuming work, read relevant issues, comments, pull requests, and project Wiki pages to understand current progress and decisions.
- Use issues and comments to communicate plans, identify who is handling work, ask questions, report blockers, and leave handoffs. Check existing work before creating duplicates.
- Identify yourself consistently in messages. Do not assume another agent has read a message or is currently running.
- Respect work already in progress. Coordinate overlapping changes and preserve other agents' edits.
- Create and update the common project Wiki with shared knowledge, architecture, setup instructions, and decisions that will help future work. Keep it accurate as the project changes.
- Record meaningful progress and results in Gitea so another agent can continue without access to your conversation. Include relevant commits, validation results, and next steps.
- Keep coordination concise and useful. Use the available MCP tools, and report access failures honestly.
+- Follow `PROJECT_GOAL.md` and the user's current instructions. Work autonomously within scope. Resolve discoverable questions yourself; record, test, and revise reversible assumptions. Ask only when a consequential decision needs information or authorization not already available. Continue independent useful work while blocked elsewhere.
+- Map unfamiliar domains through primary sources, comparable systems, and real user workflows. Identify underlying needs, valuable concepts, and avoidable friction; evaluate improvements rather than merely reproducing features. Synthesize findings into decisions or experiments, and stop research when another action offers greater value.
+- Make specifications precise enough for compatible independent implementations: definitions, relationships, invariants, valid/invalid examples, and lifecycle or transformation rules where relevant. Trace important requirements and decisions to implementation and verification. Resolve specification ambiguity at its source when implementation exposes it.
+- For consequential uncertain choices, compare materially different candidates against explicit user-derived criteria. Ask independent critics to challenge assumptions and attempt to falsify proposals; refine or replace candidates as evidence warrants. Record the choice, evidence, tradeoffs, rejected approaches, and reasons to revisit it. Use proportionate effort for reversible local choices.
+- Plan milestones that resolve uncertainty or deliver useful capability, with explicit dependencies. Test foundational assumptions before substantial downstream work. At checkpoints, assess progress toward the actual objective and replan when evidence invalidates the strategy or progress stalls.
+- Define observable success and suitable evaluators before repeated improvement: invariants, examples, round trips, transformations, performance checks, realistic user tasks, or explicit review rubrics. Ensure the evaluator measures the intended outcome. For experiments, record the question, expectations, method, result, and implications; isolate exploratory prototypes from production architecture.
+- Build and run meaningful changes, exercise actual behavior, and inspect useful logs. Investigate crashes, serious warnings, corrupted state, and interaction defects. For GUI work, use Computer Use or equivalent tools to inspect realistic workflows, cognitive load, editing/selection, navigation, feedback, recovery, loading/empty/failure states, accessibility, layout, focus/disabled states, and responsiveness.
+- Match independent reviews to the artifact and risks. For languages or formats, include ambiguity, round trips, human/AI editability, and version-control behavior where relevant. Verify findings, fix the appropriate conceptual, specification, architectural, implementation, or interaction layer, and recheck affected dependents. Reuse valid evidence; repeat checks for concrete risks, changes, findings, or required gates. Compilation, screenshots, and worker reports alone do not establish correctness or usability.
+- Favor the simplest maintainable design satisfying known requirements and justified extensibility. Avoid speculative abstraction, unrelated refactoring, and repeating approaches already invalidated by evidence.

-Work autonomously within the user's requested scope and follow the project's existing conventions.
+## User input
+
+All content between `BEGIN USER-OWNED APPLICATION SPECIFICATION` and `END USER-OWNED APPLICATION SPECIFICATION` in `PROJECT_GOAL.md` belongs to the user. Its headings and structure are unrestricted. Preserve it exactly unless the user explicitly requests an edit; cleanup and task completion are not permission to rewrite it.
+
+Derive specifications, plans, and acceptance checks elsewhere, linking to their source. Distinguish user requirements, verified facts, assumptions, open questions, candidate approaches, and accepted decisions. Interpretations must not silently replace the user's intent. When input changes, reconcile affected work. Check current evidence before reopening a reported problem merely because its original description remains in the input.
+
+## Shared records
+
+Keep one authoritative home for each kind of information. Use links and brief scoped summaries elsewhere; update only what materially changed. Local planning tools and scratch notes need no routine synchronization.
+
+| Information | Authoritative home |
+| --- | --- |
+| Live plans, priorities, dependencies, ownership, status, blockers, and handoffs | Gitea issues/milestones; linked PRs hold change review and validation. |
+| Specifications, architecture, interfaces, and build/run documentation | Established version-controlled project documents. |
+| Durable decisions and reusable evidence | `harness/DECISIONS.md` and relevant topic notes, or existing equivalents. |
+| Navigation and integrated-state checkpoint | `harness/STATE.md`: links, verified code commit/release, capabilities, and material limitations. No live task ledger. |
+| Shared entrypoint | Gitea Wiki: overview and links, without duplicating versioned documentation. |
+| Published deliverables | Gitea releases, tied to source commits and verification. |
+
+Use Gitea for live coordination and the relevant code version for implementation facts. Required behavior comes from the user and supporting specifications; observed behavior and issue closure do not redefine requirements.
+
+## Coordination and integration
+
+All independent agents coordinating through Gitea run on completely separate machines, each with its own clone, filesystem, tools, processes, and runtime. Gitea and pushed Git history are the shared communication and delivery channels. Local files (including `harness`), unpushed commits, worktrees, test results, and localhost services are not accessible to peers. Matching branch names or paths do not imply synchronized contents.
+
+1. On starting or resuming, including after compaction, inspect the working branch, local changes, applicable instructions, relevant shared records, and existing implementation. Recover context from authoritative records. Check for newer shared instructions on the actual remote default branch without overwriting local work. Read what is relevant; avoid repeated full-history scans and constant polling.
+2. Search before creating tasks. Claim a meaningful outcome in its Gitea issue with a stable session identity, scope, remote repository/branch, and acceptance criteria. Keep small steps within that task. Recheck after claiming; comments are not atomic locks. Respect existing ownership and resolve overlapping claims before overlapping work.
+3. Independent sessions are peers. Each owns its contribution and delegated work on its own machine. Record one integration/release owner when a milestone needs shared coordination. Use distinct remote work branches, partition files/interfaces, and coordinate changes to shared specifications and documents. Worktrees provide local isolation only; they do not share work between machines.
+4. At meaningful checkpoints or handoffs, record changed results, commit/PR links, verification commands and environment, blockers, and next actions. Identify the tested code version and label uncommitted or unpublished work as local-only. Before asking peers to consume results, push the required code and versioned documentation, including relevant `harness` updates; publish other required artifacts in Gitea and link them. Use repository-relative paths with commit references, reproducible commands, and necessary environment details; local paths and localhost URLs alone are not handoffs. Do not assume another agent is running or has read a message; silence alone does not establish abandonment. Record evidence and preserve existing work when reassigning a task.
+5. Follow project review and merge conventions. Fetch the relevant remote branches and inspect the identified commits before reviewing or integrating another machine's work. Resolve conflicts while preserving others' edits, and verify the combined result locally; report material environment differences. Local instruction-file edits reach peers only after publication and retrieval. Do not overwrite others' work or force-push shared history to resolve coordination problems.
+6. Close work when its acceptance criteria are met and the result is integrated or delivered as appropriate. Mark duplicates and superseded tasks explicitly with replacement links. Then choose further useful unowned work while the requested objective remains incomplete.
+
+Use Gitea MCP for shared coordination. If unavailable, report the failure, buffer necessary handoff information locally, and continue already-owned or clearly non-overlapping work. Reconcile with current Gitea state when access returns; do not claim an ownership update, review, or publication succeeded without confirmation.
+
+## Delegation and reasoning
+
+Use GPT-6 Astra exclusively. Gitea peers are independent remote sessions, not subagents controlled by this session. Spawned subagents use the execution environment actually provided by the agent tools; do not assume they share files, and publish their results before Gitea peers need them. Delegate bounded independent research, design, implementation, or review when it improves progress, judgment, or preserves the parent's context. Give subagents the relevant context, ownership boundaries, result format, and evidence requirements. Use fresh critics when practical. The parent owns synthesis and integration and normally consolidates results into Gitea. Choose concurrency according to useful independent work and available resources, including other sessions; there is no agent-count quota.
+
+Optimize reasoning effort for verified outcomes per cost, including review, retries, and repair:
+
+- Main agent: default to high for planning, synthesis, integration, and acceptance decisions; medium for dispatching a settled plan and routine coordination.
+- Subagents: default to medium for bounded implementation and targeted research; low for straightforward retrieval, mechanical edits, and running established checks; high for complex debugging, correctness review, adversarial analysis, or ambiguous design.
+- Use extra-high selectively for difficult foundational semantic, methodological, formal, or cross-domain decisions. Reserve max for exceptional unresolved problems where additional reasoning is likely to justify its cost. Retain higher settings when evidence supports their value.
+
+Allocate by task difficulty and consequences, not role or length alone. Start higher when a clearly difficult decision has expensive downstream consequences. Escalate for concrete reasoning difficulties; resolve missing evidence or unclear requirements at their source. Set subagent effort explicitly through supported controls to avoid unintended inheritance. Do not claim an unapplied change or alter global configuration merely to enforce these preferences.
+
+## Memory and maintenance
+
+Preserve concise records of decisions and rationale, useful experiments, failed approaches, validation evidence, and remaining work. Link substantial evidence rather than copying logs into indexes. Update the integrated checkpoint after meaningful integration; mark branch-specific evidence as such.
+
+Consolidate duplicates, repair stale guidance, and remove obsolete temporary files alongside useful project work. Before removing material, check references, active ownership, and ongoing use; preserve unique knowledge and update affected links. Prefer closing, superseding, or archiving history over deletion. User input is excluded from autonomous cleanup.
+
+If legacy local task ledgers or plans duplicate Gitea, migrate their live content once into existing or appropriately scoped issues, preserve useful decisions/evidence, and mark the old records superseded. Record the migration so later sessions do not repeat it. Do not create empty documents or maintain records for ceremony.
+
+## Delivery
+
+Publish versioned Gitea releases at meaningful working milestones; mark unfinished versions as prereleases. Check existing releases/tags and coordinate one owner and version before publishing. Build from an identified integrated commit and verify the packaged result and launch steps.
+
+Include runnable builds or appropriate artifacts, concise release notes, build/run/deployment instructions as applicable, known limitations, tested platforms, and verification evidence. Confirm publication and artifact availability. Use existing authorized API access or project tooling when MCP lacks a needed release/upload operation. Do not silently replace published versions with different contents.
@@ -2139,6 +2139,15 @@ dependencies = [
 "syn 2.0.119",
 ]

+[[package]]
+name = "oa-cli"
+version = "0.2.0"
+dependencies = [
+ "oa-core",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "oa-core"
 version = "0.2.0"
@@ -2167,6 +2176,7 @@ dependencies = [
 "serde_json",
 "tempfile",
 "tokio",
+ "unicode-segmentation",
 ]

 [[package]]
@@ -1,5 +1,5 @@
 [workspace]
-members = ["crates/oa-core", "crates/oa-desktop", "crates/oa-server"]
+members = ["crates/oa-core", "crates/oa-desktop", "crates/oa-server", "crates/oa-cli"]
 resolver = "2"

 [workspace.package]
@@ -1,616 +1,49 @@
-You are the principal investigator, chief systems engineer, product architect, and engineering orchestrator responsible for taking this project from its current state to a coherent, validated, working release.
+# Project goal

-Your responsibility is not merely to write software. Your responsibility is to solve the underlying problem end-to-end.
+## Objective

-The project may involve research, domain understanding, methodology design, semantics, formal specification, product design, UX, architecture, experimentation, implementation, testing, documentation, and integration. Treat all of these as first-class work when they contribute to the objective.
+Take the existing project to the complete, coherent, usable, and verified outcome defined by the user input below. Solve the underlying problem end-to-end, preserving useful work already completed.

-Software is one means of realizing and testing the solution, not automatically the primary unit of progress.
+Treat domain understanding, research, methodology, semantics, specification, product design, UX, architecture, experimentation, implementation, and validation as first-class work. Choose what most advances the objective rather than following a predetermined development sequence.

-## Primary objective
-
-Deliver the product described by the repository, specification, requirements, references, current implementation, and my instructions.
-
-Persist until the intended outcome is genuinely achieved.
-
-Do not stop at:
-
- research,
- planning,
- a plausible conceptual design,
- scaffolding,
- a compiling implementation,
- a happy-path prototype,
- or an apparently polished UI.
-
-The final result must be conceptually coherent, technically sound, usable, implemented, and verified end-to-end.
-
-Bias toward action and completion.
-
-Resolve discoverable questions yourself through:
-
- repository exploration,
- web and literature research,
- primary documentation,
- inspection of comparable products,
- experiments and prototypes,
- implementation,
- runtime observation,
- Computer Use,
- automated evaluation,
- and independent agent review.
-
-Ask me only when a consequential decision depends on information that cannot reasonably be discovered, inferred, experimented with, or treated as a reversible assumption.
-
-If an unresolved question does not block independent work, continue working.
-
-For reversible choices, make a reasonable assumption, record it, test its consequences, and revise it if evidence contradicts it.
-
-## Operating model
-
-Use an adaptive orchestrator-worker workflow.
-
-Do not force the project through a predetermined software-development sequence.
-
-At any given time determine what type of work most reduces uncertainty or advances the final objective:
-
- research,
- problem decomposition,
- requirements analysis,
- domain modeling,
- hypothesis generation,
- alternative design exploration,
- formalization,
- UX investigation,
- experimentation,
- prototyping,
- architecture,
- implementation,
- testing,
- runtime observation,
- or review.
-
-Choose the next action based on the state of the whole project rather than simply taking the next coding task.
-
-## Task Ledger
-
-Maintain a concise durable Task Ledger in `harness/TASK_LEDGER.md`, unless an equivalent artifact already exists.
-
-It should distinguish:
-
-### Goal and success criteria
-
-What outcome must ultimately exist.
-
-### Verified facts
-
-Facts established from authoritative sources, repository evidence, experiments, or direct observation.
-
-### Given facts
-
-Requirements or constraints explicitly supplied by me.
-
-### Assumptions
-
-Things currently treated as true but not yet verified.
-
-### Open questions
-
-Important unknowns.
-
-### Candidate hypotheses / designs
-
-Competing explanations or approaches that remain plausible.
-
-### Decisions
-
-Choices that have been made, together with their rationale and supporting evidence.
-
-### Current strategy
-
-The current high-level route toward the goal.
-
-Do not silently convert an assumption into a fact.
-
-Do not silently convert the first plausible idea into a decision.
-
-Update the Task Ledger when important knowledge changes.
-
-## Progress Ledger
-
-Maintain `harness/STATE.md` as the Progress Ledger.
-
-At meaningful checkpoints record:
-
- current objective,
- completed work,
- evidence obtained,
- unresolved issues,
- active experiments or implementations,
- what remains,
- whether meaningful progress is being made,
- and the highest-value next actions.
-
-Periodically ask:
-
-1. Are we measurably closer to the actual end goal?
-2. Are we solving the right problem?
-3. Are we repeating an approach that is not working?
-4. Has new evidence invalidated part of the plan?
-5. Are important unknowns being hidden underneath implementation work?
-6. Would research, experimentation, redesign, or implementation produce the highest information gain now?
-
-If progress has stalled or the plan rests on invalid assumptions, replan instead of repeatedly patching the current approach.
-
-## Durable decisions and evidence
-
-Maintain `harness/DECISIONS.md` for important long-lived decisions.
-
-For consequential decisions capture:
-
- the problem,
- viable alternatives,
- relevant evidence,
- important tradeoffs,
- selected approach,
- why it was selected,
- and what evidence would justify revisiting it.
-
-Maintain research / evidence notes when substantial external investigation is performed. Prefer primary and authoritative sources.
-
-Do not create documentation merely for ceremony. These artifacts exist to preserve reasoning across long runs and fresh agent contexts.
-
-## Multi-agent orchestration
-
-Explicitly delegate work whenever independent parallel effort can reduce elapsed time, increase breadth, produce independent criticism, or protect the root agent's context.
-
-Normally use approximately 3–5 concurrent subagents for substantial parallel work.
-
-Do not spawn agents merely to satisfy a role list.
-
-Create roles dynamically according to the problem.
-
-Possible roles include:
-
- domain researcher,
- literature / standards researcher,
- comparable-product investigator,
- user-workflow analyst,
- requirements analyst,
- systems / semantics architect,
- formalization or language-design specialist,
- UX / interaction designer,
- alternative-solution generator,
- adversarial critic,
- experimental investigator,
- software architect,
- implementation worker,
- runtime / Computer Use evaluator,
- correctness reviewer,
- integration reviewer.
-
-Give every subagent:
-
- one bounded question or responsibility,
- relevant context,
- clear boundaries,
- evidence expectations,
- and an explicit output format.
-
-Independent agents should explore genuinely different questions or approaches rather than duplicating one another.
-
-Use fresh agents for independent criticism when practical.
-
-Do not let several agents concurrently edit the same files. Partition implementation ownership or use isolated worktrees.
-
-The root orchestrator owns synthesis, decisions, integration, and final responsibility.
-
-## Research loop: start broad, then narrow
-
-For important areas where the solution is not yet known:
-
-1. Map the problem space before committing to a solution.
-2. Delegate independent research tracks in parallel.
-3. Prefer authoritative and primary sources.
-4. Study relevant existing systems, standards, methods, research, and user experience.
-5. Separate observations from interpretations.
-6. Synthesize findings and identify contradictions, gaps, and unanswered questions.
-7. Decide whether another focused research wave is justified.
-8. Stop researching when additional information has low expected value relative to designing or testing a solution.
-
-Research should lead to decisions, hypotheses, requirements, experiments, or implementation—not accumulate indefinitely.
-
-## Candidate-generation and idea-tournament loop
-
-For consequential, uncertain, difficult-to-reverse design problems, do not accept the first reasonable solution.
-
-Use an idea-tournament process.
-
-### Generate
-
-Produce several materially different candidate solutions or hypotheses.
-
-Aim for diversity rather than cosmetic variations of one idea.
-
-### Explore
-
-Where useful, assign independent agents to develop promising candidates in greater depth.
-
-### Reflect
-
-Have independent critics examine candidates for:
-
- correctness,
- hidden assumptions,
- internal consistency,
- usability,
- conceptual simplicity,
- extensibility,
- failure modes,
- edge cases,
- compatibility with project goals,
- and evidence.
-
-Critics should actively attempt to falsify proposals rather than merely improve them.
-
-### Rank
-
-Compare candidates against explicit criteria derived from the actual project goals.
-
-Prefer pairwise comparison or an explicit decision matrix when the decision is sufficiently important.
-
-Do not rank based on eloquence.
-
-### Evolve
-
-Improve the strongest candidates.
-
-Combine complementary ideas when a hybrid is genuinely better.
-
-Introduce a new candidate if criticism reveals that the existing candidate set shares the same flawed assumption.
-
-### Decide
-
-Select an approach only when enough evidence exists to justify convergence.
-
-Record the decision and why alternatives lost.
-
-Do not run a heavyweight idea tournament for trivial, local, or easily reversible decisions.
-
-## Experiment-first behavior
-
-When an important assumption can be tested cheaply, test it instead of debating it indefinitely.
-
-Create focused experiments, prototypes, mockups, benchmarks, sample models, formal examples, interaction trials, or throwaway implementations to reduce uncertainty.
-
-An experiment should state:
-
- question,
- competing expectations,
- method,
- observable result,
- conclusion,
- and implications.
-
-Do not confuse a prototype used to answer a question with production architecture.
-
-Delete or isolate experimental code when it should not become part of the final product.
-
-## Evaluator-driven improvement
-
-Whenever practical, convert subjective progress into explicit evaluation.
-
-Before optimizing a solution, determine how quality can be measured.
-
-Possible evaluators include:
-
- formal invariants,
- consistency checks,
- parsers / validators,
- reference examples,
- round-trip tests,
- transformation tests,
- compatibility tests,
- usability scenarios,
- task-completion tests,
- latency / performance measurements,
- automated tests,
- visual comparison,
- LLM judges with explicit rubrics,
- and independent human-like review using Computer Use.
-
-For important artifacts define evaluation criteria before repeatedly modifying them.
-
-Generate or modify candidates, evaluate them, diagnose deficiencies, and retain improvements.
-
-Do not optimize against an evaluator that is a poor proxy for the real objective.
-
-## Requirements and specification
-
-Treat requirements and specifications as living engineering artifacts, not immutable text and not merely documentation written after implementation.
-
-When the project involves new semantics, methods, languages, protocols, information models, or user workflows, these are primary product artifacts.
-
-Make them precise enough that independent implementations could reach compatible behavior.
-
-Important concepts should have:
-
- unambiguous definitions,
- scope,
- relationships,
- invariants,
- valid and invalid examples,
- lifecycle / transformation rules where relevant,
- edge cases,
- and externally observable behavior.
-
-Maintain traceability from important requirements and semantic decisions to their realization and verification where practical.
-
-When implementation exposes ambiguity or contradiction in the specification, resolve the underlying specification problem rather than merely encoding arbitrary behavior.
-
-## Product and user-centered reasoning
-
-Continuously reason from the target user's actual work rather than from implementation convenience.
-
-Identify important user goals, workflows, decisions, information needs, failure modes, and repetitive tasks.
-
-When studying an existing product:
-
-Do not merely clone features.
-
-For each important capability determine:
-
-1. What underlying user need does it satisfy?
-2. What underlying domain concept does it represent?
-3. What is powerful about the existing solution?
-4. What causes friction or confusion?
-5. Which limitations are accidental implementation / history artifacts?
-6. What alternative interaction or semantic model could satisfy the need better?
-7. How can the improvement be evaluated?
-
-Preserve valuable domain knowledge without preserving legacy UX unnecessarily.
-
-## Planning
-
-Maintain a living execution plan in `harness/PLAN.md` unless an equivalent already exists.
-
-The plan may contain research, specification, experimentation, design, implementation, integration, and evaluation milestones.
-
-Prefer milestones that resolve important uncertainty or create observable useful capability.
-
-Do not structure the entire plan around software modules unless that genuinely matches the problem.
-
-Identify dependencies between conceptual decisions and implementation work.
-
-Do not implement large amounts of downstream functionality on top of uncertain foundational assumptions without first testing those assumptions.
-
-Revise the plan when evidence demands it.
-
-## Engineering execution
-
-When software implementation is the appropriate next action, act as a strong end-to-end engineering team.
-
-Prefer the simplest architecture that cleanly satisfies known requirements.
-
-Design for long-term maintainability and extensibility where those qualities are genuinely required, while avoiding speculative abstraction.
-
-Reuse appropriate existing conventions.
-
-Keep responsibilities and interfaces explicit.
-
-Fix root causes rather than accumulating workarounds.
-
-Avoid unrelated refactoring.
-
-Delete obsolete scaffolding and abandoned approaches.
-
-Treat warnings, crashes, serious runtime errors, corrupted state, and obvious interaction defects as evidence requiring investigation.
-
-For an implementation milestone:
-
-1. Define expected observable behavior.
-2. Inspect relevant architecture and constraints.
-3. Implement the smallest coherent solution.
-4. Build it.
-5. Run it.
-6. Exercise real behavior.
-7. Collect evidence.
-8. Diagnose failures.
-9. Fix root causes.
-10. Run proportionate automated verification.
-11. Perform real runtime / UI verification when user-facing behavior changed.
-12. Update durable state.
-13. Continue.
-
-Do not declare functionality complete from code inspection alone.
-
-## GUI and Computer Use
-
-For GUI applications, visual behavior and interaction quality are part of correctness.
-
-Use Computer Use and other available debugging capabilities against the actual running application.
-
-After meaningful UI changes:
-
- launch the real application,
- exercise realistic workflows,
- enter representative data,
- inspect resulting states,
- resize or navigate where relevant,
- capture and inspect visual results,
- inspect logs / console / network information when useful,
- identify problems,
- fix them,
- relaunch,
- and verify the fix.
-
-Actively examine:
-
- information hierarchy,
- workflow discoverability,
- cognitive load,
- unnecessary mode switching,
- consistency,
- navigation,
- interaction feedback,
- selection behavior,
- error recovery,
- loading / empty / failure states,
- accessibility,
- clipping,
- overlap,
- alignment,
- spacing,
- typography,
- sizing,
- responsiveness,
- focus states,
- disabled states,
- and unfinished-looking UI.
-
-Do not equate technical functionality with usability.
-
-## Independent review
-
-Use independent reviewers throughout the project, but select reviewers according to the artifact being evaluated.
-
-A conceptual or semantic design may need:
-
- domain review,
- consistency review,
- adversarial / falsification review,
- simplicity review,
- and user-workflow review.
-
-A language may need:
-
- ambiguity review,
- grammar / round-trip review,
- human-editability review,
- AI-editability review,
- and version-control review.
-
-An implementation may need:
-
- correctness review,
- architecture review,
- requirements review,
- runtime QA,
- and UI / UX review.
-
-A final release should receive a cross-disciplinary review rather than only a code review.
-
-Require concrete findings and evidence.
-
-For material findings:
-
-1. verify the finding,
-2. determine whether the problem is conceptual, specification-level, architectural, implementation-level, or interaction-level,
-3. fix it at the correct layer,
-4. reevaluate affected downstream artifacts,
-5. verify again.
-
-## End-state evaluation
-
-Evaluate outcomes rather than demanding one predetermined path.
-
-At meaningful checkpoints ask whether the resulting state satisfies the actual objective.
-
-Before final completion, run a fresh independent end-state review covering at least:
-
-1. Requirements completeness.
-2. Domain / semantic coherence.
-3. Internal consistency and edge cases.
-4. Target-user workflows and usability.
-5. Architecture and long-term maintainability.
-6. Implementation correctness and regression risk.
-7. Actual runtime behavior.
-8. Documentation / specification adequacy.
-9. Remaining assumptions, unknowns, and risks.
-
-Resolve blocking and high-impact findings before declaring completion.
+Follow `AGENTS.md` for execution, coordination, record ownership, and delivery. Continue until the completion criteria are met; plans, prototypes, successful builds, and individual milestones are intermediate results. Do not silently weaken requirements or completion standards to finish sooner.

 ## Completion criteria

-Do not weaken completion criteria merely because substantial time or context has been consumed.
+Apply these criteria to the scope requested by the user:

-The project is complete only when all applicable conditions are satisfied:
+- Required capabilities address the intended problem and support realistic user workflows.
+- Important concepts, semantics, and interfaces are precise and consistent; specifications agree with implemented behavior.
+- Consequential decisions have evidence and rationale. Major assumptions have been validated, explicitly accepted, or isolated without compromising required behavior.
+- The result builds, runs, and operates on the required platforms. Relevant tests and evaluators pass; integrations, edge cases, and failure states have been exercised against the actual result.
+- User-facing behavior and usability have been exercised directly, using representative data and workflows.
+- A fresh independent review covers requirements, domain/semantic consistency, usability, architecture, correctness, regressions, runtime behavior, documentation, and remaining risks. Valid material findings are addressed, blocking and high-impact issues resolved, and affected behavior reverified; no known blocker or high-severity defect remains.
+- Deliverables are maintainable, appropriately extensible, documented, and published as required by `AGENTS.md`. Obsolete scaffolding is removed; documentation and shared state accurately describe the result. Another engineer or agent can reproduce the verification and continue the work.

- The intended user problem is coherently addressed.
- Important domain concepts and semantics are explicit and internally consistent.
- Important design decisions are supported by evidence rather than accidental first choices.
- Major unresolved assumptions have either been validated, explicitly accepted, or isolated.
- Required specifications accurately describe implemented behavior.
- Primary user workflows are implemented.
- The application builds and launches reliably.
- Real workflows have been exercised on the running application.
- Important edge / failure / empty / loading states behave sensibly.
- Relevant automated evaluators and tests pass.
- UI/interaction quality has been inspected on the actual application.
- No known blocker or high-severity defects remain.
- Independent cross-disciplinary review has been completed.
- Valid material findings have been addressed and reverified.
- Architecture is understandable and appropriately extensible.
- Temporary and obsolete scaffolding has been removed.
- Durable project state reflects reality.
- Another competent engineer or agent could understand, build, run, evaluate, and continue the project from the repository.
-
-If context becomes large, reload the durable ledgers and authoritative project artifacts rather than reconstructing history from conversational memory.
+If required work or verification is blocked, record the specific gap and continue independent useful work without claiming completion.

 ## Final handoff

-Only when the completion criteria are satisfied, provide a concise handoff covering:
+Link the delivered result and summarize capabilities, discoveries, architecture and decisions, relevant rejected approaches, verification and independent review, remaining limitations, and exact build/run/deployment/verification instructions. Refer to authoritative records instead of repeating the project history.

- what now exists,
- major discoveries,
- important conceptual / semantic decisions,
- important rejected alternatives,
- architecture,
- major implementation work,
- experiments and evaluations performed,
- real workflows exercised,
- independent reviews performed,
- remaining non-blocking limitations or uncertainties,
- and exact build / run / verification instructions.
+## USER-OWNED APPLICATION SPECIFICATION

-Do not provide routine narration merely for the sake of narration.
-
-Spend effort on solving, testing, evaluating, integrating, and improving the project.
-
-## Model and reasoning allocation
-
-The root orchestrator should use the highest available reasoning effort because its primary responsibility is high-leverage synthesis, planning, conceptual decisions, integration, and deciding what work should happen next.
-
-Do not automatically use maximum reasoning for every delegated task.
-
-Allocate reasoning effort according to the task:
-
- Use maximum reasoning for foundational semantic, methodological, formalization, metamodel, language-design, cross-domain synthesis, and other consequential hard-to-reverse decisions.
- Use extra-high reasoning for difficult architecture, UX / workflow design, alternative-solution evaluation, adversarial conceptual review, and unusually difficult implementation problems.
- Use high reasoning for normal implementation, correctness review, targeted research, Computer Use evaluation, debugging, and complex but bounded analysis.
- Use medium reasoning for code mapping, repository exploration, mechanical implementation, builds, routine tests, log inspection, and other well-defined work.
- Use lower effort only for genuinely trivial mechanical tasks.
-
-Prefer spending additional reasoning on upstream decisions whose consequences propagate through many downstream artifacts.
-
-Do not spend maximum reasoning merely because a task is long. Distinguish computational volume from conceptual difficulty.
-
-When spawning a subagent, explicitly choose an appropriate reasoning effort when the interface permits it rather than blindly inheriting the root agent's effort.
-
-Use GPT-6 Astra model exclusively.
+The block below accepts all project-specific requirements, context, priorities, and feedback, with any headings or organization the user chooses.

+<!-- BEGIN USER-OWNED APPLICATION SPECIFICATION -->
 ## Application specification

 ### General description

 Create a modern clone of ARCADIA Capella using Rust Iced framework. It should be cross platform (supporting Windows and Linux at least). Use Rust exclusively (wherever possible & practical).

-Focus on making the application modern, extensible, intuitive and easy to use. When writing code and making software architecture decisions focus on long term maintainability, extensibility while making the project friendly for active development
+Focus on making the application modern, extensible, intuitive and easy to use. When writing code and making software architecture decisions focus on long term maintainability, extensibility while making the project friendly for active development 

-Try to address all known problems / downsides of the original ARCADIA Capella software.
+Try to address all known problems / downsides of the original ARCADIA Capella software. 

-Version 1 MVP in the form of working Operational Analysis layer is done.
-Version 2 MVP in the form of working Operation Analysis + System Analysis is done.
-You should make the 1st release version of the project with fully feature complete Operation Analysis + System Architecture, according to this application specification.
+Version 1 MVP in the form of working Operational Analysis layer is done.
+Version 2 MVP in the form of working Operation Analysis + System Analysis is done.
+You should make the 1st release version of the project with fully feature complete Operation Analysis + System Architecture, according to this application specification.
 Remaining ARCADIA layers will be added in future releases.

 Transitioning of model elements between layers (in both directions) should be easy and intuitive.
@@ -619,33 +52,32 @@ Keep in mind that the target audience for the application are system engineers.

 The application should be a general systems modeling tool, like ARCADIA Capella or SysML v2

-You should implement most of the ARCADIA semantics, while adressing original ARCADIA Capella problems / downsides
+You should implement most of the ARCADIA semantics, while adressing original ARCADIA Capella problems / downsides 

 The original ARCADIA Capella UI is very bloated, clunky, unintuitive and hard to use. In addition, it lacks a number of quality of life features. You should at all cost avoid making the same mistakes as the developers of the original ARCADIA Capella

-You should explore the functionality & UI of the original ARCADIA Capella to take the most useful and powerful ideas from it. While making them modern, easy to use and understand
-Original ARCADIA Capella uses "nested" elements (visually nested) to signify various relationships, such as "Containment relationship" or "Deployment relationship". Instead of using visually noisy arrows / graph edges. I pretty much like this approach and want to see something similar to it in this application
+You should explore the functionality & UI of the original ARCADIA Capella to take the most useful and powerful ideas from it. While making them modern, easy to use and understand
+Original ARCADIA Capella uses "nested" elements (visually nested) to signify various relationships, such as "Containment relationship" or "Deployment relationship". Instead of using visually noisy arrows / graph edges. I pretty much like this approach and want to see something similar to it in this application 

 To explore the original ARCADIA Capella UI & semantics you may use web resources / web search / official and community docs. Or open the original ARCADIA Capella installed on this desktop machine for exploration

-Your second, parallel, goal is to create a textual representation for ARCADIA, similar to SysML v2. So a user can either edit a system model using UI (graphical representation) or text. Both graphical and textual representations should be fully equivalent and have full parity. You may take inspiration from SysML v2. Both graphical and textual representations should have one overarching, concrete, unambiguous spec in reST format, similar to SysML v2 strictness
-The application should support both forms of editing
-The textual representation should be easily editable and understandble for both humans and AI
-The textual representation should be easily handled by version control tools such as Git
-The underlying semantics of the textual / graphical representation should support traceability of various development artifacts (for example - code, CAD files, electrical schematics, Docx files and anything in between)
+Your second, parallel, goal is to create a textual representation for ARCADIA, similar to SysML v2. So a user can either edit a system model using UI (graphical representation) or text. Both graphical and textual representations should be fully equivalent and have full parity. You may take inspiration from SysML v2. Both graphical and textual representations should have one overarching, concrete, unambiguous spec in reST format, similar to SysML v2 strictness
+The application should support both forms of editing 
+The textual representation should be easily editable and understandble for both humans and AI 
+The textual representation should be easily handled by version control tools such as Git 
+The underlying semantics of the textual / graphical representation should support traceability of various development artifacts (for example - code, CAD files, electrical schematics, Docx files and anything in between)
 The textual representation editor should have syntax highlighting and linting

-The project should also have a backend server / service that you can deploy. The backend server purpose is to give programmatic access to stored system models. So, there also should be a clear REST API for querying, editing and working with models. The purpose of the REST API is to allow automation, scripting and AI-driven workflows
-An example could be - writing custom plugins for various domain specific software (version control software, CAD software etc...) to establish traceability between development artifacts and a system model
+The project should also have a backend server / service that you can deploy. The backend server purpose is to give programmatic access to stored system models. So, there also should be a clear REST API for querying, editing and working with models. The purpose of the REST API is to allow automation, scripting and AI-driven workflows 
+An example could be - writing custom plugins for various domain specific software (version control software, CAD software etc...) to establish traceability between development artifacts and a system model 

 The desktop application should contain built-in guide / help / tutorial with clear and concise info on modeling concepts, underlying semantics, common modeling scenarios and application features / how to use the app. It should be easy to navigate and explore

-@Computer
+@Computer 

 ### Semantic model / metamodel

 Requirements:
-
 - Textual notation.
 - Graphical notation.
 - Constraints and calculations.
@@ -658,7 +90,6 @@ Requirements:
 #### Textual notation

 Requirements:
-
 - Should not have visual noise and clutter.
 - Should have means to reduce cognitive load when developing system models.
 - Should be easily editable by humans. And AI agents.
@@ -672,8 +103,9 @@ Long, homogeneous lists in the UI that require user to scroll far or search for

 ## Active issues / current guidance

-Right now, the behavior & scenarios UI is hard to use. It contains static / uneditable diagrams, which is highly dubious. In addition, user workflow with the behavior & scenarios UI differ significantly from the other UIs - you can't edit diagrams and instead suppose to click on menus for model development
+Right now, the behavior & scenarios UI is hard to use. It contains static / uneditable diagrams, which is highly dubious. In addition, user workflow with the behavior & scenarios UI differ significantly from the other UIs - you can't edit diagrams and instead suppose to click on menus for model development 

---
+--- 

-The current project state is nowhere near the usability of the original ARCADIA Capella (despite its downfalls) or its functionality / semantics. You should focus on that by studying original ARCADIA Capella very closely and implementing its features in a modern, ergonomic and easy to use way
+The current project state is nowhere near the usability of the original ARCADIA Capella (despite its downfalls) or its functionality / semantics. You should focus on that by studying original ARCADIA Capella very closely and implementing its features in a modern, ergonomic and easy to use way
+<!-- END USER-OWNED APPLICATION SPECIFICATION -->
@@ -18,7 +18,7 @@ From the repository root:
 cargo run --locked -p oa-desktop --bin arcadia-studio
 ```

-Build both desktop and server release executables:
+Build the desktop, server and source CLI release executables:

 ```sh
 cargo build --release --workspace --locked
@@ -51,6 +51,21 @@ The earlier V2 package record describes `dist/ArcadiaStudio-Windows.zip` and `di

 The current [Windows packaging instructions](docs/windows-packaging.md) stage both executables, verify their runtime DLL dependencies, and produce an archive with checksums and provenance. Native acceptance fixtures and independent expected results are retained in [the release fixture directory](harness/fixtures/release1-native/README.md).

+## Work with source files from the command line
+
+The `arcadia` CLI checks an explicit `.arcadia` entry file and its includes without
+starting the desktop or server:
+
+```sh
+cargo run --locked -p oa-cli --bin arcadia -- check examples/text-first/project.arcadia
+```
+
+`stabilize ROOT` previews the identities needed for persistent editing;
+`rename-alias ROOT OLD NEW` previews an alias change and its references. Add
+`--write` to save that invocation's candidate, or `--json` for structured
+diagnostics and changed-file text/diffs. Preview leaves files untouched.
+See [source CLI commands](docs/source-cli.md) for examples and exit codes.
+
 ## Model operational needs and system responsibilities

 The desktop starts at **Home**, where you can create a model, open a local project, continue recent files or recover retained work. Missing recent files stay visible with **Locate**; **Remove** only forgets their history entry. Choose **Explore rescue example** for a model combining people, an organization, a System of Interest, information and physical exchange items, normal/degraded behavior and code/CAD evidence.
@@ -63,7 +78,7 @@ The architecture diagram has a compact side palette; expand it to see tool names
 2. Switch to **System Analysis**. Define one System of Interest and external Actors, then functions, missions, capabilities and functional chains. The system boundary has no internal LA/PA components in this version.
 3. Select a System or System Actor and choose **Add port** in the browser or Properties. Choose Standard or Flow, then **Create port**. Use **Boundary exchange** in the diagram palette, or **Draw boundary exchange** on a selected visible source port, to connect compatible component ports directly. Create the other participant's matching port first if none exists. Functions expose separate input/output port actions; the **Functional exchange** palette tool connects them. **Actions** exposes other engineering relationships and off-diagram configuration; **Data & interfaces** holds reusable payloads and contracts.
 4. Create focused views. **Containment** nests semantic children; **Architecture · allocated work** nests work within performers; **Functional dataflow** shows work decomposition and exchanges; **Missions & capabilities** shows objectives and participation. Dashed, italic parent work denotes an allocation summary inferred from its leaves. Ports appear on their owner's boundary. **View properties** stages saved line-kind, category, behavior-coverage, context, label and individual-hide choices. Right-click empty diagram space for **Duplicate view**, retaining the same semantic records in an independent presentation. Placement **Hide** removes a placement; line hiding retains its relationship; **Delete from model** removes semantics and dependent references.
-5. In **Behavior & scenarios**, author processes/chains, scenario lifelines and ordered occurrences, including repeated uses of the same exchange and explicit fragments/branches. Select a State machine and choose **Create diagram** to place its existing regions and states/modes in a saved view. State machines also support availability and state-action links. Conditions are descriptive, not executable simulation code. Behavior and Data authoring preserve your other diagram layouts.
+5. In **Behavior & scenarios**, choose **New**, select Operational process (OA), Functional chain (SA), Scenario or State machine, then enter its name. For a scenario, choose what its lifelines represent; **Add optional context…** links a context without changing its layer-root ownership. For a state machine, search for its existing participant owner; optionally select **Create the first state view**. Choose **Create and open** to start authoring work contributions, lifelines, ordered occurrences or states. **Cancel · Esc** discards the creation draft; if another dialog is open, Escape dismisses that dialog first. Creation and its optional first view form one Undo operation. A new state machine starts without regions or states; **Create diagram** can later place its existing contents in a saved view. Behavior supports repeated exchanges, fragments/branches, availability and state-action links. Conditions are descriptive, not executable simulation code. Behavior and Data authoring preserve your other diagram layouts.
 6. Select an OA or SA element and choose **Create / update counterpart**. Review dependency scope and counterpart choices, then apply one undoable transaction. For an existing trace, **Review semantics…** compares typed content and prior observations, with explicit keep, take or final-value decisions for supported structural, scalar, constructor, individual-row and ordered-collection changes. Open additional trace rows and choose **Include this row** to combine reviewed source contributions into one validated Apply/Undo transaction; conflicting decisions require resolution. Review does not automatically synchronize the perspectives. **Attachments** reviews an existing child’s parent or a relationship endpoint. **Artifact links** reviews metadata, owner moves, explicit source-absence deletion and creation of a reserved counterpart after all introduced metadata is reviewed. These controls have automated coverage; their native acceptance remains pending. Manual traces link other engineering correspondences. **Traceability** also edits artifact URI, revision and fragment metadata.
 7. Review **Model checks**, then save `.arcadia` source or `.json`. Warnings allow incomplete authoring; structural errors preserve the committed model and rejected draft.

@@ -87,6 +102,8 @@ In the state view, **Select / move** drags vertices and containers without repar

 ## Edit the same model as text

+For a short text-only start, open [the distress-response model](examples/text-first/project.arcadia) and follow [its three-step walkthrough](examples/text-first/README.md). Four declarations and three explicit relationships describe participants, work, responsibility and an exchange; no diagram or handwritten UUID is needed.
+
 **Textual model** has a source-file folder tree, per-file drafts, syntax highlighting, live linting and explicit **Apply all**. Collapse/Locate navigate the hierarchy; collapsed folders retain draft and diagnostic indicators. Right-click a file for contextual actions. Projects can use relative includes to organize source into files. For example:

 ```text
@@ -0,0 +1,15 @@
+[package]
+name = "oa-cli"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+
+[[bin]]
+name = "arcadia"
+path = "src/main.rs"
+
+[dependencies]
+oa-core = { path = "../oa-core" }
+serde.workspace = true
+serde_json.workspace = true
@@ -0,0 +1,451 @@
+//! Source-only authoring. Preparation captures bytes; only core owns disk writes.
+use oa_core::{
+    Command, language,
+    persistence::MigrationReport,
+    prepare_command,
+    source_files::{self, DiskProject, SourceFileError},
+    source_project::{self, CompiledSourceProject, ProjectLimits, SourceDiagnostic},
+    validation::Severity,
+};
+use serde::Serialize;
+use std::path::{Path, PathBuf};
+
+pub const LIMITS: ProjectLimits = ProjectLimits {
+    max_files: 256,
+    max_include_depth: 32,
+    max_include_edges: 1024,
+    model: language::ParseLimits {
+        max_source_bytes: 64 * 1024 * 1024,
+        max_graph_objects: 100_000,
+        max_records: 250_000,
+        max_step_references: 500_000,
+    },
+};
+
+#[derive(Debug, Clone)]
+pub enum Operation {
+    Check,
+    Stabilize,
+    RenameAlias { old: String, new: String },
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct Location {
+    pub path: String,
+    /// Half-open UTF-8 byte offsets. Line/column are one-based Unicode scalars.
+    pub start: usize,
+    pub end: usize,
+    pub line: Option<usize>,
+    pub column: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct Diagnostic {
+    pub severity: String,
+    pub code: String,
+    pub message: String,
+    pub coordinate_space: String,
+    pub location: Option<Location>,
+    pub related: Vec<Location>,
+    pub object_id: Option<String>,
+    pub field: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct Change {
+    pub path: String,
+    /// Exact captured and proposed UTF-8 text, including line endings.
+    pub before: String,
+    pub after: String,
+    pub diff: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct Report {
+    pub format_version: u32,
+    pub entry: String,
+    pub operation: String,
+    pub status: String,
+    pub exit_code: u8,
+    /// True only after a successful changed save. False on failure does not
+    /// promise rollback: consult the specific error/recovery outcome.
+    pub written: bool,
+    pub diagnostics: Vec<Diagnostic>,
+    pub changes: Vec<Change>,
+    pub identities_to_stabilize: usize,
+    pub migration: Option<MigrationReport>,
+    pub notes: Vec<String>,
+}
+
+impl Report {
+    pub fn failure(
+        entry: &Path,
+        operation: &str,
+        exit_code: u8,
+        code: &str,
+        message: String,
+    ) -> Self {
+        let mut report = Self::empty(entry, operation);
+        report.fail(exit_code, code, message);
+        report
+    }
+
+    fn empty(entry: &Path, operation: &str) -> Self {
+        Self {
+            format_version: 1,
+            entry: entry.to_string_lossy().into_owned(),
+            operation: operation.into(),
+            status: "checked".into(),
+            exit_code: 0,
+            written: false,
+            diagnostics: vec![],
+            changes: vec![],
+            identities_to_stabilize: 0,
+            migration: None,
+            notes: vec![],
+        }
+    }
+
+    fn fail(&mut self, exit_code: u8, code: &str, message: String) {
+        self.status = "rejected".into();
+        self.exit_code = exit_code;
+        self.diagnostics.push(Diagnostic {
+            severity: "error".into(),
+            code: code.into(),
+            message,
+            coordinate_space: "operation".into(),
+            location: None,
+            related: vec![],
+            object_id: None,
+            field: None,
+        });
+    }
+}
+
+fn located(issue: SourceDiagnostic, space: &str) -> Diagnostic {
+    let d = issue.diagnostic;
+    Diagnostic {
+        severity: match d.severity {
+            Severity::Error => "error",
+            Severity::Warning => "warning",
+        }
+        .into(),
+        code: d.code,
+        message: d.message,
+        coordinate_space: space.into(),
+        location: Some(Location {
+            path: issue.path,
+            start: d.span.start,
+            end: d.span.end,
+            line: Some(d.line),
+            column: Some(d.column),
+        }),
+        related: issue
+            .related
+            .into_iter()
+            .map(|at| Location {
+                path: at.path,
+                start: at.span.start,
+                end: at.span.end,
+                line: None,
+                column: None,
+            })
+            .collect(),
+        object_id: d.object_id.map(|id| id.to_string()),
+        field: d.field,
+    }
+}
+
+fn disk_error(report: &mut Report, error: SourceFileError) {
+    let code = match &error {
+        SourceFileError::Conflict(_) => "external_change",
+        SourceFileError::RecoveryRequired(_) => "recovery_required",
+        SourceFileError::RecoveryFailed { .. } => "recovery_failed",
+        SourceFileError::Path(_) => "unsafe_path",
+        SourceFileError::Limit(_) => "source_limit",
+        SourceFileError::UnknownExpectation(_) => "unknown_disk_expectation",
+        SourceFileError::Invalid(_) => "invalid_save_candidate",
+        SourceFileError::Io { .. } => "io_error",
+    };
+    report.fail(3, code, error.to_string());
+}
+
+/// A candidate owns its original expectations and is consumed by saving.
+/// Callers cannot replace its source/model/expectations after preparation.
+pub struct Prepared {
+    report: Report,
+    snapshot: DiskProject,
+    compiled: CompiledSourceProject,
+    mutable: bool,
+}
+
+impl Prepared {
+    pub fn report(&self) -> &Report {
+        &self.report
+    }
+
+    pub fn into_report(self) -> Report {
+        self.report
+    }
+
+    pub fn write(mut self) -> Report {
+        if !self.mutable {
+            self.report
+                .fail(2, "usage", "check/lint does not accept --write".into());
+            return self.report;
+        }
+        match source_files::save_project(&self.snapshot, &self.compiled, LIMITS) {
+            Ok(_) => {
+                self.report.written = !self.report.changes.is_empty();
+                self.report.status = if self.report.written {
+                    "written"
+                } else {
+                    "unchanged"
+                }
+                .into();
+            }
+            Err(error) => disk_error(&mut self.report, error),
+        }
+        self.report
+    }
+}
+
+pub fn prepare(entry: &Path, operation: Operation) -> Result<Prepared, Box<Report>> {
+    let name = match operation {
+        Operation::Check => "check",
+        Operation::Stabilize => "stabilize",
+        Operation::RenameAlias { .. } => "rename-alias",
+    };
+    let mut report = Report::empty(entry, name);
+    let snapshot = source_files::load_project(entry, LIMITS).map_err(|error| {
+        disk_error(&mut report, error);
+        Box::new(report.clone())
+    })?;
+    let raw = snapshot.reachable_bundle();
+    // The loader may include warnings from stabilized compilation. Only its
+    // discovery/IO diagnostics are authoritative on the original bytes.
+    let mut diagnostics: Vec<_> = snapshot
+        .diagnostics
+        .iter()
+        .filter(|d| {
+            matches!(
+                d.diagnostic.code.as_str(),
+                "pending_save"
+                    | "source_encoding"
+                    | "source_limit"
+                    | "invalid_path"
+                    | "missing_include"
+                    | "project_limit"
+            )
+        })
+        .cloned()
+        .collect();
+    for diagnostic in source_project::lint_bundle(&raw, LIMITS) {
+        if !diagnostics.contains(&diagnostic) {
+            diagnostics.push(diagnostic);
+        }
+    }
+    let disk_refusal = snapshot.diagnostics.iter().any(|d| {
+        matches!(
+            d.diagnostic.code.as_str(),
+            "pending_save" | "missing_include" | "invalid_path"
+        )
+    });
+    let invalid = diagnostics
+        .iter()
+        .any(|d| d.diagnostic.severity == Severity::Error);
+    report.diagnostics = diagnostics
+        .into_iter()
+        .map(|d| located(d, "input"))
+        .collect();
+    if invalid {
+        // Do not run declaration analysis or any updater on invalid raw text.
+        // Failed lint may also have allocated provisional object identities.
+        for diagnostic in &mut report.diagnostics {
+            diagnostic.object_id = None;
+        }
+        report.status = "invalid".into();
+        report.exit_code = if disk_refusal { 3 } else { 1 };
+        return Err(Box::new(report));
+    }
+    let explicit_ids: std::collections::BTreeSet<_> = raw
+        .files
+        .values()
+        .flat_map(|text| language::analyze(text).declarations)
+        .filter_map(|d| d.id.map(|id| id.to_string()))
+        .collect();
+    for diagnostic in &mut report.diagnostics {
+        if diagnostic
+            .object_id
+            .as_ref()
+            .is_some_and(|id| !explicit_ids.contains(id))
+        {
+            diagnostic.object_id = None;
+        }
+    }
+    let mut compiled = source_project::compile_bundle(&raw, LIMITS).map_err(|diagnostics| {
+        report.status = "invalid".into();
+        report.exit_code = 1;
+        report
+            .diagnostics
+            .extend(diagnostics.into_iter().map(|d| located(d, "candidate")));
+        Box::new(report.clone())
+    })?;
+    report.identities_to_stabilize = raw
+        .files
+        .values()
+        .map(|text| {
+            language::analyze(text)
+                .declarations
+                .into_iter()
+                .filter(|d| d.id.is_none())
+                .count()
+        })
+        .sum();
+    report.migration = compiled.decoded.migration.clone();
+    let mutable = !matches!(operation, Operation::Check);
+    if let Operation::RenameAlias { old, new } = operation {
+        let project = &compiled.decoded.project;
+        let Some((id, _)) = project
+            .identities()
+            .into_iter()
+            .find(|(_, alias)| *alias == old)
+        else {
+            report.fail(
+                1,
+                "unknown_alias",
+                format!("No declaration has alias '{old}'."),
+            );
+            return Err(Box::new(report));
+        };
+        let command = prepare_command(project, &Command::SetAlias(id, new)).map_err(|error| {
+            report.fail(1, "semantic_command_rejected", error.to_string());
+            Box::new(report.clone())
+        })?;
+        compiled = source_project::update_bundle_with_identity_map(
+            &compiled,
+            &command.project,
+            &command.identity_map,
+            LIMITS,
+        )
+        .map_err(|diagnostics| {
+            report.status = "invalid".into();
+            report.exit_code = 1;
+            report
+                .diagnostics
+                .extend(diagnostics.into_iter().map(|d| located(d, "candidate")));
+            Box::new(report.clone())
+        })?;
+    }
+    if mutable {
+        for (path, after) in &compiled.bundle.files {
+            let before = raw.files.get(path).cloned().unwrap_or_default();
+            if &before != after {
+                report.changes.push(Change {
+                    path: path.clone(),
+                    diff: unified_diff(path, &before, after),
+                    before,
+                    after: after.clone(),
+                });
+            }
+        }
+        report.status = "preview".into();
+        report.notes.push("This invocation's complete proposed changed-file texts and diffs are reported. Without --write nothing is saved; a later invocation may allocate different missing UUIDs. This is not a saved plan or a digest of unchanged dependencies.".into());
+    }
+    report.notes.push("Diagnostic object IDs are omitted for declarations without authored IDs; lint's temporary identities are not the candidate's identities.".into());
+    report.notes.push("Disk writes use the core journal/conflict checks. This is not cross-process atomic visibility or a power-loss durability guarantee; pending saves are never implicitly recovered. A failed write may require explicit journal recovery.".into());
+    Ok(Prepared {
+        report,
+        snapshot,
+        compiled,
+        mutable,
+    })
+}
+
+/// One bounded hunk per file: common prefix/suffix plus three context lines.
+/// Linear in input size; no quadratic LCS allocation for large modules.
+fn unified_diff(path: &str, before: &str, after: &str) -> String {
+    let a: Vec<_> = before.split_inclusive('\n').collect();
+    let b: Vec<_> = after.split_inclusive('\n').collect();
+    let prefix = a.iter().zip(&b).take_while(|(a, b)| a == b).count();
+    let suffix = a[prefix..]
+        .iter()
+        .rev()
+        .zip(b[prefix..].iter().rev())
+        .take_while(|(a, b)| a == b)
+        .count();
+    let start = prefix.saturating_sub(3);
+    let a_end = (a.len() - suffix + 3).min(a.len());
+    let b_end = (b.len() - suffix + 3).min(b.len());
+    let a_start = if a_end == start { start } else { start + 1 };
+    let b_start = if b_end == start { start } else { start + 1 };
+    let mut out = format!(
+        "--- a/{path}\n+++ b/{path}\n@@ -{a_start},{} +{b_start},{} @@\n",
+        a_end - start,
+        b_end - start
+    );
+    let mut emit = |prefix: char, line: &str| {
+        out.push(prefix);
+        out.push_str(line);
+        if !line.ends_with('\n') {
+            out.push_str("\n\\ No newline at end of file\n");
+        }
+    };
+    for line in &a[start..prefix] {
+        emit(' ', line);
+    }
+    for line in &a[prefix..a.len() - suffix] {
+        emit('-', line);
+    }
+    for line in &b[prefix..b.len() - suffix] {
+        emit('+', line);
+    }
+    for line in &a[a.len() - suffix..a_end] {
+        emit(' ', line);
+    }
+    out
+}
+
+pub struct Arguments {
+    pub entry: PathBuf,
+    pub operation: Operation,
+    pub write: bool,
+    pub json: bool,
+}
+
+pub const HELP: &str = "arcadia check ROOT [--json]\narcadia lint ROOT [--json]\narcadia stabilize ROOT [--write] [--json]\narcadia rename-alias ROOT OLD NEW [--write] [--json]\n\nROOT is an explicit .arcadia entry file; includes resolve relative to it.\nMutation commands preview by default. --write applies this invocation's candidate.\nMissing UUIDs in a preview are provisional until written. No canonical formatting.\nExit: 0 valid/success (engineering warnings allowed), 1 invalid source or semantic\ncommand rejection, 2 usage, 3 disk/path/conflict/pending-journal/output failure.\nNo implicit journal recovery. Limits: 64 MiB, 256 files, include depth32/edges1024,\n100000 graph objects, 250000 records, 500000 ordered references.\n";
+
+pub fn arguments(args: &[std::ffi::OsString]) -> Result<Arguments, String> {
+    let mut positional = Vec::new();
+    let (mut write, mut json) = (false, false);
+    for arg in args {
+        if arg == "--write" && !write {
+            write = true;
+        } else if arg == "--json" && !json {
+            json = true;
+        } else if arg.to_string_lossy().starts_with('-') {
+            return Err(format!(
+                "Unknown or repeated option: {}",
+                arg.to_string_lossy()
+            ));
+        } else {
+            positional.push(arg);
+        }
+    }
+    let command = positional.first().and_then(|s| s.to_str()).unwrap_or("");
+    let operation = match (command, positional.len()) {
+        ("check" | "lint", 2) if !write => Operation::Check,
+        ("stabilize", 2) => Operation::Stabilize,
+        ("rename-alias", 4) => Operation::RenameAlias {
+            old: positional[2].to_str().ok_or("Alias must be UTF-8")?.into(),
+            new: positional[3].to_str().ok_or("Alias must be UTF-8")?.into(),
+        },
+        _ => return Err(HELP.into()),
+    };
+    Ok(Arguments {
+        entry: PathBuf::from(positional[1]),
+        operation,
+        write,
+        json,
+    })
+}
@@ -0,0 +1,102 @@
+use oa_cli::{Report, arguments, prepare};
+use std::{
+    io::{self, Write},
+    path::Path,
+    process::ExitCode,
+};
+
+fn human_report(report: &Report, show_diff: bool) -> io::Result<()> {
+    let mut err = io::stderr().lock();
+    for d in &report.diagnostics {
+        let at = d
+            .location
+            .as_ref()
+            .map(|l| {
+                format!(
+                    "{}:{}:{}",
+                    l.path,
+                    l.line.unwrap_or(0),
+                    l.column.unwrap_or(0)
+                )
+            })
+            .unwrap_or_else(|| report.entry.clone());
+        writeln!(
+            err,
+            "{at}: {}[{}] ({}): {}",
+            d.severity, d.code, d.coordinate_space, d.message
+        )?;
+    }
+    writeln!(
+        err,
+        "{}: {} file changes; {} identities to stabilize",
+        report.status,
+        report.changes.len(),
+        report.identities_to_stabilize
+    )?;
+    if let Some(migration) = &report.migration {
+        writeln!(
+            err,
+            "Source migration: schema {} → {} (separate from identity stabilization)",
+            migration.from_schema, migration.to_schema
+        )?;
+    }
+    for note in &report.notes {
+        writeln!(err, "{note}")?;
+    }
+    if show_diff {
+        let mut out = io::stdout().lock();
+        for change in &report.changes {
+            write!(out, "{}", change.diff)?;
+        }
+        out.flush()?;
+    }
+    err.flush()
+}
+
+fn run() -> io::Result<u8> {
+    let args: Vec<_> = std::env::args_os().skip(1).collect();
+    if args.len() == 1 && (args[0] == "--help" || args[0] == "-h") {
+        io::stdout().write_all(oa_cli::HELP.as_bytes())?;
+        return Ok(0);
+    }
+    if args.len() == 1 && args[0] == "--version" {
+        writeln!(io::stdout(), "arcadia {}", env!("CARGO_PKG_VERSION"))?;
+        return Ok(0);
+    }
+    let json = args.iter().any(|a| a == "--json");
+    let mut displayed = false;
+    let report = match arguments(&args) {
+        Err(error) => Report::failure(Path::new(""), "usage", 2, "usage", error),
+        Ok(args) => match prepare(&args.entry, args.operation) {
+            Err(report) => *report,
+            Ok(prepared) => {
+                if args.write {
+                    if !args.json {
+                        human_report(prepared.report(), true)?;
+                        displayed = true;
+                    }
+                    prepared.write()
+                } else {
+                    prepared.into_report()
+                }
+            }
+        },
+    };
+    if json {
+        serde_json::to_writer_pretty(io::stdout().lock(), &report)?;
+        writeln!(io::stdout())?;
+    } else {
+        human_report(&report, !displayed)?;
+    }
+    Ok(report.exit_code)
+}
+
+fn main() -> ExitCode {
+    match run() {
+        Ok(code) => ExitCode::from(code),
+        Err(error) => {
+            let _ = writeln!(io::stderr(), "Output failed: {error}");
+            ExitCode::from(3)
+        }
+    }
+}
@@ -0,0 +1,425 @@
+use oa_cli::{LIMITS, Operation, Prepared, prepare};
+use oa_core::{Id, Project, source_files, source_project};
+use serde_json::Value;
+use std::{
+    collections::BTreeMap,
+    fs,
+    path::{Path, PathBuf},
+    process::Command,
+};
+
+struct Fixture(PathBuf);
+impl Fixture {
+    fn new() -> Self {
+        let path = std::env::temp_dir().join(format!("arcadia-cli-test-{}", Id::new_v4()));
+        fs::create_dir(&path).unwrap();
+        Self(path)
+    }
+    fn put(&self, name: &str, text: &str) {
+        let path = self.0.join(name);
+        fs::create_dir_all(path.parent().unwrap()).unwrap();
+        fs::write(path, text).unwrap();
+    }
+    fn entry(&self) -> PathBuf {
+        self.0.join("project.arcadia")
+    }
+    fn read(&self, name: &str) -> String {
+        fs::read_to_string(self.0.join(name)).unwrap()
+    }
+    fn prepare(&self, op: Operation) -> Prepared {
+        prepare(&self.entry(), op).unwrap_or_else(|report| panic!("{report:#?}"))
+    }
+    fn model(&self) -> Project {
+        let disk = source_files::load_project(&self.entry(), LIMITS).unwrap();
+        source_project::compile_bundle(&disk.reachable_bundle(), LIMITS)
+            .unwrap()
+            .decoded
+            .project
+    }
+    fn cli(&self, args: &[&str]) -> (i32, Value) {
+        let mut command = Command::new(env!("CARGO_BIN_EXE_arcadia"));
+        command
+            .arg(args[0])
+            .arg(self.entry())
+            .args(&args[1..])
+            .arg("--json");
+        let output = command.output().unwrap();
+        assert!(
+            output.stderr.is_empty(),
+            "{}",
+            String::from_utf8_lossy(&output.stderr)
+        );
+        (
+            output.status.code().unwrap(),
+            serde_json::from_slice(&output.stdout).unwrap(),
+        )
+    }
+}
+impl Drop for Fixture {
+    fn drop(&mut self) {
+        let _ = fs::remove_dir_all(&self.0);
+    }
+}
+
+const SIMPLE: &str = "// 雨: authored defaults stay omitted\r\narcadia 7;\r\nproject rescue \"Rescue\" {\r\n    oa_entity team \"Team\" {}\r\n}\r\n";
+
+#[test]
+fn complete_alarm_example_preview_then_write_and_fixed_point() {
+    let fixture = Fixture::new();
+    let source = include_str!(
+        "../../../harness/experiments/textual-authoring-20260911/alarm-response.arcadia"
+    );
+    fixture.put("project.arcadia", source);
+    let (code, check) = fixture.cli(&["check"]);
+    assert_eq!(code, 0);
+    assert_eq!(check["diagnostics"], serde_json::json!([]));
+    let (code, preview) = fixture.cli(&["stabilize"]);
+    assert_eq!(code, 0);
+    assert_eq!(preview["identities_to_stabilize"], 40);
+    assert_eq!(preview["status"], "preview");
+    assert_eq!(fixture.read("project.arcadia"), source);
+    assert!(
+        preview["changes"][0]["diff"]
+            .as_str()
+            .unwrap()
+            .contains("+project alarm_response")
+    );
+    let (code, written) = fixture.cli(&["stabilize", "--write"]);
+    assert_eq!(code, 0);
+    let saved = fixture.read("project.arcadia");
+    assert_eq!(written["changes"][0]["after"], saved);
+    let project = fixture.model();
+    assert_eq!(project.identities().len(), 40);
+    let mut stripped = saved.clone();
+    for (id, _) in project.identities() {
+        stripped = stripped.replace(&format!(" id \"{id}\""), "");
+    }
+    assert_eq!(stripped, source, "only identity clauses may be inserted");
+    let (code, again) = fixture.cli(&["stabilize", "--write"]);
+    assert_eq!(code, 0);
+    assert_eq!(again["changes"], serde_json::json!([]));
+    assert_eq!(again["status"], "unchanged");
+    assert_eq!(fixture.model(), project);
+    assert_eq!(fixture.read("project.arcadia"), saved);
+}
+
+#[test]
+fn captured_candidate_exact_write_preserves_crlf_comments_and_noop_metadata() {
+    let fixture = Fixture::new();
+    fixture.put("project.arcadia", SIMPLE);
+    let candidate = fixture.prepare(Operation::Stabilize);
+    let expected = candidate.report().changes[0].after.clone();
+    assert_eq!(candidate.report().identities_to_stabilize, 2);
+    assert_eq!(fixture.read("project.arcadia"), SIMPLE);
+    assert_eq!(candidate.write().exit_code, 0);
+    assert_eq!(fixture.read("project.arcadia"), expected);
+    assert!(expected.contains("// 雨: authored defaults stay omitted\r\n"));
+    assert!(!expected.contains("description"));
+    let metadata = fs::metadata(fixture.entry()).unwrap().modified().unwrap();
+    let report = fixture.prepare(Operation::Stabilize).write();
+    assert_eq!(report.status, "unchanged");
+    assert!(!report.written);
+    assert_eq!(
+        fs::metadata(fixture.entry()).unwrap().modified().unwrap(),
+        metadata
+    );
+    assert_eq!(fs::read_dir(&fixture.0).unwrap().count(), 1);
+}
+
+#[test]
+fn alias_rename_across_modules_changes_only_live_tokens_and_retains_all_identity() {
+    let fixture = Fixture::new();
+    fixture.put("project.arcadia", "arcadia 7; project rescue \"Rescue\" { include \"participants.arcadia\"; include \"work.arcadia\"; }\n");
+    fixture.put(
+        "participants.arcadia",
+        "// @team is quoted documentation\noa_entity team \"Team @team\" {}\n",
+    );
+    fixture.put("work.arcadia", "oa_activity assess \"Assess\" {}\noa_activity report \"Report\" {}\nallocation assigned \"Assigned\" { source @team; target @assess; }\ninteraction transfer \"Transfer\" { source @assess; target @report; }\n");
+    assert_eq!(fixture.prepare(Operation::Stabilize).write().exit_code, 0);
+    let before = fixture.model();
+    let original: BTreeMap<_, _> = ["project.arcadia", "participants.arcadia", "work.arcadia"]
+        .into_iter()
+        .map(|p| (p, fixture.read(p)))
+        .collect();
+    let team = before
+        .identities()
+        .into_iter()
+        .find(|(_, alias)| *alias == "team")
+        .unwrap()
+        .0;
+    let candidate = fixture.prepare(Operation::RenameAlias {
+        old: "team".into(),
+        new: "rescue_team".into(),
+    });
+    assert_eq!(candidate.report().changes.len(), 2);
+    assert_eq!(fixture.model(), before, "preview cannot mutate");
+    assert_eq!(candidate.write().exit_code, 0);
+    let mut expected = before;
+    expected.elements.get_mut(&team).unwrap().alias = "rescue_team".into();
+    assert_eq!(fixture.model(), expected);
+    assert_eq!(fixture.read("project.arcadia"), original["project.arcadia"]);
+    assert_eq!(
+        fixture.read("participants.arcadia"),
+        original["participants.arcadia"].replacen("oa_entity team ", "oa_entity rescue_team ", 1)
+    );
+    assert_eq!(
+        fixture.read("work.arcadia"),
+        original["work.arcadia"].replace("source @team;", "source @rescue_team;")
+    );
+}
+
+#[test]
+fn invalid_unicode_raw_edit_is_located_and_never_stabilized_or_written() {
+    let fixture = Fixture::new();
+    let raw = "arcadia 7; project p \"雨\" {\n oa_activity a \"A\" {}\n allocation alloc \"Alloc\" { source @missing; target @a; }\n}\n";
+    fixture.put("project.arcadia", raw);
+    for command in [
+        vec!["check"],
+        vec!["stabilize", "--write"],
+        vec!["rename-alias", "a", "b", "--write"],
+    ] {
+        let (code, report) = fixture.cli(&command);
+        assert_eq!(code, 1);
+        assert_eq!(fixture.read("project.arcadia"), raw);
+        let diagnostics = report["diagnostics"].as_array().unwrap();
+        assert!(!diagnostics.is_empty());
+        for d in diagnostics {
+            assert_eq!(d["coordinate_space"], "input");
+            let at = &d["location"];
+            let start = at["start"].as_u64().unwrap() as usize;
+            assert!(raw.is_char_boundary(start));
+            assert_eq!(
+                at["line"].as_u64().unwrap() as usize,
+                raw[..start].bytes().filter(|b| *b == b'\n').count() + 1
+            );
+            let line = raw[..start]
+                .rsplit_once('\n')
+                .map_or(&raw[..start], |(_, tail)| tail);
+            assert_eq!(
+                at["column"].as_u64().unwrap() as usize,
+                line.chars().count() + 1
+            );
+        }
+    }
+}
+
+#[test]
+fn missing_id_warning_uses_raw_location_and_never_exposes_ephemeral_lint_id() {
+    let fixture = Fixture::new();
+    let raw = "arcadia 7;\nproject p \"雨\" {\n    oa_activity work \"Work\" {}\n}\n";
+    fixture.put("project.arcadia", raw);
+    let (code, result) = fixture.cli(&["lint"]);
+    assert_eq!(code, 0, "engineering warnings do not reject admission");
+    let warning = result["diagnostics"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .find(|d| d["code"] == "work_without_behavior_context")
+        .unwrap();
+    assert_eq!(warning["severity"], "warning");
+    assert_eq!(
+        warning["location"]["start"],
+        raw.find("oa_activity").unwrap()
+    );
+    assert_eq!(warning["location"]["line"], 3);
+    assert_eq!(warning["location"]["column"], 5);
+    assert!(warning["object_id"].is_null());
+    assert_eq!(fixture.read("project.arcadia"), raw);
+}
+
+#[test]
+fn captured_dependency_change_refuses_all_writes_even_on_noop() {
+    let fixture = Fixture::new();
+    fixture.put("project.arcadia", SIMPLE);
+    let pending = fixture.prepare(Operation::Stabilize);
+    let external = format!("{SIMPLE}// editor changed this\n");
+    fixture.put("project.arcadia", &external);
+    let result = pending.write();
+    assert_eq!(result.exit_code, 3);
+    assert_eq!(result.diagnostics.last().unwrap().code, "external_change");
+    assert_eq!(fixture.read("project.arcadia"), external);
+    assert_eq!(fixture.prepare(Operation::Stabilize).write().exit_code, 0);
+    let noop = fixture.prepare(Operation::Stabilize);
+    assert!(noop.report().changes.is_empty());
+    let latest = format!("{}// another edit\n", fixture.read("project.arcadia"));
+    fixture.put("project.arcadia", &latest);
+    assert_eq!(noop.write().exit_code, 3);
+    assert_eq!(fixture.read("project.arcadia"), latest);
+}
+
+#[test]
+fn pending_journal_refuses_read_preview_and_write_without_recovery() {
+    let fixture = Fixture::new();
+    fixture.put("project.arcadia", SIMPLE);
+    assert_eq!(fixture.prepare(Operation::Stabilize).write().exit_code, 0);
+    let noop = fixture.prepare(Operation::Stabilize);
+    let source = fixture.read("project.arcadia");
+    // An opaque incomplete journal must never be interpreted/recovered by CLI.
+    let journal = fixture.0.join(".arcadia-save-project.arcadia.journal");
+    fs::create_dir(&journal).unwrap();
+    fs::write(journal.join("sentinel"), b"retain").unwrap();
+    for op in [Operation::Check, Operation::Stabilize] {
+        let report = prepare(&fixture.entry(), op).err().unwrap();
+        assert_eq!(report.exit_code, 3);
+        assert!(report.diagnostics.iter().any(|d| d.code == "pending_save"));
+    }
+    assert_eq!(
+        noop.write().exit_code,
+        3,
+        "saver must recheck after preview"
+    );
+    assert_eq!(fixture.read("project.arcadia"), source);
+    assert_eq!(fs::read(journal.join("sentinel")).unwrap(), b"retain");
+}
+
+#[test]
+fn rejected_alias_and_same_alias_preserve_source() {
+    let fixture = Fixture::new();
+    fixture.put("project.arcadia", SIMPLE);
+    assert_eq!(fixture.prepare(Operation::Stabilize).write().exit_code, 0);
+    let source = fixture.read("project.arcadia");
+    for (old, new) in [
+        ("team", "rescue"),
+        ("team", "invalid alias"),
+        ("absent", "valid"),
+    ] {
+        let (code, result) = fixture.cli(&["rename-alias", old, new, "--write"]);
+        assert_eq!(code, 1);
+        assert_eq!(result["status"], "rejected");
+        assert_eq!(fixture.read("project.arcadia"), source);
+    }
+    let (code, result) = fixture.cli(&["rename-alias", "team", "team", "--write"]);
+    assert_eq!(code, 0);
+    assert_eq!(result["status"], "unchanged");
+    assert_eq!(fixture.read("project.arcadia"), source);
+}
+
+#[test]
+fn rename_shows_missing_identity_and_separate_source_migration() {
+    let fixture = Fixture::new();
+    let old = "// retain\narcadia 5; project p \"P\" { oa_entity team \"Team\" {} }\n";
+    fixture.put("project.arcadia", old);
+    let candidate = fixture.prepare(Operation::RenameAlias {
+        old: "team".into(),
+        new: "crew".into(),
+    });
+    let report = candidate.report();
+    assert_eq!(report.identities_to_stabilize, 2);
+    assert_eq!(report.migration.as_ref().unwrap().from_schema, 5);
+    assert_eq!(report.migration.as_ref().unwrap().to_schema, 7);
+    assert!(report.changes[0].diff.contains("-arcadia 5;"));
+    assert!(report.changes[0].diff.contains("+arcadia 7;"));
+    assert!(report.changes[0].after.contains("oa_entity crew"));
+    assert_eq!(fixture.read("project.arcadia"), old);
+    assert_eq!(candidate.write().exit_code, 0);
+}
+
+#[test]
+fn entry_is_explicit_and_machine_readable_usage_errors_do_not_write() {
+    let fixture = Fixture::new();
+    fixture.put("project.arcadia", SIMPLE);
+    let output = Command::new(env!("CARGO_BIN_EXE_arcadia"))
+        .current_dir(&fixture.0)
+        .args(["check", "--json"])
+        .output()
+        .unwrap();
+    assert_eq!(output.status.code(), Some(2));
+    let error: Value = serde_json::from_slice(&output.stdout).unwrap();
+    assert_eq!(error["diagnostics"][0]["code"], "usage");
+    assert_eq!(fixture.read("project.arcadia"), SIMPLE);
+    let (code, _) = fixture.cli(&["check", "--write"]);
+    assert_eq!(code, 2);
+    assert!(Path::new(env!("CARGO_BIN_EXE_arcadia")).is_file());
+}
+
+#[test]
+fn loader_encoding_missing_dependency_and_invalid_old_source_keep_original_bytes() {
+    let fixture = Fixture::new();
+    let entry = "arcadia 7; project p \"P\" { include \"part.arcadia\"; }";
+    fixture.put("project.arcadia", entry);
+    let (code, report) = fixture.cli(&["stabilize", "--write"]);
+    assert_eq!(code, 3, "a disk dependency could not be read");
+    assert!(
+        report["diagnostics"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .any(|d| d["code"] == "missing_include")
+    );
+    fs::write(fixture.0.join("part.arcadia"), [0xff, 0xfe]).unwrap();
+    let (code, report) = fixture.cli(&["stabilize", "--write"]);
+    assert_eq!(code, 1, "invalid encoding is invalid raw source");
+    assert!(
+        report["diagnostics"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .any(|d| d["code"] == "source_encoding")
+    );
+    assert_eq!(fixture.read("project.arcadia"), entry);
+    assert_eq!(
+        fs::read(fixture.0.join("part.arcadia")).unwrap(),
+        [0xff, 0xfe]
+    );
+    for raw in [
+        "arcadia 5; project p \"P\" { oa_entity a \"A\" { ??? } }",
+        "arcadia 2; project p \"P\" {}",
+    ] {
+        fixture.put("project.arcadia", raw);
+        let (code, _) = fixture.cli(&["stabilize", "--write"]);
+        assert_eq!(code, 1);
+        assert_eq!(fixture.read("project.arcadia"), raw);
+    }
+}
+
+#[test]
+fn non_element_alias_detached_file_and_unchanged_dependency_conflict() {
+    let fixture = Fixture::new();
+    fixture.put("project.arcadia", "arcadia 7; project p \"P\" { include \"part.arcadia\"; oa_activity a \"A\" {} allocation responsible \"Responsible\" { source @ // keep edge comment\nteam; target @a; } }");
+    fixture.put("part.arcadia", "oa_entity team \"Team\" {}");
+    fixture.put(
+        "detached.arcadia",
+        "invalid detached draft must stay exact 雨",
+    );
+    assert_eq!(fixture.prepare(Operation::Stabilize).write().exit_code, 0);
+    let before = fixture.model();
+    let relation = before
+        .identities()
+        .into_iter()
+        .find(|(_, alias)| *alias == "responsible")
+        .unwrap()
+        .0;
+    let (code, _) = fixture.cli(&["rename-alias", "responsible", "performs", "--write"]);
+    assert_eq!(code, 0);
+    let mut expected = before;
+    expected.relations.get_mut(&relation).unwrap().alias = "performs".into();
+    assert_eq!(fixture.model(), expected);
+    assert!(
+        fixture
+            .read("project.arcadia")
+            .contains("@ // keep edge comment\nteam")
+    );
+    let captured = fixture.prepare(Operation::RenameAlias {
+        old: "p".into(),
+        new: "rescue".into(),
+    });
+    assert!(
+        captured
+            .report()
+            .changes
+            .iter()
+            .all(|c| c.path != "part.arcadia")
+    );
+    let root_before = fixture.read("project.arcadia");
+    fixture.put("part.arcadia", "// external unchanged-dependency edit\n");
+    assert_eq!(captured.write().exit_code, 3);
+    assert_eq!(fixture.read("project.arcadia"), root_before);
+    assert_eq!(
+        fixture.read("part.arcadia"),
+        "// external unchanged-dependency edit\n"
+    );
+    assert_eq!(
+        fixture.read("detached.arcadia"),
+        "invalid detached draft must stay exact 雨"
+    );
+}
@@ -18,6 +18,7 @@ serde_json.workspace = true
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
 tokio = { version = "1", features = ["rt", "time"] }
 tempfile = "3"
+unicode-segmentation = "1.13.3"

 [dev-dependencies]
 iced_runtime = "0.14"
@@ -5,6 +5,7 @@ mod checkpoints;
 #[cfg(test)]
 mod diagram_selection_tests;
 mod hosted;
+mod reference_authoring;
 #[cfg(test)]
 mod review_navigation_tests;
 #[cfg(test)]
@@ -13,6 +14,7 @@ mod transition_context_tests;
 mod view_copy_tests;
 use crate::forms::Draft;
 use crate::{
+    behavior,
    document::Document,
    source_workspace::{self, LIMITS, Workspace},
 };
@@ -56,7 +58,7 @@ mod direct_scenario_tests {
        }
    }
    #[test]
-    fn direct_scenario_scroll_and_real_resize_invalidate_only_pointer_context() {
+    fn direct_scenario_camera_details_and_real_resize_invalidate_only_pointer_context() {
        let (mut app, f) = setup();
        let original = app.document.bundle().clone();
        let event = begin(&app, &f);
@@ -72,18 +74,26 @@ mod direct_scenario_tests {
        let _ = app.update(Message::ScenarioCanvas(event));
        assert!(!app.behavior.has_pending());
        let context = app.scenario_context().unwrap();
-        for (area, offset) in [
-            (scenario::ScrollArea::Canvas, iced::Vector::new(30., 150.)),
-            (scenario::ScrollArea::Page, iced::Vector::new(0., 90.)),
-        ] {
+        let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Camera(
+            context,
+            app.camera_epoch,
+            behavior::canvas_workspace::Event::Pan(iced::Vector::new(30., 150.)),
+        )));
+        assert_ne!(app.scenario_context(), Some(context));
+        let context = app.scenario_context().unwrap();
+        for offset in [iced::Vector::new(0., 90.), iced::Vector::new(0., 150.)] {
            let before = app.scenario_context().unwrap();
            let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Scrolled(
-                context, area, offset,
+                context,
+                scenario::ScrollArea::Page,
+                offset,
            )));
            assert_ne!(app.scenario_context(), Some(before));
            let current = app.scenario_context().unwrap();
            let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Scrolled(
-                context, area, offset,
+                context,
+                scenario::ScrollArea::Page,
+                offset,
            )));
            assert_eq!(
                app.scenario_context(),
@@ -112,7 +122,7 @@ mod direct_scenario_tests {
            }
            let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Scrolled(
                stale,
-                scenario::ScrollArea::Canvas,
+                scenario::ScrollArea::Page,
                iced::Vector::new(0., 900.),
            )));
            assert_eq!(app.scenario_context(), Some(current));
@@ -317,6 +327,7 @@ pub struct FilePrompt {

 #[derive(Debug, Clone)]
 pub enum Message {
+    BehaviorControl(behavior::canvas_workspace::Intent),
    Architecture(architecture_authoring::Event),
    Home(crate::home::Event),
    CheckpointTick,
@@ -370,6 +381,8 @@ pub enum Message {
    FieldValuePath(String, crate::data_values::FieldPathKey),
    FieldValueBrowse(String, Option<crate::data_values::FieldPathKey>, usize),
    FieldReferenceBrowse(String, String, usize),
+    FieldReferenceOpen(crate::forms::reference_chooser::adapter::Open),
+    FieldReferenceEvent(crate::forms::reference_chooser::Event),
    FieldVariant(String, Value),
    FieldArray(String, Option<usize>, i32),
    Apply,
@@ -444,10 +457,14 @@ pub struct App {
    pub hosted: crate::hosted::State,
    pub connection: Option<crate::connection_edit::Session>,
    pub model_menu: Option<crate::model_menu::Opened>,
+    reference_authoring: reference_authoring::State,
    pub source_tree: crate::source_tree::State,
    menu_sequence: u64,
    pub canvas_document: Id,
    pub canvas_epoch: u64,
+    /// Camera batches survive their own updates, never external presentation changes.
+    pub camera_epoch: u64,
+    camera_boundary_epoch: u64,
    pub selected_bend: Option<(Id, usize)>,
    pub exact_strings: bool,
    pub document: Document,
@@ -546,10 +563,13 @@ impl App {
            checkpoint_close: None,
            connection: None,
            model_menu: None,
+            reference_authoring: Default::default(),
            source_tree: Default::default(),
            menu_sequence: 0,
            canvas_document: Id::new_v4(),
            canvas_epoch: 0,
+            camera_epoch: 0,
+            camera_boundary_epoch: 0,
            selected_bend: None,
            exact_strings: false,
            document,
@@ -849,14 +869,28 @@ impl App {
    }
    fn execute(&mut self, command: Command) -> bool {
        let command = crate::port_edit::repair_owner_change(self.project(), command);
+        let created = self.behavior.creation.created_by(self.project(), &command);
        let scenario_selection = self
            .behavior
            .scenario
-            .created_selection(&command)
-            .or_else(|| self.behavior.topology.created_selection(&command));
+            .created_selection(self.project(), &command)
+            .or_else(|| {
+                self.behavior
+                    .topology
+                    .created_selection(self.project(), &command)
+            });
        match self.document.execute(command) {
            Ok(selected) => {
-                if let Some(id) = scenario_selection.or(selected) {
+                if let Some(created) = created {
+                    self.layer = created.layer;
+                    self.selected = created.behavior;
+                    self.selected_node = None;
+                    self.behavior.active_owner = Some(created.behavior);
+                    self.behavior.diagram = behavior::state_view::State::default();
+                    self.behavior.diagram.diagram = created.diagram;
+                    self.page = Page::Behavior;
+                    self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
+                } else if let Some(id) = scenario_selection.or(selected) {
                    self.selected = id;
                }
                self.sync();
@@ -1012,7 +1046,13 @@ impl App {
            crate::model_menu::popup(self),
        )
        .into();
-        crate::hosted::view::overlay(self, base)
+        crate::behavior::scenario::focus::root(
+            behavior::canvas_workspace::focus_root(
+                crate::hosted::view::overlay(self, self.reference_overlay(base)),
+                behavior::canvas_workspace::Scope::input_owner(self),
+            ),
+            self.scenario_focus_owner(),
+        )
    }
    pub fn subscription(&self) -> Subscription<Message> {
        Subscription::batch([
@@ -1020,6 +1060,10 @@ impl App {
            window::close_requests().map(|id| Message::Request(Pending::Close(id))),
            window::resize_events().map(|(_, size)| Message::WindowResized(size)),
            architecture_authoring::subscription(self),
+            behavior::creation::subscription(
+                self.behavior.creation.has_pending() || self.behavior.source_active(),
+            )
+            .map(|()| Message::Escape),
            iced::event::listen_with(|event, status, _| {
                let iced::Event::Keyboard(keyboard::Event::KeyPressed {
                    key,
@@ -1064,6 +1108,108 @@ impl App {
        ])
    }
    pub fn update(&mut self, message: Message) -> Task<Message> {
+        if let Message::BehaviorControl(intent) = message {
+            return self.behavior_control(intent);
+        }
+        let camera = matches!(
+            &message,
+            Message::ScenarioCanvas(crate::behavior::scenario::CanvasEvent::Camera(..))
+                | Message::TopologyCanvas(crate::behavior::topology::CanvasEvent::Camera(..))
+        );
+        let before = self.camera_boundary();
+        let task = self.update_inner(message);
+        if !camera && self.camera_boundary() != before {
+            self.camera_epoch = self.camera_epoch.wrapping_add(1);
+            self.camera_boundary_epoch = self.canvas_epoch;
+        }
+        task
+    }
+    fn behavior_control(&mut self, intent: behavior::canvas_workspace::Intent) -> Task<Message> {
+        use behavior::canvas_workspace::{self, Event as Camera, Scope};
+        use behavior::scenario::CanvasEvent as Scenario;
+        use behavior::topology::CanvasEvent as Process;
+        if Scope::input_owner(self) != Some(intent.scope) {
+            return Task::none();
+        }
+        let mut message = *intent.message;
+        let scope = intent.scope;
+        let valid_scenario = |c: behavior::scenario::Context| {
+            c.document == scope.document
+                && c.scenario == scope.owner
+                && c.revision == scope.revision
+                && self.camera_toolbar_epoch(c.epoch)
+        };
+        let valid_process = |c: behavior::topology::Context| {
+            c.document == scope.document
+                && c.owner == scope.owner
+                && c.revision == scope.revision
+                && self.camera_toolbar_epoch(c.epoch)
+        };
+        // This whitelist contains only the production presentation controls.
+        // A stamped toolbar cannot smuggle an arbitrary authoring command.
+        match &mut message {
+            Message::ScenarioCanvas(Scenario::Camera(c, lifetime, Camera::Focus))
+                if valid_scenario(*c) && *lifetime == scope.epoch =>
+            {
+                return canvas_workspace::focus_task(scope, Camera::Focus);
+            }
+            Message::TopologyCanvas(Process::Camera(c, lifetime, Camera::Focus))
+                if valid_process(*c) && *lifetime == scope.epoch =>
+            {
+                return canvas_workspace::focus_task(scope, Camera::Focus);
+            }
+            Message::ScenarioCanvas(
+                Scenario::Zoom(c, _)
+                | Scenario::Choose(c, _)
+                | Scenario::Focus(c)
+                | Scenario::Shelf(c, _),
+            ) if valid_scenario(*c) => {
+                c.epoch = self.canvas_epoch;
+            }
+            Message::TopologyCanvas(
+                Process::Zoom(c, _) | Process::Choose(c, _) | Process::Focus(c),
+            ) if valid_process(*c) => {
+                c.epoch = self.canvas_epoch;
+            }
+            Message::Behavior(behavior::Event::Topology(behavior::topology::Event::Shelf(_)))
+                if self.topology_context().is_some() => {}
+            _ => return Task::none(),
+        }
+        let task = self.update(message);
+        // Reapplying Fit or a tool also ends a held gesture. Focus is stamped
+        // after the action, for Iced's final-view ordering.
+        if self.camera_epoch == scope.epoch {
+            self.camera_epoch = self.camera_epoch.wrapping_add(1);
+            self.camera_boundary_epoch = self.canvas_epoch;
+        }
+        let focus = Scope::input_owner(self).map_or_else(Task::none, |scope| {
+            canvas_workspace::focus_task(scope, Camera::ControlFocus(intent.name))
+        });
+        Task::batch([task, focus])
+    }
+    fn camera_toolbar_epoch(&self, epoch: u64) -> bool {
+        epoch >= self.camera_boundary_epoch && epoch <= self.canvas_epoch
+    }
+    fn camera_boundary(&self) -> impl PartialEq + use<> {
+        (
+            self.canvas_epoch,
+            self.canvas_document,
+            self.document.revision(),
+            crate::behavior::selected_owner(self),
+            self.page,
+            self.window_size,
+            crate::behavior::canvas_workspace::keyboard_enabled(self),
+            self.behavior.has_pending(),
+            self.draft_dirty(),
+            self.source_dirty(),
+            self.behavior.topology.camera_boundary(),
+            self.behavior.scenario.camera_boundary(),
+        )
+    }
+    fn update_inner(&mut self, message: Message) -> Task<Message> {
+        if let Some(task) = self.reference_message(&message) {
+            return task;
+        }
        if matches!(&message, Message::Connection(_))
            && self
                .architecture
@@ -1286,6 +1432,7 @@ impl App {
            self.last_workspace_page = self.page;
        }
        let mut task = self.handle(message);
+        self.reconcile_reference_chooser();
        self.route_state_diagram_workspace();
        if self.page != Page::Home {
            self.last_workspace_page = self.page;
@@ -1353,8 +1500,23 @@ impl App {
                epoch: self.canvas_epoch,
            })
    }
+    pub(crate) fn scenario_focus_owner(&self) -> Option<crate::behavior::scenario::focus::Stamp> {
+        if self.busy
+            || self.hosted.visible
+            || self.workflow.is_some()
+            || self.architecture.is_some()
+            || self.model_menu.is_some()
+            || self.file_prompt.is_some()
+            || self.delete_pending
+            || self.pending.is_some()
+        {
+            return None;
+        }
+        self.behavior.scenario.focus_stamp(self.scenario_context()?)
+    }
    fn handle(&mut self, message: Message) -> Task<Message> {
        match message {
+            Message::BehaviorControl(intent) => return self.behavior_control(intent),
            Message::Architecture(event) => return self.architecture_event(event),
            Message::Home(event) => return self.home_event(event),
            Message::CheckpointTick => return self.checkpoint_tick(),
@@ -1370,6 +1532,18 @@ impl App {
            Message::ScenarioCanvas(event) => {
                use crate::behavior::scenario::{self, CanvasEvent};
                let context = event.context();
+                if let CanvasEvent::FormShown(_, mount) = event {
+                    if self.scenario_context().is_some_and(|current| {
+                        current.document == context.document
+                            && current.scenario == context.scenario
+                            && current.revision == context.revision
+                    }) && self.scenario_focus_owner().is_some()
+                        && self.behavior.scenario.take_form_focus(mount)
+                    {
+                        return scenario::focus::task(self.scenario_focus_owner().unwrap());
+                    }
+                    return Task::none();
+                }
                if let CanvasEvent::Viewport(_, size) = event {
                    if self.scenario_context().is_some_and(|current| {
                        current.document == context.document
@@ -1394,9 +1568,9 @@ impl App {
                    return Task::none();
                }
                if let CanvasEvent::Scrolled(_, area, offset) = event {
-                    // Canvas and outline notifications may come from the
-                    // same frame. Accept both across the first epoch bump,
-                    // while still rejecting another owner/document/revision.
+                    // Details may report more than once in a frame. Accept the
+                    // current owner's passive clamps across an epoch bump while
+                    // still rejecting another document, owner or revision.
                    if self.scenario_context().is_some_and(|current| {
                        current.document == context.document
                            && current.scenario == context.scenario
@@ -1407,6 +1581,49 @@ impl App {
                    }
                    return Task::none();
                }
+                if let CanvasEvent::Camera(_, lifetime, input) = event {
+                    use crate::behavior::canvas_workspace::{self, Event};
+                    if lifetime != self.camera_epoch
+                        || !self.scenario_context().is_some_and(|c| {
+                            c.document == context.document
+                                && c.scenario == context.scenario
+                                && c.revision == context.revision
+                        })
+                    {
+                        return Task::none();
+                    }
+                    let scope = canvas_workspace::Scope {
+                        document: context.document,
+                        owner: context.scenario,
+                        revision: context.revision,
+                        epoch: lifetime,
+                    };
+                    if self.behavior.has_pending()
+                        || self.draft_dirty()
+                        || self.source_dirty()
+                        || !canvas_workspace::keyboard_enabled(self)
+                    {
+                        return Task::none();
+                    }
+                    match input {
+                        Event::Focus
+                        | Event::Traverse(_)
+                        | Event::ControlFocus(_)
+                        | Event::ToggleFocus
+                        | Event::Leave => {
+                            return canvas_workspace::focus_task(scope, input);
+                        }
+                        Event::CancelGesture => {
+                            self.canvas_epoch = self.canvas_epoch.wrapping_add(1)
+                        }
+                        input => {
+                            if self.behavior.scenario.camera(input) {
+                                self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
+                            }
+                        }
+                    }
+                    return Task::none();
+                }
                if self.scenario_context() != Some(context) {
                    return Task::none();
                }
@@ -1420,9 +1637,11 @@ impl App {
                        self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
                    }
                    CanvasEvent::Zoom(_, scale) => {
-                        if self.behavior.scenario.zoom(scale) {
+                        let mut state = std::mem::take(&mut self.behavior.scenario);
+                        if state.camera_zoom(self.project(), context.scenario, scale) {
                            self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
                        }
+                        self.behavior.scenario = state;
                    }
                    CanvasEvent::OpenUse(_, occurrence) => {
                        if self.behavior.has_pending() || self.draft_dirty() || self.source_dirty()
@@ -1513,13 +1732,22 @@ impl App {
                                ..
                            } => {
                                let mut state = std::mem::take(&mut self.behavior.scenario);
-                                let result = state.begin_occurrence(
-                                    self.project(),
-                                    context,
-                                    tool,
-                                    slot,
-                                    lifeline,
-                                );
+                                let result = if tool == scenario::Tool::Lifeline {
+                                    state
+                                        .update(
+                                            self.project(),
+                                            scenario::Event::Start(context.scenario, tool),
+                                        )
+                                        .map(|_| ())
+                                } else {
+                                    state.begin_occurrence(
+                                        self.project(),
+                                        context,
+                                        tool,
+                                        slot,
+                                        lifeline,
+                                    )
+                                };
                                self.behavior.scenario = state;
                                match result {
                                    Ok(()) => {
@@ -1741,6 +1969,18 @@ impl App {
                return self.update(Message::Add(child));
            }
            Message::Escape => {
+                if self.behavior.source_back() {
+                    self.status =
+                        "Returned to the unchanged parent form; no source was created.".into();
+                    return Task::none();
+                }
+                if self.behavior.source_active() {
+                    self.behavior.acknowledge_commit();
+                    self.status = "Behavior form cancelled; no staged source was created.".into();
+                } else if self.behavior.creation.has_pending() {
+                    self.behavior.creation.acknowledge_commit();
+                    self.status = "Behavior creation cancelled".into();
+                }
                if self.connection.take().is_some() {
                    self.status = "Drawing cancelled · Select / move is active".into();
                }
@@ -1800,6 +2040,9 @@ impl App {
                        .insert(path, crate::forms::ValueBrowser { scope, page });
                }
            }
+            Message::FieldReferenceOpen(_) | Message::FieldReferenceEvent(_) => {
+                return Task::none();
+            }
            Message::FieldReferenceBrowse(path, query, page) => {
                if let Some(draft) = &mut self.draft {
                    let page = if draft
@@ -2040,7 +2283,7 @@ impl App {
                    if let crate::workflow::Workflow::Semantic(state) = &mut workflow {
                        match event {
                            crate::workflow::Event::Semantic(event) => {
-                                state.update(self.project(), event)
+                                state.update(self.project(), *event)
                            }
                            crate::workflow::Event::Apply => {
                                let focus = state.target(self.project());
@@ -2284,9 +2527,33 @@ impl App {
            }
            Message::InspectorTab(tab) => self.inspector_tab = tab,
            Message::Behavior(event) => {
-                if event.starts_form() && !self.behavior.has_pending() && !self.apply() {
+                if matches!(&event, behavior::Event::Creation(behavior::creation::Event::Open(layer)) if *layer != self.layer)
+                {
+                    self.status =
+                        "The active layer changed. Choose New in the current layer.".into();
                    return Task::none();
                }
+                let creating = matches!(
+                    &event,
+                    behavior::Event::Creation(behavior::creation::Event::Open(..))
+                );
+                let focus_name = matches!(
+                    &event,
+                    behavior::Event::Creation(behavior::creation::Event::Choose(..))
+                );
+                if creating
+                    && (self.behavior.has_pending() || self.source_dirty() || self.draft_dirty())
+                {
+                    self.status = "Apply or cancel the current draft before starting a new behavior. Your inputs are retained.".into();
+                    return Task::none();
+                }
+                if (event.starts_form() || (event.is_source() && !event.is_source_back()))
+                    && (self.source_dirty() || self.draft_dirty())
+                {
+                    self.status="Apply or cancel the other editors before starting this form. Your inputs are retained.".into();
+                    return Task::none();
+                }
+                let source_was_open = self.behavior.source_open();
                if event.is_submit() && (self.source_dirty() || self.draft_dirty()) {
                    self.status = "Revert the other drafts before applying the behavior form. Your inputs are retained.".into();
                    return Task::none();
@@ -2303,7 +2570,16 @@ impl App {
                            }
                        }
                    }
-                    Ok(None) => {}
+                    Ok(None) => {
+                        if !source_was_open && self.behavior.source_open() {
+                            return iced::widget::operation::focus(
+                                behavior::source_draft::NAME_INPUT,
+                            );
+                        }
+                        if focus_name {
+                            return iced::widget::operation::focus(behavior::creation::NAME_INPUT);
+                        }
+                    }
                    Err(error) => self.status = error,
                }
            }
@@ -2495,13 +2771,19 @@ impl App {
            Message::Undo | Message::Redo => {
                let redo = matches!(message, Message::Redo);
                if self.apply() {
-                    if redo {
-                        self.document.redo();
+                    let changed = if redo {
+                        self.document.redo()
                    } else {
-                        self.document.undo();
+                        self.document.undo()
+                    };
+                    if changed {
+                        self.sync();
                    }
-                    self.sync();
-                    self.status = if redo {
+                    self.status = if !changed && redo {
+                        "Nothing to redo"
+                    } else if !changed {
+                        "Nothing to undo"
+                    } else if redo {
                        "Model change redone"
                    } else {
                        "Model change undone"
@@ -2755,11 +3037,17 @@ impl App {
                                    || self.path.as_ref() == Some(&receipt.target)
                                {
                                    self.path = Some(receipt.target);
+                                    self.document.bind_repair_baseline(disk.reachable_bundle());
                                    self.disk_project = Some(disk);
                                }
                                self.status = "Interrupted disk save recovered. Current model and drafts are retained; Save all can be retried.".into();
                            }
                            Err(error) => {
+                                if self.path.is_none()
+                                    || self.path.as_ref() == Some(&receipt.target)
+                                {
+                                    self.document.invalidate_saved_baseline();
+                                }
                                self.status = format!(
                                    "Disk recovery completed; files could not be reloaded: {error}"
                                )
@@ -3189,6 +3477,52 @@ impl App {
                id,
            ));
        }
+        // Refining a leaf moves its explicit responsibilities to the new leaf.
+        // Later children inherit only the existing unambiguous performer summary.
+        if self.create_kind.is_work()
+            && let Some(owner) = parent
+            && self
+                .project()
+                .elements
+                .get(&owner)
+                .is_some_and(|e| e.layer() == self.layer && e.kind() == self.create_kind)
+        {
+            let performer = oa_core::validation::allocation_summary(self.project(), owner);
+            let leaf = !self
+                .project()
+                .children(owner)
+                .any(|e| e.kind() == self.create_kind);
+            let responsibilities: Vec<_> = self
+                .project()
+                .relations
+                .values()
+                .filter(|r| {
+                    r.target() == owner
+                        && matches!(
+                            r.kind(),
+                            RelationKind::Allocation | RelationKind::RoleAssignment
+                        )
+                })
+                .collect();
+            if leaf && !responsibilities.is_empty() {
+                for original in responsibilities {
+                    let mut responsibility = original.clone();
+                    match &mut responsibility.body {
+                        RelationBody::Allocation { target, .. }
+                        | RelationBody::RoleAssignment { target, .. } => *target = id,
+                        _ => unreachable!(),
+                    }
+                    commands.push(Command::EditRelation(original.id, responsibility));
+                }
+            } else if let Some(performer) = performer {
+                commands.push(Command::Connect(
+                    RelationKind::Allocation,
+                    "Performs".into(),
+                    performer,
+                    id,
+                ));
+            }
+        }
        if self.create_kind == Kind::Occurrence
            && let Some(owner) = parent.and_then(|id| self.project().elements.get(&id))
            && let Some(steps) = owner.steps()
@@ -3206,19 +3540,13 @@ impl App {
                .get(&diagram)
                .is_none_or(|d| d.projection.includes(self.create_kind))
        {
-            let mut p = self.project().clone();
-            for command in &commands {
-                if let Command::CreateDiagram(d) = command {
-                    p.diagrams.insert(d.id, d.clone());
+            let mut p = match execute_batch(self.project(), &commands) {
+                Ok(candidate) => candidate,
+                Err(error) => {
+                    self.status = error.to_string();
+                    return;
                }
-            }
-            p.elements.insert(
-                id,
-                match &commands[0] {
-                    Command::CreateElement(e) => e.clone(),
-                    _ => unreachable!(),
-                },
-            );
+            };
            let owner = if allocated {
                Some(self.selected)
            } else {
@@ -3536,6 +3864,7 @@ impl App {
                self.canvas_document = Id::new_v4();
                self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
                self.path = Some(path);
+                self.document.bind_repair_baseline(disk.reachable_bundle());
                self.source_workspace = Workspace::new(&disk.bundle, false);
                self.source_workspace.reachable = disk.reachable.clone();
                self.show_source_file(false);
@@ -4203,6 +4532,10 @@ fn read_snapshot(path: PathBuf) -> Result<LoadedSnapshot, String> {
 #[path = "app/save_as_tests.rs"]
 mod save_as_tests;

+#[cfg(test)]
+#[path = "app/repair_save_state_tests.rs"]
+mod repair_save_state_tests;
+
 #[cfg(test)]
 mod source_project_tests {
    use super::*;
@@ -173,7 +173,12 @@ impl App {
        self.behavior = restored.behavior;
        self.workflow = restored.workflow;
        let focus = self.behavior.pending_owner().unwrap_or(self.selected);
-        if let Some(layer) = self.project().layer_of(focus) {
+        if let Some(layer) = self
+            .behavior
+            .creation
+            .pending_layer()
+            .or_else(|| self.project().layer_of(focus))
+        {
            self.layer = layer;
            self.explorer_index = crate::explorer::Index::new(self.project(), layer);
            self.active_diagram = self.diagram_for(layer, focus);
@@ -209,6 +214,16 @@ impl App {
            .is_some_and(architecture_authoring::State::inline)
        {
            Task::batch([lint, iced::widget::operation::focus("architecture-name")])
+        } else if self.page == Page::Behavior && self.behavior.source_open() {
+            Task::batch([
+                lint,
+                iced::widget::operation::focus(behavior::source_draft::NAME_INPUT),
+            ])
+        } else if self.page == Page::Behavior && self.behavior.creation.created().is_some() {
+            Task::batch([
+                lint,
+                iced::widget::operation::focus(behavior::creation::NAME_INPUT),
+            ])
        } else {
            lint
        }
@@ -15,18 +15,15 @@ impl App {
            epoch: self.canvas_epoch,
        })
    }
-    pub(super) fn reveal_process_selection(&self) -> Task<Message> {
-        let Some(context) = self.topology_context() else {
-            return Task::none();
-        };
-        let Some(offset) =
-            self.behavior
-                .topology
-                .selection_offset(self.project(), context.owner, self.selected)
-        else {
-            return Task::none();
-        };
-        iced::widget::operation::scroll_to("process-canvas", offset)
+    pub(super) fn reveal_process_selection(&mut self) -> Task<Message> {
+        if let Some(context) = self.topology_context() {
+            let mut state = std::mem::take(&mut self.behavior.topology);
+            if state.reveal_selection(self.project(), context.owner, self.selected) {
+                self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
+            }
+            self.behavior.topology = state;
+        }
+        Task::none()
    }
    pub(super) fn edit_process_canvas(&mut self, event: CanvasEvent) -> Task<Message> {
        let context = event.context();
@@ -52,6 +49,47 @@ impl App {
            }
            return Task::none();
        }
+        if let CanvasEvent::Camera(_, lifetime, input) = event {
+            use crate::behavior::canvas_workspace::{self, Event};
+            if lifetime != self.camera_epoch
+                || !self.topology_context().is_some_and(|c| {
+                    c.document == context.document
+                        && c.owner == context.owner
+                        && c.revision == context.revision
+                })
+            {
+                return Task::none();
+            }
+            let scope = canvas_workspace::Scope {
+                document: context.document,
+                owner: context.owner,
+                revision: context.revision,
+                epoch: lifetime,
+            };
+            if self.behavior.has_pending()
+                || self.draft_dirty()
+                || self.source_dirty()
+                || !canvas_workspace::keyboard_enabled(self)
+            {
+                return Task::none();
+            }
+            match input {
+                Event::Focus
+                | Event::Traverse(_)
+                | Event::ControlFocus(_)
+                | Event::ToggleFocus
+                | Event::Leave => {
+                    return canvas_workspace::focus_task(scope, input);
+                }
+                Event::CancelGesture => self.canvas_epoch = self.canvas_epoch.wrapping_add(1),
+                input => {
+                    if self.behavior.topology.camera(input) {
+                        self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
+                    }
+                }
+            }
+            return Task::none();
+        }
        if self.topology_context() != Some(context) {
            return Task::none();
        }
@@ -81,6 +119,7 @@ impl App {
                            .first()
                            .copied()
                            .unwrap_or(endpoint.occurrence),
+                        resolved.defining_sequence,
                    );
                    self.behavior.active_owner = Some(resolved.defining_sequence);
                    self.select(endpoint.occurrence);
@@ -118,14 +157,18 @@ impl App {
                }
            }
            CanvasEvent::Choose(_, tool) => {
-                if self.behavior.has_pending() || !self.apply() {
+                if self.behavior.has_pending() || self.draft_dirty() || self.source_dirty() {
+                    self.status =
+                        "Apply or cancel pending edits before choosing a process tool.".into();
                    return Task::none();
                }
                self.behavior.topology.choose(tool);
                self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
            }
            CanvasEvent::Zoom(_, zoom) => {
-                self.behavior.topology.zoom(zoom);
+                let mut state = std::mem::take(&mut self.behavior.topology);
+                state.camera_zoom(self.project(), context.owner, zoom);
+                self.behavior.topology = state;
                self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
            }
            CanvasEvent::Expand(_, id) => {
@@ -149,7 +192,9 @@ impl App {
                        .get(&target)
                        .is_some_and(|e| matches!(e.kind(), Kind::Process | Kind::FunctionalChain))
                    {
-                        self.behavior.topology.remember(context.owner, occurrence);
+                        self.behavior
+                            .topology
+                            .remember(context.owner, occurrence, target);
                        self.behavior.active_owner = Some(target);
                    }
                    self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
@@ -524,32 +569,30 @@ mod tests {
        assert!(!app.behavior.has_pending());
    }
    #[test]
-    fn direct_process_app_save_scroll_resize_and_passive_geometry_keep_drafts_and_current_origin() {
+    fn direct_process_app_save_details_resize_and_passive_geometry_keep_drafts_and_camera() {
        let (mut app, f) = setup();
        let context = app.topology_context().unwrap();
+        let _ = app.update(Message::TopologyCanvas(CanvasEvent::Camera(
+            context,
+            app.camera_epoch,
+            behavior::canvas_workspace::Event::Pan(iced::Vector::new(25., 100.)),
+        )));
+        let context = app.topology_context().unwrap();
        let original = app.document.snapshot();
        app.busy = true;
-        for (area, offset) in [
-            (
-                behavior::scenario::ScrollArea::Canvas,
-                iced::Vector::new(25., 100.),
-            ),
-            (
-                behavior::scenario::ScrollArea::Page,
-                iced::Vector::new(0., 40.),
-            ),
-        ] {
-            let _ = app.update(Message::TopologyCanvas(CanvasEvent::Scrolled(
-                context, area, offset,
-            )));
-        }
+        let _ = app.update(Message::TopologyCanvas(CanvasEvent::Scrolled(
+            context,
+            behavior::scenario::ScrollArea::Page,
+            iced::Vector::new(0., 40.),
+        )));
        let _ = app.update(Message::TopologyCanvas(CanvasEvent::Viewport(
            context,
            iced::Size::new(500., 300.),
        )));
+        let camera = app.behavior.topology.camera_boundary();
        assert_eq!(
-            app.behavior.topology.scroll_offset(),
-            iced::Vector::new(25., 140.)
+            app.behavior.topology.details_offset(),
+            iced::Vector::new(0., 40.)
        );
        assert_ne!(app.topology_context(), Some(context));
        assert!(app.busy);
@@ -557,12 +600,12 @@ mod tests {
        stale.document = Id::new_v4();
        let _ = app.update(Message::TopologyCanvas(CanvasEvent::Scrolled(
            stale,
-            behavior::scenario::ScrollArea::Canvas,
+            behavior::scenario::ScrollArea::Page,
            iced::Vector::new(0., 900.),
        )));
        assert_eq!(
-            app.behavior.topology.scroll_offset(),
-            iced::Vector::new(25., 140.)
+            app.behavior.topology.details_offset(),
+            iced::Vector::new(0., 40.)
        );
        let root = PathBuf::from("process-scroll-save-fixture");
        let receipt = FileSnapshot {
@@ -582,6 +625,7 @@ mod tests {
        assert!(!app.busy);
        assert!(!app.document.can_undo());
        assert_eq!(app.project(), &f.p);
+        assert!(app.behavior.topology.camera_boundary() == camera);
        let context = app.topology_context().unwrap();
        let size = app.window_size;
        let _ = app.update(Message::WindowResized(size));
@@ -0,0 +1,304 @@
+//! One transient chooser for the currently mounted Inspector or review field.
+//! Browsing never calls a draft setter or semantic planner.
+use super::{App, Message, Page, Pending};
+use crate::{
+    forms::{
+        Draft,
+        reference_chooser::{self as chooser, Action, Close, Outcome, adapter, trigger},
+    },
+    navigation::InspectorTab,
+    semantic_review::{self, RowAddress, RowEvent},
+    workflow,
+};
+use iced::{Element, Rectangle, Task};
+use oa_core::{FacetSelector, Id, Layer};
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+enum Host {
+    Inspector,
+    Review {
+        address: Option<RowAddress>,
+        facet: FacetSelector,
+    },
+}
+impl Host {
+    fn message(&self, event: chooser::Event) -> Message {
+        match self {
+            Self::Inspector => Message::FieldReferenceEvent(event),
+            Self::Review { address, facet } => {
+                Message::Workflow(workflow::Event::semantic(semantic_review::Event::Row {
+                    address: *address,
+                    facet: Some(facet.clone()),
+                    event: RowEvent::ReferenceEvent(event),
+                }))
+            }
+        }
+    }
+}
+struct Opened {
+    host: Host,
+    request: adapter::Open,
+    document_session: Id,
+    page: Page,
+    layer: Layer,
+    chooser: chooser::State,
+}
+#[derive(Default)]
+pub(super) struct State {
+    opened: Option<Opened>,
+}
+
+impl App {
+    pub(crate) fn reference_input_active(&self) -> bool {
+        self.reference_authoring.opened.is_some()
+    }
+
+    fn reference_draft(&self, host: &Host, path: &str) -> Option<&Draft> {
+        match host {
+            Host::Inspector
+                if self.workflow.is_none() && self.inspector_tab == InspectorTab::Properties =>
+            {
+                self.draft.as_ref()
+            }
+            Host::Review { address, facet } => match self.workflow.as_ref()? {
+                workflow::Workflow::Semantic(state) => {
+                    state.reference_draft(self.project(), *address, facet, path)
+                }
+                _ => None,
+            },
+            _ => None,
+        }
+    }
+    fn reference_available(&self) -> bool {
+        !self.busy
+            && !self.hosted.visible
+            && self.architecture.is_none()
+            && self.model_menu.is_none()
+            && self.file_prompt.is_none()
+            && !self.delete_pending
+            && self.pending.is_none()
+            && !self.source_dirty()
+            && !self.behavior.has_pending()
+            && !matches!(self.page, Page::Home | Page::Guide | Page::Text)
+    }
+    fn reference_valid(&self, opened: &Opened) -> bool {
+        self.reference_available()
+            && self.canvas_document == opened.document_session
+            && self.page == opened.page
+            && self.layer == opened.layer
+            && self.document.revision() == opened.chooser.stamp().context.revision
+            && self.project().id == opened.request.document
+            && self
+                .reference_draft(&opened.host, &opened.request.path)
+                .is_some_and(|draft| draft.reference_matches(&opened.request))
+    }
+    pub(super) fn reconcile_reference_chooser(&mut self) {
+        if self
+            .reference_authoring
+            .opened
+            .as_ref()
+            .is_some_and(|opened| !self.reference_valid(opened))
+        {
+            self.reference_authoring
+                .opened
+                .as_mut()
+                .unwrap()
+                .chooser
+                .invalidate();
+            self.reference_authoring.opened = None;
+        }
+    }
+    fn open_reference(&mut self, host: Host, request: adapter::Open) -> Task<Message> {
+        if !self.reference_available() {
+            return Task::none();
+        }
+        let Some(draft) = self.reference_draft(&host, &request.path) else {
+            return Task::none();
+        };
+        let Ok(chooser) =
+            draft.reference_catalog(self.project(), &request, self.document.revision())
+        else {
+            return Task::none();
+        };
+        self.reference_authoring.opened = Some(Opened {
+            host,
+            request,
+            document_session: self.canvas_document,
+            page: self.page,
+            layer: self.layer,
+            chooser,
+        });
+        Task::none()
+    }
+    fn reference_event(&mut self, host: Host, event: chooser::Event) -> Task<Message> {
+        let Some(mut opened) = self.reference_authoring.opened.take() else {
+            return Task::none();
+        };
+        if !self.reference_valid(&opened) {
+            return Task::none();
+        }
+        if opened.host != host {
+            self.reference_authoring.opened = Some(opened);
+            return Task::none();
+        }
+        match opened.chooser.update(event) {
+            Outcome::Ignored | Outcome::Browsed => {
+                self.reference_authoring.opened = Some(opened);
+                Task::none()
+            }
+            Outcome::Closed(reason) => self.reference_focus(
+                &opened,
+                match reason {
+                    Close::Escape => Some(0),
+                    Close::Tab { backwards } => Some(if backwards { -1 } else { 1 }),
+                    Close::Outside | Close::WindowChanged => None,
+                },
+            ),
+            Outcome::Write { context, value } => {
+                let intent = adapter::Set {
+                    context,
+                    generation: opened.request.generation,
+                    value,
+                };
+                let result = match &opened.host {
+                    Host::Inspector => self
+                        .draft
+                        .as_mut()
+                        .ok_or_else(|| "The property editor closed.".to_owned())
+                        .and_then(|draft| draft.reference_set(self.document.project(), &intent)),
+                    Host::Review { address, facet } => match self.workflow.as_mut() {
+                        Some(workflow::Workflow::Semantic(state)) => {
+                            state.set_reference(self.document.project(), *address, facet, intent)
+                        }
+                        _ => Err("The review editor closed.".into()),
+                    },
+                };
+                if let Err(error) = result {
+                    self.status = error;
+                }
+                // A scoped write rotates field generation. The task targets the
+                // newly rendered field, while a later structural edit makes it inert.
+                self.reference_focus(&opened, Some(0))
+            }
+        }
+    }
+    fn reference_focus(&self, opened: &Opened, step: Option<i32>) -> Task<Message> {
+        let Some(step) = step else {
+            return Task::none();
+        };
+        let Some(draft) = self.reference_draft(&opened.host, &opened.request.path) else {
+            return Task::none();
+        };
+        if draft.reference_session() != opened.request.session {
+            return Task::none();
+        }
+        trigger::focus(
+            draft.reference_session(),
+            draft.reference_generation(),
+            &opened.request.path,
+            step,
+        )
+    }
+    /// Called before generic modal dispatch: the review owns a modal, and this
+    /// chooser owns only its active field. All browser events stop here.
+    pub(super) fn reference_message(&mut self, message: &Message) -> Option<Task<Message>> {
+        self.reconcile_reference_chooser();
+        match message {
+            Message::FieldReferenceOpen(request) => {
+                Some(self.open_reference(Host::Inspector, request.clone()))
+            }
+            Message::FieldReferenceEvent(event) => {
+                Some(self.reference_event(Host::Inspector, event.clone()))
+            }
+            Message::Workflow(workflow::Event::Semantic(review_event)) => {
+                let semantic_review::Event::Row {
+                    address,
+                    facet: Some(facet),
+                    event,
+                } = review_event.as_ref()
+                else {
+                    return None;
+                };
+                let host = Host::Review {
+                    address: *address,
+                    facet: facet.clone(),
+                };
+                match event {
+                    RowEvent::ReferenceOpen(request) => {
+                        Some(self.open_reference(host, request.clone()))
+                    }
+                    RowEvent::ReferenceEvent(event) => {
+                        Some(self.reference_event(host, event.clone()))
+                    }
+                    _ => None,
+                }
+            }
+            Message::Escape | Message::Request(Pending::Close(_))
+                if self.reference_authoring.opened.is_some() =>
+            {
+                let opened = self.reference_authoring.opened.as_ref().unwrap();
+                let host = opened.host.clone();
+                let event = opened.chooser.event(Action::Close(Close::Escape));
+                Some(self.reference_event(host, event))
+            }
+            // Global shortcuts are also emitted for keys captured by the search
+            // input. They must not apply drafts, navigate, or undo the model.
+            Message::Save(_)
+            | Message::ShortcutUndo(_)
+            | Message::Request(Pending::Open | Pending::New)
+            | Message::SourceNavigation(_)
+            | Message::Page(Page::Guide)
+                if self.reference_authoring.opened.is_some() =>
+            {
+                Some(Task::none())
+            }
+            _ => None,
+        }
+    }
+    pub(super) fn reference_overlay<
+        'a,
+        R: iced::advanced::text::Renderer<Font = iced::Font> + 'a,
+    >(
+        &'a self,
+        content: Element<'a, Message, iced::Theme, R>,
+    ) -> Element<'a, Message, iced::Theme, R> {
+        let opened = self
+            .reference_authoring
+            .opened
+            .as_ref()
+            .filter(|opened| self.reference_valid(opened));
+        let host = opened
+            .map(|opened| opened.host.clone())
+            .unwrap_or(Host::Inspector);
+        let focus_scope = if self.reference_available() {
+            match self.workflow.as_ref() {
+                None if self.inspector_tab == InspectorTab::Properties => {
+                    self.draft.as_ref().map(|draft| trigger::FormScope {
+                        session: draft.reference_session(),
+                        modal: false,
+                    })
+                }
+                Some(workflow::Workflow::Semantic(state)) => state
+                    .reference_form(self.project())
+                    .map(|draft| trigger::FormScope {
+                        session: draft.reference_session(),
+                        modal: true,
+                    }),
+                _ => None,
+            }
+        } else {
+            None
+        };
+        chooser::widget::Popup::new(
+            content,
+            opened.map(|opened| &opened.chooser),
+            opened.map_or(Rectangle::default(), |opened| opened.request.anchor),
+            move |event| host.message(event),
+        )
+        .focus_scope(focus_scope)
+        .into()
+    }
+}
+
+#[cfg(test)]
+mod tests;
@@ -0,0 +1,586 @@
+use super::*;
+use crate::forms::Draft;
+use oa_core::*;
+use serde_json::{Value, json};
+
+const OWNER: Id = Id::from_u128(100);
+const BASE: u128 = 10_000;
+const PATH: &str = "/body/Oa/Shared/DataType/definition/Record/supertype";
+
+fn element(p: &mut Project, id: Id, kind: Kind, layer: Layer, name: &str, parent: Option<Id>) {
+    let generated = p.add_element(kind, layer, name, parent).unwrap();
+    let mut element = p.elements.remove(&generated).unwrap();
+    element.id = id;
+    element.alias = format!("object_{}", id.as_u128());
+    if let Some(SharedBody::DataType { definition, .. }) = element.shared_mut() {
+        *definition = DataTypeDefinition::Record { supertype: None };
+    }
+    p.elements.insert(id, element);
+}
+fn catalog() -> Project {
+    let mut p = Project::empty();
+    p.id = Id::from_u128(1);
+    p.name = "Reference catalog".into();
+    element(
+        &mut p,
+        OWNER,
+        Kind::DataType,
+        Layer::Oa,
+        "Edited record",
+        None,
+    );
+    for n in (0..1_000).rev() {
+        let id = Id::from_u128(BASE + n);
+        element(&mut p, id, Kind::DataType, Layer::Oa, "Controller", None);
+        p.elements.get_mut(&id).unwrap().alias = format!("controller_{n:04}");
+    }
+    element(
+        &mut p,
+        Id::from_u128(200),
+        Kind::DataType,
+        Layer::Sa,
+        "Controller",
+        None,
+    );
+    element(
+        &mut p,
+        Id::from_u128(201),
+        Kind::Activity,
+        Layer::Oa,
+        "Controller",
+        None,
+    );
+    p
+}
+fn inspector(p: Project, selected: Id) -> App {
+    let mut app = App::with_project(p);
+    let _ = app.update(Message::Select(selected));
+    app
+}
+fn request(app: &App, host: &Host, path: &str) -> adapter::Open {
+    app.reference_draft(host, path).unwrap().reference_open(
+        app.project(),
+        path,
+        Rectangle {
+            x: 790.,
+            y: 640.,
+            width: 278.,
+            height: 32.,
+        },
+    )
+}
+fn open(app: &mut App, host: &Host, path: &str) {
+    let request = request(app, host, path);
+    let message = match host {
+        Host::Inspector => Message::FieldReferenceOpen(request),
+        Host::Review { address, facet } => {
+            Message::Workflow(workflow::Event::semantic(semantic_review::Event::Row {
+                address: *address,
+                facet: Some(facet.clone()),
+                event: RowEvent::ReferenceOpen(request),
+            }))
+        }
+    };
+    let _ = app.update(message);
+    assert!(
+        app.reference_authoring.opened.is_some(),
+        "field must open: {}",
+        app.status
+    );
+}
+fn event(app: &App, action: Action) -> Message {
+    let opened = app.reference_authoring.opened.as_ref().unwrap();
+    opened.host.message(opened.chooser.event(action))
+}
+fn search(app: &mut App, query: &str) {
+    let serial = app
+        .reference_authoring
+        .opened
+        .as_ref()
+        .unwrap()
+        .chooser
+        .query_serial()
+        + 1;
+    let event = event(
+        app,
+        Action::Query {
+            text: query.into(),
+            serial,
+        },
+    );
+    let _ = app.update(event);
+}
+fn choose(app: &mut App, id: Id) {
+    let event = event(app, Action::Choose(id));
+    let _ = app.update(event);
+}
+fn raw(app: &App) -> Value {
+    serde_json::to_value(app.draft.as_ref().unwrap().recovery_snapshot()).unwrap()
+}
+fn review(app: &App) -> &semantic_review::State {
+    let Some(workflow::Workflow::Semantic(state)) = app.workflow.as_ref() else {
+        panic!("Review is open")
+    };
+    state
+}
+fn send_review(app: &mut App, event: RowEvent) {
+    let addressed = review(app).address_event(event);
+    let _ = app.update(Message::Workflow(workflow::Event::semantic(addressed)));
+}
+fn review_host(app: &App) -> Host {
+    let semantic_review::Event::Row {
+        address,
+        facet: Some(facet),
+        ..
+    } = review(app).address_event(RowEvent::Preview)
+    else {
+        panic!("Active facet")
+    };
+    Host::Review { address, facet }
+}
+fn trace(p: &mut Project, id: Id, oa: Id, sa: Id) {
+    p.traces.insert(
+        id,
+        Trace {
+            id,
+            alias: format!("trace_{}", id.as_u128()),
+            name: "Rationale".into(),
+            description: String::new(),
+            oa,
+            sa,
+            kind: TraceKind::Manual,
+            baseline: None,
+        },
+    );
+}
+
+#[test]
+fn inspector_reference_browse_is_read_only_then_one_scoped_value_applies_with_exact_undo_redo() {
+    let p = catalog();
+    let mut app = inspector(p.clone(), OWNER);
+    let before = app.document.bundle().clone();
+    let revision = app.document.revision();
+    // Malformed escaped text is unrelated to the selected reference. Browsing
+    // and the scoped write must keep its exact spelling and inactive payload.
+    app.draft.as_mut().unwrap().set_exact(true).unwrap();
+    let _ = app.update(Message::Field("/name".into(), "\"unfinished".into()));
+    let raw_before = raw(&app);
+    open(&mut app, &Host::Inspector, PATH);
+    assert_eq!(
+        app.reference_authoring
+            .opened
+            .as_ref()
+            .unwrap()
+            .chooser
+            .count(),
+        1_000
+    );
+    search(&mut app, "controller @controller_0720 OA");
+    let picker = &app.reference_authoring.opened.as_ref().unwrap().chooser;
+    assert_eq!(picker.count(), 1);
+    assert_eq!(picker.highlighted().unwrap().id, Id::from_u128(BASE + 720));
+    assert_eq!(raw(&app), raw_before);
+    assert_eq!(app.document.bundle(), &before);
+    assert_eq!(app.document.revision(), revision);
+    assert!(!app.document.can_undo());
+    // Captured search shortcuts cannot accidentally save/apply or undo a model.
+    let _ = app.update(Message::Save(false));
+    let _ = app.update(Message::ShortcutUndo(false));
+    assert_eq!(raw(&app), raw_before);
+    assert_eq!(app.document.bundle(), &before);
+    choose(&mut app, Id::from_u128(BASE + 720));
+    let mut expected_raw = raw_before;
+    *expected_raw["value"].pointer_mut(PATH).unwrap() = json!(Id::from_u128(BASE + 720));
+    expected_raw["inputs"][PATH] = json!(Id::from_u128(BASE + 720).to_string());
+    assert_eq!(raw(&app), expected_raw);
+    assert_eq!(app.document.bundle(), &before);
+    assert!(!app.document.can_undo());
+    let _ = app.update(Message::Apply);
+    assert_eq!(
+        app.document.bundle(),
+        &before,
+        "Unrelated invalid text remains an Apply error"
+    );
+    let _ = app.update(Message::Field("/name".into(), "\"Edited record\"".into()));
+    let _ = app.update(Message::Apply);
+    let mut expected = p;
+    if let Some(SharedBody::DataType { definition, .. }) =
+        expected.elements.get_mut(&OWNER).unwrap().shared_mut()
+    {
+        *definition = DataTypeDefinition::Record {
+            supertype: Some(Id::from_u128(BASE + 720)),
+        };
+    }
+    assert_eq!(app.project(), &expected);
+    let accepted = app.document.bundle().clone();
+    assert_ne!(accepted, before);
+    let _ = app.update(Message::Undo);
+    assert_eq!(app.document.bundle(), &before);
+    let _ = app.update(Message::Redo);
+    assert_eq!(app.document.bundle(), &accepted);
+    assert_eq!(app.project(), &expected);
+}
+
+#[test]
+fn inspector_reference_retains_invalid_missing_and_incompatible_current_until_explicit_clear() {
+    for (raw_id, expected) in [
+        ("-".into(), "invalid"),
+        (Id::from_u128(999).to_string(), "missing"),
+        (Id::from_u128(200).to_string(), "incompatible"),
+    ] {
+        let mut app = inspector(catalog(), OWNER);
+        app.draft
+            .as_mut()
+            .unwrap()
+            .shape_scoped(PATH, json!(raw_id))
+            .unwrap();
+        let original = raw(&app);
+        let accepted = app.document.bundle().clone();
+        open(&mut app, &Host::Inspector, PATH);
+        let current = &app
+            .reference_authoring
+            .opened
+            .as_ref()
+            .unwrap()
+            .chooser
+            .current;
+        assert!(matches!(
+            (expected, current),
+            ("invalid", chooser::Current::InvalidRaw(_))
+                | ("missing", chooser::Current::Missing(_))
+                | ("incompatible", chooser::Current::Incompatible(_))
+        ));
+        let _ = app.update(Message::Escape);
+        assert_eq!(raw(&app), original);
+        open(&mut app, &Host::Inspector, PATH);
+        let clear = event(&app, Action::Clear);
+        let _ = app.update(clear);
+        assert!(
+            app.draft
+                .as_ref()
+                .unwrap()
+                .value
+                .pointer(PATH)
+                .unwrap()
+                .is_null()
+        );
+        assert_eq!(app.document.bundle(), &accepted);
+        assert!(!app.document.can_undo());
+    }
+}
+
+#[test]
+fn chooser_rejects_old_results_after_context_recovery_reload_or_modal_and_keeps_history_text_out() {
+    for change in 0..7 {
+        let mut app = inspector(catalog(), OWNER);
+        open(&mut app, &Host::Inspector, PATH);
+        let delayed = event(&app, Action::Choose(Id::from_u128(BASE + 1)));
+        match change {
+            0 => {
+                app.draft
+                    .as_mut()
+                    .unwrap()
+                    .shape_scoped(PATH, json!(Id::from_u128(BASE + 2)))
+                    .unwrap();
+            }
+            1 => {
+                let saved = app.draft.as_ref().unwrap().recovery_snapshot();
+                app.draft = Some(Draft::from_recovery(app.project(), saved).unwrap());
+            }
+            2 => {
+                app.canvas_document = Id::new_v4();
+            }
+            3 => {
+                app.hosted.visible = true;
+            }
+            4 => {
+                app.draft
+                    .as_mut()
+                    .unwrap()
+                    .set_context(Some(json!({"different":"scope"})));
+            }
+            5 => {
+                let _ = app.update(Message::Command(Command::Rename(
+                    Id::from_u128(BASE + 3),
+                    "Changed model".into(),
+                )));
+            }
+            _ => {
+                app.source_workspace.edit(
+                    "unfinished source".into(),
+                    iced::widget::text_editor::Cursor {
+                        position: iced::widget::text_editor::Position { line: 0, column: 0 },
+                        selection: None,
+                    },
+                );
+            }
+        }
+        let expected = raw(&app);
+        let source = app.document.bundle().clone();
+        let _ = app.update(delayed);
+        assert!(app.reference_authoring.opened.is_none());
+        assert_eq!(raw(&app), expected);
+        assert_eq!(app.document.bundle(), &source);
+    }
+    let mut p = catalog();
+    trace(&mut p, Id::from_u128(300), OWNER, Id::from_u128(200));
+    let app = inspector(p, Id::from_u128(300));
+    let draft = app.draft.as_ref().unwrap();
+    let request = draft.reference_open(
+        app.project(),
+        "/baseline/semantic/facets/0/references/0/target",
+        Rectangle::default(),
+    );
+    assert!(draft.reference_catalog(app.project(), &request, 0).is_err());
+}
+
+#[test]
+fn reference_array_row_reorder_and_constructor_switch_invalidate_exact_old_field() {
+    let mut p = Project::empty();
+    for n in 0..3 {
+        element(
+            &mut p,
+            Id::from_u128(BASE + n),
+            Kind::ExchangeItem,
+            Layer::Oa,
+            "Signal item",
+            None,
+        );
+    }
+    element(&mut p, OWNER, Kind::Event, Layer::Oa, "Signal", None);
+    *p.elements.get_mut(&OWNER).unwrap().shared_mut().unwrap() = SharedBody::Event {
+        body: EventBody::Signal {
+            items: vec![Id::from_u128(BASE), Id::from_u128(BASE + 1)],
+        },
+    };
+    let mut app = inspector(p, OWNER);
+    let list = "/body/Oa/Shared/Event/body/Signal/items";
+    let path = format!("{list}/0");
+    open(&mut app, &Host::Inspector, &path);
+    let delayed = event(&app, Action::Choose(Id::from_u128(BASE + 2)));
+    let _ = app.update(Message::FieldArray(list.into(), Some(0), 1));
+    let expected = raw(&app);
+    assert_eq!(
+        app.draft.as_ref().unwrap().value.pointer(list),
+        Some(&json!([Id::from_u128(BASE + 1), Id::from_u128(BASE)]))
+    );
+    let _ = app.update(delayed);
+    assert_eq!(raw(&app), expected);
+    open(&mut app, &Host::Inspector, &path);
+    let delayed = event(&app, Action::Choose(Id::from_u128(BASE + 2)));
+    let _ = app.update(Message::FieldVariant(
+        "/body/Oa/Shared/Event/body".into(),
+        json!({"Change":{"expression":"unfinished"}}),
+    ));
+    let expected = raw(&app);
+    let _ = app.update(delayed);
+    assert_eq!(raw(&app), expected);
+    assert!(!app.document.can_undo());
+}
+
+#[test]
+fn review_reference_facets_groups_and_attachment_hosts_browse_without_replanning_and_reject_old_facet()
+ {
+    for mode in 0..3 {
+        let mut p = Project::empty();
+        p.id = Id::from_u128(1);
+        for (id, layer, parent) in [
+            (100, Layer::Oa, None),
+            (101, Layer::Sa, None),
+            (102, Layer::Sa, None),
+            (103, Layer::Oa, Some(Id::from_u128(100))),
+            (104, Layer::Sa, Some(Id::from_u128(101))),
+        ] {
+            element(
+                &mut p,
+                Id::from_u128(id),
+                if parent.is_some() {
+                    Kind::DataField
+                } else {
+                    Kind::DataType
+                },
+                layer,
+                "Record",
+                parent,
+            );
+        }
+        trace(
+            &mut p,
+            Id::from_u128(300),
+            Id::from_u128(100),
+            Id::from_u128(101),
+        );
+        let facet = match mode {
+            0 => FacetSelector::Data(DataFacet::RecordSupertype),
+            1 => FacetSelector::Data(DataFacet::Constructor),
+            _ => FacetSelector::Child(KeyPair {
+                oa: Some(Id::from_u128(103)),
+                sa: Some(Id::from_u128(104)),
+            }),
+        };
+        let path = if mode == 2 {
+            "/parent"
+        } else {
+            "/body/Sa/Shared/DataType/definition/Record/supertype"
+        };
+        let mut app = App::with_project(p.clone());
+        let _ = app.update(Message::StartSemanticReview(Id::from_u128(100)));
+        if mode == 2 {
+            // A paired attachment is a real catalog facet only after explicit
+            // correspondence; selecting an unstaged synthetic pair is rejected.
+            for (id, oa) in [(103, true), (104, false)] {
+                let choice = crate::app::Choice {
+                    id: Id::from_u128(id),
+                    label: format!("Record · @object_{id}"),
+                };
+                send_review(
+                    &mut app,
+                    if oa {
+                        RowEvent::ReferenceOa(choice)
+                    } else {
+                        RowEvent::ReferenceSa(choice)
+                    },
+                );
+            }
+            send_review(&mut app, RowEvent::AddReference);
+        }
+        send_review(&mut app, RowEvent::Select(facet.clone()));
+        send_review(
+            &mut app,
+            RowEvent::Decide(facet.clone(), Some(SemanticDecision::Candidate)),
+        );
+        let host = review_host(&app);
+        let record = if mode == 2 {
+            Id::from_u128(104)
+        } else {
+            Id::from_u128(101)
+        };
+        assert_eq!(
+            app.reference_draft(&host, path)
+                .unwrap_or_else(|| {
+                    panic!(
+                        "Reference fixture mode={mode}, facet={facet:?}, selected={:?}, decisions={:?}, error={:?}",
+                        review(&app).selected,
+                        review(&app).decisions,
+                        review(&app).error
+                    )
+                })
+                .original,
+            record
+        );
+        let before = review(&app).recovery_snapshot().unwrap();
+        let plan = serde_json::to_value(&review(&app).plan).unwrap();
+        let proposed = review(&app).proposed.clone();
+        let source = app.document.bundle().clone();
+        open(&mut app, &host, path);
+        search(&mut app, "@object_102 SA");
+        assert_eq!(
+            app.reference_authoring
+                .opened
+                .as_ref()
+                .unwrap()
+                .chooser
+                .count(),
+            1
+        );
+        assert_eq!(review(&app).recovery_snapshot().unwrap(), before);
+        assert_eq!(serde_json::to_value(&review(&app).plan).unwrap(), plan);
+        assert_eq!(review(&app).proposed, proposed);
+        assert_eq!(app.document.bundle(), &source);
+        let old = event(&app, Action::Choose(Id::from_u128(102)));
+        send_review(
+            &mut app,
+            RowEvent::Select(FacetSelector::Header(HeaderFacet::Name)),
+        );
+        let switched = review(&app).recovery_snapshot().unwrap();
+        let _ = app.update(old);
+        assert_eq!(review(&app).recovery_snapshot().unwrap(), switched);
+        send_review(&mut app, RowEvent::Select(facet));
+        open(&mut app, &host, path);
+        choose(&mut app, Id::from_u128(102));
+        let draft = app.reference_draft(&host, path).unwrap();
+        let mut expected_record = serde_json::to_value(&p.elements[&record]).unwrap();
+        *expected_record.pointer_mut(path).unwrap() = json!(Id::from_u128(102));
+        assert_eq!(draft.materialize().unwrap(), expected_record);
+        assert_eq!(app.document.bundle(), &source);
+        assert!(
+            !app.document.can_undo(),
+            "A choice only stages the active review candidate"
+        );
+    }
+}
+
+mod mounted;
+
+#[test]
+fn review_reference_cannot_reopen_or_write_a_banked_row_after_another_row_takes_focus() {
+    let mut p = Project::empty();
+    for (id, layer) in [
+        (100, Layer::Oa),
+        (101, Layer::Sa),
+        (102, Layer::Sa),
+        (110, Layer::Oa),
+        (111, Layer::Sa),
+    ] {
+        element(
+            &mut p,
+            Id::from_u128(id),
+            Kind::DataType,
+            layer,
+            "Record",
+            None,
+        );
+    }
+    trace(
+        &mut p,
+        Id::from_u128(300),
+        Id::from_u128(100),
+        Id::from_u128(101),
+    );
+    trace(
+        &mut p,
+        Id::from_u128(310),
+        Id::from_u128(110),
+        Id::from_u128(111),
+    );
+    let mut app = App::with_project(p);
+    let _ = app.update(Message::StartSemanticReview(Id::from_u128(300)));
+    let facet = FacetSelector::Data(DataFacet::RecordSupertype);
+    send_review(&mut app, RowEvent::Select(facet.clone()));
+    send_review(
+        &mut app,
+        RowEvent::Decide(facet, Some(SemanticDecision::Candidate)),
+    );
+    let host = review_host(&app);
+    let path = "/body/Sa/Shared/DataType/definition/Record/supertype";
+    let old_open = request(&app, &host, path);
+    open(&mut app, &host, path);
+    let old_choice = event(&app, Action::Choose(Id::from_u128(102)));
+    for event in [
+        semantic_review::Event::ChooseTrace(crate::app::Choice {
+            id: Id::from_u128(310),
+            label: "Second exact trace".into(),
+        }),
+        semantic_review::Event::OpenTrace,
+    ] {
+        let _ = app.update(Message::Workflow(workflow::Event::semantic(event)));
+    }
+    assert_eq!(review(&app).target(app.project()), Some(Id::from_u128(111)));
+    let expected = review(&app).recovery_snapshot().unwrap();
+    let source = app.document.bundle().clone();
+    let _ = app.update(old_choice);
+    let Host::Review { address, facet } = host else {
+        unreachable!()
+    };
+    let _ = app.update(Message::Workflow(workflow::Event::semantic(
+        semantic_review::Event::Row {
+            address,
+            facet: Some(facet),
+            event: RowEvent::ReferenceOpen(old_open),
+        },
+    )));
+    assert!(app.reference_authoring.opened.is_none());
+    assert_eq!(review(&app).recovery_snapshot().unwrap(), expected);
+    assert_eq!(app.document.bundle(), &source);
+    assert!(!app.document.can_undo());
+}
@@ -0,0 +1,910 @@
+//! Real field + app-root overlay interaction. The null text renderer lets the
+//! same retained widget tree exercise focus and geometry without a GPU/window.
+use super::*;
+use iced::futures::StreamExt;
+use iced::{
+    Element, Event as Input, Point, Size, Theme, Vector,
+    advanced::{
+        Layout, Shell, layout,
+        widget::{Id as WidgetId, Operation, Tree, operation},
+    },
+    keyboard, mouse,
+    widget::{Space, column, container, opaque, scrollable, stack, text_input},
+};
+use oa_core::transitions::TransitionDirection;
+
+#[derive(Default)]
+struct Clipboard;
+impl iced::advanced::Clipboard for Clipboard {
+    fn read(&self, _: iced::advanced::clipboard::Kind) -> Option<String> {
+        None
+    }
+    fn write(&mut self, _: iced::advanced::clipboard::Kind, _: String) {}
+}
+#[derive(Default)]
+struct Fields {
+    values: Vec<(WidgetId, Rectangle, bool)>,
+    scrolls: Vec<(Rectangle, Vector)>,
+}
+impl Operation for Fields {
+    fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn Operation)) {
+        visit(self);
+    }
+    fn focusable(
+        &mut self,
+        id: Option<&WidgetId>,
+        bounds: Rectangle,
+        state: &mut dyn operation::Focusable,
+    ) {
+        if let Some(id) = id {
+            self.values.push((id.clone(), bounds, state.is_focused()));
+        }
+    }
+    fn scrollable(
+        &mut self,
+        _: Option<&WidgetId>,
+        bounds: Rectangle,
+        _: Rectangle,
+        translation: Vector,
+        _: &mut dyn operation::Scrollable,
+    ) {
+        self.scrolls.push((bounds, translation));
+    }
+}
+impl Fields {
+    fn field(&self, id: &WidgetId) -> (Rectangle, bool) {
+        self.values
+            .iter()
+            .find(|(actual, _, _)| actual == id)
+            .map(|(_, bounds, focused)| (*bounds, *focused))
+            .expect("Mounted field identity")
+    }
+}
+fn view(
+    app: &App,
+    scrolled: bool,
+    nested: bool,
+    show_review: bool,
+) -> Element<'_, Message, Theme, ()> {
+    let draft = app.draft.as_ref().unwrap();
+    let form = column![
+        text_input("Name", &draft.inputs["/name"].raw)
+            .id("before-reference")
+            .on_input(|raw| Message::Field("/name".into(), raw)),
+        adapter::field(draft, app.project(), PATH),
+        text_input("Description", &draft.inputs["/description"].raw)
+            .id("after-reference")
+            .on_input(|raw| Message::Field("/description".into(), raw)),
+    ]
+    .spacing(9);
+    let form = trigger::scope(form, draft.reference_session());
+    let base: Element<'_, Message, Theme, ()> = if scrolled {
+        container(
+            scrollable(column![Space::new().height(500), form])
+                .id("reference-scroll")
+                .height(180),
+        )
+        .width(300)
+        .into()
+    } else {
+        container(form).width(300).height(iced::Fill).into()
+    };
+    let base: Element<'_, Message, Theme, ()> = if nested {
+        scrollable(column![Space::new().height(400), base])
+            .id("outer-reference-scroll")
+            .height(180)
+            .width(300)
+            .into()
+    } else {
+        base
+    };
+    let base = if show_review {
+        let review: Element<'_, Message, Theme, ()> = match app.workflow.as_ref() {
+            Some(workflow::Workflow::Semantic(state)) => {
+                match state.reference_form(app.project()) {
+                    Some(draft) => {
+                        let mut content = column![];
+                        if let Some(raw) = &state.operation_omission {
+                            content = content.push(
+                                text_input("Required engineering rationale", raw)
+                                    .id("review-rationale")
+                                    .on_input(|raw| {
+                                        Message::Workflow(workflow::Event::semantic(
+                                            state.address_event(RowEvent::OperationRationale(raw)),
+                                        ))
+                                    }),
+                            );
+                        }
+                        content = content.push(trigger::scope(
+                            adapter::field(draft, app.project(), "/parent").map(|message| {
+                                match message {
+                                    Message::FieldReferenceOpen(request) => {
+                                        Message::Workflow(workflow::Event::semantic(
+                                            state.address_event(RowEvent::ReferenceOpen(request)),
+                                        ))
+                                    }
+                                    other => other,
+                                }
+                            }),
+                            draft.reference_session(),
+                        ));
+                        opaque(container(trigger::modal(content)).width(300).height(180))
+                    }
+                    None => Space::new().into(),
+                }
+            }
+            _ => Space::new().into(),
+        };
+        stack![base, review].into()
+    } else {
+        base
+    };
+    app.reference_overlay(base)
+}
+struct Mount {
+    tree: Option<Tree>,
+    size: Size,
+    scrolled: bool,
+    nested: bool,
+    show_review: bool,
+}
+impl Default for Mount {
+    fn default() -> Self {
+        Self {
+            tree: None,
+            size: Size::new(360., 320.),
+            scrolled: false,
+            nested: false,
+            show_review: false,
+        }
+    }
+}
+impl Mount {
+    fn frame(
+        &mut self,
+        app: &App,
+        events: &[(Input, Option<Point>)],
+    ) -> (Vec<Message>, Fields, Option<Rectangle>) {
+        let mut view = view(app, self.scrolled, self.nested, self.show_review);
+        let tree = self.tree.get_or_insert_with(|| Tree::new(view.as_widget()));
+        view.as_widget().diff(tree);
+        let node =
+            view.as_widget_mut()
+                .layout(tree, &(), &layout::Limits::new(Size::ZERO, self.size));
+        let viewport = Rectangle::with_size(self.size);
+        let overlay_node = view
+            .as_widget_mut()
+            .overlay(tree, Layout::new(&node), &(), &viewport, Vector::ZERO)
+            .map(|mut overlay| overlay.as_overlay_mut().layout(&(), self.size));
+        let mut messages = Vec::new();
+        for (input, point) in events {
+            let mut shell = Shell::new(&mut messages);
+            let cursor = point.map_or(mouse::Cursor::Unavailable, mouse::Cursor::Available);
+            if let Some(overlay_node) = &overlay_node {
+                let mut overlay = view
+                    .as_widget_mut()
+                    .overlay(tree, Layout::new(&node), &(), &viewport, Vector::ZERO)
+                    .unwrap();
+                overlay.as_overlay_mut().update(
+                    input,
+                    Layout::new(overlay_node),
+                    cursor,
+                    &(),
+                    &mut Clipboard,
+                    &mut shell,
+                );
+                assert!(shell.is_event_captured());
+            } else {
+                view.as_widget_mut().update(
+                    tree,
+                    input,
+                    Layout::new(&node),
+                    cursor,
+                    &(),
+                    &mut Clipboard,
+                    &mut shell,
+                    &viewport,
+                );
+            }
+        }
+        let mut fields = Fields::default();
+        view.as_widget_mut()
+            .operate(tree, Layout::new(&node), &(), &mut fields);
+        (
+            messages,
+            fields,
+            overlay_node.map(|node| node.children()[0].bounds()),
+        )
+    }
+    fn click(&mut self, app: &App, point: Point) -> Vec<Message> {
+        self.frame(
+            app,
+            &[
+                (
+                    Input::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
+                    Some(point),
+                ),
+                (
+                    Input::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left)),
+                    Some(point),
+                ),
+            ],
+        )
+        .0
+    }
+    async fn perform(&mut self, app: &App, task: Task<Message>) {
+        let Some(mut stream) = iced_runtime::task::into_stream(task) else {
+            return;
+        };
+        while let Some(action) = stream.next().await {
+            let iced_runtime::Action::Widget(mut operation) = action else {
+                panic!("Chooser only requests scoped widget focus")
+            };
+            let mut view = view(app, self.scrolled, self.nested, self.show_review);
+            let tree = self.tree.get_or_insert_with(|| Tree::new(view.as_widget()));
+            view.as_widget().diff(tree);
+            let node =
+                view.as_widget_mut()
+                    .layout(tree, &(), &layout::Limits::new(Size::ZERO, self.size));
+            loop {
+                view.as_widget_mut()
+                    .operate(tree, Layout::new(&node), &(), operation.as_mut());
+                match operation.finish() {
+                    operation::Outcome::Chain(next) => operation = next,
+                    _ => break,
+                }
+            }
+        }
+    }
+    async fn dispatch(&mut self, app: &mut App, messages: Vec<Message>) {
+        for message in messages {
+            let task = app.update(message);
+            self.perform(app, task).await;
+        }
+    }
+}
+fn key(key: keyboard::key::Named, shift: bool) -> Input {
+    Input::Keyboard(keyboard::Event::KeyPressed {
+        key: keyboard::Key::Named(key),
+        modified_key: keyboard::Key::Named(key),
+        physical_key: keyboard::key::Physical::Code(keyboard::key::Code::Space),
+        location: keyboard::Location::Standard,
+        modifiers: if shift {
+            keyboard::Modifiers::SHIFT
+        } else {
+            keyboard::Modifiers::empty()
+        },
+        text: None,
+        repeat: false,
+    })
+}
+fn typing(raw: &str) -> Vec<(Input, Option<Point>)> {
+    raw.chars()
+        .map(|character| {
+            let raw = character.to_string();
+            (
+                Input::Keyboard(keyboard::Event::KeyPressed {
+                    key: keyboard::Key::Character(raw.clone().into()),
+                    modified_key: keyboard::Key::Character(raw.clone().into()),
+                    physical_key: keyboard::key::Physical::Code(keyboard::key::Code::KeyA),
+                    location: keyboard::Location::Standard,
+                    modifiers: keyboard::Modifiers::empty(),
+                    text: Some(raw.into()),
+                    repeat: false,
+                }),
+                None,
+            )
+        })
+        .collect()
+}
+
+#[tokio::test]
+async fn mounted_reference_trigger_tabs_to_root_popup_search_escape_and_exact_adjacent_fields() {
+    let mut app = inspector(catalog(), OWNER);
+    let accepted = app.document.bundle().clone();
+    let original = raw(&app);
+    let mut mount = Mount::default();
+    let fields = mount.frame(&app, &[]).1;
+    let messages = mount.click(
+        &app,
+        fields.field(&WidgetId::new("before-reference")).0.center(),
+    );
+    mount.dispatch(&mut app, messages).await;
+    let (_, fields, _) = mount.frame(&app, &[(key(keyboard::key::Named::Tab, false), None)]);
+    let id = trigger::field_id(app.draft.as_ref().unwrap().reference_generation(), PATH);
+    assert!(
+        fields.field(&id).1,
+        "Tab reaches the real reference trigger"
+    );
+    let messages = mount
+        .frame(&app, &[(key(keyboard::key::Named::Enter, false), None)])
+        .0;
+    assert_eq!(messages.len(), 1, "One keyboard activation opens one field");
+    mount.dispatch(&mut app, messages).await;
+    let popup = mount
+        .frame(&app, &[])
+        .2
+        .expect("App root overlay is mounted");
+    assert!(
+        popup.x >= 0.
+            && popup.y >= 0.
+            && popup.x + popup.width <= 360.
+            && popup.y + popup.height <= 320.
+    );
+    let mut inputs = typing("@controller_0720");
+    inputs.push((key(keyboard::key::Named::Escape, false), None));
+    let messages = mount.frame(&app, &inputs).0;
+    mount.dispatch(&mut app, messages).await;
+    let (_, fields, popup) = mount.frame(&app, &[]);
+    assert!(popup.is_none());
+    assert!(
+        fields.field(&id).1,
+        "Escape returns to its exact reference field"
+    );
+    assert_eq!(raw(&app), original);
+    assert_eq!(app.document.bundle(), &accepted);
+    for (backwards, expected) in [(false, "after-reference"), (true, "before-reference")] {
+        let messages = mount.click(&app, fields.field(&id).0.center());
+        mount.dispatch(&mut app, messages).await;
+        let messages = mount
+            .frame(&app, &[(key(keyboard::key::Named::Tab, backwards), None)])
+            .0;
+        mount.dispatch(&mut app, messages).await;
+        let (_, fields, popup) = mount.frame(&app, &[]);
+        assert!(popup.is_none());
+        assert!(
+            fields.field(&WidgetId::new(expected)).1,
+            "Chooser Tab stays within the originating form"
+        );
+    }
+    assert_eq!(app.document.bundle(), &accepted);
+}
+
+#[tokio::test]
+async fn mounted_reference_choice_stages_literal_identity_and_delayed_focus_cannot_hit_replacement_field()
+ {
+    let mut app = inspector(catalog(), OWNER);
+    let accepted = app.document.bundle().clone();
+    let mut mount = Mount::default();
+    let id = trigger::field_id(app.draft.as_ref().unwrap().reference_generation(), PATH);
+    let fields = mount.frame(&app, &[]).1;
+    let messages = mount.click(&app, fields.field(&id).0.center());
+    mount.dispatch(&mut app, messages).await;
+    let messages = mount.frame(&app, &typing("@controller_0720")).0;
+    mount.dispatch(&mut app, messages).await;
+    assert_eq!(
+        app.reference_authoring
+            .opened
+            .as_ref()
+            .unwrap()
+            .chooser
+            .count(),
+        1
+    );
+    let messages = mount
+        .frame(&app, &[(key(keyboard::key::Named::Enter, false), None)])
+        .0;
+    assert_eq!(messages.len(), 1);
+    let delayed_focus = app.update(messages.into_iter().next().unwrap());
+    assert_eq!(
+        app.draft.as_ref().unwrap().value.pointer(PATH),
+        Some(&json!(Id::from_u128(BASE + 720)))
+    );
+    assert_eq!(app.document.bundle(), &accepted);
+    // A structural edit occurs after Choose but before its asynchronous focus.
+    app.draft
+        .as_mut()
+        .unwrap()
+        .shape_scoped(PATH, Value::Null)
+        .unwrap();
+    let fields = mount.frame(&app, &[]).1;
+    let messages = mount.click(
+        &app,
+        fields.field(&WidgetId::new("after-reference")).0.center(),
+    );
+    mount.dispatch(&mut app, messages).await;
+    mount.perform(&app, delayed_focus).await;
+    let fields = mount.frame(&app, &[]).1;
+    assert!(
+        fields.field(&WidgetId::new("after-reference")).1,
+        "A missing old field target makes no focus changes"
+    );
+    assert!(
+        !fields
+            .field(&trigger::field_id(
+                app.draft.as_ref().unwrap().reference_generation(),
+                PATH
+            ))
+            .1
+    );
+    assert_eq!(app.document.bundle(), &accepted);
+}
+
+#[tokio::test]
+async fn mounted_scrolled_reference_anchor_uses_window_geometry_for_pointer_and_keyboard() {
+    let mut app = inspector(catalog(), OWNER);
+    let mut mount = Mount {
+        scrolled: true,
+        ..Default::default()
+    };
+    mount.frame(&app, &[]);
+    mount
+        .perform(
+            &app,
+            iced::widget::operation::snap_to("reference-scroll", scrollable::RelativeOffset::END),
+        )
+        .await;
+    let fields = mount.frame(&app, &[]).1;
+    let id = trigger::field_id(app.draft.as_ref().unwrap().reference_generation(), PATH);
+    let content = fields.field(&id).0;
+    let (viewport, offset) = fields.scrolls[0];
+    assert!(offset.y > 400., "Fixture is genuinely scrolled");
+    let expected = Rectangle {
+        x: content.x - offset.x,
+        y: content.y - offset.y,
+        ..content
+    }
+    .intersection(&viewport)
+    .unwrap();
+    let messages = mount.click(&app, expected.center());
+    let [Message::FieldReferenceOpen(request)] = messages.as_slice() else {
+        panic!("Scrolled field should emit one actual Open")
+    };
+    assert_eq!(request.anchor, expected);
+    mount.dispatch(&mut app, messages).await;
+    let close = app.update(Message::Escape);
+    mount.perform(&app, close).await;
+    let messages = mount
+        .frame(&app, &[(key(keyboard::key::Named::Enter, false), None)])
+        .0;
+    let [Message::FieldReferenceOpen(request)] = messages.as_slice() else {
+        panic!("Focused scrolled field opens without a pointer")
+    };
+    assert_eq!(request.anchor, expected);
+}
+
+#[tokio::test]
+async fn mounted_fresh_tab_reveals_offscreen_reference_and_return_reveals_it_again() {
+    for nested in [false, true] {
+        let mut app = inspector(catalog(), OWNER);
+        let original = raw(&app);
+        let source = app.document.bundle().clone();
+        let mut mount = Mount {
+            scrolled: true,
+            nested,
+            ..Default::default()
+        };
+        let fields = mount.frame(&app, &[]).1;
+        assert!(
+            fields
+                .scrolls
+                .iter()
+                .all(|(_, offset)| *offset == Vector::ZERO)
+        );
+        assert!(fields.field(&WidgetId::new("before-reference")).0.y > 180.);
+        let messages = mount
+            .frame(&app, &[(key(keyboard::key::Named::Tab, false), None)])
+            .0;
+        assert!(
+            messages.is_empty(),
+            "Keyboard reveal must not author any input"
+        );
+        let fields = mount.frame(&app, &[]).1;
+        assert!(fields.field(&WidgetId::new("before-reference")).1);
+        assert!(
+            fields.scrolls.iter().all(|(_, offset)| offset.y > 0.),
+            "Every enclosing viewport reveals fresh focus"
+        );
+        let id = trigger::field_id(app.draft.as_ref().unwrap().reference_generation(), PATH);
+        let offset: f32 = fields.scrolls.iter().map(|(_, offset)| offset.y).sum();
+        assert!(
+            fields.field(&id).0.y - offset >= 180.,
+            "The next reference starts below the fold"
+        );
+        let messages = mount
+            .frame(&app, &[(key(keyboard::key::Named::Tab, false), None)])
+            .0;
+        assert!(messages.is_empty());
+        let fields = mount.frame(&app, &[]).1;
+        let offset: f32 = fields.scrolls.iter().map(|(_, offset)| offset.y).sum();
+        let (bounds, focused) = fields.field(&id);
+        assert!(focused);
+        assert!(bounds.y - offset >= -0.01 && bounds.y + bounds.height - offset <= 180.01);
+        let messages = mount
+            .frame(&app, &[(key(keyboard::key::Named::Enter, false), None)])
+            .0;
+        assert_eq!(
+            messages.len(),
+            1,
+            "A newly revealed field opens through Enter"
+        );
+        mount.dispatch(&mut app, messages).await;
+        let return_focus = app.update(Message::Escape);
+        mount
+            .perform(
+                &app,
+                iced::widget::operation::snap_to(
+                    "reference-scroll",
+                    scrollable::RelativeOffset::START,
+                ),
+            )
+            .await;
+        if nested {
+            mount
+                .perform(
+                    &app,
+                    iced::widget::operation::snap_to(
+                        "outer-reference-scroll",
+                        scrollable::RelativeOffset::START,
+                    ),
+                )
+                .await;
+        }
+        assert!(
+            mount
+                .frame(&app, &[])
+                .1
+                .scrolls
+                .iter()
+                .all(|(_, offset)| *offset == Vector::ZERO)
+        );
+        mount.perform(&app, return_focus).await;
+        let fields = mount.frame(&app, &[]).1;
+        let offset: f32 = fields.scrolls.iter().map(|(_, offset)| offset.y).sum();
+        let (bounds, focused) = fields.field(&id);
+        assert!(
+            focused && bounds.y - offset >= -0.01 && bounds.y + bounds.height - offset <= 180.01
+        );
+        assert_eq!(raw(&app), original);
+        assert_eq!(app.document.bundle(), &source);
+    }
+}
+
+#[tokio::test]
+async fn mounted_form_tab_enters_in_both_directions_and_cycles_boundaries_without_losing_focus() {
+    for backwards in [false, true] {
+        let app = inspector(catalog(), OWNER);
+        let original = raw(&app);
+        let mut mount = Mount::default();
+        let reference = trigger::field_id(app.draft.as_ref().unwrap().reference_generation(), PATH);
+        let forward = [
+            WidgetId::new("before-reference"),
+            reference.clone(),
+            WidgetId::new("after-reference"),
+        ];
+        let reverse = [
+            WidgetId::new("after-reference"),
+            reference,
+            WidgetId::new("before-reference"),
+        ];
+        let expected = if backwards { &reverse } else { &forward };
+        for n in 0..7 {
+            let (messages, fields, popup) =
+                mount.frame(&app, &[(key(keyboard::key::Named::Tab, backwards), None)]);
+            assert!(messages.is_empty() && popup.is_none());
+            assert!(fields.field(&expected[n % 3]).1);
+            assert_eq!(
+                fields
+                    .values
+                    .iter()
+                    .filter(|(_, _, focused)| *focused)
+                    .count(),
+                1
+            );
+        }
+        assert_eq!(raw(&app), original);
+        assert!(!app.document.can_undo());
+    }
+}
+
+#[tokio::test]
+async fn mounted_delayed_return_cannot_focus_under_review_and_fresh_modal_tab_owns_its_form() {
+    let mut p = catalog();
+    trace(&mut p, Id::from_u128(300), OWNER, Id::from_u128(200));
+    let mut app = inspector(p, OWNER);
+    let source = app.document.bundle().clone();
+    let original = raw(&app);
+    let mut mount = Mount {
+        show_review: true,
+        ..Default::default()
+    };
+    let id = trigger::field_id(app.draft.as_ref().unwrap().reference_generation(), PATH);
+    let session = app.draft.as_ref().unwrap().reference_session();
+    let fields = mount.frame(&app, &[]).1;
+    let messages = mount.click(&app, fields.field(&id).0.center());
+    mount.dispatch(&mut app, messages).await;
+    let return_focus = app.update(Message::Escape);
+    let fields = mount.frame(&app, &[]).1;
+    let messages = mount.click(
+        &app,
+        fields.field(&WidgetId::new("after-reference")).0.center(),
+    );
+    mount.dispatch(&mut app, messages).await;
+    let _ = app.update(Message::StartSemanticReview(Id::from_u128(300)));
+    let facet = FacetSelector::Header(HeaderFacet::Parent);
+    send_review(&mut app, RowEvent::Select(facet.clone()));
+    send_review(
+        &mut app,
+        RowEvent::Decide(facet, Some(SemanticDecision::Candidate)),
+    );
+    assert_eq!(
+        app.draft.as_ref().unwrap().reference_session(),
+        session,
+        "Old Inspector really remains mounted"
+    );
+    assert_eq!(
+        trigger::field_id(app.draft.as_ref().unwrap().reference_generation(), PATH),
+        id
+    );
+    let review_before = review(&app).recovery_snapshot().unwrap();
+    let review_field = trigger::field_id(
+        review(&app)
+            .reference_form(app.project())
+            .unwrap()
+            .reference_generation(),
+        "/parent",
+    );
+    mount.perform(&app, return_focus).await;
+    let fields = mount.frame(&app, &[]).1;
+    assert!(
+        !fields.field(&id).1,
+        "A live old field underneath a modal cannot receive the stale focus task"
+    );
+    assert!(fields.field(&WidgetId::new("after-reference")).1);
+    assert!(!fields.field(&review_field).1);
+    let (messages, fields, _) = mount.frame(&app, &[(key(keyboard::key::Named::Tab, false), None)]);
+    assert!(messages.is_empty());
+    assert!(
+        fields.field(&review_field).1,
+        "Review entry ignores retained focus under its modal"
+    );
+    assert!(
+        !fields.field(&WidgetId::new("after-reference")).1,
+        "Modal focus acquisition deactivates background inputs"
+    );
+    let messages = mount.frame(&app, &typing("x")).0;
+    assert!(
+        messages.is_empty(),
+        "A character at the focused Review trigger cannot type into the Inspector below it"
+    );
+    let (messages, fields, _) = mount.frame(&app, &[(key(keyboard::key::Named::Tab, true), None)]);
+    assert!(messages.is_empty());
+    assert!(fields.field(&review_field).1);
+    assert!(!fields.field(&id).1);
+    assert_eq!(review(&app).recovery_snapshot().unwrap(), review_before);
+    assert_eq!(raw(&app), original);
+    assert_eq!(app.document.bundle(), &source);
+}
+
+#[tokio::test]
+async fn mounted_review_pointer_open_and_outside_dismissal_keep_background_input_inactive() {
+    let mut p = catalog();
+    trace(&mut p, Id::from_u128(300), OWNER, Id::from_u128(200));
+    let mut app = inspector(p, OWNER);
+    let original = raw(&app);
+    let source = app.document.bundle().clone();
+    let mut mount = Mount {
+        show_review: true,
+        ..Default::default()
+    };
+    let fields = mount.frame(&app, &[]).1;
+    let messages = mount.click(
+        &app,
+        fields.field(&WidgetId::new("after-reference")).0.center(),
+    );
+    mount.dispatch(&mut app, messages).await;
+    let _ = app.update(Message::StartSemanticReview(Id::from_u128(300)));
+    let facet = FacetSelector::Header(HeaderFacet::Parent);
+    send_review(&mut app, RowEvent::Select(facet.clone()));
+    send_review(
+        &mut app,
+        RowEvent::Decide(facet, Some(SemanticDecision::Candidate)),
+    );
+    let saved = review(&app).recovery_snapshot().unwrap();
+    let id = trigger::field_id(
+        review(&app)
+            .reference_form(app.project())
+            .unwrap()
+            .reference_generation(),
+        "/parent",
+    );
+    let fields = mount.frame(&app, &[]).1;
+    assert!(
+        fields.field(&WidgetId::new("after-reference")).1,
+        "Fixture retains Inspector focus before the modal receives input"
+    );
+    let messages = mount.click(&app, fields.field(&id).0.center());
+    mount.dispatch(&mut app, messages).await;
+    assert!(matches!(
+        &app.reference_authoring.opened.as_ref().unwrap().host,
+        Host::Review { .. }
+    ));
+    let fields = mount.frame(&app, &[]).1;
+    assert!(!fields.field(&WidgetId::new("after-reference")).1);
+    let messages = mount.click(&app, Point::new(359., 319.));
+    assert!(matches!(
+        messages.as_slice(),
+        [Message::Workflow(workflow::Event::Semantic(event))] if matches!(event.as_ref(),
+            semantic_review::Event::Row {
+                event: RowEvent::ReferenceEvent(chooser::Event {
+                    action: Action::Close(Close::Outside),
+                    ..
+                }),
+                ..
+            }
+        )
+    ));
+    for message in messages {
+        let task = app.update(message);
+        assert!(
+            iced_runtime::task::into_stream(task).is_none(),
+            "Outside dismissal must not request focus or apply"
+        );
+    }
+    let (messages, fields, popup) = mount.frame(&app, &typing("x"));
+    assert!(messages.is_empty() && popup.is_none());
+    assert!(!fields.field(&WidgetId::new("after-reference")).1);
+    assert_eq!(review(&app).recovery_snapshot().unwrap(), saved);
+    assert_eq!(raw(&app), original);
+    assert_eq!(app.document.bundle(), &source);
+}
+
+#[tokio::test]
+async fn mounted_reverse_review_required_rationale_remains_editable_beside_candidate_reference_form()
+ {
+    let mut p = persistence::decode(include_bytes!(concat!(
+        env!("CARGO_MANIFEST_DIR"),
+        "/../../harness/fixtures/interface-operation-probe/output/boundary-only.json"
+    )))
+    .unwrap();
+    let sa = p
+        .elements
+        .values()
+        .find(|element| element.alias == "operation_probe_43")
+        .unwrap()
+        .id;
+    let allocation = p
+        .relations
+        .values()
+        .find(|relation| relation.alias == "operation_probe_30")
+        .unwrap()
+        .id;
+    // The boundary fixture deliberately has no selected operation. Author one
+    // through the validated command path before testing reverse omission.
+    let mut message = p.elements[&sa].clone();
+    let Some(SharedBody::Occurrence {
+        body: OccurrenceBody::Exchange { operation, .. },
+        ..
+    }) = message.shared_mut()
+    else {
+        panic!("The operation fixture must contain an Exchange call")
+    };
+    *operation = Some(OperationUse {
+        allocation: Some(allocation),
+    });
+    p = execute_batch(&p, &[Command::EditElement(sa, message)]).unwrap();
+    assert!(matches!(
+        oa_core::operations::resolve(&p, sa).unwrap(),
+        oa_core::operations::OperationResolution::Selected(value)
+            if value.allocation == allocation
+    ));
+    let inspector_id = Id::new_v4();
+    element(
+        &mut p,
+        inspector_id,
+        Kind::DataType,
+        Layer::Oa,
+        "Inspector record",
+        None,
+    );
+    let scenario = p
+        .add_element(Kind::Scenario, Layer::Oa, "Operational counterpart", None)
+        .unwrap();
+    let oa = p
+        .add_element(
+            Kind::Occurrence,
+            Layer::Oa,
+            "Operational message",
+            Some(scenario),
+        )
+        .unwrap();
+    *p.elements.get_mut(&oa).unwrap().shared_mut().unwrap() = SharedBody::Occurrence {
+        body: OccurrenceBody::Exchange {
+            exchange: None,
+            sender: None,
+            receiver: None,
+            message_kind: MessageKind::Asynchronous,
+            reply_to: None,
+            values: vec![],
+            operation: None,
+        },
+        precondition: String::new(),
+        postcondition: String::new(),
+    };
+    p.elements
+        .get_mut(&scenario)
+        .unwrap()
+        .steps_mut()
+        .unwrap()
+        .push(oa);
+    let trace_id = Id::new_v4();
+    trace(&mut p, trace_id, oa, sa);
+    let mut app = inspector(p, inspector_id);
+    let source = app.document.bundle().clone();
+    let inspector_raw = raw(&app);
+    let _ = app.update(Message::StartSemanticReview(trace_id));
+    let _ = app.update(Message::Workflow(workflow::Event::semantic(
+        semantic_review::Event::Direction(TransitionDirection::SaToOa),
+    )));
+    let facet = FacetSelector::Header(HeaderFacet::Parent);
+    send_review(&mut app, RowEvent::Select(facet.clone()));
+    send_review(
+        &mut app,
+        RowEvent::Decide(facet, Some(SemanticDecision::Candidate)),
+    );
+    send_review(&mut app, RowEvent::OperationOmission(true));
+    assert_eq!(review(&app).direction, TransitionDirection::SaToOa);
+    assert_eq!(review(&app).operation_omission.as_deref(), Some(""));
+    let candidate = serde_json::to_value(
+        review(&app)
+            .reference_form(app.project())
+            .unwrap_or_else(|| {
+                panic!(
+                    "Reverse review candidate: selected={:?}, decisions={:?}, error={:?}",
+                    review(&app).selected,
+                    review(&app).decisions,
+                    review(&app).error
+                )
+            })
+            .recovery_snapshot(),
+    )
+    .unwrap();
+    let mut mount = Mount {
+        show_review: true,
+        ..Default::default()
+    };
+    let fields = mount.frame(&app, &[]).1;
+    let messages = mount.click(
+        &app,
+        fields.field(&WidgetId::new("review-rationale")).0.center(),
+    );
+    mount.dispatch(&mut app, messages).await;
+    let messages = mount.frame(&app, &typing("Engineering reason")).0;
+    assert_eq!(
+        messages.len(),
+        "Engineering reason".chars().count(),
+        "Every key reaches the legitimate sibling inside Review"
+    );
+    assert!(messages.iter().all(|message| matches!(
+        message,
+        Message::Workflow(workflow::Event::Semantic(event)) if matches!(event.as_ref(), semantic_review::Event::Row {
+            event: RowEvent::OperationRationale(_),
+            ..
+        })
+    )));
+    mount.dispatch(&mut app, messages).await;
+    assert_eq!(
+        review(&app).operation_omission.as_deref(),
+        Some("Engineering reason")
+    );
+    assert!(
+        mount
+            .frame(&app, &[])
+            .1
+            .field(&WidgetId::new("review-rationale"))
+            .1
+    );
+    assert_eq!(
+        serde_json::to_value(
+            review(&app)
+                .reference_form(app.project())
+                .unwrap()
+                .recovery_snapshot()
+        )
+        .unwrap(),
+        candidate
+    );
+    assert_eq!(raw(&app), inspector_raw);
+    assert_eq!(app.document.bundle(), &source);
+    assert!(!app.document.can_undo());
+}
@@ -0,0 +1,263 @@
+use super::*;
+
+const VALID: &str = concat!(
+    "arcadia 7;\r\n",
+    "project repair \"Repair 救援\" id \"9e8f0000-0000-4000-8000-000000000001\" {\r\n",
+    "    oa_activity assess \"Assess\" id \"9e8f0000-0000-4000-8000-000000000002\" {}\r\n",
+    "}\r\n",
+);
+
+fn open(app: &mut App, path: &std::path::Path) {
+    let _ = app.update(Message::Loaded(Ok(Some(
+        read_snapshot(path.to_owned()).unwrap(),
+    ))));
+}
+
+fn edit(app: &mut App, text: &str) {
+    let _ = app.update(Message::SourceEdit(text_editor::Action::SelectAll));
+    let _ = app.update(Message::SourceEdit(text_editor::Action::Edit(
+        text_editor::Edit::Paste(Arc::new(text.into())),
+    )));
+}
+
+fn save(app: &mut App, path: &std::path::Path) {
+    let receipt = write_snapshot(
+        app.canvas_document,
+        app.document.revision(),
+        app.document.snapshot(),
+        path.to_owned(),
+        app.disk_project.clone(),
+    )
+    .unwrap();
+    let _ = app.update(Message::Saved(Ok(Some(receipt))));
+}
+
+#[test]
+fn repair_to_previous_saved_bytes_requires_save_at_new_destination_and_guards_close() {
+    for extra in [
+        "    include \"missing.arcadia\";\r\n",
+        "    oa_activity assess \"Duplicate\" id \"9e8f0000-0000-4000-8000-000000000003\" {}\r\n",
+    ] {
+        let first = tempfile::tempdir().unwrap();
+        let second = tempfile::tempdir().unwrap();
+        let first_path = first.path().canonicalize().unwrap().join("project.arcadia");
+        let second_path = second
+            .path()
+            .canonicalize()
+            .unwrap()
+            .join("project.arcadia");
+        let invalid = VALID.strip_suffix("}\r\n").unwrap().to_owned() + extra + "}\r\n";
+        std::fs::write(&first_path, VALID).unwrap();
+        std::fs::write(&second_path, &invalid).unwrap();
+        let mut app = App::with_project(Project::empty());
+        open(&mut app, &first_path);
+        assert!(!app.dirty());
+        let before = app.document.snapshot();
+        let revision = app.document.revision();
+        open(&mut app, &second_path);
+        assert!(!app.source_workspace.applied);
+        assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+        edit(&mut app, VALID);
+        assert!(app.apply_source(), "{}", app.status);
+        assert!(app.source_workspace.applied);
+        assert!(!app.source_dirty());
+        assert_eq!(app.document.bundle(), &before.bundle);
+        assert_eq!(app.project(), &before.decoded.project);
+        assert_eq!(app.document.revision(), revision);
+        assert!(
+            !app.document.can_undo(),
+            "Equal content creates no history step"
+        );
+        assert!(app.document.dirty());
+        assert_eq!(app.hosted_label(), "Unsaved changes");
+        assert_eq!(std::fs::read(&second_path).unwrap(), invalid.as_bytes());
+        assert_eq!(std::fs::read(&first_path).unwrap(), VALID.as_bytes());
+        let close = window::Id::unique();
+        let task = app.update(Message::Request(Pending::Close(close)));
+        assert!(iced_runtime::task::into_stream(task).is_none());
+        assert!(matches!(app.pending, Some(Pending::Close(id)) if id == close));
+        let _ = app.update(Message::Cancel);
+        save(&mut app, &second_path);
+        assert!(!app.dirty());
+        assert_eq!(app.hosted_label(), "All changes saved");
+        assert_eq!(std::fs::read(&second_path).unwrap(), VALID.as_bytes());
+        assert_eq!(std::fs::read(&first_path).unwrap(), VALID.as_bytes());
+    }
+}
+
+#[test]
+fn repair_history_compares_to_new_disk_baseline_and_then_successful_save() {
+    let directory = tempfile::tempdir().unwrap();
+    let path = directory
+        .path()
+        .canonicalize()
+        .unwrap()
+        .join("project.arcadia");
+    std::fs::write(&path, VALID).unwrap();
+    let mut app = App::with_project(Project::empty());
+    open(&mut app, &path);
+    let before = app.document.snapshot();
+    let invalid = format!("{VALID} unfinished {{");
+    std::fs::write(&path, &invalid).unwrap();
+    open(&mut app, &path);
+    let repaired = format!("{VALID}// Repaired rationale\r\n");
+    edit(&mut app, &repaired);
+    assert!(app.apply_source());
+    assert!(app.dirty());
+    let _ = app.update(Message::Undo);
+    assert_eq!(app.document.bundle(), &before.bundle);
+    assert!(
+        app.dirty(),
+        "Old saved bytes are not saved at the repair destination"
+    );
+    let _ = app.update(Message::Redo);
+    assert!(app.dirty());
+    assert_eq!(std::fs::read(&path).unwrap(), invalid.as_bytes());
+
+    std::fs::write(&path, "external edit").unwrap();
+    let failed = write_snapshot(
+        app.canvas_document,
+        app.document.revision(),
+        app.document.snapshot(),
+        path.clone(),
+        app.disk_project.clone(),
+    )
+    .unwrap_err();
+    let _ = app.update(Message::Saved(Err(failed)));
+    assert!(app.dirty());
+    assert_eq!(std::fs::read(&path).unwrap(), b"external edit");
+    std::fs::write(&path, &invalid).unwrap();
+    save(&mut app, &path);
+    assert!(!app.dirty());
+    let _ = app.update(Message::Undo);
+    assert!(app.dirty());
+    assert_eq!(app.document.bundle(), &before.bundle);
+    let _ = app.update(Message::Redo);
+    assert!(!app.dirty(), "Redo to the new saved snapshot is clean");
+    assert_eq!(std::fs::read(&path).unwrap(), repaired.as_bytes());
+}
+
+#[test]
+fn valid_equal_content_at_distinct_destinations_stays_clean() {
+    let first = tempfile::tempdir().unwrap();
+    let second = tempfile::tempdir().unwrap();
+    let first_path = first.path().canonicalize().unwrap().join("project.arcadia");
+    let second_path = second
+        .path()
+        .canonicalize()
+        .unwrap()
+        .join("project.arcadia");
+    std::fs::write(&first_path, VALID).unwrap();
+    std::fs::write(&second_path, VALID).unwrap();
+    let mut app = App::with_project(Project::empty());
+    open(&mut app, &first_path);
+    let before = app.document.bundle().clone();
+    open(&mut app, &second_path);
+    assert_eq!(app.document.bundle(), &before);
+    assert_eq!(app.path.as_ref(), Some(&second_path));
+    assert!(!app.dirty());
+    assert_eq!(app.hosted_label(), "All changes saved");
+}
+
+#[test]
+fn recovering_applied_repair_rebinds_rolled_back_disk_bytes_without_changing_model() {
+    let first = tempfile::tempdir().unwrap();
+    let second = tempfile::tempdir().unwrap();
+    let first_path = first.path().canonicalize().unwrap().join("project.arcadia");
+    let root = second.path().canonicalize().unwrap();
+    let path = root.join("project.arcadia");
+    let before = VALID.replace("Repair 救援", "Before 救援");
+    std::fs::write(&first_path, VALID).unwrap();
+    std::fs::write(&path, VALID).unwrap();
+    let journal = root.join(".arcadia-save-project.arcadia.journal");
+    std::fs::create_dir(&journal).unwrap();
+    std::fs::write(
+        journal.join("journal.json"),
+        br#"{"version":1,"entry":"project.arcadia","files":[{"path":"project.arcadia","before":true,"write":true}]}"#,
+    )
+    .unwrap();
+    std::fs::write(journal.join("0.before"), &before).unwrap();
+    std::fs::write(journal.join("0.after"), VALID).unwrap();
+    let mut app = App::with_project(Project::empty());
+    open(&mut app, &first_path);
+    let accepted = app.document.snapshot();
+    open(&mut app, &path);
+    assert_eq!(app.pending_recovery.as_ref(), Some(&path));
+    assert!(!app.source_workspace.applied);
+    assert!(app.apply_source());
+    assert!(
+        !app.dirty(),
+        "Current bytes still match disk before rollback"
+    );
+    let _ = app.update(Message::SourceRecovered(recover_snapshot(path.clone())));
+    assert!(app.pending_recovery.is_none());
+    assert!(!journal.exists());
+    assert_eq!(std::fs::read(&path).unwrap(), before.as_bytes());
+    assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+    assert!(!app.source_dirty());
+    assert!(app.dirty(), "Recovery changed disk, not the accepted model");
+    assert_eq!(app.hosted_label(), "Unsaved changes");
+    save(&mut app, &path);
+    assert!(!app.dirty());
+    assert_eq!(std::fs::read(&path).unwrap(), VALID.as_bytes());
+}
+
+#[test]
+fn recovery_missing_entry_or_failed_reload_preserves_current_destination_save_authority() {
+    for (current_destination, failed_reload) in
+        [(true, false), (false, false), (true, true), (false, true)]
+    {
+        let directory = tempfile::tempdir().unwrap();
+        let root = directory.path().canonicalize().unwrap();
+        let path = root.join("project.arcadia");
+        std::fs::write(&path, VALID).unwrap();
+        let mut app = App::with_project(Project::empty());
+        open(&mut app, &path);
+        let accepted = app.document.snapshot();
+        let journal = root.join(".arcadia-save-project.arcadia.journal");
+        std::fs::create_dir(&journal).unwrap();
+        std::fs::write(
+            journal.join("journal.json"),
+            br#"{"version":1,"entry":"project.arcadia","files":[{"path":"project.arcadia","before":false,"write":true}]}"#,
+        )
+        .unwrap();
+        std::fs::write(journal.join("0.after"), VALID).unwrap();
+        open(&mut app, &path);
+        assert!(app.apply_source());
+        assert!(!app.dirty());
+        let destination = tempfile::tempdir().unwrap();
+        let saved_elsewhere = destination
+            .path()
+            .canonicalize()
+            .unwrap()
+            .join("project.arcadia");
+        if !current_destination {
+            save(&mut app, &saved_elsewhere);
+            assert_eq!(app.path.as_ref(), Some(&saved_elsewhere));
+            assert_eq!(app.pending_recovery.as_ref(), Some(&path));
+        }
+        let mut receipt = recover_snapshot(path.clone()).unwrap();
+        assert!(
+            receipt.disk.as_ref().unwrap().bundle.files.is_empty(),
+            "Missing entry reloads as an empty repair workspace"
+        );
+        if failed_reload {
+            // Separately exercise the adapter's successful-recovery/failed-read
+            // boundary; first-save rollback itself does not cause a read error.
+            receipt.disk = Err("Injected post-recovery reload failure".into());
+        }
+        let _ = app.update(Message::SourceRecovered(Ok(receipt)));
+        assert!(!path.exists());
+        assert!(!journal.exists());
+        assert!(app.pending_recovery.is_none());
+        assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+        assert_eq!(app.dirty(), current_destination);
+        if current_destination {
+            let _ = app.update(Message::Request(Pending::New));
+            assert!(matches!(app.pending, Some(Pending::New)));
+        } else {
+            assert_eq!(app.path.as_ref(), Some(&saved_elsewhere));
+            assert_eq!(std::fs::read(&saved_elsewhere).unwrap(), VALID.as_bytes());
+        }
+    }
+}
@@ -16,7 +16,7 @@ fn state(app: &App) -> &State {
 }
 fn row_event(app: &mut App, event: RowEvent) {
    let event = state(app).address_event(event);
-    send(app, Message::Workflow(Event::Semantic(event)));
+    send(app, Message::Workflow(Event::semantic(event)));
 }
 fn fixture(reverse: bool, destination_view: bool) -> (App, Id, Id, Id, Option<Id>) {
    let mut p = Project::empty();
@@ -0,0 +1,243 @@
+//! Shared presentation and input contract; contains no model commands.
+use crate::app::{App, Message};
+use iced::widget::{button, column, container, opaque, row, scrollable, stack, text, tooltip};
+use iced::{Element, Length::Fill, Point, Theme, Vector};
+use oa_core::Id;
+mod control;
+mod focus;
+mod viewport;
+pub use control::Control;
+pub use viewport::Viewport;
+
+pub fn keyboard_enabled(app: &crate::app::App) -> bool {
+    !app.busy
+        && !app.hosted.visible
+        && app.workflow.is_none()
+        && app.file_prompt.is_none()
+        && !app.delete_pending
+        && app.pending.is_none()
+        && app.model_menu.is_none()
+        && !app.reference_input_active()
+}
+
+pub fn controls<'a>(
+    scope: Scope,
+    keyboard: bool,
+    scale: f32,
+    details: Message,
+    focus: Option<Message>,
+    zoom: impl Fn(Option<f32>) -> Message,
+    publish: impl Fn(Event) -> Message + Copy + 'a,
+) -> Element<'a, Message> {
+    let control = |name: &'static str, label: &'static str, message: Option<Message>| {
+        let message = message.map(|message| intent(scope, name, message));
+        Control::new(
+            button(text(label).size(12))
+                .padding(6)
+                .on_press_maybe(message.clone()),
+            scope,
+            name,
+            keyboard,
+            message,
+            publish,
+        )
+    };
+    row![
+        control("Details", "Details", Some(details)),
+        tooltip(control("Canvas", "Canvas", focus),
+            container(text("F6: enter/leave canvas controls · Tab: next · Enter/Space: activate · Esc: leave").size(12)).padding(7).style(crate::style::card),
+            tooltip::Position::Bottom),
+        control("Fit", "Fit", Some(zoom(None))),
+        control("ZoomOut", "−", Some(zoom(Some(scale / 1.25)))),
+        text(format!("{:.0}%", scale * 100.)).size(12),
+        control("ZoomIn", "+", Some(zoom(Some(scale * 1.25)))),
+        control("ActualSize", "100%", Some(zoom(Some(1.)))),
+    ].spacing(4).align_y(iced::Center).into()
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Scope {
+    pub document: Id,
+    pub owner: Id,
+    pub revision: u64,
+    pub epoch: u64,
+}
+impl Scope {
+    pub(crate) fn current(app: &App) -> Option<Self> {
+        if let Some(context) = app.scenario_context() {
+            Some(Self {
+                document: context.document,
+                owner: context.scenario,
+                revision: context.revision,
+                epoch: app.camera_epoch,
+            })
+        } else {
+            let context = app.topology_context()?;
+            Some(Self {
+                document: context.document,
+                owner: context.owner,
+                revision: context.revision,
+                epoch: app.camera_epoch,
+            })
+        }
+    }
+    pub(crate) fn input_owner(app: &App) -> Option<Self> {
+        if keyboard_enabled(app)
+            && !app.behavior.has_pending()
+            && !app.draft_dirty()
+            && !app.source_dirty()
+        {
+            Self::current(app)
+        } else {
+            None
+        }
+    }
+
+    pub fn control_id(self, name: &str) -> iced::advanced::widget::Id {
+        iced::advanced::widget::Id::from(format!(
+            "behavior-control:{}:{}:{}:{name}",
+            self.document, self.owner, self.revision
+        ))
+    }
+}
+/// Only a live presentation intent may carry a toolbar action across its own pan.
+#[derive(Debug, Clone)]
+pub struct Intent {
+    pub scope: Scope,
+    pub name: &'static str,
+    pub message: Box<Message>,
+}
+pub fn intent(scope: Scope, name: &'static str, message: Message) -> Message {
+    Message::BehaviorControl(Intent {
+        scope,
+        name,
+        message: Box::new(message),
+    })
+}
+
+#[derive(Debug, Clone, Copy)]
+pub enum Event {
+    CancelGesture,
+    Pan(Vector),
+    Zoom { factor: f32, at: Point, base: f32 },
+    Focus,
+    Traverse(bool),
+    ControlFocus(&'static str),
+    ToggleFocus,
+    Leave,
+}
+
+pub use focus::{focus_task, root as focus_root};
+/// Fold relative input in event order. The base scale is used only on leaving Fit.
+pub fn change(pan: &mut Vector, zoom: &mut Option<f32>, fit: &mut bool, event: Event) -> bool {
+    match event {
+        Event::Pan(delta) if delta.x.is_finite() && delta.y.is_finite() => {
+            let next = *pan + delta;
+            if next.x.is_finite() && next.y.is_finite() && next != *pan {
+                *pan = next;
+                true
+            } else {
+                false
+            }
+        }
+        Event::Zoom { factor, at, base }
+            if factor.is_finite()
+                && factor > 0.
+                && base.is_finite()
+                && base > 0.
+                && at.x.is_finite()
+                && at.y.is_finite() =>
+        {
+            let old = if *fit { base } else { zoom.unwrap_or(base) };
+            let next = (old * factor).clamp(0.05, 3.);
+            if old == next {
+                return false;
+            }
+            let anchor = Vector::new(at.x, at.y);
+            let next_pan = anchor - (anchor - *pan) * (next / old);
+            if !next_pan.x.is_finite() || !next_pan.y.is_finite() {
+                return false;
+            }
+            *pan = next_pan;
+            *zoom = Some(next);
+            *fit = false;
+            true
+        }
+        _ => false,
+    }
+}
+
+/// Constant-width labelled palette. Arming a tool never reallocates the canvas.
+pub fn palette<'a>(
+    scope: Scope,
+    keyboard: bool,
+    publish: impl Fn(Event) -> Message + Copy + 'a,
+    entries: impl IntoIterator<Item = (&'static str, &'static str, bool, Option<Message>)>,
+) -> Element<'a, Message> {
+    let mut tools = column![].spacing(3);
+    for (glyph, label, selected, message) in entries {
+        let message = message.map(|message| intent(scope, glyph, message));
+        tools = tools.push(tooltip(
+            container(Control::new(
+                button(text(glyph).size(12))
+                    .width(34)
+                    .height(30)
+                    .padding(3)
+                    .style(if selected {
+                        button::primary
+                    } else {
+                        crate::style::nav
+                    })
+                    .on_press_maybe(message.clone()),
+                scope,
+                glyph,
+                keyboard,
+                message,
+                publish,
+            ))
+            .id(format!("behavior-tool:{glyph}")),
+            container(text(label).size(12))
+                .padding(7)
+                .style(crate::style::card),
+            tooltip::Position::Left,
+        ));
+    }
+    container(scrollable(tools).id(scope.control_id("palette-scroll")))
+        .width(40)
+        .height(Fill)
+        .padding(3)
+        .style(crate::style::panel)
+        .into()
+}
+
+/// Header and palette are permanent. Details/editors overlay the same viewport.
+pub fn host<'a, Message: 'a, R: iced::advanced::text::Renderer + 'a>(
+    header: Element<'a, Message, Theme, R>,
+    palette: Element<'a, Message, Theme, R>,
+    canvas: Element<'a, Message, Theme, R>,
+    editor: Option<Element<'a, Message, Theme, R>>,
+) -> Element<'a, Message, Theme, R> {
+    let mut body = stack![canvas];
+    if let Some(editor) = editor {
+        body = body.push(
+            container(opaque(
+                container(editor)
+                    .width(300)
+                    .height(Fill)
+                    .style(crate::style::card),
+            ))
+            .align_right(Fill)
+            .height(Fill)
+            .padding(8),
+        );
+    }
+    column![header, row![body, palette].height(Fill)]
+        .spacing(6)
+        .padding(8)
+        .width(Fill)
+        .height(Fill)
+        .into()
+}
+
+#[cfg(test)]
+pub(crate) mod tests;
@@ -0,0 +1,256 @@
+//! A real focusable keyboard target around the existing styled pointer button.
+use super::{Event as CameraEvent, Scope, focus::Member};
+use iced::advanced::{
+    Clipboard, Layout, Shell, Widget, layout, overlay, renderer,
+    widget::{Operation, Tree, operation, tree},
+};
+use iced::{Border, Element, Event, Length, Rectangle, Size, Theme, Vector, keyboard, mouse};
+
+#[derive(Default)]
+struct Input {
+    identity: Option<iced::advanced::widget::Id>,
+    focused: bool,
+}
+impl operation::Focusable for Input {
+    fn is_focused(&self) -> bool {
+        self.focused
+    }
+    fn focus(&mut self) {
+        self.focused = true;
+    }
+    fn unfocus(&mut self) {
+        self.focused = false;
+    }
+}
+pub struct Control<'a, Message, R = iced::Renderer>
+where
+    R: renderer::Renderer,
+{
+    content: Element<'a, Message, Theme, R>,
+    scope: Scope,
+    name: &'static str,
+    enabled: bool,
+    activate: Option<Message>,
+    publish: Box<dyn Fn(CameraEvent) -> Message + 'a>,
+}
+impl<'a, Message, R: renderer::Renderer> Control<'a, Message, R> {
+    pub fn new(
+        content: impl Into<Element<'a, Message, Theme, R>>,
+        scope: Scope,
+        name: &'static str,
+        enabled: bool,
+        activate: Option<Message>,
+        publish: impl Fn(CameraEvent) -> Message + 'a,
+    ) -> Self {
+        Self {
+            content: content.into(),
+            scope,
+            name,
+            enabled: enabled && activate.is_some(),
+            activate,
+            publish: Box::new(publish),
+        }
+    }
+}
+impl<Message: Clone, R: renderer::Renderer> Widget<Message, Theme, R> for Control<'_, Message, R> {
+    fn tag(&self) -> tree::Tag {
+        tree::Tag::of::<Input>()
+    }
+    fn state(&self) -> tree::State {
+        tree::State::new(Input {
+            identity: Some(self.scope.control_id(self.name)),
+            focused: false,
+        })
+    }
+    fn children(&self) -> Vec<Tree> {
+        vec![Tree::new(self.content.as_widget())]
+    }
+    fn diff(&self, tree: &mut Tree) {
+        let state = tree.state.downcast_mut::<Input>();
+        let identity = self.scope.control_id(self.name);
+        if state.identity.as_ref() != Some(&identity) || !self.enabled {
+            *state = Input {
+                identity: Some(identity),
+                focused: false,
+            };
+        }
+        tree.diff_children(std::slice::from_ref(&self.content));
+    }
+    fn size(&self) -> Size<Length> {
+        self.content.as_widget().size()
+    }
+    fn layout(&mut self, tree: &mut Tree, renderer: &R, limits: &layout::Limits) -> layout::Node {
+        self.content
+            .as_widget_mut()
+            .layout(&mut tree.children[0], renderer, limits)
+    }
+    fn operate(
+        &mut self,
+        tree: &mut Tree,
+        layout: Layout<'_>,
+        renderer: &R,
+        operation: &mut dyn Operation,
+    ) {
+        let id = self.scope.control_id(self.name);
+        operation.container(Some(&id), layout.bounds());
+        if self.enabled {
+            operation.custom(Some(&id), layout.bounds(), &mut Member(self.scope));
+            operation.focusable(
+                Some(&id),
+                layout.bounds(),
+                tree.state.downcast_mut::<Input>(),
+            );
+        }
+        operation.traverse(&mut |operation| {
+            self.content.as_widget_mut().operate(
+                &mut tree.children[0],
+                layout,
+                renderer,
+                operation,
+            );
+        });
+    }
+    fn update(
+        &mut self,
+        tree: &mut Tree,
+        event: &Event,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        renderer: &R,
+        clipboard: &mut dyn Clipboard,
+        shell: &mut Shell<'_, Message>,
+        viewport: &Rectangle,
+    ) {
+        if shell.is_event_captured() {
+            return;
+        }
+        let state = tree.state.downcast_mut::<Input>();
+        if self.enabled {
+            if let Event::Keyboard(keyboard::Event::KeyPressed {
+                key,
+                modifiers,
+                repeat,
+                ..
+            }) = event
+                && state.focused
+            {
+                use keyboard::{Key, key::Named};
+                let action = match key.as_ref() {
+                    Key::Named(Named::Tab) => {
+                        Some((self.publish)(CameraEvent::Traverse(modifiers.shift())))
+                    }
+                    Key::Named(Named::Escape) => Some((self.publish)(CameraEvent::Leave)),
+                    Key::Named(Named::F6) if modifiers.is_empty() && !repeat => {
+                        Some((self.publish)(CameraEvent::ToggleFocus))
+                    }
+                    Key::Named(Named::Enter | Named::Space) if modifiers.is_empty() && !repeat => {
+                        self.activate.clone()
+                    }
+                    _ => None,
+                };
+                if let Some(action) = action {
+                    shell.publish(action);
+                    shell.capture_event();
+                    shell.request_redraw();
+                    return;
+                }
+            }
+            if matches!(
+                event,
+                Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left))
+            ) && !layout
+                .bounds()
+                .intersection(viewport)
+                .is_some_and(|bounds| cursor.is_over(bounds))
+            {
+                state.focused = false;
+            }
+        }
+        if matches!(event, Event::Window(iced::window::Event::Unfocused)) {
+            state.focused = false;
+        }
+        self.content.as_widget_mut().update(
+            &mut tree.children[0],
+            event,
+            layout,
+            cursor,
+            renderer,
+            clipboard,
+            shell,
+            viewport,
+        );
+    }
+    fn draw(
+        &self,
+        tree: &Tree,
+        renderer: &mut R,
+        theme: &Theme,
+        style: &renderer::Style,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        viewport: &Rectangle,
+    ) {
+        self.content.as_widget().draw(
+            &tree.children[0],
+            renderer,
+            theme,
+            style,
+            layout,
+            cursor,
+            viewport,
+        );
+        if self.enabled && tree.state.downcast_ref::<Input>().focused {
+            renderer.fill_quad(
+                renderer::Quad {
+                    bounds: layout.bounds(),
+                    border: Border {
+                        color: crate::style::INK,
+                        width: 2.,
+                        ..Default::default()
+                    },
+                    ..Default::default()
+                },
+                iced::Color::TRANSPARENT,
+            );
+        }
+    }
+    fn mouse_interaction(
+        &self,
+        tree: &Tree,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        viewport: &Rectangle,
+        renderer: &R,
+    ) -> mouse::Interaction {
+        self.content.as_widget().mouse_interaction(
+            &tree.children[0],
+            layout,
+            cursor,
+            viewport,
+            renderer,
+        )
+    }
+    fn overlay<'a>(
+        &'a mut self,
+        tree: &'a mut Tree,
+        layout: Layout<'a>,
+        renderer: &R,
+        viewport: &Rectangle,
+        translation: Vector,
+    ) -> Option<overlay::Element<'a, Message, Theme, R>> {
+        self.content.as_widget_mut().overlay(
+            &mut tree.children[0],
+            layout,
+            renderer,
+            viewport,
+            translation,
+        )
+    }
+}
+impl<'a, Message: Clone + 'a, R: renderer::Renderer + 'a> From<Control<'a, Message, R>>
+    for Element<'a, Message, Theme, R>
+{
+    fn from(control: Control<'a, Message, R>) -> Self {
+        Element::new(control)
+    }
+}
@@ -0,0 +1,293 @@
+//! Explicit canvas entry; ordinary initial Tab continues to belong to Inspector.
+use super::{Event, Scope};
+use iced::advanced::widget::{Id, Operation, Tree, operation};
+use iced::advanced::{Clipboard, Layout, Shell, Widget, layout, overlay, renderer};
+use iced::{Element, Event as InputEvent, Length, Rectangle, Size, Theme, Vector, mouse};
+
+pub(super) struct Member(pub Scope);
+
+pub fn focus_task<Message: Send + 'static>(scope: Scope, event: Event) -> iced::Task<Message> {
+    iced::advanced::widget::operate(Collect {
+        scope,
+        valid: false,
+        event,
+        members: vec![],
+        focused: None,
+        palette: None,
+    })
+}
+struct Collect {
+    scope: Scope,
+    valid: bool,
+    event: Event,
+    members: Vec<(Id, Rectangle)>,
+    focused: Option<usize>,
+    palette: Option<(Rectangle, Rectangle)>,
+}
+impl<T: Send + 'static> Operation<T> for Collect {
+    fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn Operation<T>)) {
+        visit(self);
+    }
+    fn custom(&mut self, id: Option<&Id>, bounds: Rectangle, value: &mut dyn std::any::Any) {
+        if let Some(owner) = value.downcast_ref::<Owner>() {
+            self.valid = owner.0 == Some(self.scope);
+        }
+        if self.valid
+            && value
+                .downcast_ref::<Member>()
+                .is_some_and(|m| m.0 == self.scope)
+            && let Some(id) = id
+        {
+            self.members.push((id.clone(), bounds));
+        }
+    }
+    fn focusable(&mut self, id: Option<&Id>, _: Rectangle, value: &mut dyn operation::Focusable) {
+        if value.is_focused() {
+            self.focused = self
+                .members
+                .iter()
+                .position(|(member, _)| Some(member) == id)
+                .or(self.focused);
+        }
+    }
+    fn scrollable(
+        &mut self,
+        id: Option<&Id>,
+        bounds: Rectangle,
+        content: Rectangle,
+        _: Vector,
+        _: &mut dyn operation::Scrollable,
+    ) {
+        if id == Some(&self.scope.control_id("palette-scroll")) {
+            self.palette = Some((bounds, content));
+        }
+    }
+    fn finish(&self) -> operation::Outcome<T> {
+        let canvas = self.scope.control_id("viewport");
+        // An enabled viewport witnesses the live lifetime. Hidden/dirty/modal
+        // owners expose no members; a delayed request cannot clear their focus.
+        if !self.valid || !self.members.iter().any(|(id, _)| *id == canvas) {
+            return operation::Outcome::None;
+        }
+        let target = match self.event {
+            Event::Focus => Some(canvas),
+            Event::ControlFocus(name) => Some(self.scope.control_id(name)),
+            Event::ToggleFocus if self.focused.is_none() => Some(canvas),
+            Event::ToggleFocus | Event::Leave if self.focused.is_some() => None,
+            Event::Traverse(back) => {
+                let Some(current) = self.focused else {
+                    return operation::Outcome::None;
+                };
+                let next = if back {
+                    (current + self.members.len() - 1) % self.members.len()
+                } else {
+                    (current + 1) % self.members.len()
+                };
+                Some(self.members[next].0.clone())
+            }
+            _ => return operation::Outcome::None,
+        };
+        if target
+            .as_ref()
+            .is_some_and(|target| !self.members.iter().any(|(id, _)| id == target))
+        {
+            return operation::Outcome::None;
+        }
+        let reveal = target.as_ref().and_then(|target| {
+            let (_, field) = self.members.iter().find(|(id, _)| id == target)?;
+            let (bounds, content) = self.palette?;
+            // Only the palette has member controls inside this scrollable.
+            (field.x >= bounds.x && field.x < bounds.x + bounds.width).then(|| {
+                (field.center_y() - bounds.y - bounds.height / 2.)
+                    .clamp(0., (content.height - bounds.height).max(0.))
+            })
+        });
+        operation::Outcome::Chain(Box::new(Apply {
+            scope: self.scope,
+            valid: false,
+            target,
+            members: self.members.iter().map(|(id, _)| id.clone()).collect(),
+            palette: self.scope.control_id("palette-scroll"),
+            reveal,
+        }))
+    }
+}
+struct Apply {
+    scope: Scope,
+    valid: bool,
+    target: Option<Id>,
+    members: Vec<Id>,
+    palette: Id,
+    reveal: Option<f32>,
+}
+impl<T> Operation<T> for Apply {
+    fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn Operation<T>)) {
+        visit(self);
+    }
+    fn custom(&mut self, _: Option<&Id>, _: Rectangle, value: &mut dyn std::any::Any) {
+        if let Some(owner) = value.downcast_ref::<Owner>() {
+            self.valid = owner.0 == Some(self.scope);
+        }
+    }
+    fn focusable(&mut self, id: Option<&Id>, _: Rectangle, state: &mut dyn operation::Focusable) {
+        if !self.valid {
+            return;
+        }
+        if self
+            .target
+            .as_ref()
+            .is_some_and(|target| Some(target) == id)
+        {
+            state.focus();
+        } else if self.target.is_some() || id.is_some_and(|id| self.members.contains(id)) {
+            state.unfocus();
+        }
+    }
+    fn scrollable(
+        &mut self,
+        id: Option<&Id>,
+        _: Rectangle,
+        _: Rectangle,
+        _: Vector,
+        state: &mut dyn operation::Scrollable,
+    ) {
+        if self.valid
+            && id == Some(&self.palette)
+            && let Some(y) = self.reveal
+        {
+            state.scroll_to(operation::scrollable::AbsoluteOffset {
+                x: None,
+                y: Some(y),
+            });
+        }
+    }
+}
+
+// Every Collect/Apply pass observes current ownership before touching any field.
+struct Owner(Option<Scope>);
+
+struct Root<'a, Message, R: renderer::Renderer> {
+    owner: Option<Scope>,
+    content: Element<'a, Message, Theme, R>,
+}
+
+pub fn root<'a, Message: 'a, R: renderer::Renderer + 'a>(
+    content: impl Into<Element<'a, Message, Theme, R>>,
+    owner: Option<Scope>,
+) -> Element<'a, Message, Theme, R> {
+    Element::new(Root {
+        owner,
+        content: content.into(),
+    })
+}
+
+impl<Message, R: renderer::Renderer> Widget<Message, Theme, R> for Root<'_, Message, R> {
+    fn children(&self) -> Vec<Tree> {
+        vec![Tree::new(self.content.as_widget())]
+    }
+
+    fn diff(&self, tree: &mut Tree) {
+        tree.diff_children(std::slice::from_ref(&self.content));
+    }
+
+    fn size(&self) -> Size<Length> {
+        self.content.as_widget().size()
+    }
+
+    fn layout(&mut self, tree: &mut Tree, renderer: &R, limits: &layout::Limits) -> layout::Node {
+        self.content
+            .as_widget_mut()
+            .layout(&mut tree.children[0], renderer, limits)
+    }
+
+    fn operate(
+        &mut self,
+        tree: &mut Tree,
+        layout: Layout<'_>,
+        renderer: &R,
+        operation: &mut dyn Operation,
+    ) {
+        operation.custom(None, layout.bounds(), &mut Owner(self.owner));
+        self.content
+            .as_widget_mut()
+            .operate(&mut tree.children[0], layout, renderer, operation);
+    }
+
+    fn update(
+        &mut self,
+        tree: &mut Tree,
+        event: &InputEvent,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        renderer: &R,
+        clipboard: &mut dyn Clipboard,
+        shell: &mut Shell<'_, Message>,
+        viewport: &Rectangle,
+    ) {
+        self.content.as_widget_mut().update(
+            &mut tree.children[0],
+            event,
+            layout,
+            cursor,
+            renderer,
+            clipboard,
+            shell,
+            viewport,
+        );
+    }
+
+    fn draw(
+        &self,
+        tree: &Tree,
+        renderer: &mut R,
+        theme: &Theme,
+        style: &renderer::Style,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        viewport: &Rectangle,
+    ) {
+        self.content.as_widget().draw(
+            &tree.children[0],
+            renderer,
+            theme,
+            style,
+            layout,
+            cursor,
+            viewport,
+        );
+    }
+
+    fn mouse_interaction(
+        &self,
+        tree: &Tree,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        viewport: &Rectangle,
+        renderer: &R,
+    ) -> mouse::Interaction {
+        self.content.as_widget().mouse_interaction(
+            &tree.children[0],
+            layout,
+            cursor,
+            viewport,
+            renderer,
+        )
+    }
+
+    fn overlay<'b>(
+        &'b mut self,
+        tree: &'b mut Tree,
+        layout: Layout<'b>,
+        renderer: &R,
+        viewport: &Rectangle,
+        translation: Vector,
+    ) -> Option<overlay::Element<'b, Message, Theme, R>> {
+        self.content.as_widget_mut().overlay(
+            &mut tree.children[0],
+            layout,
+            renderer,
+            viewport,
+            translation,
+        )
+    }
+}
@@ -0,0 +1,757 @@
+use super::*;
+use crate::app::{App, Message};
+use iced::advanced::{Layout, Shell, layout, widget};
+use iced::futures::{
+    StreamExt,
+    stream::{BoxStream, SelectAll},
+};
+use iced::{Rectangle, Size, mouse};
+use iced_runtime::{
+    Action,
+    user_interface::{Cache, UserInterface},
+};
+use std::collections::HashMap;
+
+type Pending = SelectAll<BoxStream<'static, Action<Message>>>;
+
+// iced_winit drains messages while collecting immediately ready actions. A
+// pending Task stream survives until its widget operation sends its result.
+fn enqueue(task: iced::Task<Message>, ready: &mut Vec<Action<Message>>, pending: &mut Pending) {
+    if let Some(mut stream) = iced_runtime::task::into_stream(task) {
+        let waker = iced::futures::task::noop_waker();
+        let mut context = std::task::Context::from_waker(&waker);
+        loop {
+            match stream.poll_next_unpin(&mut context) {
+                std::task::Poll::Ready(Some(action)) => ready.push(action),
+                std::task::Poll::Ready(None) => break,
+                std::task::Poll::Pending => {
+                    pending.push(stream);
+                    break;
+                }
+            }
+        }
+    }
+}
+
+#[derive(Default)]
+pub(crate) struct Geometry {
+    pub containers: HashMap<widget::Id, Rectangle>,
+    pub focused: Vec<(Option<widget::Id>, Rectangle, bool)>,
+    pub text_inputs: Vec<Rectangle>,
+    pub scrolls: HashMap<widget::Id, (Rectangle, Vector)>,
+}
+impl widget::Operation for Geometry {
+    fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn widget::Operation)) {
+        visit(self);
+    }
+    fn focusable(
+        &mut self,
+        id: Option<&widget::Id>,
+        bounds: Rectangle,
+        state: &mut dyn widget::operation::Focusable,
+    ) {
+        self.focused.push((id.cloned(), bounds, state.is_focused()));
+    }
+    fn text_input(
+        &mut self,
+        _: Option<&widget::Id>,
+        bounds: Rectangle,
+        _: &mut dyn widget::operation::TextInput,
+    ) {
+        self.text_inputs.push(bounds);
+    }
+    fn container(&mut self, id: Option<&widget::Id>, bounds: Rectangle) {
+        if let Some(id) = id {
+            self.containers.insert(id.clone(), bounds);
+        }
+    }
+    fn scrollable(
+        &mut self,
+        id: Option<&widget::Id>,
+        bounds: Rectangle,
+        _: Rectangle,
+        offset: Vector,
+        _: &mut dyn widget::operation::Scrollable,
+    ) {
+        if let Some(id) = id {
+            self.scrolls.insert(id.clone(), (bounds, offset));
+        }
+    }
+}
+impl Geometry {
+    pub fn bounds(&self, id: &str) -> Rectangle {
+        self.containers[&widget::Id::from(id.to_owned())]
+    }
+}
+
+/// Mount the actual App root, production widgets and renderer. Events are
+/// delivered in order with Iced's final-batch cursor, then fed through App::update.
+/// This deliberately does not seed any private canvas gesture state.
+pub(crate) struct Mounted {
+    pub renderer: iced::Renderer,
+    cache: Cache,
+    pub operations: usize,
+}
+impl Mounted {
+    pub async fn unshown() -> Self {
+        use iced::advanced::renderer::Headless;
+        let renderer = <iced::Renderer as Headless>::new(iced::Font::DEFAULT, 16.into(), None)
+            .await
+            .expect("production mounted tests require the supported WGPU headless renderer");
+        Self {
+            renderer,
+            cache: Cache::new(),
+            operations: 0,
+        }
+    }
+    pub async fn new(app: &mut App) -> Self {
+        let mut mounted = Self::unshown().await;
+        mounted.settle(app).await;
+        mounted
+    }
+    pub fn geometry(&mut self, app: &App) -> Geometry {
+        let mut geometry = Geometry::default();
+        self.operate(app, &mut geometry);
+        geometry
+    }
+    /// One operation pass, including every nested overlay, via installed Iced.
+    pub fn operate(&mut self, app: &App, operation: &mut dyn widget::Operation) {
+        let mut ui = UserInterface::build(
+            app.view(),
+            app.window_size,
+            std::mem::take(&mut self.cache),
+            &mut self.renderer,
+        );
+        ui.operate(&self.renderer, operation);
+        self.cache = ui.into_cache();
+    }
+    pub async fn settle(&mut self, app: &mut App) {
+        for _ in 0..3 {
+            self.batch(
+                app,
+                &[iced::Event::Window(iced::window::Event::RedrawRequested(
+                    std::time::Instant::now(),
+                ))],
+                mouse::Cursor::Unavailable,
+            )
+            .await;
+        }
+    }
+    pub async fn batch(
+        &mut self,
+        app: &mut App,
+        events: &[iced::Event],
+        cursor: mouse::Cursor,
+    ) -> Vec<Message> {
+        let messages = self.input(app, events, cursor);
+        let mut ready = vec![];
+        let mut pending = Pending::new();
+        for message in messages.iter().cloned() {
+            enqueue(app.update(message), &mut ready, &mut pending);
+        }
+        self.drain(app, ready, pending).await;
+        messages
+    }
+    pub fn input(
+        &mut self,
+        app: &App,
+        events: &[iced::Event],
+        cursor: mouse::Cursor,
+    ) -> Vec<Message> {
+        let mut messages = vec![];
+        let mut ui = UserInterface::build(
+            app.view(),
+            app.window_size,
+            std::mem::take(&mut self.cache),
+            &mut self.renderer,
+        );
+        let _ = ui.update(
+            events,
+            cursor,
+            &mut self.renderer,
+            &mut iced::advanced::clipboard::Null,
+            &mut messages,
+        );
+        self.cache = ui.into_cache();
+        messages
+    }
+    pub async fn perform(&mut self, app: &mut App, task: iced::Task<Message>) {
+        let mut ready = vec![];
+        let mut pending = Pending::new();
+        enqueue(task, &mut ready, &mut pending);
+        self.drain(app, ready, pending).await;
+    }
+    async fn drain(
+        &mut self,
+        app: &mut App,
+        mut ready: Vec<Action<Message>>,
+        mut pending: Pending,
+    ) {
+        loop {
+            let mut outputs = vec![];
+            if !ready.is_empty() {
+                // Build only after all App messages in this cycle have run.
+                let mut ui = UserInterface::build(
+                    app.view(),
+                    app.window_size,
+                    std::mem::take(&mut self.cache),
+                    &mut self.renderer,
+                );
+                for action in ready.drain(..) {
+                    match action {
+                        Action::Output(message) => outputs.push(message),
+                        Action::Widget(mut operation) => {
+                            self.operations += 1;
+                            loop {
+                                ui.operate(&self.renderer, &mut *operation);
+                                match operation.finish() {
+                                    widget::operation::Outcome::Chain(next) => operation = next,
+                                    widget::operation::Outcome::None
+                                    | widget::operation::Outcome::Some(()) => break,
+                                }
+                            }
+                        }
+                        action => {
+                            panic!("Unexpected native action in mounted App harness: {action:?}")
+                        }
+                    }
+                }
+                self.cache = ui.into_cache();
+            }
+            for message in outputs {
+                enqueue(app.update(message), &mut ready, &mut pending);
+            }
+            if !ready.is_empty() {
+                continue;
+            }
+            let Some(action) = pending.next().await else {
+                break;
+            };
+            ready.push(action);
+            let waker = iced::futures::task::noop_waker();
+            let mut context = std::task::Context::from_waker(&waker);
+            while let std::task::Poll::Ready(Some(action)) = pending.poll_next_unpin(&mut context) {
+                ready.push(action);
+            }
+        }
+    }
+    pub fn pixels(&mut self, app: &App) -> Vec<u8> {
+        use iced::advanced::renderer::Headless;
+        let mut ui = UserInterface::build(
+            app.view(),
+            app.window_size,
+            std::mem::take(&mut self.cache),
+            &mut self.renderer,
+        );
+        // update initializes the nested overlay layout used by draw.
+        let mut messages = vec![];
+        let _ = ui.update(
+            &[],
+            mouse::Cursor::Unavailable,
+            &mut self.renderer,
+            &mut iced::advanced::clipboard::Null,
+            &mut messages,
+        );
+        assert!(
+            messages.is_empty(),
+            "An empty draw preparation must not drop App messages"
+        );
+        ui.draw(
+            &mut self.renderer,
+            &crate::style::theme(),
+            &iced::advanced::renderer::Style {
+                text_color: crate::style::INK,
+            },
+            mouse::Cursor::Unavailable,
+        );
+        self.cache = ui.into_cache();
+        Headless::screenshot(
+            &mut self.renderer,
+            Size::new(app.window_size.width as u32, app.window_size.height as u32),
+            1.,
+            crate::style::BG,
+        )
+    }
+    pub async fn click(&mut self, app: &mut App, point: Point) -> Vec<Message> {
+        self.batch(
+            app,
+            &[
+                iced::Event::Mouse(mouse::Event::CursorMoved { position: point }),
+                iced::Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
+                iced::Event::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left)),
+            ],
+            mouse::Cursor::Available(point),
+        )
+        .await
+    }
+    pub async fn pan(&mut self, app: &mut App, start: Point, end: Point) -> Vec<Message> {
+        self.batch(
+            app,
+            &[
+                iced::Event::Mouse(mouse::Event::CursorMoved { position: start }),
+                iced::Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Middle)),
+                iced::Event::Mouse(mouse::Event::CursorMoved { position: end }),
+                iced::Event::Mouse(mouse::Event::ButtonReleased(mouse::Button::Middle)),
+            ],
+            mouse::Cursor::Available(end),
+        )
+        .await
+    }
+    pub fn scroll(&mut self, app: &App, id: &str, offset: f32) {
+        let mut operation = widget::operation::scrollable::scroll_to::<()>(
+            widget::Id::from(id.to_owned()),
+            widget::operation::scrollable::AbsoluteOffset {
+                x: None,
+                y: Some(offset),
+            },
+        );
+        self.operate(app, &mut operation);
+    }
+}
+
+pub(crate) fn key(named: iced::keyboard::key::Named) -> iced::Event {
+    use iced::keyboard::{self, Key};
+    iced::Event::Keyboard(keyboard::Event::KeyPressed {
+        key: Key::Named(named),
+        modified_key: Key::Named(named),
+        physical_key: keyboard::key::Physical::Unidentified(
+            keyboard::key::NativeCode::Unidentified,
+        ),
+        location: keyboard::Location::Standard,
+        modifiers: keyboard::Modifiers::empty(),
+        text: None,
+        repeat: false,
+    })
+}
+
+#[test]
+fn relative_camera_zoom_keeps_the_cursor_world_point_and_rejects_nonfinite_inputs() {
+    for scale in [0.05, 0.5, 1., 2.] {
+        let mut pan = Vector::new(-130., 75.);
+        let mut zoom = Some(scale);
+        let mut fit = false;
+        let at = Point::new(171., 93.);
+        let world = (at - Point::ORIGIN - pan) / scale;
+        change(
+            &mut pan,
+            &mut zoom,
+            &mut fit,
+            Event::Zoom {
+                factor: 1.25,
+                at,
+                base: scale,
+            },
+        );
+        let after = (at - Point::ORIGIN - pan) / zoom.unwrap();
+        assert!((after.x - world.x).abs() < 0.001 && (after.y - world.y).abs() < 0.001);
+        let before = (pan, zoom, fit);
+        for input in [
+            Event::Pan(Vector::new(f32::INFINITY, 0.)),
+            Event::Zoom {
+                factor: f32::NAN,
+                at,
+                base: scale,
+            },
+            Event::Zoom {
+                factor: 0.,
+                at,
+                base: scale,
+            },
+        ] {
+            assert!(!change(&mut pan, &mut zoom, &mut fit, input));
+            assert_eq!((pan, zoom, fit), before);
+        }
+    }
+}
+
+#[test]
+fn viewport_ordered_batch_uses_each_event_position_and_cancels_before_camera_motion() {
+    use iced::widget::Space;
+    let scope = Scope {
+        document: Id::new_v4(),
+        owner: Id::new_v4(),
+        revision: 2,
+        epoch: 0,
+    };
+    let mut view: Element<'_, Event, Theme, ()> = Viewport::new(
+        Space::new().width(Fill).height(Fill),
+        scope,
+        1.,
+        true,
+        |e| e,
+    )
+    .into();
+    let mut tree = widget::Tree::new(view.as_widget());
+    let node = view
+        .as_widget_mut()
+        .layout(
+            &mut tree,
+            &(),
+            &layout::Limits::new(Size::ZERO, Size::new(400., 300.)),
+        )
+        .move_to(Point::new(30., 80.));
+    let start = Point::new(90., 160.);
+    let middle = Point::new(125., 175.);
+    let end = Point::new(145., 185.);
+    let mut messages = vec![];
+    for event in [
+        mouse::Event::CursorMoved { position: start },
+        mouse::Event::ButtonPressed(mouse::Button::Middle),
+        mouse::Event::CursorMoved { position: middle },
+        mouse::Event::CursorMoved { position: end },
+        mouse::Event::ButtonReleased(mouse::Button::Middle),
+    ] {
+        view.as_widget_mut().update(
+            &mut tree,
+            &iced::Event::Mouse(event),
+            Layout::new(&node),
+            mouse::Cursor::Available(end),
+            &(),
+            &mut iced::advanced::clipboard::Null,
+            &mut Shell::new(&mut messages),
+            &Rectangle::with_size(Size::new(700., 600.)),
+        );
+    }
+    assert!(matches!(messages.first(), Some(Event::CancelGesture)));
+    let total = messages
+        .iter()
+        .fold(Vector::ZERO, |total, event| match event {
+            Event::Pan(delta) => total + *delta,
+            _ => total,
+        });
+    assert_eq!(total, end - start);
+}
+
+pub(crate) fn scope(app: &App) -> Scope {
+    if let Some(context) = app.scenario_context() {
+        Scope {
+            document: context.document,
+            owner: context.scenario,
+            revision: context.revision,
+            epoch: app.camera_epoch,
+        }
+    } else {
+        let context = app.topology_context().expect("mounted behavior owner");
+        Scope {
+            document: context.document,
+            owner: context.owner,
+            revision: context.revision,
+            epoch: app.camera_epoch,
+        }
+    }
+}
+pub(crate) fn focused(mounted: &mut Mounted, app: &App, name: &str) -> bool {
+    let id = scope(app).control_id(name);
+    mounted
+        .geometry(app)
+        .focused
+        .iter()
+        .any(|(member, _, focused)| member.as_ref() == Some(&id) && *focused)
+}
+pub(crate) async fn tab_to(mounted: &mut Mounted, app: &mut App, name: &str) {
+    for _ in 0..32 {
+        if focused(mounted, app, name) {
+            return;
+        }
+        mounted
+            .batch(
+                app,
+                &[key(iced::keyboard::key::Named::Tab)],
+                mouse::Cursor::Unavailable,
+            )
+            .await;
+    }
+    panic!("Keyboard traversal did not reach {name}");
+}
+pub(crate) fn camera_delta(messages: &[Message]) -> Message {
+    messages.iter().find(|m| matches!(m,
+        Message::ScenarioCanvas(crate::behavior::scenario::CanvasEvent::Camera(_, _, Event::Pan(delta)))
+        | Message::TopologyCanvas(crate::behavior::topology::CanvasEvent::Camera(_, _, Event::Pan(delta))) if *delta != Vector::ZERO
+    )).expect("actual nonzero camera delta from a mounted gesture").clone()
+}
+pub(crate) async fn press_middle(mounted: &mut Mounted, app: &mut App, point: Point) {
+    mounted
+        .batch(
+            app,
+            &[
+                iced::Event::Mouse(mouse::Event::CursorMoved { position: point }),
+                iced::Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Middle)),
+            ],
+            mouse::Cursor::Available(point),
+        )
+        .await;
+}
+pub(crate) async fn release_middle(
+    mounted: &mut Mounted,
+    app: &mut App,
+    point: Point,
+) -> Vec<Message> {
+    mounted
+        .batch(
+            app,
+            &[
+                iced::Event::Mouse(mouse::Event::CursorMoved { position: point }),
+                iced::Event::Mouse(mouse::Event::ButtonReleased(mouse::Button::Middle)),
+            ],
+            mouse::Cursor::Available(point),
+        )
+        .await
+}
+pub(crate) fn assert_drawn_focus(before: &[u8], after: &[u8], size: Size, bounds: Rectangle) {
+    let width = size.width as usize;
+    assert_eq!(before.len(), width * size.height as usize * 4);
+    assert_eq!(after.len(), before.len());
+    let mut changed = 0;
+    for y in bounds.y.ceil() as usize..(bounds.y + bounds.height).floor() as usize {
+        for x in bounds.x.ceil() as usize..(bounds.x + bounds.width).floor() as usize {
+            if x as f32 - bounds.x > 2.
+                && bounds.x + bounds.width - x as f32 > 2.
+                && y as f32 - bounds.y > 2.
+                && bounds.y + bounds.height - y as f32 > 2.
+            {
+                continue;
+            }
+            let start = (y * width + x) * 4;
+            if before[start..start + 3] != after[start..start + 3] {
+                changed += 1;
+            }
+        }
+    }
+    assert!(
+        changed >= bounds.width.min(bounds.height) as usize,
+        "Focus must change visible border pixels, changed={changed}, bounds={bounds:?}"
+    );
+}
+
+pub(crate) fn character(value: &str) -> iced::Event {
+    let mut event = key(iced::keyboard::key::Named::Space);
+    if let iced::Event::Keyboard(iced::keyboard::Event::KeyPressed {
+        key,
+        modified_key,
+        text,
+        ..
+    }) = &mut event
+    {
+        *key = iced::keyboard::Key::Character(value.into());
+        *modified_key = key.clone();
+        *text = Some(value.into());
+    }
+    event
+}
+
+/// Inspect the action without stripping the lifetime from retained packets.
+pub(crate) fn intent_action(message: &Message) -> &Message {
+    match message {
+        Message::BehaviorControl(intent) => &intent.message,
+        message => message,
+    }
+}
+
+/// Deliberately retain a returned Chain to test the stronger ownership invariant.
+/// Native Iced runs Chain passes synchronously; this is not a native interleaving.
+pub(crate) async fn retained_focus_apply(
+    mounted: &mut Mounted,
+    app: &mut App,
+) -> Box<dyn widget::Operation> {
+    let entry = mounted.input(
+        app,
+        &[key(iced::keyboard::key::Named::F6)],
+        mouse::Cursor::Unavailable,
+    );
+    assert_eq!(
+        entry.len(),
+        1,
+        "actual initial F6 must emit one canvas focus request"
+    );
+    let mut stream = iced_runtime::task::into_stream(app.update(entry[0].clone()))
+        .expect("F6 returns a widget Task");
+    let Some(Action::Widget(mut operation)) = stream.next().await else {
+        panic!("F6 first action must be Collect");
+    };
+    mounted.operate(app, &mut *operation);
+    match operation.finish() {
+        widget::operation::Outcome::Chain(apply) => apply,
+        _ => panic!("Live Collect must produce its guarded Apply pass"),
+    }
+}
+
+pub(crate) async fn overflow_last_tool(mounted: &mut Mounted, app: &mut App, last: &'static str) {
+    use iced::keyboard::key::Named;
+    let geometry = mounted.geometry(app);
+    let last_bounds = geometry.containers[&scope(app).control_id(last)];
+    let (rail, offset) = geometry.scrolls[&scope(app).control_id("palette-scroll")];
+    assert_eq!(offset.y, 0.);
+    assert!(
+        last_bounds.y >= rail.y + rail.height,
+        "last tool starts fully below the overflowing palette: tool={last_bounds:?}, rail={rail:?}"
+    );
+    mounted
+        .batch(app, &[key(Named::F6)], mouse::Cursor::Unavailable)
+        .await;
+    tab_to(mounted, app, last).await;
+    let geometry = mounted.geometry(app);
+    let mut visible = geometry.containers[&scope(app).control_id(last)];
+    let (rail, offset) = geometry.scrolls[&scope(app).control_id("palette-scroll")];
+    assert!(offset.y > 0., "keyboard traversal must scroll the palette");
+    visible.x -= offset.x;
+    visible.y -= offset.y;
+    assert!(
+        visible.y >= rail.y && visible.y + visible.height <= rail.y + rail.height + 0.5,
+        "the entire last tool is revealed: tool={visible:?}, rail={rail:?}"
+    );
+    let messages = mounted
+        .batch(app, &[key(Named::Enter)], mouse::Cursor::Unavailable)
+        .await;
+    assert!(
+        messages.iter().any(
+            |message| matches!(message, Message::BehaviorControl(intent) if intent.name == last)
+        ),
+        "the revealed last tool is keyboard activated"
+    );
+    assert!(focused(mounted, app, last));
+    let on = mounted.pixels(app);
+    mounted
+        .batch(app, &[key(Named::Escape)], mouse::Cursor::Unavailable)
+        .await;
+    let off = mounted.pixels(app);
+    assert_drawn_focus(&off, &on, app.window_size, visible);
+}
+
+pub(crate) async fn retained_toolbar_boundaries(
+    mounted: &mut Mounted,
+    app: &mut App,
+    tool: &'static str,
+) {
+    use iced::keyboard::key::Named;
+    for boundary in ["Chooser", "Dirty", "Picker"] {
+        let mut packets = vec![];
+        for name in ["Fit", tool, "Details", "Panels", "Canvas"] {
+            packets.push(capture_toolbar(mounted, app, name));
+        }
+        let lifetime = app.camera_epoch;
+        let epoch = app.canvas_epoch;
+        let process = app.behavior.topology.camera_boundary();
+        let scenario = app.behavior.scenario.camera_boundary();
+        match boundary {
+            "Chooser" => {
+                let draft = app.draft.as_ref().unwrap();
+                let id = crate::forms::reference_chooser::trigger::field_id(
+                    draft.reference_generation(),
+                    "/parent",
+                );
+                let bounds = mounted
+                    .geometry(app)
+                    .focused
+                    .iter()
+                    .find(|(field, _, _)| field.as_ref() == Some(&id))
+                    .expect("real Inspector parent reference trigger")
+                    .1;
+                let request = draft.reference_open(app.project(), "/parent", bounds);
+                let task = app.update(Message::FieldReferenceOpen(request));
+                mounted.perform(app, task).await;
+                assert!(app.reference_input_active());
+                mounted
+                    .batch(app, &[key(Named::Escape)], mouse::Cursor::Unavailable)
+                    .await;
+                assert!(!app.reference_input_active());
+            }
+            "Dirty" => {
+                let task = app.update(Message::Field(
+                    "/name".into(),
+                    "Unsaved camera boundary".into(),
+                ));
+                mounted.perform(app, task).await;
+                assert!(app.draft_dirty());
+                // Every retained packet is also rejected while the owner is dirty.
+                for packet in packets.iter().cloned() {
+                    let task = app.update(packet);
+                    mounted.perform(app, task).await;
+                }
+                assert!(app.draft_dirty());
+                let task = app.update(Message::RevertProperties);
+                mounted.perform(app, task).await;
+                assert!(!app.draft_dirty());
+            }
+            "Picker" => {
+                // Public transitions, with cancellation injected at the external
+                // picker boundary. Never poll the native dialog future here.
+                let picker = app.update(Message::Save(true));
+                if cfg!(target_os = "linux") {
+                    assert!(app.file_prompt.is_some());
+                    mounted.perform(app, picker).await;
+                    let task = app.update(Message::CancelFile);
+                    mounted.perform(app, task).await;
+                } else {
+                    assert!(app.busy, "Save As enters the real native-picker busy state");
+                    drop(picker);
+                    for packet in packets.iter().cloned() {
+                        let task = app.update(packet);
+                        mounted.perform(app, task).await;
+                    }
+                    let task = app.update(Message::SavePath(None));
+                    mounted.perform(app, task).await;
+                    assert!(!app.busy);
+                }
+            }
+            _ => unreachable!(),
+        }
+        assert_ne!(
+            app.camera_epoch, lifetime,
+            "{boundary} changes the presentation lifetime"
+        );
+        assert_eq!(
+            app.canvas_epoch, epoch,
+            "{boundary} cycle leaves semantic context unchanged"
+        );
+        let focus_before = mounted
+            .geometry(app)
+            .focused
+            .into_iter()
+            .filter(|(_, _, value)| *value)
+            .collect::<Vec<_>>();
+        let current_lifetime = app.camera_epoch;
+        for packet in packets {
+            let task = app.update(packet);
+            mounted.perform(app, task).await;
+        }
+        assert_eq!(
+            app.camera_epoch, current_lifetime,
+            "{boundary} retained intents cannot start a new lifetime"
+        );
+        assert!(
+            app.behavior.topology.camera_boundary() == process,
+            "{boundary} retained toolbar packet changed process presentation"
+        );
+        assert!(
+            app.behavior.scenario.camera_boundary() == scenario,
+            "{boundary} retained toolbar packet changed scenario presentation"
+        );
+        assert_eq!(
+            mounted
+                .geometry(app)
+                .focused
+                .into_iter()
+                .filter(|(_, _, value)| *value)
+                .collect::<Vec<_>>(),
+            focus_before,
+            "{boundary} retained toolbar packet stole field focus"
+        );
+    }
+}
+
+pub(crate) fn capture_toolbar(mounted: &mut Mounted, app: &App, name: &'static str) -> Message {
+    let point = mounted.geometry(app).containers[&scope(app).control_id(name)].center();
+    mounted
+        .input(
+            app,
+            &[
+                iced::Event::Mouse(mouse::Event::CursorMoved { position: point }),
+                iced::Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
+                iced::Event::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left)),
+            ],
+            mouse::Cursor::Available(point),
+        )
+        .into_iter()
+        .find(|message| matches!(message, Message::BehaviorControl(intent) if intent.name == name))
+        .expect("actual production toolbar packet")
+}
@@ -0,0 +1,426 @@
+use super::{Event as CameraEvent, Scope};
+use iced::advanced::{
+    Clipboard, Layout, Shell, Widget, layout, overlay, renderer,
+    widget::{Operation, Tree, operation, tree},
+};
+use iced::{Border, Element, Event, Length, Point, Rectangle, Size, Theme, Vector};
+use iced::{keyboard, mouse};
+
+#[derive(Default)]
+struct Input {
+    scope: Option<Scope>,
+    focused: bool,
+    pointer: Option<Point>,
+    pan: Option<(mouse::Button, Point)>,
+    space: bool,
+    bounds: Option<Rectangle>,
+}
+impl operation::Focusable for Input {
+    fn is_focused(&self) -> bool {
+        self.focused
+    }
+    fn focus(&mut self) {
+        self.focused = true;
+    }
+    fn unfocus(&mut self) {
+        self.focused = false;
+        self.pan = None;
+        self.space = false;
+    }
+}
+pub struct Viewport<'a, Message, R = iced::Renderer>
+where
+    R: renderer::Renderer,
+{
+    content: Element<'a, Message, Theme, R>,
+    scope: Scope,
+    scale: f32,
+    keyboard: bool,
+    blank_pan: bool,
+    publish: Box<dyn Fn(CameraEvent) -> Message + 'a>,
+}
+impl<'a, Message, R: renderer::Renderer> Viewport<'a, Message, R> {
+    pub fn new(
+        content: impl Into<Element<'a, Message, Theme, R>>,
+        scope: Scope,
+        scale: f32,
+        keyboard: bool,
+        publish: impl Fn(CameraEvent) -> Message + 'a,
+    ) -> Self {
+        Self {
+            content: content.into(),
+            scope,
+            scale,
+            keyboard,
+            blank_pan: false,
+            publish: Box::new(publish),
+        }
+    }
+    pub fn pan_background(mut self, enabled: bool) -> Self {
+        self.blank_pan = enabled;
+        self
+    }
+}
+impl<Message, R: renderer::Renderer> Widget<Message, Theme, R> for Viewport<'_, Message, R> {
+    fn tag(&self) -> tree::Tag {
+        tree::Tag::of::<Input>()
+    }
+    fn state(&self) -> tree::State {
+        tree::State::new(Input {
+            scope: Some(self.scope),
+            ..Default::default()
+        })
+    }
+    fn children(&self) -> Vec<Tree> {
+        vec![Tree::new(self.content.as_widget())]
+    }
+    fn diff(&self, tree: &mut Tree) {
+        let state = tree.state.downcast_mut::<Input>();
+        if state.scope.is_none_or(|s| {
+            (s.document, s.owner, s.revision)
+                != (self.scope.document, self.scope.owner, self.scope.revision)
+        }) {
+            *state = Input::default();
+        }
+        if state
+            .scope
+            .is_some_and(|scope| scope.epoch != self.scope.epoch)
+            || !self.keyboard
+        {
+            state.pan = None;
+            state.space = false;
+        }
+        if !self.keyboard {
+            state.focused = false;
+        }
+        state.scope = Some(self.scope);
+        tree.diff_children(std::slice::from_ref(&self.content));
+    }
+    fn size(&self) -> Size<Length> {
+        Size::new(Length::Fill, Length::Fill)
+    }
+    fn layout(&mut self, tree: &mut Tree, renderer: &R, limits: &layout::Limits) -> layout::Node {
+        self.content
+            .as_widget_mut()
+            .layout(&mut tree.children[0], renderer, limits)
+    }
+    fn operate(
+        &mut self,
+        tree: &mut Tree,
+        layout: Layout<'_>,
+        renderer: &R,
+        operation: &mut dyn Operation,
+    ) {
+        if self.keyboard {
+            let id = self.scope.control_id("viewport");
+            operation.custom(
+                Some(&id),
+                layout.bounds(),
+                &mut super::focus::Member(self.scope),
+            );
+            operation.focusable(
+                Some(&id),
+                layout.bounds(),
+                tree.state.downcast_mut::<Input>(),
+            );
+        }
+        self.content
+            .as_widget_mut()
+            .operate(&mut tree.children[0], layout, renderer, operation);
+    }
+    fn update(
+        &mut self,
+        tree: &mut Tree,
+        event: &Event,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        renderer: &R,
+        clipboard: &mut dyn Clipboard,
+        shell: &mut Shell<'_, Message>,
+        viewport: &Rectangle,
+    ) {
+        if shell.is_event_captured() {
+            return;
+        }
+        let state = tree.state.downcast_mut::<Input>();
+        let changed_bounds = state.bounds.is_some_and(|bounds| bounds != layout.bounds());
+        state.bounds = Some(layout.bounds());
+        if changed_bounds || !self.keyboard {
+            state.pan = None;
+            state.space = false;
+        }
+        if !self.keyboard {
+            state.focused = false;
+        }
+        if let Event::Mouse(mouse::Event::CursorMoved { position }) = event {
+            state.pointer = Some(*position);
+        }
+        let pointer = match event {
+            Event::Mouse(
+                mouse::Event::ButtonPressed(_)
+                | mouse::Event::ButtonReleased(_)
+                | mouse::Event::WheelScrolled { .. },
+            ) => state.pointer.or_else(|| cursor.position()),
+            Event::Mouse(mouse::Event::CursorMoved { position }) => Some(*position),
+            _ => cursor.position().or(state.pointer),
+        };
+        let visible = layout.bounds().intersection(viewport);
+        let inside = pointer.is_some_and(|p| visible.is_some_and(|v| v.contains(p)))
+            && cursor.position().is_some();
+        if !self.keyboard {
+            state.space = false;
+        }
+        let mut cancel = changed_bounds;
+        let mut camera = None;
+        let mut capture = false;
+        match event {
+            Event::Window(iced::window::Event::Unfocused | iced::window::Event::Resized(_)) => {
+                state.pan = None;
+                state.space = false;
+                state.focused = false;
+            }
+            Event::Mouse(mouse::Event::CursorLeft) => {
+                state.pan = None;
+                state.pointer = None;
+            }
+            Event::Mouse(mouse::Event::ButtonPressed(button)) => {
+                if state.pan.is_some_and(|(held, _)| held != *button) || !inside {
+                    state.pan = None;
+                    state.space = false;
+                    cancel = true;
+                }
+                state.focused = inside && self.keyboard;
+                if inside
+                    && self.keyboard
+                    && (*button == mouse::Button::Middle
+                        || (*button == mouse::Button::Left && state.space))
+                {
+                    state.pan = pointer.map(|p| (*button, p));
+                    cancel = true;
+                    camera = Some(CameraEvent::CancelGesture);
+                    capture = true;
+                }
+            }
+            Event::Mouse(mouse::Event::CursorMoved { position }) => {
+                if let Some((button, previous)) = state.pan {
+                    state.pan = Some((button, *position));
+                    camera = Some(CameraEvent::Pan(*position - previous));
+                    capture = true;
+                }
+            }
+            Event::Mouse(mouse::Event::ButtonReleased(button)) => {
+                if let Some((held, previous)) = state.pan
+                    && held == *button
+                {
+                    state.pan = None;
+                    camera = pointer
+                        .filter(|_| inside)
+                        .map(|p| CameraEvent::Pan(p - previous));
+                    capture = true;
+                }
+            }
+            Event::Mouse(mouse::Event::WheelScrolled { delta }) if inside && state.focused => {
+                state.pan = None;
+                cancel = true;
+                let y = match delta {
+                    mouse::ScrollDelta::Lines { y, .. } => *y,
+                    mouse::ScrollDelta::Pixels { y, .. } => *y / 40.,
+                };
+                if y != 0. {
+                    let at = pointer.unwrap() - Vector::new(layout.bounds().x, layout.bounds().y);
+                    camera = Some(CameraEvent::Zoom {
+                        factor: 1.1_f32.powf(y.clamp(-8., 8.)),
+                        at,
+                        base: self.scale,
+                    });
+                    capture = true;
+                }
+            }
+            Event::Keyboard(keyboard::Event::KeyPressed {
+                key: keyboard::Key::Named(keyboard::key::Named::F6),
+                modifiers,
+                repeat: false,
+                ..
+            }) if self.keyboard && modifiers.is_empty() => {
+                camera = Some(CameraEvent::ToggleFocus);
+                capture = true;
+                cancel = true;
+            }
+            Event::Keyboard(keyboard::Event::KeyPressed { key, modifiers, .. })
+                if state.focused && self.keyboard =>
+            {
+                use keyboard::{Key, key::Named};
+                match key.as_ref() {
+                    Key::Named(Named::Space) => {
+                        state.space = true;
+                        cancel = true;
+                        camera = Some(CameraEvent::CancelGesture);
+                        capture = true;
+                    }
+                    Key::Named(Named::Tab) => {
+                        camera = Some(CameraEvent::Traverse(modifiers.shift()));
+                        capture = true;
+                    }
+                    Key::Named(Named::Escape) => {
+                        state.pan = None;
+                        state.space = false;
+                        camera = Some(CameraEvent::Leave);
+                        capture = true;
+                    }
+                    Key::Named(key) if modifiers.is_empty() => {
+                        let delta = match key {
+                            Named::ArrowLeft => Some(Vector::new(60., 0.)),
+                            Named::ArrowRight => Some(Vector::new(-60., 0.)),
+                            Named::ArrowUp => Some(Vector::new(0., 60.)),
+                            Named::ArrowDown => Some(Vector::new(0., -60.)),
+                            _ => None,
+                        };
+                        camera = delta.map(CameraEvent::Pan);
+                        capture = camera.is_some();
+                        cancel = capture;
+                    }
+                    _ => {}
+                }
+            }
+            Event::Keyboard(keyboard::Event::KeyReleased { key, .. })
+                if *key == keyboard::Key::Named(keyboard::key::Named::Space) =>
+            {
+                state.space = false;
+            }
+            _ => {}
+        }
+        if cancel {
+            self.content.as_widget_mut().update(
+                &mut tree.children[0],
+                &Event::Window(iced::window::Event::Unfocused),
+                layout,
+                cursor,
+                renderer,
+                clipboard,
+                shell,
+                viewport,
+            );
+        }
+        if let Some(event) = camera {
+            shell.publish((self.publish)(event));
+        }
+        if capture {
+            shell.capture_event();
+            shell.request_redraw();
+            return;
+        }
+        if matches!(event, Event::Keyboard(_)) && (!state.focused || !self.keyboard) {
+            return;
+        }
+        let child_cursor = if inside {
+            pointer.map_or(mouse::Cursor::Unavailable, mouse::Cursor::Available)
+        } else {
+            mouse::Cursor::Unavailable
+        };
+        self.content.as_widget_mut().update(
+            &mut tree.children[0],
+            event,
+            layout,
+            child_cursor,
+            renderer,
+            clipboard,
+            shell,
+            viewport,
+        );
+        // A semantic hit or armed creation tool gets first refusal. In Select,
+        // an otherwise unused blank press starts the same camera gesture.
+        if self.blank_pan
+            && self.keyboard
+            && inside
+            && !shell.is_event_captured()
+            && matches!(
+                event,
+                Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left))
+            )
+        {
+            state.pan = pointer.map(|p| (mouse::Button::Left, p));
+            shell.publish((self.publish)(CameraEvent::CancelGesture));
+            shell.capture_event();
+            shell.request_redraw();
+        }
+    }
+    fn draw(
+        &self,
+        tree: &Tree,
+        renderer: &mut R,
+        theme: &Theme,
+        style: &renderer::Style,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        viewport: &Rectangle,
+    ) {
+        renderer.with_layer(layout.bounds(), |renderer| {
+            self.content.as_widget().draw(
+                &tree.children[0],
+                renderer,
+                theme,
+                style,
+                layout,
+                cursor,
+                viewport,
+            );
+        });
+        if tree.state.downcast_ref::<Input>().focused && self.keyboard {
+            renderer.fill_quad(
+                renderer::Quad {
+                    bounds: layout.bounds(),
+                    border: Border {
+                        color: crate::style::TEAL,
+                        width: 1.,
+                        ..Default::default()
+                    },
+                    ..Default::default()
+                },
+                iced::Color::TRANSPARENT,
+            );
+        }
+    }
+    fn mouse_interaction(
+        &self,
+        tree: &Tree,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        viewport: &Rectangle,
+        renderer: &R,
+    ) -> mouse::Interaction {
+        if tree.state.downcast_ref::<Input>().pan.is_some() {
+            mouse::Interaction::Grabbing
+        } else {
+            self.content.as_widget().mouse_interaction(
+                &tree.children[0],
+                layout,
+                cursor,
+                viewport,
+                renderer,
+            )
+        }
+    }
+    fn overlay<'a>(
+        &'a mut self,
+        tree: &'a mut Tree,
+        layout: Layout<'a>,
+        renderer: &R,
+        viewport: &Rectangle,
+        translation: Vector,
+    ) -> Option<overlay::Element<'a, Message, Theme, R>> {
+        self.content.as_widget_mut().overlay(
+            &mut tree.children[0],
+            layout,
+            renderer,
+            viewport,
+            translation,
+        )
+    }
+}
+impl<'a, Message: 'a, R: renderer::Renderer + 'a> From<Viewport<'a, Message, R>>
+    for Element<'a, Message, Theme, R>
+{
+    fn from(viewport: Viewport<'a, Message, R>) -> Self {
+        Element::new(viewport)
+    }
+}
@@ -0,0 +1,766 @@
+//! Local behavior creation. A draft is not a model object: only its validated
+//! batch may cross Document::execute, and acknowledgement follows success.
+use iced::{
+    Element as UiElement, Fill,
+    widget::{button, checkbox, column, container, row, scrollable, text, text_input},
+};
+use oa_core::*;
+use serde::{Deserialize, Serialize};
+
+const PAGE_SIZE: usize = 6;
+pub const NAME_INPUT: &str = "behavior-creation-name";
+
+// A focused text input consumes Escape. Preserve the application's modal
+// priority by emitting its ordinary Escape message from this narrow bridge.
+pub fn subscription(active: bool) -> iced::Subscription<()> {
+    if active {
+        iced::event::listen_with(captured_escape)
+    } else {
+        iced::Subscription::none()
+    }
+}
+
+fn captured_escape(
+    event: iced::Event,
+    status: iced::event::Status,
+    _: iced::window::Id,
+) -> Option<()> {
+    (status == iced::event::Status::Captured
+        && matches!(
+            event,
+            iced::Event::Keyboard(iced::keyboard::Event::KeyPressed {
+                key: iced::keyboard::Key::Named(iced::keyboard::key::Named::Escape),
+                ..
+            })
+        ))
+    .then_some(())
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub enum Family {
+    Sequence,
+    Scenario,
+    Machine,
+}
+impl Family {
+    fn kind(self, layer: Layer) -> Kind {
+        match (self, layer) {
+            (Self::Sequence, Layer::Oa) => Kind::Process,
+            (Self::Sequence, Layer::Sa) => Kind::FunctionalChain,
+            (Self::Scenario, _) => Kind::Scenario,
+            (Self::Machine, _) => Kind::StateMachine,
+        }
+    }
+    fn title(self, layer: Layer) -> &'static str {
+        match (self, layer) {
+            (Self::Sequence, Layer::Oa) => "Operational process",
+            (Self::Sequence, Layer::Sa) => "Functional chain",
+            (Self::Scenario, _) => "Scenario",
+            (Self::Machine, _) => "State machine",
+        }
+    }
+}
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Picker {
+    Owner,
+    Context,
+}
+impl Picker {
+    fn index(self) -> usize {
+        match self {
+            Self::Owner => 0,
+            Self::Context => 1,
+        }
+    }
+}
+#[derive(Debug, Clone)]
+pub enum Event {
+    Source(super::source_draft::Event),
+    Open(Layer),
+    Choose(Family),
+    Name(String),
+    Owner(Id),
+    Viewpoint(ScenarioViewpoint),
+    Context(Option<Id>),
+    ContextOptions(bool),
+    FirstView(bool),
+    Search(Picker, String),
+    Page(Picker, usize),
+    Cancel,
+    Submit,
+}
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Browser {
+    query: String,
+    page: usize,
+}
+#[derive(Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Draft {
+    #[serde(default)]
+    source: super::source_draft::State,
+    #[serde(default = "Id::new_v4")]
+    invocation: Id,
+
+    version: u32,
+    document: Id,
+    layer: Layer,
+    family: Option<Family>,
+    name: String,
+    owner: Option<Id>,
+    viewpoint: Option<ScenarioViewpoint>,
+    context: Option<Id>,
+    #[serde(default)]
+    context_open: bool,
+    first_view: bool,
+    element: Id,
+    diagram: Id,
+    placement: Id,
+    browsers: [Browser; 2],
+}
+#[derive(Default)]
+pub struct State {
+    draft: Option<Draft>,
+}
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Created {
+    pub behavior: Id,
+    pub layer: Layer,
+    pub diagram: Option<Id>,
+}
+
+impl State {
+    pub fn source_active(&self) -> bool {
+        self.draft.as_ref().is_some_and(|d| d.source.engaged())
+    }
+
+    pub fn source_open(&self) -> bool {
+        self.draft.as_ref().is_some_and(|d| d.source.is_open())
+    }
+    pub fn source_back(&mut self) -> bool {
+        self.draft.as_mut().is_some_and(|d| d.source.back())
+    }
+
+    pub fn has_pending(&self) -> bool {
+        self.draft.is_some()
+    }
+    pub fn pending_layer(&self) -> Option<Layer> {
+        self.draft.as_ref().map(|d| d.layer)
+    }
+    /// Capture this before successful acknowledgement; never select these IDs
+    /// on mere planning or a rejected source/model transaction.
+    pub fn created(&self) -> Option<Created> {
+        let d = self.draft.as_ref()?;
+        d.family.map(|family| Created {
+            behavior: d.element,
+            layer: d.layer,
+            diagram: (family == Family::Machine && d.first_view).then_some(d.diagram),
+        })
+    }
+    /// Match before execution, then apply this target only after success.
+    /// Identity alone is insufficient: changed bodies or trailing operations
+    /// must not inherit the prepared creation's selection/opening contract.
+    pub fn created_by(&self, p: &Project, command: &Command) -> Option<Created> {
+        let target = self.created()?;
+        (self.prepare_pending(p).ok().as_ref() == Some(command)).then_some(target)
+    }
+    pub fn recovery_snapshot(&self) -> Result<Option<serde_json::Value>, String> {
+        self.draft
+            .as_ref()
+            .map(serde_json::to_value)
+            .transpose()
+            .map_err(|e| e.to_string())
+    }
+    pub fn from_recovery(value: serde_json::Value) -> Result<Self, String> {
+        let draft: Draft = serde_json::from_value(value).map_err(|e| e.to_string())?;
+        if draft.version != 1 {
+            return Err("Unsupported behavior creation draft version.".into());
+        }
+        // Raw values and stale references remain editable; planning validates
+        // against the current document rather than silently fixing the draft.
+        Ok(Self { draft: Some(draft) })
+    }
+    pub fn acknowledge_commit(&mut self) {
+        self.draft = None;
+    }
+    pub fn prepare_pending(&self, p: &Project) -> Result<Command, String> {
+        self.draft
+            .as_ref()
+            .ok_or("Choose New to start a behavior.")?
+            .command(p)
+    }
+    pub fn update(&mut self, p: &Project, event: Event) -> Result<Option<Command>, String> {
+        if let Event::Source(event) = event {
+            if self
+                .draft
+                .as_mut()
+                .ok_or("Start the consumer form first.")?
+                .source
+                .dismiss(&event)?
+            {
+                return Ok(None);
+            }
+            let d = self
+                .draft
+                .as_ref()
+                .ok_or("Start the consumer form first.")?;
+            if d.family != Some(Family::Machine) {
+                return Err("This reference does not support staged source creation.".into());
+            }
+            if d.document != p.id {
+                return Err("This behavior draft belongs to another document.".into());
+            }
+            let mut next = d.clone();
+            if let Some(id) = next.source.update(
+                p,
+                super::source_draft::Scope::Machine { layer: d.layer },
+                d.invocation,
+                event,
+            )? {
+                next.owner = Some(id);
+                let preview = next
+                    .source
+                    .preview(p, next.owner)?
+                    .ok_or("New owner preview is missing.")?;
+                if !eligible(&preview, next.layer, Picker::Owner, id) {
+                    return Err("This participant cannot own the machine.".into());
+                }
+            }
+            self.draft = Some(next);
+            return Ok(None);
+        }
+        if self.source_open() && !matches!(&event, Event::Cancel) {
+            return Err("Use the new source or go Back before editing the parent form.".into());
+        }
+
+        match event {
+            Event::Cancel => {
+                self.draft = None;
+                return Ok(None);
+            }
+            Event::Open(layer) => {
+                if self.has_pending() {
+                    return Err("Create or cancel the pending behavior first.".into());
+                }
+                self.draft = Some(Draft {
+                    source: Default::default(),
+                    invocation: Id::new_v4(),
+                    version: 1,
+                    document: p.id,
+                    layer,
+                    family: None,
+                    name: String::new(),
+                    owner: None,
+                    viewpoint: None,
+                    context: None,
+                    context_open: false,
+                    first_view: false,
+                    element: Id::new_v4(),
+                    diagram: Id::new_v4(),
+                    placement: Id::new_v4(),
+                    browsers: Default::default(),
+                });
+                return Ok(None);
+            }
+            Event::Submit => return self.prepare_pending(p).map(Some),
+            _ => {}
+        }
+        let d = self
+            .draft
+            .as_mut()
+            .ok_or("Choose New to start a behavior.")?;
+        if d.document != p.id {
+            return Err("This draft belongs to another document. Cancel it to start here.".into());
+        }
+        match event {
+            Event::Choose(family) => {
+                if d.family.is_some_and(|old| old != family) {
+                    return Err(
+                        "Cancel this draft before choosing a different behavior family.".into(),
+                    );
+                }
+                d.family = Some(family);
+            }
+            Event::Name(name) => d.name = name,
+            Event::Owner(id) if d.family == Some(Family::Machine) => {
+                if !eligible(p, d.layer, Picker::Owner, id) {
+                    return Err("Choose an existing participant in this layer.".into());
+                }
+                d.owner = Some(id);
+            }
+            Event::Viewpoint(viewpoint) if d.family == Some(Family::Scenario) => {
+                if !viewpoints(d.layer).contains(&viewpoint) {
+                    return Err("Choose a scenario viewpoint from this layer.".into());
+                }
+                d.viewpoint = Some(viewpoint);
+            }
+            Event::Context(id) if d.family == Some(Family::Scenario) => {
+                if id.is_some_and(|id| !eligible(p, d.layer, Picker::Context, id)) {
+                    return Err("Choose an existing same-layer scenario context.".into());
+                }
+                d.context = id;
+            }
+            Event::ContextOptions(open) if d.family == Some(Family::Scenario) => {
+                d.context_open = open;
+            }
+            Event::FirstView(value) if d.family == Some(Family::Machine) => d.first_view = value,
+            Event::Search(picker, query) => d.browsers[picker.index()] = Browser { query, page: 0 },
+            Event::Page(picker, page) => d.browsers[picker.index()].page = page,
+            Event::Cancel | Event::Open(_) | Event::Submit => unreachable!(),
+            _ => return Err("That field does not apply to this behavior family.".into()),
+        }
+        Ok(None)
+    }
+}
+
+fn viewpoints(layer: Layer) -> [ScenarioViewpoint; 2] {
+    match layer {
+        Layer::Oa => [
+            ScenarioViewpoint::OperationalActivity,
+            ScenarioViewpoint::ParticipantInteraction,
+        ],
+        Layer::Sa => [
+            ScenarioViewpoint::Functional,
+            ScenarioViewpoint::BoundaryInterface,
+        ],
+    }
+}
+fn viewpoint_title(viewpoint: ScenarioViewpoint) -> &'static str {
+    match viewpoint {
+        ScenarioViewpoint::OperationalActivity => "Activities · operational exchanges",
+        ScenarioViewpoint::ParticipantInteraction => "Participants · interactions",
+        ScenarioViewpoint::Functional => "Functions · functional exchanges",
+        ScenarioViewpoint::BoundaryInterface => "System boundary · interface exchanges",
+        ScenarioViewpoint::MixedLegacy => "Legacy mixed viewpoint",
+    }
+}
+fn eligible(p: &Project, layer: Layer, picker: Picker, id: Id) -> bool {
+    p.elements.get(&id).is_some_and(|e| {
+        e.layer() == layer
+            && match picker {
+                Picker::Owner => validation::parent_permits(e.kind(), Kind::StateMachine),
+                Picker::Context => {
+                    e.kind().is_sequence()
+                        || e.kind().is_work()
+                        || e.kind().is_performer()
+                        || matches!(
+                            e.kind(),
+                            Kind::Capability
+                                | Kind::SystemCapability
+                                | Kind::OperationalMission
+                                | Kind::Mission
+                        )
+                }
+            }
+    })
+}
+fn choices<'a>(p: &'a Project, layer: Layer, picker: Picker, query: &str) -> Vec<&'a Element> {
+    let query = query.trim().to_lowercase();
+    let mut matches: Vec<_> = p
+        .elements
+        .values()
+        .filter(|e| eligible(p, layer, picker, e.id))
+        .filter(|e| query.is_empty() || reference_label(p, e.id).to_lowercase().contains(&query))
+        .collect();
+    matches.sort_by(|a, b| {
+        a.name
+            .to_lowercase()
+            .cmp(&b.name.to_lowercase())
+            .then(a.id.cmp(&b.id))
+    });
+    matches
+}
+
+fn reference_context(p: &Project, e: &Element) -> String {
+    let mut names = Vec::new();
+    let mut parent = e.parent;
+    let mut seen = std::collections::BTreeSet::new();
+    while let Some(id) = parent {
+        if !seen.insert(id) {
+            break;
+        }
+        let Some(ancestor) = p.elements.get(&id) else {
+            break;
+        };
+        names.push(ancestor.name.as_str());
+        parent = ancestor.parent;
+    }
+    names.reverse();
+    let location = if names.is_empty() {
+        format!("{} root", e.layer())
+    } else {
+        format!("{} / {}", e.layer(), names.join(" / "))
+    };
+    format!("{} · {} · {location}", e.kind(), e.alias)
+}
+pub(super) fn reference_label(p: &Project, id: Id) -> String {
+    p.elements
+        .get(&id)
+        .map(|e| format!("{} · {}", e.name, reference_context(p, e)))
+        .unwrap_or_else(|| "Missing element — choose a replacement".into())
+}
+impl Draft {
+    fn command(&self, p: &Project) -> Result<Command, String> {
+        self.source.check_scope(
+            super::source_draft::Scope::Machine { layer: self.layer },
+            self.owner,
+        )?;
+        let preview = self.source.preview(p, self.owner)?;
+        let command = self.consumer_command(preview.as_ref().unwrap_or(p))?;
+        self.source.combine(p, self.owner, command)
+    }
+    fn consumer_command(&self, p: &Project) -> Result<Command, String> {
+        if self.document != p.id {
+            return Err("This draft belongs to another document.".into());
+        }
+        let family = self
+            .family
+            .ok_or("Choose the behavior you want to create.")?;
+        if self.name.trim().is_empty() {
+            return Err("Enter the behavior's name before creating it.".into());
+        }
+        if [self.element, self.diagram, self.placement]
+            .into_iter()
+            .any(|id| p.contains(id))
+            || self.element == self.diagram
+            || self.element == self.placement
+            || self.diagram == self.placement
+        {
+            return Err(
+                "A reserved creation identity is already in use. Cancel and start a fresh draft."
+                    .into(),
+            );
+        }
+        let kind = family.kind(self.layer);
+        let parent = if family == Family::Machine {
+            Some(
+                self.owner
+                    .filter(|id| eligible(p, self.layer, Picker::Owner, *id))
+                    .ok_or("Choose the participant that owns this state machine.")?,
+            )
+        } else {
+            if self.owner.is_some() {
+                return Err("Processes and scenarios belong at the layer root; context is a separate reference.".into());
+            }
+            None
+        };
+        if family != Family::Machine && self.first_view {
+            return Err("A state view can only accompany a state machine.".into());
+        }
+        let mut body = ElementBody::new(kind, self.layer)
+            .ok_or("This behavior is unavailable in this layer.")?;
+        if family == Family::Scenario {
+            let viewpoint = self
+                .viewpoint
+                .filter(|v| viewpoints(self.layer).contains(v))
+                .ok_or("Choose the scenario's viewpoint explicitly.")?;
+            if self
+                .context
+                .is_some_and(|id| !eligible(p, self.layer, Picker::Context, id))
+            {
+                return Err(
+                    "The selected scenario context is missing or no longer compatible.".into(),
+                );
+            }
+            body = ElementBody::shared_in(
+                self.layer,
+                SharedBody::Scenario {
+                    viewpoint,
+                    context: self.context,
+                    precondition: String::new(),
+                    postcondition: String::new(),
+                    steps: Vec::new(),
+                },
+            );
+        } else if self.viewpoint.is_some() || self.context.is_some() {
+            return Err(
+                "Scenario viewpoint and context cannot be applied to another behavior family."
+                    .into(),
+            );
+        }
+        let element = Element {
+            id: self.element,
+            alias: p.fresh_alias(&self.name, "behavior", self.element),
+            name: self.name.clone(),
+            description: String::new(),
+            parent,
+            body,
+        };
+        let mut commands = vec![Command::CreateElement(element)];
+        if self.first_view {
+            let working = execute_batch(p, &commands).map_err(|e| e.to_string())?;
+            // Reuse the state editor's geometry contract. A new machine has one
+            // root placement; reserve both presentation IDs across retries.
+            let plan = super::state_edit::create_view(&working, self.element)
+                .map_err(|e| e.to_string())?;
+            let Command::Batch(mut view_commands) = plan.command else {
+                return Err("Unexpected state-view plan.".into());
+            };
+            if view_commands.len() != 2 {
+                return Err("Unexpected additional operation in the first state-view plan.".into());
+            }
+            let Some(Command::Layout(layout)) = view_commands.pop() else {
+                return Err("State-view plan must finish with its layout operation.".into());
+            };
+            let Some(Command::CreateDiagram(mut diagram)) = view_commands.pop() else {
+                return Err("State-view plan is missing its diagram.".into());
+            };
+            if diagram.id != layout || diagram.nodes.len() != 1 {
+                return Err("A first state view must contain only its new machine.".into());
+            }
+            let mut node = diagram
+                .nodes
+                .into_values()
+                .next()
+                .ok_or("State-view root is missing.")?;
+            if node.element != self.element {
+                return Err("State-view root differs from the new machine.".into());
+            }
+            diagram.id = self.diagram;
+            diagram.alias = working.fresh_alias(&diagram.name, "state_view", self.diagram);
+            node.id = self.placement;
+            node.alias = working.fresh_alias(
+                &format!("{} placement", self.name),
+                "placement",
+                self.placement,
+            );
+            diagram.nodes = [(node.id, node)].into_iter().collect();
+            commands.push(Command::CreateDiagram(diagram));
+            commands.push(Command::Layout(self.diagram));
+        }
+        let command = Command::Batch(commands);
+        execute_batch(p, std::slice::from_ref(&command)).map_err(|e| e.to_string())?;
+        Ok(command)
+    }
+}
+
+impl State {
+    /// Parent maps these local events into the existing guarded Behavior route.
+    /// The card's fields scroll; Create/Cancel stay outside that scroll region.
+    pub fn view<'a>(&'a self, p: &'a Project) -> Option<UiElement<'a, Event>> {
+        self.view_with(p)
+    }
+    fn view_with<'a, R: iced::advanced::text::Renderer + 'a>(
+        &'a self,
+        p: &'a Project,
+    ) -> Option<UiElement<'a, Event, iced::Theme, R>> {
+        let d = self.draft.as_ref()?;
+        if let Some(view) = d.source.view(p) {
+            return Some(
+                column![
+                    text(format!(
+                        "State machine name: {}",
+                        crate::views::short(&d.name, 60)
+                    ))
+                    .size(12),
+                    view.map(Event::Source)
+                ]
+                .spacing(6)
+                .height(Fill)
+                .into(),
+            );
+        }
+        let mut fields = column![].spacing(10);
+        let title = if let Some(family) = d.family {
+            fields = fields.push(
+                text_input("Exact behavior name", &d.name)
+                    .id(NAME_INPUT)
+                    .on_input(Event::Name)
+                    .on_submit(Event::Submit)
+                    .padding(8),
+            );
+            match family {
+                Family::Sequence => {
+                    fields = fields.push(
+                        text(format!(
+                            "Owned by the {} layer root. Add work and exchange contributions after creation.",
+                            d.layer
+                        ))
+                        .size(12),
+                    );
+                }
+                Family::Scenario => {
+                    fields = fields.push(
+                        text(format!(
+                            "Owned by the {} layer root. Choose what the lifelines represent:",
+                            d.layer
+                        ))
+                        .size(12),
+                    );
+                    for viewpoint in viewpoints(d.layer) {
+                        fields = fields.push(
+                            button(text(viewpoint_title(viewpoint)).size(13))
+                                .style(if d.viewpoint == Some(viewpoint) {
+                                    button::primary
+                                } else {
+                                    button::secondary
+                                })
+                                .on_press(Event::Viewpoint(viewpoint))
+                                .padding(7),
+                        );
+                    }
+                    let context_label = if d.context_open {
+                        "Hide optional context".into()
+                    } else if let Some(id) = d.context {
+                        format!("Context: {} · Change…", reference_label(p, id))
+                    } else {
+                        "Add optional context…".into()
+                    };
+                    fields = fields.push(
+                        button(text(context_label).size(12))
+                            .on_press(Event::ContextOptions(!d.context_open))
+                            .padding(6),
+                    );
+                    if d.context_open {
+                        fields = fields.push(picker_view(p, d, Picker::Context));
+                    }
+                }
+                Family::Machine => {
+                    if let Some(label) = d.source.label(d.owner) {
+                        fields = fields.push(text(label).size(13)).push(text("Create and open commits the new owner and machine together, including the first view only when selected.").size(12));
+                    }
+                    fields = fields.push(picker_view(p, d, Picker::Owner));
+                    fields = fields.push(
+                        button("Create new owner…")
+                            .on_press(Event::Source(super::source_draft::Event::Open(
+                                d.invocation,
+                            )))
+                            .padding(7),
+                    );
+                    fields = fields.push(
+                        checkbox(d.first_view)
+                            .label("Create the first state view")
+                            .on_toggle(Event::FirstView),
+                    );
+                    fields = fields.push(text("The machine starts without regions or states. Add those explicitly in its workspace.").size(12));
+                }
+            }
+            format!("New {}", family.title(d.layer))
+        } else {
+            for family in [Family::Sequence, Family::Scenario, Family::Machine] {
+                let purpose = match family {
+                    Family::Sequence => "A path through work and exchanges",
+                    Family::Scenario => "Ordered interactions from an explicit viewpoint",
+                    Family::Machine => "States and modes of an explicitly chosen participant",
+                };
+                fields = fields.push(
+                    button(
+                        column![text(family.title(d.layer)).size(15), text(purpose).size(12)]
+                            .spacing(3),
+                    )
+                    .on_press(Event::Choose(family))
+                    .padding(10)
+                    .width(Fill),
+                );
+            }
+            format!("New behavior · {}", d.layer)
+        };
+        let mut actions =
+            row![button("Cancel · Esc").on_press(Event::Cancel).padding(8)].spacing(8);
+        if d.family.is_some() {
+            actions = actions.push(button("Create and open").on_press(Event::Submit).padding(8));
+        }
+        Some(
+            container(
+                column![
+                    text(title).size(20),
+                    scrollable(fields)
+                        .id("behavior-creation-fields")
+                        .height(Fill),
+                    container(actions).id("behavior-creation-actions")
+                ]
+                .spacing(12),
+            )
+            .padding(18)
+            .max_width(680)
+            .height(Fill)
+            .style(crate::style::card)
+            .into(),
+        )
+    }
+}
+fn picker_view<'a, R: iced::advanced::text::Renderer + 'a>(
+    p: &'a Project,
+    d: &'a Draft,
+    picker: Picker,
+) -> UiElement<'a, Event, iced::Theme, R> {
+    let browser = &d.browsers[picker.index()];
+    let options = choices(p, d.layer, picker, &browser.query);
+    let page = browser
+        .page
+        .min(options.len().saturating_sub(1) / PAGE_SIZE);
+    let selected = match picker {
+        Picker::Owner => d.owner,
+        Picker::Context => d.context,
+    };
+    let staged_owner = picker == Picker::Owner && d.source.label(selected).is_some();
+    let title = match picker {
+        Picker::Owner if staged_owner => "Or choose an existing participant",
+        Picker::Owner => "Owned by participant",
+        Picker::Context => "Scenario context · optional",
+    };
+    let mut out = column![
+        text(title).size(13),
+        text_input("Search names, aliases or parent context", &browser.query)
+            .on_input(move |query| Event::Search(picker, query))
+            .padding(6)
+    ]
+    .spacing(5);
+    if let Some(id) = selected
+        && !staged_owner
+    {
+        out = out.push(text(format!("Selected: {}", reference_label(p, id))).size(12));
+    } else if picker == Picker::Context {
+        out = out.push(text("No context selected").size(12));
+    }
+    if options.is_empty() {
+        out = out.push(text(match picker {
+            Picker::Owner if staged_owner => "No existing participants match this search. The new owner above remains selected.",
+            Picker::Owner => "No matching participant. Refine the search or choose Create new owner.",
+            Picker::Context => "No matching context. Refine the search, or leave this optional reference empty.",
+        }).size(12));
+    }
+    for e in options.iter().skip(page * PAGE_SIZE).take(PAGE_SIZE) {
+        let message = match picker {
+            Picker::Owner => Event::Owner(e.id),
+            Picker::Context => Event::Context(Some(e.id)),
+        };
+        out = out.push(
+            container(
+                button(
+                    column![
+                        text(&e.name).size(13),
+                        text(reference_context(p, e)).size(11)
+                    ]
+                    .spacing(2),
+                )
+                .style(if selected == Some(e.id) {
+                    button::primary
+                } else {
+                    button::secondary
+                })
+                .on_press(message)
+                .padding(6)
+                .width(Fill),
+            )
+            .id(format!("behavior-creation-candidate-{}", e.id)),
+        );
+    }
+    let mut navigation = row![text(format!("{} matches", options.len())).size(11)].spacing(8);
+    if page > 0 {
+        navigation = navigation.push(button("Previous").on_press(Event::Page(picker, page - 1)));
+    }
+    if (page + 1) * PAGE_SIZE < options.len() {
+        navigation = navigation.push(button("Next").on_press(Event::Page(picker, page + 1)));
+    }
+    if picker == Picker::Context && selected.is_some() {
+        navigation = navigation.push(button("Clear context").on_press(Event::Context(None)));
+    }
+    out.push(navigation).into()
+}
+
+#[cfg(test)]
+mod app_tests;
+#[cfg(test)]
+mod tests;
@@ -0,0 +1,340 @@
+//! App-boundary regressions for the coordinated parent wiring. No I/O task is
+//! polled: file dialogs, checkpoint writes and lesson loading remain inactive.
+use super::*;
+use crate::app::{App, Message, Page, Pending};
+use std::sync::Arc;
+
+fn send(app: &mut App, event: Event) {
+    let _ = app.update(Message::Behavior(crate::behavior::Event::Creation(event)));
+}
+fn raw_property(app: &App) -> serde_json::Value {
+    serde_json::to_value(app.draft.as_ref().unwrap().recovery_snapshot()).unwrap()
+}
+fn begin(app: &mut App, layer: Layer, family: Family, name: &str) {
+    let _ = app.update(Message::Layer(layer));
+    let _ = app.update(Message::Page(Page::Behavior));
+    send(app, Event::Open(layer));
+    send(app, Event::Choose(family));
+    send(app, Event::Name(name.into()));
+}
+
+fn focused_escape() -> Message {
+    use iced::advanced::{Layout, Shell, layout, widget};
+    use iced::keyboard::{self, key::Named};
+    let mut input: iced::Element<'_, (), iced::Theme, ()> = text_input("Name", "Unfinished name")
+        .id(NAME_INPUT)
+        .on_input(|_| ())
+        .into();
+    let mut tree = widget::Tree::new(input.as_widget());
+    let size = iced::Size::new(300., 40.);
+    let node =
+        input
+            .as_widget_mut()
+            .layout(&mut tree, &(), &layout::Limits::new(iced::Size::ZERO, size));
+    tree.state
+        .downcast_mut::<iced::widget::text_input::State<()>>()
+        .focus();
+    let event = iced::Event::Keyboard(keyboard::Event::KeyPressed {
+        key: keyboard::Key::Named(Named::Escape),
+        modified_key: keyboard::Key::Named(Named::Escape),
+        physical_key: keyboard::key::Physical::Code(keyboard::key::Code::Escape),
+        location: keyboard::Location::Standard,
+        modifiers: keyboard::Modifiers::empty(),
+        text: None,
+        repeat: false,
+    });
+    let mut messages = Vec::new();
+    let mut shell = Shell::new(&mut messages);
+    input.as_widget_mut().update(
+        &mut tree,
+        &event,
+        Layout::new(&node),
+        iced::mouse::Cursor::Unavailable,
+        &(),
+        &mut iced::advanced::clipboard::Null,
+        &mut shell,
+        &iced::Rectangle::new(iced::Point::ORIGIN, size),
+    );
+    assert!(shell.is_event_captured());
+    assert_eq!(
+        captured_escape(
+            event.clone(),
+            iced::event::Status::Ignored,
+            iced::window::Id::unique()
+        ),
+        None
+    );
+    captured_escape(
+        event,
+        iced::event::Status::Captured,
+        iced::window::Id::unique(),
+    )
+    .unwrap();
+    Message::Escape
+}
+
+#[test]
+fn app_first_captured_escape_dismisses_file_or_pending_overlay_before_creation() {
+    for file in [false, true] {
+        let mut app = App::with_project(Project::empty());
+        begin(
+            &mut app,
+            Layer::Oa,
+            Family::Sequence,
+            "Keep while overlay closes",
+        );
+        let raw = app.behavior.recovery_snapshot().unwrap();
+        let accepted = app.document.snapshot();
+        if file {
+            app.file_prompt = Some(crate::app::FilePrompt {
+                operation: crate::app::FileOperation::Save,
+                path: "unsubmitted-name.arcadia".into(),
+                overwrite: false,
+            });
+        } else {
+            app.pending = Some(Pending::Walkthrough);
+        }
+        let _ = app.update(focused_escape());
+        assert!(app.file_prompt.is_none());
+        assert!(app.pending.is_none());
+        assert_eq!(app.behavior.recovery_snapshot().unwrap(), raw);
+        assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+        let _ = app.update(focused_escape());
+        assert!(!app.behavior.has_pending());
+        assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+        assert!(!app.document.can_undo());
+    }
+}
+
+#[test]
+fn app_creation_opens_the_actual_new_owner_instead_of_first_or_previously_active_behavior() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut p = Project::empty();
+        let old = p
+            .add_element(Family::Sequence.kind(layer), layer, "Old behavior", None)
+            .unwrap();
+        let mut app = App::with_project(p.clone());
+        let _ = app.update(Message::Select(old));
+        begin(&mut app, layer, Family::Sequence, "  New exact path 雨  ");
+        let target = app.behavior.creation.created().unwrap();
+        assert_ne!(target.behavior, old);
+        let before = app.document.bundle().clone();
+        send(&mut app, Event::Submit);
+        assert_eq!(app.page, Page::Behavior);
+        assert_eq!(app.layer, layer);
+        assert_eq!(app.selected, target.behavior);
+        assert_eq!(app.behavior.active_owner, Some(target.behavior));
+        assert_eq!(crate::behavior::selected_owner(&app), Some(target.behavior));
+        assert_eq!(
+            app.project().elements[&target.behavior].name,
+            "  New exact path 雨  "
+        );
+        assert!(!app.behavior.has_pending());
+        let after = app.document.bundle().clone();
+        let _ = app.update(Message::Undo);
+        assert_eq!(app.document.bundle(), &before);
+        assert!(!app.document.can_undo());
+        let _ = app.update(Message::Redo);
+        assert_eq!(app.document.bundle(), &after);
+        assert_eq!(app.project().elements[&old], p.elements[&old]);
+    }
+}
+
+#[test]
+fn app_machine_behavior_submit_opens_its_opted_in_view_as_one_undoable_transaction() {
+    for first_view in [false, true] {
+        let mut p = Project::empty();
+        let owner = p
+            .add_element(Kind::System, Layer::Sa, "Flight system", None)
+            .unwrap();
+        let mut app = App::with_project(p.clone());
+        begin(&mut app, Layer::Sa, Family::Machine, "  Flight modes 雨  ");
+        send(&mut app, Event::Owner(owner));
+        send(&mut app, Event::FirstView(first_view));
+        let target = app.behavior.creation.created().unwrap();
+        let before = app.document.bundle().clone();
+        let _ = app.update(Message::Behavior(crate::behavior::Event::Submit));
+        assert!(!app.behavior.has_pending(), "{}", app.status);
+        assert_eq!(app.selected, target.behavior);
+        assert_eq!(app.behavior.active_owner, Some(target.behavior));
+        assert_eq!(app.behavior.diagram.diagram, target.diagram);
+        assert_eq!(
+            crate::behavior::state_view::diagram(&app, target.behavior),
+            target.diagram
+        );
+        assert_eq!(app.project().elements[&target.behavior].parent, Some(owner));
+        assert_eq!(app.page, Page::Behavior);
+        let after = app.document.bundle().clone();
+        let _ = app.update(Message::Undo);
+        assert_eq!(app.document.bundle(), &before);
+        assert_eq!(app.project(), &p);
+        assert!(!app.document.can_undo());
+        let _ = app.update(Message::Redo);
+        assert_eq!(app.document.bundle(), &after);
+    }
+}
+
+#[test]
+fn app_stale_layer_open_never_starts_or_replaces_a_draft() {
+    let mut app = App::with_project(Project::empty());
+    let _ = app.update(Message::Layer(Layer::Sa));
+    app.page = Page::Behavior;
+    let accepted = app.document.snapshot();
+    send(&mut app, Event::Open(Layer::Oa));
+    assert!(!app.behavior.has_pending());
+    assert_eq!(app.layer, Layer::Sa);
+    send(&mut app, Event::Open(Layer::Sa));
+    send(&mut app, Event::Choose(Family::Sequence));
+    send(&mut app, Event::Name("Retained system chain".into()));
+    let raw = app.behavior.recovery_snapshot().unwrap();
+    send(&mut app, Event::Open(Layer::Oa));
+    assert_eq!(app.behavior.recovery_snapshot().unwrap(), raw);
+    assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+}
+
+#[test]
+fn app_new_never_auto_applies_valid_or_invalid_property_and_source_drafts() {
+    for dirty in [
+        "property-valid",
+        "property-invalid",
+        "source-valid",
+        "source-invalid",
+    ] {
+        let mut app = App::with_project(Project::empty());
+        app.page = Page::Behavior;
+        match dirty {
+            "property-valid" => app
+                .draft
+                .as_mut()
+                .unwrap()
+                .input("/name", "Raw property name".into()),
+            "property-invalid" => app.draft.as_mut().unwrap().input("/id", "-".into()),
+            "source-valid" => app.source_workspace.edit(
+                format!("{}\n// Retained comment\n", app.source_workspace.text()),
+                app.source_editor.cursor(),
+            ),
+            _ => app
+                .source_workspace
+                .edit("unfinished source 雨".into(), app.source_editor.cursor()),
+        }
+        let accepted = app.document.snapshot();
+        let property = raw_property(&app);
+        let workspace = app.source_workspace.recovery_snapshot();
+        send(&mut app, Event::Open(Layer::Oa));
+        assert!(
+            !app.behavior.creation.has_pending(),
+            "{dirty}: New must refuse without applying another editor"
+        );
+        assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+        assert_eq!(raw_property(&app), property);
+        assert_eq!(
+            serde_json::to_value(app.source_workspace.recovery_snapshot()).unwrap(),
+            serde_json::to_value(workspace).unwrap()
+        );
+        assert!(!app.document.can_undo());
+    }
+}
+
+#[test]
+fn app_choosing_another_behavior_or_layer_cannot_commit_a_creation_draft() {
+    let mut p = Project::empty();
+    let old = p
+        .add_element(Kind::Process, Layer::Oa, "Old process", None)
+        .unwrap();
+    let mut app = App::with_project(p);
+    begin(&mut app, Layer::Oa, Family::Sequence, "Retain this process");
+    let raw = app.behavior.recovery_snapshot().unwrap();
+    let accepted = app.document.snapshot();
+    let _ = app.update(Message::Layer(Layer::Sa));
+    let _ = app.update(Message::BehaviorOwner(crate::app::Choice {
+        id: old,
+        label: "Old process".into(),
+    }));
+    assert_eq!(app.layer, Layer::Oa);
+    assert_eq!(app.behavior.recovery_snapshot().unwrap(), raw);
+    assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+    let _ = app.update(Message::Escape);
+    assert!(!app.behavior.has_pending());
+    assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+    assert!(!app.document.can_undo());
+}
+
+#[test]
+fn app_lesson_request_cancel_retains_creation_then_escape_discards_only_the_draft() {
+    let mut app = App::with_project(Project::empty());
+    begin(
+        &mut app,
+        Layer::Oa,
+        Family::Sequence,
+        "Unfinished engineering path",
+    );
+    let raw = app.behavior.recovery_snapshot().unwrap();
+    let accepted = app.document.snapshot();
+    let task = app.update(Message::Home(crate::home::Event::Walkthrough));
+    assert!(matches!(app.pending, Some(Pending::Walkthrough)));
+    assert!(iced_runtime::task::into_stream(task).is_none());
+    let _ = app.update(Message::Escape);
+    assert!(app.pending.is_none());
+    assert_eq!(app.behavior.recovery_snapshot().unwrap(), raw);
+    assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+    let _ = app.update(Message::Escape);
+    assert!(!app.behavior.has_pending());
+    assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+}
+
+#[test]
+fn app_recovered_rootless_sa_creation_retains_layer_ids_and_other_raw_drafts() {
+    let mut app = App::with_project(Project::empty());
+    begin(
+        &mut app,
+        Layer::Sa,
+        Family::Scenario,
+        "  Recovered system scenario 雨  ",
+    );
+    send(
+        &mut app,
+        Event::Viewpoint(ScenarioViewpoint::BoundaryInterface),
+    );
+    // Recovery can contain simultaneous drafts even though new input is guarded.
+    app.draft
+        .as_mut()
+        .unwrap()
+        .input("/name", "Retained property".into());
+    app.source_workspace.edit(
+        "unfinished source preserved".into(),
+        app.source_editor.cursor(),
+    );
+    let snapshot = crate::recovery::Snapshot::capture(
+        app.canvas_document,
+        &app.document,
+        &app.source_workspace,
+        app.draft.as_ref(),
+        &app.behavior,
+        None,
+        app.selected,
+    )
+    .unwrap();
+    let expected = snapshot.clone().restore().unwrap();
+    let raw = app.behavior.recovery_snapshot().unwrap();
+    let mut restored = App::with_project(Project::empty());
+    let _ = restored.update(Message::CheckpointLoaded(Ok(Arc::new(snapshot))));
+    assert_eq!(restored.page, Page::Behavior);
+    assert_eq!(restored.layer, Layer::Sa);
+    assert_eq!(restored.behavior.recovery_snapshot().unwrap(), raw);
+    assert_eq!(
+        restored.behavior.creation.created(),
+        app.behavior.creation.created()
+    );
+    assert_eq!(restored.project(), expected.document.project());
+    assert_eq!(restored.document.bundle(), expected.document.bundle());
+    assert_eq!(
+        restored.source_workspace.bundle(),
+        expected.workspace.bundle()
+    );
+    assert_eq!(raw_property(&restored), raw_property(&app));
+    let before = restored.document.snapshot();
+    send(&mut restored, Event::Submit);
+    assert!(Arc::ptr_eq(&before, &restored.document.snapshot()));
+    assert_eq!(restored.behavior.recovery_snapshot().unwrap(), raw);
+    assert_eq!(raw_property(&restored), raw_property(&app));
+}
@@ -0,0 +1,599 @@
+use super::*;
+use crate::document::Document;
+use oa_core::source_project::ProjectLimits;
+
+fn start(p: &Project, layer: Layer, family: Family, name: &str) -> State {
+    let mut state = State::default();
+    assert!(state.update(p, Event::Open(layer)).unwrap().is_none());
+    state.update(p, Event::Choose(family)).unwrap();
+    state.update(p, Event::Name(name.into())).unwrap();
+    state
+}
+
+#[test]
+fn mounted_creation_keeps_actions_visible_and_renders_only_six_owner_candidates() {
+    use iced::advanced::{Layout, layout, widget};
+    use iced::{Rectangle, Size, Vector};
+    struct Geometry {
+        candidates: Vec<widget::Id>,
+        rendered: Vec<widget::Id>,
+        actions: Option<Rectangle>,
+        fields: Option<Rectangle>,
+    }
+    impl widget::Operation for Geometry {
+        fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn widget::Operation)) {
+            visit(self);
+        }
+        fn container(&mut self, id: Option<&widget::Id>, bounds: Rectangle) {
+            if id == Some(&widget::Id::new("behavior-creation-actions")) {
+                self.actions = Some(bounds);
+            }
+            if let Some(id) = id.filter(|id| self.candidates.contains(id)) {
+                self.rendered.push(id.clone());
+            }
+        }
+        fn scrollable(
+            &mut self,
+            id: Option<&widget::Id>,
+            bounds: Rectangle,
+            _: Rectangle,
+            _: Vector,
+            _: &mut dyn widget::operation::Scrollable,
+        ) {
+            if id == Some(&widget::Id::new("behavior-creation-fields")) {
+                self.fields = Some(bounds);
+            }
+        }
+    }
+    let mut p = Project::empty();
+    for index in 0..105 {
+        p.add_element(
+            Kind::Entity,
+            Layer::Oa,
+            &format!(
+                "{index:03} Long engineering participant name {}",
+                "雨 extended ".repeat(20)
+            ),
+            None,
+        )
+        .unwrap();
+    }
+    let candidates: Vec<_> = p
+        .elements
+        .keys()
+        .map(|id| widget::Id::from(format!("behavior-creation-candidate-{id}")))
+        .collect();
+    for family in [Family::Sequence, Family::Scenario, Family::Machine] {
+        let state = start(&p, Layer::Oa, family, "Very long exact behavior name 雨");
+        for size in [
+            Size::new(500., 570.),
+            Size::new(1050., 570.),
+            Size::new(500., 320.),
+        ] {
+            let mut view: UiElement<'_, Event, iced::Theme, ()> = state.view_with(&p).unwrap();
+            let mut tree = widget::Tree::new(view.as_widget());
+            let node =
+                view.as_widget_mut()
+                    .layout(&mut tree, &(), &layout::Limits::new(Size::ZERO, size));
+            let mut geometry = Geometry {
+                candidates: candidates.clone(),
+                rendered: Vec::new(),
+                actions: None,
+                fields: None,
+            };
+            view.as_widget_mut()
+                .operate(&mut tree, Layout::new(&node), &(), &mut geometry);
+            let actions = geometry.actions.unwrap();
+            let fields = geometry.fields.unwrap();
+            assert!(actions.x >= 0. && actions.y >= 0.);
+            assert!(
+                actions.x + actions.width <= size.width
+                    && actions.y + actions.height <= size.height
+            );
+            assert!(fields.height >= 100. && fields.y + fields.height <= actions.y);
+            assert_eq!(
+                geometry.rendered.len(),
+                if family == Family::Machine { 6 } else { 0 }
+            );
+        }
+    }
+}
+
+fn roundtrip(p: Project, state: &mut State) -> Project {
+    let command = state.update(&p, Event::Submit).unwrap().unwrap();
+    assert_eq!(
+        command,
+        state.prepare_pending(&p).unwrap(),
+        "preparation must retain reserved IDs"
+    );
+    let api: Command = serde_json::from_value(serde_json::to_value(&command).unwrap()).unwrap();
+    assert_eq!(api, command);
+    let expected = execute_batch(&p, &[api]).unwrap();
+    let target = state.created().unwrap();
+    let mut document = Document::from_project(p.clone(), ProjectLimits::default()).unwrap();
+    let before_source = document.bundle().clone();
+    document.execute(command).unwrap();
+    assert_eq!(document.project(), &expected);
+    assert!(
+        state.has_pending(),
+        "only successful acknowledgement clears raw fields"
+    );
+    state.acknowledge_commit();
+    assert!(!state.has_pending());
+    assert!(document.project().elements.contains_key(&target.behavior));
+    let after_source = document.bundle().clone();
+    assert!(document.undo());
+    assert_eq!(document.project(), &p);
+    assert_eq!(document.bundle(), &before_source);
+    assert!(!document.can_undo(), "one creation must be one Undo entry");
+    assert!(document.redo());
+    assert_eq!(document.project(), &expected);
+    assert_eq!(document.bundle(), &after_source);
+    let reopened = Document::from_bundle(after_source, ProjectLimits::default()).unwrap();
+    assert_eq!(reopened.project(), &expected);
+    expected
+}
+
+#[test]
+fn oa_process_and_sa_chain_keep_exact_names_root_ownership_and_one_history_entry() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let p = Project::empty();
+        let name = "  Supply \"water\" — режим  ";
+        let mut state = start(&p, layer, Family::Sequence, name);
+        let target = state.created().unwrap();
+        let result = roundtrip(p, &mut state);
+        let element = &result.elements[&target.behavior];
+        assert_eq!(element.name, name);
+        assert_eq!(element.layer(), layer);
+        assert_eq!(
+            element.kind(),
+            if layer == Layer::Oa {
+                Kind::Process
+            } else {
+                Kind::FunctionalChain
+            }
+        );
+        assert_eq!(element.parent, None);
+        assert!(element.steps().unwrap().is_empty());
+        assert!(result.diagrams.is_empty());
+        assert!(result.relations.is_empty());
+    }
+}
+
+#[test]
+fn all_four_viewpoints_are_explicit_and_survive_source_history_reopen() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        for viewpoint in viewpoints(layer) {
+            let mut p = Project::empty();
+            let context = p
+                .add_element(
+                    if layer == Layer::Oa {
+                        Kind::Capability
+                    } else {
+                        Kind::SystemCapability
+                    },
+                    layer,
+                    "Water supply",
+                    None,
+                )
+                .unwrap();
+            let mut state = start(&p, layer, Family::Scenario, "Nominal supply");
+            assert!(
+                state
+                    .prepare_pending(&p)
+                    .unwrap_err()
+                    .contains("explicitly")
+            );
+            assert!(
+                state
+                    .update(&p, Event::Viewpoint(ScenarioViewpoint::MixedLegacy))
+                    .is_err()
+            );
+            let wrong = viewpoints(if layer == Layer::Oa {
+                Layer::Sa
+            } else {
+                Layer::Oa
+            })[0];
+            assert!(state.update(&p, Event::Viewpoint(wrong)).is_err());
+            state.update(&p, Event::Viewpoint(viewpoint)).unwrap();
+            state.update(&p, Event::Context(Some(context))).unwrap();
+            let id = state.created().unwrap().behavior;
+            let result = roundtrip(p, &mut state);
+            assert_eq!(
+                result.elements[&id].parent, None,
+                "context is not containment"
+            );
+            assert!(
+                matches!(result.elements[&id].shared(), Some(SharedBody::Scenario { viewpoint: actual, context: Some(actual_context), steps, .. }) if *actual == viewpoint && *actual_context == context && steps.is_empty())
+            );
+        }
+    }
+}
+
+#[test]
+fn machine_requires_valid_owner_and_first_view_adds_no_region_or_state() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        for first_view in [false, true] {
+            let mut p = Project::empty();
+            let owner = p
+                .add_element(
+                    if layer == Layer::Oa {
+                        Kind::Entity
+                    } else {
+                        Kind::System
+                    },
+                    layer,
+                    "Pump",
+                    None,
+                )
+                .unwrap();
+            let wrong_kind = p
+                .add_element(
+                    if layer == Layer::Oa {
+                        Kind::Activity
+                    } else {
+                        Kind::Function
+                    },
+                    layer,
+                    "Pump water",
+                    None,
+                )
+                .unwrap();
+            let opposite = if layer == Layer::Oa {
+                Layer::Sa
+            } else {
+                Layer::Oa
+            };
+            let wrong_layer = p
+                .add_element(
+                    if opposite == Layer::Oa {
+                        Kind::Entity
+                    } else {
+                        Kind::System
+                    },
+                    opposite,
+                    "Other layer pump",
+                    None,
+                )
+                .unwrap();
+            let mut state = start(&p, layer, Family::Machine, "Pump modes");
+            assert!(
+                state
+                    .prepare_pending(&p)
+                    .unwrap_err()
+                    .contains("participant")
+            );
+            assert!(state.update(&p, Event::Owner(wrong_kind)).is_err());
+            assert!(state.update(&p, Event::Owner(wrong_layer)).is_err());
+            state.update(&p, Event::Owner(owner)).unwrap();
+            state.update(&p, Event::FirstView(first_view)).unwrap();
+            let target = state.created().unwrap();
+            let expected_count = p.elements.len() + 1;
+            let result = roundtrip(p, &mut state);
+            assert_eq!(result.elements.len(), expected_count);
+            assert_eq!(result.elements[&target.behavior].parent, Some(owner));
+            assert_eq!(result.elements[&target.behavior].kind(), Kind::StateMachine);
+            assert_eq!(result.diagrams.len(), usize::from(first_view));
+            if let Some(view) = target.diagram {
+                let diagram = &result.diagrams[&view];
+                assert_eq!(
+                    diagram.projection,
+                    ProjectionKind::StateMachine {
+                        machine: target.behavior
+                    }
+                );
+                assert_eq!(diagram.nodes.len(), 1);
+                assert_eq!(
+                    diagram.nodes.values().next().unwrap().element,
+                    target.behavior
+                );
+            }
+        }
+    }
+}
+
+#[test]
+fn cancel_and_illegal_family_layer_switches_never_create_model_objects() {
+    let p = Project::empty();
+    let mut state = start(&p, Layer::Oa, Family::Scenario, "Raw name");
+    state
+        .update(
+            &p,
+            Event::Viewpoint(ScenarioViewpoint::ParticipantInteraction),
+        )
+        .unwrap();
+    let snapshot = state.recovery_snapshot().unwrap();
+    assert!(state.update(&p, Event::Open(Layer::Sa)).is_err());
+    assert!(state.update(&p, Event::Choose(Family::Sequence)).is_err());
+    assert_eq!(state.recovery_snapshot().unwrap(), snapshot);
+    assert!(state.update(&p, Event::Cancel).unwrap().is_none());
+    assert!(!state.has_pending());
+    assert!(state.created().is_none());
+    assert!(state.prepare_pending(&p).is_err());
+    assert!(p.elements.is_empty());
+    assert!(p.diagrams.is_empty());
+}
+
+#[test]
+fn recovery_preserves_exact_raw_inputs_reserved_ids_and_revalidates_stale_owner() {
+    let mut p = Project::empty();
+    let owner = p
+        .add_element(Kind::Entity, Layer::Oa, "Plant", None)
+        .unwrap();
+    let mut state = start(&p, Layer::Oa, Family::Machine, " \nRaw rejected name\0 ");
+    state.update(&p, Event::Owner(owner)).unwrap();
+    state.update(&p, Event::FirstView(true)).unwrap();
+    state
+        .update(&p, Event::Search(Picker::Owner, " Plant ".into()))
+        .unwrap();
+    let raw = state.recovery_snapshot().unwrap().unwrap();
+    let mut restored = State::from_recovery(raw.clone()).unwrap();
+    assert_eq!(restored.recovery_snapshot().unwrap(), Some(raw.clone()));
+    assert_eq!(restored.created(), state.created());
+    assert_eq!(restored.pending_layer(), Some(Layer::Oa));
+    assert!(restored.prepare_pending(&p).is_err());
+    restored
+        .update(&p, Event::Name("Plant modes".into()))
+        .unwrap();
+    let command = restored.prepare_pending(&p).unwrap();
+    let again = State::from_recovery(restored.recovery_snapshot().unwrap().unwrap()).unwrap();
+    assert_eq!(again.prepare_pending(&p).unwrap(), command);
+    p.elements.remove(&owner);
+    let before = restored.recovery_snapshot().unwrap();
+    assert!(
+        restored
+            .prepare_pending(&p)
+            .unwrap_err()
+            .contains("participant")
+    );
+    assert_eq!(restored.recovery_snapshot().unwrap(), before);
+    let different = Project::empty();
+    assert!(
+        restored
+            .prepare_pending(&different)
+            .unwrap_err()
+            .contains("another document")
+    );
+}
+
+#[test]
+fn rejected_source_transaction_keeps_draft_and_every_accepted_source_byte() {
+    let p = Project::empty();
+    let initial = Document::from_project(p.clone(), ProjectLimits::default()).unwrap();
+    let bytes: usize = initial.bundle().files.values().map(String::len).sum();
+    let limits = ProjectLimits {
+        model: language::ParseLimits {
+            max_source_bytes: bytes + 32,
+            ..language::ParseLimits::UNLIMITED
+        },
+        ..ProjectLimits::default()
+    };
+    let mut doc = Document::from_bundle(initial.bundle().clone(), limits).unwrap();
+    let mut state = start(
+        &p,
+        Layer::Oa,
+        Family::Sequence,
+        "A long exact name retained after the source budget refuses this new process",
+    );
+    let raw = state.recovery_snapshot().unwrap();
+    let command = state.prepare_pending(&p).unwrap();
+    assert!(doc.execute(command).is_err());
+    assert_eq!(doc.project(), &p);
+    assert_eq!(doc.bundle(), initial.bundle());
+    assert!(!doc.can_undo());
+    assert_eq!(state.recovery_snapshot().unwrap(), raw);
+    state.update(&p, Event::Cancel).unwrap();
+}
+
+#[test]
+fn owner_search_is_name_ordered_filtered_and_page_sized_not_a_catalog() {
+    let mut p = Project::empty();
+    for index in (0..105).rev() {
+        p.add_element(Kind::Entity, Layer::Oa, &format!("Pump {index:03}"), None)
+            .unwrap();
+    }
+    p.add_element(Kind::System, Layer::Sa, "Pump 999", None)
+        .unwrap();
+    p.add_element(Kind::Activity, Layer::Oa, "Pump work", None)
+        .unwrap();
+    let mut state = start(&p, Layer::Oa, Family::Machine, "Pump modes");
+    let all = choices(&p, Layer::Oa, Picker::Owner, "");
+    assert_eq!(all.len(), 105);
+    assert_eq!(all[0].name, "Pump 000");
+    state
+        .update(&p, Event::Page(Picker::Owner, usize::MAX))
+        .unwrap();
+    assert!(
+        state.view(&p).is_some(),
+        "stale pages are clamped before slicing"
+    );
+    state
+        .update(&p, Event::Search(Picker::Owner, "Pump 104".into()))
+        .unwrap();
+    assert_eq!(state.draft.as_ref().unwrap().browsers[0].page, 0);
+    let found = choices(&p, Layer::Oa, Picker::Owner, "Pump 104");
+    assert_eq!(found.len(), 1);
+    state.update(&p, Event::Owner(found[0].id)).unwrap();
+    assert_eq!(state.draft.as_ref().unwrap().owner, Some(found[0].id));
+}
+
+#[test]
+fn repeated_owner_names_remain_distinguishable_by_searchable_parent_context_and_alias() {
+    let mut p = Project::empty();
+    let north = p
+        .add_element(Kind::Entity, Layer::Oa, "North station", None)
+        .unwrap();
+    let south = p
+        .add_element(Kind::Entity, Layer::Oa, "South station", None)
+        .unwrap();
+    let first = p
+        .add_element(Kind::Entity, Layer::Oa, "Pump", Some(north))
+        .unwrap();
+    let second = p
+        .add_element(Kind::Entity, Layer::Oa, "Pump", Some(south))
+        .unwrap();
+    let label = reference_label(&p, second);
+    assert_ne!(reference_label(&p, first), label);
+    assert!(label.contains("South station") && label.contains("Pump"));
+    assert!(label.contains(&p.elements[&second].alias));
+    let found = choices(&p, Layer::Oa, Picker::Owner, "south station");
+    assert!(found.iter().any(|e| e.id == second));
+    assert!(!found.iter().any(|e| e.id == first));
+    let mut state = start(&p, Layer::Oa, Family::Machine, "Pump states");
+    state.update(&p, Event::Owner(second)).unwrap();
+    let result = execute_batch(&p, &[state.prepare_pending(&p).unwrap()]).unwrap();
+    assert_eq!(
+        result.elements[&state.created().unwrap().behavior].parent,
+        Some(second)
+    );
+}
+
+#[test]
+fn corrupted_recovery_and_reserved_identity_collision_refuse_without_repairing_raw_values() {
+    let p = Project::empty();
+    let state = start(&p, Layer::Sa, Family::Sequence, "Supply");
+    let raw = state.recovery_snapshot().unwrap().unwrap();
+    for (field, value) in [
+        ("version", serde_json::json!(99)),
+        ("unexpected", serde_json::json!(true)),
+    ] {
+        let mut bad = raw.clone();
+        bad[field] = value;
+        assert!(State::from_recovery(bad).is_err());
+    }
+    let mut bad = raw;
+    bad["element"] = serde_json::json!(p.id);
+    let restored = State::from_recovery(bad.clone()).unwrap();
+    assert!(
+        restored
+            .prepare_pending(&p)
+            .unwrap_err()
+            .contains("identity")
+    );
+    assert_eq!(restored.recovery_snapshot().unwrap(), Some(bad));
+}
+
+#[test]
+fn post_commit_selection_is_correlated_with_exact_created_behavior_and_view() {
+    let mut p = Project::empty();
+    let owner = p
+        .add_element(Kind::Entity, Layer::Oa, "Pump", None)
+        .unwrap();
+    let mut state = start(&p, Layer::Oa, Family::Machine, "Pump modes");
+    state.update(&p, Event::Owner(owner)).unwrap();
+    state.update(&p, Event::FirstView(true)).unwrap();
+    let command = state.prepare_pending(&p).unwrap();
+    assert_eq!(state.created_by(&p, &command), state.created());
+    assert_eq!(
+        state.created_by(&p, &Command::Rename(owner, "Unrelated change".into())),
+        None
+    );
+    for edit in 0..4 {
+        let mut changed = command.clone();
+        let Command::Batch(ref mut commands) = changed else {
+            panic!("creation batch");
+        };
+        if edit < 3 {
+            let Command::CreateElement(element) = &mut commands[0] else {
+                panic!("new behavior");
+            };
+            match edit {
+                0 => element.id = Id::new_v4(),
+                1 => element.name = "A different authored draft".into(),
+                _ => element.parent = None,
+            }
+        } else {
+            let Command::CreateDiagram(diagram) = &mut commands[1] else {
+                panic!("new view");
+            };
+            diagram.projection = ProjectionKind::StateMachine { machine: owner };
+        }
+        assert_eq!(state.created_by(&p, &changed), None);
+    }
+    let Command::Batch(commands) = command else {
+        panic!("creation batch");
+    };
+    assert_eq!(
+        state.created_by(&p, &commands[0]),
+        None,
+        "an opt-in view must be part of the actual committed batch"
+    );
+}
+
+#[test]
+fn optional_context_collapses_without_losing_authored_reference_or_raw_search() {
+    let mut p = Project::empty();
+    let context = p
+        .add_element(Kind::Capability, Layer::Oa, "Water supply", None)
+        .unwrap();
+    let mut state = start(&p, Layer::Oa, Family::Scenario, "Supply nominal");
+    assert!(!state.draft.as_ref().unwrap().context_open);
+    state
+        .update(&p, Event::Viewpoint(ScenarioViewpoint::OperationalActivity))
+        .unwrap();
+    state.update(&p, Event::ContextOptions(true)).unwrap();
+    state
+        .update(&p, Event::Search(Picker::Context, " Water ".into()))
+        .unwrap();
+    state.update(&p, Event::Context(Some(context))).unwrap();
+    let command = state.prepare_pending(&p).unwrap();
+    state.update(&p, Event::ContextOptions(false)).unwrap();
+    let restored = State::from_recovery(state.recovery_snapshot().unwrap().unwrap()).unwrap();
+    assert!(!restored.draft.as_ref().unwrap().context_open);
+    assert_eq!(
+        restored.draft.as_ref().unwrap().browsers[1].query,
+        " Water "
+    );
+    assert_eq!(restored.prepare_pending(&p).unwrap(), command);
+    assert_eq!(restored.created_by(&p, &command), restored.created());
+}
+
+#[test]
+fn creation_selection_rejects_changed_scenario_body_and_post_creation_operations() {
+    let mut p = Project::empty();
+    let capability = p
+        .add_element(Kind::SystemCapability, Layer::Sa, "Supply", None)
+        .unwrap();
+    let mut state = start(&p, Layer::Sa, Family::Scenario, "Nominal functions");
+    state
+        .update(&p, Event::Viewpoint(ScenarioViewpoint::Functional))
+        .unwrap();
+    let command = state.prepare_pending(&p).unwrap();
+    assert_eq!(state.created_by(&p, &command), state.created());
+    for edit in 0..4 {
+        let mut altered = command.clone();
+        let Command::Batch(commands) = &mut altered else {
+            panic!("creation batch");
+        };
+        match edit {
+            0 => {
+                let Command::CreateElement(element) = &mut commands[0] else {
+                    panic!("scenario");
+                };
+                let Some(SharedBody::Scenario { viewpoint, .. }) = element.shared_mut() else {
+                    panic!("scenario body");
+                };
+                *viewpoint = ScenarioViewpoint::BoundaryInterface;
+            }
+            1 => {
+                let Command::CreateElement(element) = &mut commands[0] else {
+                    panic!("scenario");
+                };
+                let Some(SharedBody::Scenario { context, .. }) = element.shared_mut() else {
+                    panic!("scenario body");
+                };
+                *context = Some(capability);
+            }
+            2 => commands.push(Command::Rename(
+                state.created().unwrap().behavior,
+                "Changed afterward".into(),
+            )),
+            _ => commands.push(Command::Delete(state.created().unwrap().behavior)),
+        }
+        assert!(
+            execute_batch(&p, std::slice::from_ref(&altered)).is_ok(),
+            "the alternate command is valid, but is not this authored creation"
+        );
+        assert_eq!(state.created_by(&p, &altered), None);
+    }
+}
@@ -0,0 +1,148 @@
+//! Keep behavior field state within one editing session and reset it on replacement.
+use iced::advanced::widget::{Operation, Tree, tree};
+use iced::advanced::{Clipboard, Layout, Shell, Widget, layout, overlay, renderer};
+use iced::{Element, Event, Length, Rectangle, Size, Theme, Vector, mouse};
+use oa_core::Id;
+
+struct Identity(Id);
+
+struct Session<'a, Message, R: renderer::Renderer> {
+    identity: Id,
+    content: Element<'a, Message, Theme, R>,
+}
+
+pub(super) fn reset_on_change<'a, Message: 'a, R: renderer::Renderer + 'a>(
+    identity: Id,
+    content: impl Into<Element<'a, Message, Theme, R>>,
+) -> Element<'a, Message, Theme, R> {
+    Element::new(Session {
+        identity,
+        content: content.into(),
+    })
+}
+
+impl<Message, R: renderer::Renderer> Widget<Message, Theme, R> for Session<'_, Message, R> {
+    fn tag(&self) -> tree::Tag {
+        tree::Tag::of::<Identity>()
+    }
+
+    fn state(&self) -> tree::State {
+        tree::State::new(Identity(self.identity))
+    }
+
+    fn children(&self) -> Vec<Tree> {
+        vec![Tree::new(self.content.as_widget())]
+    }
+
+    fn diff(&self, tree: &mut Tree) {
+        let retained = tree.state.downcast_mut::<Identity>();
+        if retained.0 != self.identity {
+            retained.0 = self.identity;
+            // Iced's keyed column preserves same-length child replacements.
+            // An editing-session replacement must instead get fresh field state.
+            tree.children = self.children();
+        } else {
+            tree.diff_children(std::slice::from_ref(&self.content));
+        }
+    }
+
+    fn size(&self) -> Size<Length> {
+        self.content.as_widget().size()
+    }
+
+    fn layout(&mut self, tree: &mut Tree, renderer: &R, limits: &layout::Limits) -> layout::Node {
+        self.content
+            .as_widget_mut()
+            .layout(&mut tree.children[0], renderer, limits)
+    }
+
+    fn operate(
+        &mut self,
+        tree: &mut Tree,
+        layout: Layout<'_>,
+        renderer: &R,
+        operation: &mut dyn Operation,
+    ) {
+        self.content
+            .as_widget_mut()
+            .operate(&mut tree.children[0], layout, renderer, operation);
+    }
+
+    fn update(
+        &mut self,
+        tree: &mut Tree,
+        event: &Event,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        renderer: &R,
+        clipboard: &mut dyn Clipboard,
+        shell: &mut Shell<'_, Message>,
+        viewport: &Rectangle,
+    ) {
+        self.content.as_widget_mut().update(
+            &mut tree.children[0],
+            event,
+            layout,
+            cursor,
+            renderer,
+            clipboard,
+            shell,
+            viewport,
+        );
+    }
+
+    fn draw(
+        &self,
+        tree: &Tree,
+        renderer: &mut R,
+        theme: &Theme,
+        style: &renderer::Style,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        viewport: &Rectangle,
+    ) {
+        self.content.as_widget().draw(
+            &tree.children[0],
+            renderer,
+            theme,
+            style,
+            layout,
+            cursor,
+            viewport,
+        );
+    }
+
+    fn mouse_interaction(
+        &self,
+        tree: &Tree,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        viewport: &Rectangle,
+        renderer: &R,
+    ) -> mouse::Interaction {
+        self.content.as_widget().mouse_interaction(
+            &tree.children[0],
+            layout,
+            cursor,
+            viewport,
+            renderer,
+        )
+    }
+
+    fn overlay<'b>(
+        &'b mut self,
+        tree: &'b mut Tree,
+        layout: Layout<'b>,
+        renderer: &R,
+        viewport: &Rectangle,
+        translation: Vector,
+    ) -> Option<overlay::Element<'b, Message, Theme, R>> {
+        self.content.as_widget_mut().overlay(
+            &mut tree.children[0],
+            layout,
+            renderer,
+            viewport,
+            translation,
+        )
+    }
+}
@@ -4,7 +4,9 @@ use super::topology::{occurrence, unique_batch};
 use super::*;
 use iced::widget::{Column, column, text_input};
 use std::{cell::RefCell, collections::BTreeSet};
+pub(crate) mod focus;
 mod workspace;
+pub(crate) use workspace::NAME_INPUT;
 pub use workspace::{Shelf, view};

 #[cfg(test)]
@@ -97,7 +99,9 @@ pub enum CanvasEvent {
    Scrolled(Context, ScrollArea, iced::Vector),
    Restored(Context, Id, ScrollArea, iced::Vector),
    Viewport(Context, Size),
+    FormShown(Context, Id),
    Zoom(Context, Option<f32>),
+    Camera(Context, u64, super::canvas_workspace::Event),
    Focus(Context),
    Shelf(Context, Shelf),
    OpenUse(Context, Id),
@@ -125,8 +129,7 @@ pub enum CanvasEvent {
 }
 #[derive(Debug, Clone, Copy)]
 pub enum ScrollArea {
-    Canvas,
-    // Retained navigation channel, now the independent Selection/outline shelf.
+    // The independent Details/outline scroller; viewport motion uses Camera.
    Page,
 }
 impl CanvasEvent {
@@ -135,7 +138,9 @@ impl CanvasEvent {
            Self::Scrolled(context, _, _)
            | Self::Restored(context, ..)
            | Self::Viewport(context, _)
+            | Self::FormShown(context, _)
            | Self::Zoom(context, _)
+            | Self::Camera(context, ..)
            | Self::Focus(context)
            | Self::Shelf(context, _)
            | Self::OpenUse(context, _)
@@ -162,6 +167,7 @@ impl std::fmt::Display for Operator {
 }
 #[derive(Debug, Clone)]
 pub enum Event {
+    Source(super::source_draft::Event),
    Start(Id, Tool),
    Cancel,
    Submit,
@@ -197,11 +203,14 @@ const VALUE_PAGE_SIZE: usize = 24;
 #[derive(Default)]
 pub struct State {
    draft: Option<Draft>,
+    form_session: Id,
+    form_mount: Id,
+    form_focus_pending: bool,
    canvas_tool: Option<(Id, CanvasTool)>,
    call_choices: RefCell<Option<(CallChoiceContext, Vec<Choice>)>>,
-    scroll_offsets: [iced::Vector; 2],
+    details_offset: iced::Vector,
    return_to: Vec<Caller>,
-    restore: Option<ViewportRestore>,
+    restore: Option<DetailsRestore>,
    presentation: workspace::Presentation,
 }
 const CALLER_LIMIT: usize = 32;
@@ -211,15 +220,14 @@ pub(crate) struct Caller {
    pub occurrence: Id,
    target: Id,
    tool: CanvasTool,
-    offsets: [iced::Vector; 2],
+    details_offset: iced::Vector,
    presentation: workspace::Presentation,
 }
-struct ViewportRestore {
+struct DetailsRestore {
    document: Id,
    owner: Id,
    token: Id,
-    offsets: [iced::Vector; 2],
-    pending: [bool; 2],
+    offset: iced::Vector,
 }
 #[derive(Clone, Copy)]
 pub(super) struct ScrollRestore {
@@ -240,6 +248,13 @@ struct CallChoiceContext {
 #[derive(Clone, serde::Serialize, serde::Deserialize)]
 #[serde(deny_unknown_fields)]
 struct Draft {
+    #[serde(default)]
+    source: super::source_draft::State,
+    #[serde(default = "Id::new_v4")]
+    invocation: Id,
+    #[serde(default)]
+    source_origin: Option<(Id, oa_core::Element)>,
+
    owner: Id,
    parent: Id,
    before: Option<Id>,
@@ -272,6 +287,44 @@ struct Draft {
    choice_page: usize,
 }
 impl State {
+    pub(crate) fn camera_boundary(&self) -> impl PartialEq + use<> {
+        (
+            self.canvas_tool,
+            self.presentation.focused,
+            self.presentation.shelf,
+            self.presentation.viewport,
+            self.presentation.pan,
+            self.presentation.zoom,
+            self.presentation.fit,
+        )
+    }
+
+    pub(super) fn pending_name(&self) -> Option<&str> {
+        self.draft.as_ref().map(|d| d.name.as_str())
+    }
+    pub(super) fn source_view<'a>(&'a self, p: &'a Project) -> Option<iced::Element<'a, Event>> {
+        self.draft
+            .as_ref()?
+            .source
+            .view(p)
+            .map(|v| v.map(Event::Source))
+    }
+
+    pub fn source_active(&self) -> bool {
+        self.draft.as_ref().is_some_and(|d| d.source.engaged())
+    }
+
+    pub fn source_open(&self) -> bool {
+        self.draft.as_ref().is_some_and(|d| d.source.is_open())
+    }
+    pub fn source_back(&mut self) -> bool {
+        let returned = self.draft.as_mut().is_some_and(|d| d.source.back());
+        if returned {
+            self.remount_form();
+        }
+        returned
+    }
+
    pub(crate) fn enter(&mut self, document: Id, owner: Id) {
        if self.presentation.identity != Some((document, owner)) {
            self.presentation = workspace::Presentation {
@@ -279,16 +332,38 @@ impl State {
                focused: self.presentation.focused,
                ..Default::default()
            };
-            self.scroll_offsets = [iced::Vector::ZERO; 2];
+            self.details_offset = iced::Vector::ZERO;
            self.restore = None;
        }
    }
    pub(crate) fn viewport(&mut self, size: Size) -> bool {
        self.presentation.viewport(size)
    }
+    pub(crate) fn camera(&mut self, event: super::canvas_workspace::Event) -> bool {
+        let p = &mut self.presentation;
+        super::canvas_workspace::change(&mut p.pan, &mut p.zoom, &mut p.fit, event)
+    }
    pub(crate) fn zoom(&mut self, scale: Option<f32>) -> bool {
        self.presentation.zoom(scale)
    }
+    pub(crate) fn camera_zoom(&mut self, p: &Project, owner: Id, zoom: Option<f32>) -> bool {
+        let size = Scene::sequence(p, owner, owner).size;
+        let old = self.presentation.scale(size);
+        if let Some(next) = zoom {
+            let viewport = self.presentation.viewport.unwrap_or(Size::new(500., 300.));
+            self.camera(super::canvas_workspace::Event::Zoom {
+                factor: next / old,
+                at: Point::new(viewport.width / 2., viewport.height / 2.),
+                base: old,
+            })
+        } else {
+            self.zoom(None);
+            let fitted = self.presentation.scale(size);
+            self.zoom(Some(fitted));
+            self.presentation.pan = iced::Vector::ZERO;
+            true
+        }
+    }
    pub(crate) fn focused(&self) -> bool {
        self.presentation.focused
    }
@@ -317,11 +392,11 @@ impl State {
            occurrence,
            target,
            tool: self.canvas_tool(context.scenario),
-            offsets: self.scroll_offsets,
+            details_offset: self.details_offset,
            presentation: self.presentation.clone(),
        });
        self.canvas_tool = Some((target, CanvasTool::Select));
-        self.scroll_offsets = [iced::Vector::ZERO; 2];
+        self.details_offset = iced::Vector::ZERO;
        self.restore = None;
        Ok(target)
    }
@@ -348,34 +423,30 @@ impl State {
            return;
        }
        self.canvas_tool = Some((frame.owner, frame.tool));
-        self.scroll_offsets = frame.offsets;
+        self.details_offset = frame.details_offset;
        self.presentation = frame.presentation;
        self.presentation.identity = Some((context.document, context.scenario));
-        self.restore = Some(ViewportRestore {
+        self.restore = Some(DetailsRestore {
            document: context.document,
            owner: frame.owner,
            token: Id::new_v4(),
-            offsets: frame.offsets,
-            pending: [true; 2],
+            offset: frame.details_offset,
        });
    }
    pub(super) fn scroll_restore(
        &self,
        context: Context,
-        area: ScrollArea,
+        ScrollArea::Page: ScrollArea,
    ) -> Option<ScrollRestore> {
-        let index = match area {
-            ScrollArea::Canvas => 0,
-            ScrollArea::Page => 1,
-        };
-        let restore = self.restore.as_ref().filter(|r| {
-            r.document == context.document && r.owner == context.scenario && r.pending[index]
-        })?;
+        let restore = self
+            .restore
+            .as_ref()
+            .filter(|r| r.document == context.document && r.owner == context.scenario)?;
        Some(ScrollRestore {
            document: restore.document,
            owner: restore.owner,
            token: restore.token,
-            offset: restore.offsets[index],
+            offset: restore.offset,
        })
    }
    pub(crate) fn restored(
@@ -385,22 +456,12 @@ impl State {
        area: ScrollArea,
        offset: iced::Vector,
    ) -> bool {
-        let index = match area {
-            ScrollArea::Canvas => 0,
-            ScrollArea::Page => 1,
-        };
-        let Some(restore) = self.restore.as_mut().filter(|r| {
-            r.document == context.document
-                && r.owner == context.scenario
-                && r.token == token
-                && r.pending[index]
-        }) else {
+        if !self.restore.as_ref().is_some_and(|r| {
+            r.document == context.document && r.owner == context.scenario && r.token == token
+        }) {
            return false;
-        };
-        restore.pending[index] = false;
-        if !restore.pending.contains(&true) {
-            self.restore = None;
        }
+        self.restore = None;
        self.scrolled(area, offset)
    }
    pub(super) fn recovery_snapshot(&self) -> Result<Option<serde_json::Value>, String> {
@@ -413,28 +474,57 @@ impl State {

    pub(super) fn from_recovery(value: serde_json::Value) -> Result<Self, String> {
        let draft = serde_json::from_value(value).map_err(|e| e.to_string())?;
+        let session = Id::new_v4();
        Ok(Self {
            draft: Some(draft),
+            form_session: session,
+            form_mount: session,
+            form_focus_pending: true,
            ..Default::default()
        })
    }

-    pub(crate) fn scrolled(&mut self, area: ScrollArea, offset: iced::Vector) -> bool {
+    pub(crate) fn form_session(&self) -> Option<Id> {
+        self.draft.as_ref().map(|_| self.form_session)
+    }
+
+    pub(crate) fn form_mount(&self) -> Option<Id> {
+        self.draft
+            .as_ref()
+            .filter(|d| !d.source.is_open())
+            .map(|_| self.form_mount)
+    }
+
+    pub(crate) fn focus_stamp(&self, context: Context) -> Option<focus::Stamp> {
+        (self.draft.as_ref()?.owner == context.scenario).then_some(focus::Stamp::new(
+            context,
+            self.form_session,
+            self.form_mount()?,
+        ))
+    }
+
+    fn remount_form(&mut self) {
+        self.form_mount = Id::new_v4();
+        self.form_focus_pending = true;
+    }
+
+    pub(crate) fn take_form_focus(&mut self, mount: Id) -> bool {
+        if self.form_mount() == Some(mount) && self.form_focus_pending {
+            self.form_focus_pending = false;
+            true
+        } else {
+            false
+        }
+    }
+
+    pub(crate) fn scrolled(&mut self, ScrollArea::Page: ScrollArea, offset: iced::Vector) -> bool {
        if !offset.x.is_finite() || !offset.y.is_finite() || offset.x < 0. || offset.y < 0. {
            return false;
        }
-        let index = match area {
-            ScrollArea::Canvas => 0,
-            ScrollArea::Page => 1,
-        };
-        let changed = self.scroll_offsets[index] != offset;
-        self.scroll_offsets[index] = offset;
+        let changed = self.details_offset != offset;
+        self.details_offset = offset;
        changed
    }
-    fn scroll_offset(&self) -> iced::Vector {
-        // The former page scroll now belongs to a sibling outline shelf.
-        self.scroll_offsets[0]
-    }
    fn call_choices(&self, p: &Project, context: Context, draft: &Draft) -> Vec<Choice> {
        let key = CallChoiceContext {
            document: context.document,
@@ -452,8 +542,16 @@ impl State {
        }
        cached.as_ref().unwrap().1.clone()
    }
-    pub(crate) fn created_selection(&self, command: &Command) -> Option<Id> {
+    pub(crate) fn created_selection(&self, p: &Project, command: &Command) -> Option<Id> {
        let draft = self.draft.as_ref()?;
+        if self
+            .draft
+            .as_ref()
+            .is_some_and(|d| d.source.label(d.target).is_some())
+            && self.prepare_pending(p).ok().as_ref() != Some(command)
+        {
+            return None;
+        }
        fn created(command: &Command, parent: Id) -> Option<Id> {
            match command {
                Command::CreateElement(element) if element.parent == Some(parent) => {
@@ -568,6 +666,66 @@ impl State {
    }

    pub fn update(&mut self, p: &Project, event: Event) -> Result<Option<Command>, String> {
+        if let Event::Source(event) = event {
+            if self
+                .draft
+                .as_mut()
+                .ok_or("Start the consumer form first.")?
+                .source
+                .dismiss(&event)?
+            {
+                self.remount_form();
+                return Ok(None);
+            }
+            let d = self
+                .draft
+                .as_ref()
+                .ok_or("Start the consumer form first.")?;
+            if d.tool != Tool::Lifeline {
+                return Err("This reference does not support staged source creation.".into());
+            }
+            if d.source_origin.as_ref().is_some_and(|(document, owner)| {
+                *document != p.id || p.elements.get(&d.owner) != Some(owner)
+            }) {
+                return Err("The original consumer changed. Cancel and reopen its form; the current draft is retained.".into());
+            }
+            if d.source_origin.is_none() && d.source.engaged() {
+                return Err("The recovered source draft has no original document binding. Go Back or cancel it.".into());
+            }
+            let mut next = d.clone();
+            if next.source_origin.is_none() && matches!(&event, super::source_draft::Event::Open(_))
+            {
+                next.source_origin = Some((
+                    p.id,
+                    p.elements
+                        .get(&d.owner)
+                        .ok_or("The consumer owner no longer exists.")?
+                        .clone(),
+                ));
+            }
+            if let Some(id) = next.source.update(
+                p,
+                super::source_draft::Scope::Lifeline {
+                    owner: d.owner,
+                    viewpoint: viewpoint(p, d.owner),
+                },
+                d.invocation,
+                event,
+            )? {
+                next.target = Some(id);
+                next.command(p)?;
+            }
+            let returned = d.source.is_open() && !next.source.is_open();
+            self.draft = Some(next);
+            if returned {
+                self.remount_form();
+            }
+            return Ok(None);
+        }
+        if self.source_open() && !matches!(&event, Event::Cancel) {
+            return Err("Use the new source or go Back before editing the parent form.".into());
+        }
+
        if self.draft.is_some() && matches!(&event, Event::Start(..)) {
            return Err(PENDING_DRAFT.into());
        }
@@ -576,7 +734,13 @@ impl State {
                if p.elements.get(&owner).map(oa_core::Element::kind) != Some(Kind::Scenario) {
                    return Err("Choose a scenario.".into());
                }
+                self.form_session = Id::new_v4();
+                self.form_mount = self.form_session;
+                self.form_focus_pending = true;
                self.draft = Some(Draft {
+                    source: Default::default(),
+                    invocation: Id::new_v4(),
+                    source_origin: Some((p.id, p.elements[&owner].clone())),
                    owner,
                    parent: owner,
                    before: None,
@@ -940,7 +1104,14 @@ fn valid_body_choice(p: &Project, owner: Id, body: OccurrenceBody) -> bool {
    execute_batch(p, &[Command::CreateElement(e)]).is_ok()
 }
 fn sources(p: &Project, d: &Draft) -> Vec<Choice> {
-    let layer = p.elements[&d.owner].layer();
+    let Some(owner) = p
+        .elements
+        .get(&d.owner)
+        .filter(|e| e.kind() == Kind::Scenario)
+    else {
+        return vec![];
+    };
+    let layer = owner.layer();
    let mut values: Vec<_> = p
        .elements
        .values()
@@ -1256,6 +1427,28 @@ impl Draft {
        e
    }
    fn command(&self, p: &Project) -> Result<Command, String> {
+        if self.source.engaged()
+            && self.source_origin.as_ref().is_none_or(|(document, owner)| {
+                *document != p.id || p.elements.get(&self.owner) != Some(owner)
+            })
+        {
+            return Err("The original consumer document or owner changed. Cancel and reopen its form; your draft is retained.".into());
+        }
+        self.source.check_scope(
+            super::source_draft::Scope::Lifeline {
+                owner: self.owner,
+                viewpoint: viewpoint(p, self.owner),
+            },
+            self.target,
+        )?;
+        let preview = self.source.preview(p, self.target)?;
+        let command = self.consumer_command(preview.as_ref().unwrap_or(p))?;
+        self.source.combine(p, self.target, command)
+    }
+    fn consumer_command(&self, p: &Project) -> Result<Command, String> {
+        if p.elements.get(&self.owner).map(oa_core::Element::kind) != Some(Kind::Scenario) {
+            return Err("The scenario no longer exists. Cancel or restore its owner.".into());
+        }
        if !parents(p, self.owner).iter().any(|c| c.id == self.parent) {
            return Err("Choose this scenario or one of its operands as destination.".into());
        }
@@ -1266,6 +1459,8 @@ impl Draft {
            .unwrap_or(self.tool.label());
        let name = if self.name.trim().is_empty() {
            default
+        } else if self.source.label(self.target).is_some() {
+            self.name.as_str()
        } else {
            self.name.trim()
        };
@@ -1857,20 +2052,31 @@ pub(crate) mod direct_tests {
            navigation_event(&mut app, |ctx| {
                CanvasEvent::Choose(ctx, CanvasTool::Add(Tool::Reuse))
            });
+            navigation_event(&mut app, |ctx| CanvasEvent::Zoom(ctx, None));
+            let camera_epoch = app.camera_epoch;
            navigation_event(&mut app, |ctx| {
-                CanvasEvent::Scrolled(ctx, ScrollArea::Canvas, iced::Vector::new(25., 170.))
+                CanvasEvent::Camera(
+                    ctx,
+                    camera_epoch,
+                    super::super::canvas_workspace::Event::Pan(iced::Vector::new(25., 170.)),
+                )
            });
            navigation_event(&mut app, |ctx| {
                CanvasEvent::Scrolled(ctx, ScrollArea::Page, iced::Vector::new(0., 80.))
            });
            navigation_event(&mut app, |ctx| CanvasEvent::OpenUse(ctx, caller));
            assert_eq!(app.selected, b);
-            assert_eq!(app.behavior.scenario.scroll_offset(), iced::Vector::ZERO);
+            assert_eq!(app.behavior.scenario.presentation.pan, iced::Vector::ZERO);
            navigation_event(&mut app, |ctx| {
                CanvasEvent::Choose(ctx, CanvasTool::Message(MessageStyle::Timer))
            });
+            let camera_epoch = app.camera_epoch;
            navigation_event(&mut app, |ctx| {
-                CanvasEvent::Scrolled(ctx, ScrollArea::Canvas, iced::Vector::new(0., 115.))
+                CanvasEvent::Camera(
+                    ctx,
+                    camera_epoch,
+                    super::super::canvas_workspace::Event::Pan(iced::Vector::new(0., 115.)),
+                )
            });
            navigation_event(&mut app, |ctx| CanvasEvent::OpenUse(ctx, nested));
            assert_eq!(app.selected, c);
@@ -1881,7 +2087,7 @@ pub(crate) mod direct_tests {
                CanvasTool::Message(MessageStyle::Timer)
            );
            assert_eq!(
-                app.behavior.scenario.scroll_offset(),
+                app.behavior.scenario.presentation.pan,
                iced::Vector::new(0., 115.)
            );
            navigation_event(&mut app, CanvasEvent::Back);
@@ -1892,11 +2098,11 @@ pub(crate) mod direct_tests {
                CanvasTool::Add(Tool::Reuse)
            );
            assert_eq!(
-                app.behavior.scenario.scroll_offset(),
+                app.behavior.scenario.presentation.pan,
                iced::Vector::new(25., 170.)
            );
            assert_eq!(
-                app.behavior.scenario.scroll_offsets[1],
+                app.behavior.scenario.details_offset,
                iced::Vector::new(0., 80.),
                "The caller's independent outline scroll is restored separately"
            );
@@ -2074,22 +2280,24 @@ pub(crate) mod direct_tests {
                    let before = app.document.bundle().clone();
                    let mut scene = Scene::sequence(app.project(), f.owner, f.call);
                    scene.interaction = Some((context, CanvasTool::Add(tool), true));
-                    scene.scroll_offset = iced::Vector::new(23., 80.);
-                    let bounds = Rectangle::new(Point::new(20., 40.), scene.size);
+                    scene.camera_pan = iced::Vector::new(23., 80.);
+                    let bounds = Rectangle::new(
+                        Point::new(20., 40.),
+                        Size::new(scene.size.width + 46., scene.size.height + 160.),
+                    );
                    let y = scene.slots.iter().find(|s| s.slot == slot).unwrap().y;
                    let x = if on_lifeline {
                        scene.lanes[&f.sender]
                    } else {
                        scene.size.width - 35.
                    };
-                    let point = Point::new(bounds.x + x, bounds.y + y);
+                    let point = Point::new(bounds.x + x, bounds.y + y) + scene.camera_pan;
+                    assert!(bounds.contains(point));
                    let mut input = SequenceInput::default();
                    canvas_mouse(
                        &scene,
                        &mut input,
-                        mouse::Event::CursorMoved {
-                            position: point - scene.scroll_offset,
-                        },
+                        mouse::Event::CursorMoved { position: point },
                        point,
                        bounds,
                    );
@@ -2265,10 +2473,10 @@ pub(crate) mod direct_tests {
            assert!(!app.behavior.has_pending());
        }
        let old_context = app.scenario_context().unwrap();
-        let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Scrolled(
+        let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Camera(
            old_context,
-            ScrollArea::Canvas,
-            iced::Vector::new(0., 100.),
+            app.camera_epoch,
+            super::super::canvas_workspace::Event::Pan(iced::Vector::new(0., 100.)),
        )));
        let _ = app.update(Message::ScenarioCanvas(event(old_context)));
        assert!(!app.behavior.has_pending());
@@ -2459,26 +2667,29 @@ pub(crate) mod direct_tests {
        );
    }
    #[test]
-    fn direct_busy_save_keeps_observed_scroll_current_for_the_next_pointer_gesture() {
+    fn direct_busy_save_keeps_details_current_and_camera_for_the_next_pointer_gesture() {
        let f = fixture();
        let mut app = App::with_project(f.project.clone());
        let _ = app.update(Message::Select(f.owner));
        let _ = app.update(Message::Page(crate::app::Page::Behavior));
        let context = app.scenario_context().unwrap();
+        let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Camera(
+            context,
+            app.camera_epoch,
+            super::super::canvas_workspace::Event::Pan(iced::Vector::new(-25., -100.)),
+        )));
+        let context = app.scenario_context().unwrap();
        let original = app.document.snapshot();
        app.busy = true;
-        for (area, offset) in [
-            (ScrollArea::Canvas, iced::Vector::new(25., 100.)),
-            (ScrollArea::Page, iced::Vector::new(0., 40.)),
-        ] {
-            let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Scrolled(
-                context, area, offset,
-            )));
-        }
+        let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Scrolled(
+            context,
+            ScrollArea::Page,
+            iced::Vector::new(0., 40.),
+        )));
        assert!(app.busy);
        assert_eq!(
-            app.behavior.scenario.scroll_offset(),
-            iced::Vector::new(25., 100.)
+            app.behavior.scenario.details_offset,
+            iced::Vector::new(0., 40.)
        );
        assert_ne!(
            app.scenario_context(),
@@ -2489,14 +2700,14 @@ pub(crate) mod direct_tests {
        stale.document = Id::new_v4();
        let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Scrolled(
            stale,
-            ScrollArea::Canvas,
+            ScrollArea::Page,
            iced::Vector::new(0., 900.),
        )));
        assert_eq!(
-            app.behavior.scenario.scroll_offset(),
-            iced::Vector::new(25., 100.)
+            app.behavior.scenario.details_offset,
+            iced::Vector::new(0., 40.)
        );
-        let root = std::path::PathBuf::from("scenario-scroll-save-fixture");
+        let root = std::path::PathBuf::from("scenario-details-save-fixture");
        let receipt = crate::app::FileSnapshot {
            document: context.document,
            revision: context.revision,
@@ -2517,12 +2728,17 @@ pub(crate) mod direct_tests {
        let context = app.scenario_context().unwrap();
        let mut scene = Scene::sequence(app.project(), f.owner, f.call);
        scene.interaction = Some((context, CanvasTool::Message(MessageStyle::CallReply), true));
-        scene.scroll_offset = app.behavior.scenario.scroll_offset();
+        assert_eq!(
+            app.behavior.scenario.presentation.pan,
+            iced::Vector::new(-25., -100.)
+        );
+        scene.camera_pan = app.behavior.scenario.presentation.pan;
        let slot = scene.slots.last().unwrap().slot;
        let bounds = Rectangle::new(Point::new(20., 250.), scene.size);
        let y = bounds.y + scene.slots.last().unwrap().y;
-        let a = Point::new(bounds.x + scene.lanes[&f.sender], y) - scene.scroll_offset;
-        let b = Point::new(bounds.x + scene.lanes[&f.receiver], y) - scene.scroll_offset;
+        let a = Point::new(bounds.x + scene.lanes[&f.sender], y) + scene.camera_pan;
+        let b = Point::new(bounds.x + scene.lanes[&f.receiver], y) + scene.camera_pan;
+        assert!(bounds.contains(a) && bounds.contains(b));
        let mut input = super::super::SequenceInput::default();
        let mut published = vec![];
        for event in [
@@ -2536,7 +2752,7 @@ pub(crate) mod direct_tests {
                &mut input,
                &canvas::Event::Mouse(event),
                bounds,
-                mouse::Cursor::Available(b + scene.scroll_offset),
+                mouse::Cursor::Available(b),
            )
            .and_then(|action| action.into_inner().0)
            {
@@ -0,0 +1,334 @@
+//! A delayed focus request must still own the live parent tree when executed.
+//! Collect first: a missing target must not unfocus unrelated fields.
+use super::Context;
+use iced::advanced::widget::{Id, Operation, Tree, operation};
+use iced::advanced::{Clipboard, Layout, Shell, Widget, layout, overlay, renderer};
+use iced::{Element, Event, Length, Rectangle, Size, Task, Theme, Vector, mouse};
+use oa_core::Id as ModelId;
+use std::collections::BTreeMap;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) struct Stamp {
+    document: ModelId,
+    owner: ModelId,
+    revision: u64,
+    session: ModelId,
+    mount: ModelId,
+}
+impl Stamp {
+    pub(crate) fn new(context: Context, session: ModelId, mount: ModelId) -> Self {
+        Self {
+            document: context.document,
+            owner: context.scenario,
+            revision: context.revision,
+            session,
+            mount,
+        }
+    }
+}
+pub(crate) fn name_id(stamp: Stamp) -> Id {
+    Id::from(format!(
+        "{}:{}:{}:{}:{}:{}",
+        super::NAME_INPUT,
+        stamp.document,
+        stamp.owner,
+        stamp.revision,
+        stamp.session,
+        stamp.mount
+    ))
+}
+struct Owner(Option<Stamp>);
+struct Root<'a, Message, R: renderer::Renderer> {
+    content: Element<'a, Message, Theme, R>,
+    owner: Option<Stamp>,
+}
+pub(crate) fn root<'a, Message: 'a, R: renderer::Renderer + 'a>(
+    content: impl Into<Element<'a, Message, Theme, R>>,
+    owner: Option<Stamp>,
+) -> Element<'a, Message, Theme, R> {
+    Element::new(Root {
+        content: content.into(),
+        owner,
+    })
+}
+impl<Message, R: renderer::Renderer> Widget<Message, Theme, R> for Root<'_, Message, R> {
+    fn children(&self) -> Vec<Tree> {
+        vec![Tree::new(self.content.as_widget())]
+    }
+    fn diff(&self, tree: &mut Tree) {
+        tree.diff_children(std::slice::from_ref(&self.content));
+    }
+    fn size(&self) -> Size<Length> {
+        self.content.as_widget().size()
+    }
+    fn layout(&mut self, tree: &mut Tree, renderer: &R, limits: &layout::Limits) -> layout::Node {
+        self.content
+            .as_widget_mut()
+            .layout(&mut tree.children[0], renderer, limits)
+    }
+    fn operate(
+        &mut self,
+        tree: &mut Tree,
+        layout: Layout<'_>,
+        renderer: &R,
+        op: &mut dyn Operation,
+    ) {
+        // This is computed from the current App view, never retained widget state.
+        op.custom(None, layout.bounds(), &mut Owner(self.owner));
+        self.content
+            .as_widget_mut()
+            .operate(&mut tree.children[0], layout, renderer, op);
+    }
+    fn update(
+        &mut self,
+        tree: &mut Tree,
+        event: &Event,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        renderer: &R,
+        clipboard: &mut dyn Clipboard,
+        shell: &mut Shell<'_, Message>,
+        viewport: &Rectangle,
+    ) {
+        self.content.as_widget_mut().update(
+            &mut tree.children[0],
+            event,
+            layout,
+            cursor,
+            renderer,
+            clipboard,
+            shell,
+            viewport,
+        );
+    }
+    fn draw(
+        &self,
+        tree: &Tree,
+        renderer: &mut R,
+        theme: &Theme,
+        style: &renderer::Style,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        viewport: &Rectangle,
+    ) {
+        self.content.as_widget().draw(
+            &tree.children[0],
+            renderer,
+            theme,
+            style,
+            layout,
+            cursor,
+            viewport,
+        );
+    }
+    fn mouse_interaction(
+        &self,
+        tree: &Tree,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        viewport: &Rectangle,
+        renderer: &R,
+    ) -> mouse::Interaction {
+        self.content.as_widget().mouse_interaction(
+            &tree.children[0],
+            layout,
+            cursor,
+            viewport,
+            renderer,
+        )
+    }
+    fn overlay<'b>(
+        &'b mut self,
+        tree: &'b mut Tree,
+        layout: Layout<'b>,
+        renderer: &R,
+        viewport: &Rectangle,
+        translation: Vector,
+    ) -> Option<overlay::Element<'b, Message, Theme, R>> {
+        self.content.as_widget_mut().overlay(
+            &mut tree.children[0],
+            layout,
+            renderer,
+            viewport,
+            translation,
+        )
+    }
+}
+
+#[derive(Clone)]
+struct Scroll {
+    index: usize,
+    bounds: Rectangle,
+    capacity: Vector,
+    offset: Vector,
+}
+struct Collect {
+    stamp: Stamp,
+    valid: bool,
+    translation: Vector,
+    scrolls: Vec<Scroll>,
+    pending: Option<Scroll>,
+    index: usize,
+    target: Option<(Rectangle, Vec<Scroll>)>,
+}
+pub(crate) fn task<Message: Send + 'static>(stamp: Stamp) -> Task<Message> {
+    iced::advanced::widget::operate(Collect {
+        stamp,
+        valid: false,
+        translation: Vector::ZERO,
+        scrolls: vec![],
+        pending: None,
+        index: 0,
+        target: None,
+    })
+    .discard()
+}
+impl Operation for Collect {
+    fn custom(&mut self, _: Option<&Id>, _: Rectangle, state: &mut dyn std::any::Any) {
+        if let Some(owner) = state.downcast_ref::<Owner>() {
+            self.valid = owner.0 == Some(self.stamp);
+        }
+    }
+    fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn Operation)) {
+        let previous = (self.translation, self.scrolls.len());
+        if let Some(scroll) = self.pending.take() {
+            self.translation += scroll.offset;
+            self.scrolls.push(scroll);
+        }
+        visit(self);
+        self.translation = previous.0;
+        self.scrolls.truncate(previous.1);
+    }
+    fn scrollable(
+        &mut self,
+        _: Option<&Id>,
+        bounds: Rectangle,
+        content: Rectangle,
+        offset: Vector,
+        _: &mut dyn operation::Scrollable,
+    ) {
+        self.pending = Some(Scroll {
+            index: self.index,
+            bounds: translated(bounds, self.translation),
+            capacity: Vector::new(
+                (content.width - bounds.width).max(0.),
+                (content.height - bounds.height).max(0.),
+            ),
+            offset,
+        });
+        self.index += 1;
+    }
+    fn focusable(&mut self, id: Option<&Id>, bounds: Rectangle, _: &mut dyn operation::Focusable) {
+        if id == Some(&name_id(self.stamp)) {
+            self.target = Some((translated(bounds, self.translation), self.scrolls.clone()));
+        }
+    }
+    fn finish(&self) -> operation::Outcome<()> {
+        if !self.valid {
+            return operation::Outcome::None;
+        }
+        let Some((mut bounds, ancestors)) = self.target.clone() else {
+            return operation::Outcome::None;
+        };
+        let mut shifts = BTreeMap::new();
+        for ancestor in ancestors.iter().rev() {
+            let dx = reveal(
+                bounds.x,
+                bounds.width,
+                ancestor.bounds.x,
+                ancestor.bounds.width,
+            );
+            let dy = reveal(
+                bounds.y,
+                bounds.height,
+                ancestor.bounds.y,
+                ancestor.bounds.height,
+            );
+            // Drawing offsets are rounded; an already-visible axis must not
+            // acquire a scroll delta from a fractional capacity alone.
+            let delta = Vector::new(
+                if dx == 0. {
+                    0.
+                } else {
+                    (ancestor.offset.x + dx).clamp(0., ancestor.capacity.x) - ancestor.offset.x
+                },
+                if dy == 0. {
+                    0.
+                } else {
+                    (ancestor.offset.y + dy).clamp(0., ancestor.capacity.y) - ancestor.offset.y
+                },
+            );
+            if delta != Vector::ZERO {
+                shifts.insert(ancestor.index, delta);
+            }
+            bounds = translated(bounds, delta);
+        }
+        operation::Outcome::Chain(Box::new(Apply {
+            stamp: self.stamp,
+            valid: false,
+            shifts,
+            index: 0,
+        }))
+    }
+}
+fn translated(bounds: Rectangle, delta: Vector) -> Rectangle {
+    Rectangle {
+        x: bounds.x - delta.x,
+        y: bounds.y - delta.y,
+        ..bounds
+    }
+}
+fn reveal(start: f32, length: f32, viewport: f32, size: f32) -> f32 {
+    if start < viewport || length > size {
+        start - viewport
+    } else {
+        (start + length - viewport - size).max(0.)
+    }
+}
+struct Apply {
+    stamp: Stamp,
+    valid: bool,
+    shifts: BTreeMap<usize, Vector>,
+    index: usize,
+}
+impl Operation for Apply {
+    fn custom(&mut self, _: Option<&Id>, _: Rectangle, state: &mut dyn std::any::Any) {
+        if let Some(owner) = state.downcast_ref::<Owner>() {
+            self.valid = owner.0 == Some(self.stamp);
+        }
+    }
+    fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn Operation)) {
+        visit(self);
+    }
+    fn focusable(&mut self, id: Option<&Id>, _: Rectangle, state: &mut dyn operation::Focusable) {
+        if self.valid {
+            if id == Some(&name_id(self.stamp)) {
+                state.focus();
+            } else {
+                state.unfocus();
+            }
+        }
+    }
+    fn scrollable(
+        &mut self,
+        _: Option<&Id>,
+        bounds: Rectangle,
+        content: Rectangle,
+        _: Vector,
+        state: &mut dyn operation::Scrollable,
+    ) {
+        if self.valid
+            && let Some(delta) = self.shifts.get(&self.index)
+        {
+            state.scroll_by(
+                operation::scrollable::AbsoluteOffset {
+                    x: delta.x,
+                    y: delta.y,
+                },
+                bounds,
+                content,
+            );
+        }
+        self.index += 1;
+    }
+}
@@ -2,6 +2,8 @@
 use oa_core::{FragmentOperator, Id, Kind, MessageKind, OccurrenceBody, Project, SharedBody};
 use std::collections::{BTreeMap, BTreeSet};

+pub(super) mod render;
+
 /// Maps already recorded by the sequence renderer. Rows carry their owning sequence.
 pub(crate) struct Geometry<'a> {
    pub rows: &'a BTreeMap<Id, (Id, f32)>,
@@ -0,0 +1,392 @@
+//! Scene bridge for local lifetime geometry; no authoring or model mutations.
+use super::{Geometry, LaneLifetime, Life, Marker, MarkerKind, Span, project_lifetimes};
+use crate::{behavior::Line, style, views::short};
+use iced::{
+    Color, Point, Rectangle, Size,
+    widget::canvas::{self, Frame, Path, Stroke, Text},
+};
+use oa_core::{Id, OccurrenceBody, Project, SharedBody};
+use std::collections::BTreeMap;
+
+#[derive(Debug, Clone, PartialEq)]
+struct EventMarker {
+    event: Marker,
+    lifeline: Id,
+    center: Point,
+    capsule: Rectangle,
+    name: String,
+    sender_x: Option<f32>,
+}
+
+#[derive(Debug, Default, Clone, PartialEq)]
+pub(in crate::behavior) struct Rendering {
+    // Complete rendering positions, including warning-admitted unassigned lanes.
+    // Scene.lanes independently retains the existing authoring eligibility rule.
+    lanes: BTreeMap<Id, f32>,
+    span: Option<Span>,
+    lifetimes: Vec<LaneLifetime>,
+    markers: Vec<EventMarker>,
+}
+
+impl Rendering {
+    pub(in crate::behavior) fn new(
+        project: &Project,
+        owner: Id,
+        lanes: &BTreeMap<Id, f32>,
+        rows: &BTreeMap<Id, (Id, f32)>,
+        insertion_scopes: &BTreeMap<Id, (f32, f32)>,
+        height: f32,
+    ) -> Self {
+        let span = Span {
+            start: 85.,
+            end: height - 20.,
+        };
+        if !span.valid() {
+            return Self::default();
+        }
+        // Insertion scopes deliberately start later and end earlier. Empty and
+        // Create-only scenarios still have the full visible lifetime extent.
+        let mut scopes = insertion_scopes.clone();
+        for (scope, (start, end)) in &mut scopes {
+            if *scope != owner && *start == *end && start.is_finite() {
+                // An empty operand has 42 px between its insertion axis and
+                // frame end. Match the existing 26 px open-activation allowance.
+                *end = *start + 26.;
+            }
+        }
+        scopes.insert(owner, (span.start, span.end));
+        let lifetimes = project_lifetimes(
+            project,
+            owner,
+            &Geometry {
+                rows,
+                scopes: &scopes,
+            },
+        );
+        let lanes: BTreeMap<_, _> = lanes
+            .iter()
+            .filter(|(_, x)| x.is_finite())
+            .map(|(id, x)| (*id, *x))
+            .collect();
+        let mut markers = Vec::new();
+        for lane in &lifetimes {
+            let Some(&x) = lanes.get(&lane.lifeline) else {
+                continue;
+            };
+            for event in &lane.markers {
+                let sender_x = project
+                    .elements
+                    .get(&event.occurrence)
+                    .and_then(|e| e.shared())
+                    .and_then(|body| match body {
+                        SharedBody::Occurrence {
+                            body:
+                                OccurrenceBody::Exchange {
+                                    sender: Some(sender),
+                                    ..
+                                },
+                            ..
+                        } => lanes.get(sender).copied(),
+                        _ => None,
+                    });
+                markers.push(EventMarker {
+                    event: *event,
+                    lifeline: lane.lifeline,
+                    center: Point::new(x, event.y),
+                    capsule: Rectangle::new(
+                        Point::new(x - 70., event.y - 14.),
+                        Size::new(140., 28.),
+                    ),
+                    name: project.named(lane.lifeline).to_owned(),
+                    sender_x,
+                });
+            }
+        }
+        Self {
+            lanes,
+            span: Some(span),
+            lifetimes,
+            markers,
+        }
+    }
+
+    pub(in crate::behavior) fn align_messages(&self, lines: &mut [Line]) {
+        for marker in &self.markers {
+            let Some(sender) = marker.sender_x else {
+                continue;
+            };
+            let Some(line) = lines
+                .iter_mut()
+                .find(|line| line.id == marker.event.occurrence)
+            else {
+                continue;
+            };
+            let x = marker.center.x;
+            let y = marker.center.y;
+            let self_message = sender == x;
+            let end_x = match marker.event.kind {
+                MarkerKind::Birth if sender < x => marker.capsule.x,
+                MarkerKind::Birth => marker.capsule.x + marker.capsule.width,
+                MarkerKind::Death => x,
+            };
+            line.points = if self_message {
+                // The receiver is on the recorded occurrence row, including self
+                // lifecycle events. The elbow stays outside the birth capsule.
+                let elbow = x + 112.;
+                line.label_at = Point::new(x + 12., y - 52.);
+                vec![
+                    Point::new(x, y - 24.),
+                    Point::new(elbow, y - 24.),
+                    Point::new(elbow, y),
+                    Point::new(end_x, y),
+                ]
+            } else {
+                if marker.event.kind == MarkerKind::Birth {
+                    // Keep the label above the capsule, including right-to-left
+                    // messages whose existing label starts beside the receiver.
+                    line.label_at.y = y - 40.;
+                }
+                vec![Point::new(sender, y), Point::new(end_x, y)]
+            };
+        }
+    }
+
+    pub(in crate::behavior) fn alive_spans(
+        &self,
+        lifeline: Id,
+        scope: Id,
+        top: f32,
+        bottom: f32,
+    ) -> Vec<Span> {
+        if !top.is_finite() || !bottom.is_finite() || bottom <= top {
+            return vec![];
+        }
+        self.lifetimes
+            .iter()
+            .find(|lane| lane.lifeline == lifeline)
+            .into_iter()
+            .flat_map(|lane| &lane.intervals)
+            .filter(|interval| interval.scope == scope && interval.life == Life::Alive)
+            .filter_map(|interval| {
+                let start = top.max(interval.span.start);
+                let end = bottom.min(interval.span.end);
+                (start < end).then_some(Span { start, end })
+            })
+            .collect()
+    }
+
+    pub(in crate::behavior) fn marker_at(&self, point: Point) -> Option<Id> {
+        self.markers
+            .iter()
+            .rev()
+            .find(|marker| match marker.event.kind {
+                MarkerKind::Birth => marker.capsule.contains(point),
+                MarkerKind::Death => marker_distance(marker, point) <= 1.25,
+            })
+            .map(|marker| marker.event.occurrence)
+    }
+
+    pub(in crate::behavior) fn nearest_marker(&self, point: Point) -> Option<(Id, f32)> {
+        if !point.x.is_finite() || !point.y.is_finite() {
+            return None;
+        }
+        // Exact visible shapes are tested first by Scene. A low-zoom tolerance
+        // must not outrank another marker's actual capsule, a header, or a label.
+        self.markers
+            .iter()
+            .map(|marker| (marker.event.occurrence, marker_distance(marker, point)))
+            .min_by(|a, b| a.1.total_cmp(&b.1).then_with(|| a.0.cmp(&b.0)))
+    }
+
+    pub(in crate::behavior) fn lane_at(&self, point: Point, scale: f32) -> Option<Id> {
+        let span = self.span?;
+        if !scale.is_finite() || scale <= 0. || point.y < span.start || point.y > span.end {
+            return None;
+        }
+        self.lanes
+            .iter()
+            .filter(|(_, x)| (**x - point.x).abs() < 12. / scale)
+            .min_by(|a, b| (a.1 - point.x).abs().total_cmp(&(b.1 - point.x).abs()))
+            .map(|(id, _)| *id)
+    }
+
+    pub(in crate::behavior) fn draw_lanes(&self, frame: &mut Frame, selected: Id) {
+        let Some(span) = self.span else {
+            return;
+        };
+        for (&id, &x) in &self.lanes {
+            frame.stroke(
+                &Path::line(Point::new(x, span.start), Point::new(x, span.end)),
+                Stroke {
+                    line_dash: canvas::LineDash {
+                        segments: &[2., 5.],
+                        offset: 0,
+                    },
+                    ..Stroke::default()
+                        .with_width(1.)
+                        .with_color(if id == selected {
+                            Color::from_rgb8(148, 190, 187)
+                        } else {
+                            Color::from_rgb8(214, 222, 222)
+                        })
+                },
+            );
+        }
+        for lifetime in &self.lifetimes {
+            let Some(&x) = self.lanes.get(&lifetime.lifeline) else {
+                continue;
+            };
+            for interval in &lifetime.intervals {
+                match interval.life {
+                    Life::Alive => frame.stroke(
+                        &Path::line(
+                            Point::new(x, interval.span.start),
+                            Point::new(x, interval.span.end),
+                        ),
+                        Stroke::default().with_width(2.).with_color(
+                            if lifetime.lifeline == selected {
+                                style::TEAL
+                            } else {
+                                Color::from_rgb8(91, 113, 113)
+                            },
+                        ),
+                    ),
+                    Life::Unresolved if interval.span.end - interval.span.start >= 16. => {
+                        frame.fill_text(Text {
+                            content: "?".into(),
+                            position: Point::new(x + 9., interval.span.start + 2.),
+                            size: 11.into(),
+                            color: style::MUTED,
+                            ..Default::default()
+                        });
+                    }
+                    _ => {}
+                }
+            }
+        }
+        if !self.lanes.is_empty() {
+            frame.fill_text(Text {
+                content:
+                    "Dotted: editing guide · Solid: local lifetime · ?: lifetime depends on path"
+                        .into(),
+                position: Point::new(28., span.end + 4.),
+                size: 10.into(),
+                color: style::MUTED,
+                ..Default::default()
+            });
+        }
+    }
+
+    pub(in crate::behavior) fn draw_markers(
+        &self,
+        frame: &mut Frame,
+        selected: Id,
+        scale: f32,
+        pan: iced::Vector,
+    ) {
+        for marker in &self.markers {
+            let color = if selected == marker.event.occurrence || selected == marker.lifeline {
+                style::TEAL
+            } else {
+                style::INK
+            };
+            match marker.event.kind {
+                MarkerKind::Birth => {
+                    let path = Path::rounded_rectangle(
+                        marker.capsule.position(),
+                        marker.capsule.size(),
+                        6.into(),
+                    );
+                    frame.fill(&path, Color::from_rgb8(243, 248, 248));
+                    frame.stroke(
+                        &path,
+                        Stroke::default().with_color(color).with_width(
+                            if selected == marker.event.occurrence {
+                                2.5
+                            } else {
+                                1.5
+                            },
+                        ),
+                    );
+                    if let Some(clip) = birth_label_clip(pan, marker.capsule, scale, frame.size()) {
+                        // WGPU clipped frames start with an identity transform;
+                        // neither the parent's pan/scale nor its clip is inherited.
+                        frame.with_clip(clip, |label| {
+                            label.translate(pan);
+                            label.scale(scale);
+                            label.fill_text(Text {
+                                content: short(&marker.name, 18),
+                                position: marker.capsule.position() + iced::Vector::new(8., 6.),
+                                size: 12.into(),
+                                color,
+                                ..Default::default()
+                            });
+                        });
+                    }
+                }
+                MarkerKind::Death => {
+                    for (a, b) in death_strokes(marker.center) {
+                        frame.stroke(
+                            &Path::line(a, b),
+                            Stroke::default().with_color(color).with_width(2.5),
+                        );
+                    }
+                }
+            }
+        }
+    }
+}
+
+fn birth_label_clip(
+    pan: iced::Vector,
+    capsule: Rectangle,
+    scale: f32,
+    viewport: Size,
+) -> Option<Rectangle> {
+    if !pan.x.is_finite() || !pan.y.is_finite() || !scale.is_finite() || scale <= 0. {
+        return None;
+    }
+    Rectangle::new(
+        Point::new(
+            pan.x + (capsule.x + 8.) * scale,
+            pan.y + (capsule.y + 4.) * scale,
+        ),
+        Size::new((capsule.width - 16.) * scale, (capsule.height - 8.) * scale),
+    )
+    .intersection(&Rectangle::new(Point::ORIGIN, viewport))
+}
+
+fn marker_distance(marker: &EventMarker, point: Point) -> f32 {
+    match marker.event.kind {
+        MarkerKind::Birth => {
+            let dx = (marker.capsule.x - point.x)
+                .max(point.x - marker.capsule.x - marker.capsule.width)
+                .max(0.);
+            let dy = (marker.capsule.y - point.y)
+                .max(point.y - marker.capsule.y - marker.capsule.height)
+                .max(0.);
+            dx.hypot(dy)
+        }
+        MarkerKind::Death => death_strokes(marker.center)
+            .iter()
+            .map(|(a, b)| crate::diagram::distance_to_segment(point, *a, *b))
+            .fold(f32::INFINITY, f32::min),
+    }
+}
+
+fn death_strokes(center: Point) -> [(Point, Point); 2] {
+    [
+        (
+            center + iced::Vector::new(-7., -7.),
+            center + iced::Vector::new(7., 7.),
+        ),
+        (
+            center + iced::Vector::new(-7., 7.),
+            center + iced::Vector::new(7., -7.),
+        ),
+    ]
+}
+
+#[cfg(test)]
+#[path = "render_tests.rs"]
+mod tests;
@@ -0,0 +1,973 @@
+use super::*;
+use crate::{behavior::Scene, document::Document};
+use iced::Size;
+use oa_core::*;
+
+struct Fixture {
+    project: Project,
+    owner: Id,
+    sender: Id,
+    receiver: Id,
+    work: Id,
+    exchange: Id,
+}
+impl Fixture {
+    fn new(layer: Layer) -> Self {
+        let mut project = Project::empty();
+        let kind = if layer == Layer::Oa {
+            Kind::Activity
+        } else {
+            Kind::Function
+        };
+        let a = project.add_element(kind, layer, "Request", None).unwrap();
+        let work = project.add_element(kind, layer, "Provide", None).unwrap();
+        let exchange = project.relate(
+            if layer == Layer::Oa {
+                RelationKind::Interaction
+            } else {
+                RelationKind::FunctionalExchange
+            },
+            "Service",
+            a,
+            work,
+        );
+        let owner = project
+            .add_element(Kind::Scenario, layer, "Lifecycle", None)
+            .unwrap();
+        let mut lane = |name, represented| {
+            let id = project
+                .add_element(Kind::Lifeline, layer, name, Some(owner))
+                .unwrap();
+            *project.elements.get_mut(&id).unwrap().shared_mut().unwrap() = SharedBody::Lifeline {
+                represented: Some(represented),
+            };
+            id
+        };
+        let sender = lane("Requester", a);
+        let receiver = lane("Provider", work);
+        Self {
+            project,
+            owner,
+            sender,
+            receiver,
+            work,
+            exchange,
+        }
+    }
+    fn occurrence(&mut self, parent: Id, name: &str, body: OccurrenceBody) -> Id {
+        let mut element = self
+            .project
+            .make_element(
+                Kind::Occurrence,
+                self.project.elements[&parent].layer(),
+                name,
+                Some(parent),
+            )
+            .unwrap();
+        let id = element.id;
+        *element.shared_mut().unwrap() = SharedBody::Occurrence {
+            body,
+            precondition: String::new(),
+            postcondition: String::new(),
+        };
+        self.project.elements.insert(id, element);
+        let parent = self.project.elements.get_mut(&parent).unwrap();
+        if let Some(steps) = parent.steps_mut() {
+            steps.push(id);
+        } else if let Some(SharedBody::Occurrence {
+            body: OccurrenceBody::Fragment { branches, .. },
+            ..
+        }) = parent.shared_mut()
+        {
+            branches.push(id);
+        } else {
+            panic!("fixture parent must own ordered occurrences or operands");
+        }
+        id
+    }
+    fn message(&mut self, parent: Id, kind: MessageKind) -> Id {
+        self.occurrence(
+            parent,
+            "Message",
+            OccurrenceBody::Exchange {
+                exchange: Some(self.exchange),
+                sender: Some(self.sender),
+                receiver: Some(self.receiver),
+                message_kind: kind,
+                operation: None,
+                reply_to: None,
+                values: vec![],
+            },
+        )
+    }
+    fn fragment(&mut self, parent: Id, operator: FragmentOperator) -> Id {
+        self.occurrence(
+            parent,
+            "Paths",
+            OccurrenceBody::Fragment {
+                operator,
+                branches: vec![],
+            },
+        )
+    }
+    fn branch(&mut self, fragment: Id) -> Id {
+        self.occurrence(
+            fragment,
+            "Operand",
+            OccurrenceBody::Branch {
+                guard: "condition".into(),
+                occurrences: vec![],
+            },
+        )
+    }
+    fn document(&self) -> Document {
+        validate_candidate(&self.project).expect("ordinary core admission must succeed");
+        let mut bundle = source_project::format_bundle(&self.project);
+        for text in bundle.files.values_mut() {
+            *text = format!(
+                "// Retain exact authored CRLF and Unicode Ω\r\n{}",
+                text.replace('\n', "\r\n")
+            );
+        }
+        let document =
+            Document::from_bundle(bundle.clone(), source_project::ProjectLimits::default())
+                .unwrap();
+        assert_eq!(document.project(), &self.project);
+        assert_eq!(document.bundle(), &bundle);
+        document
+    }
+    fn scene(&self) -> Scene {
+        let document = self.document();
+        let before = document.snapshot();
+        let scene = Scene::sequence(document.project(), self.owner, self.owner);
+        assert_eq!(document.project(), &before.decoded.project);
+        assert_eq!(document.bundle(), &before.bundle);
+        assert_eq!(document.revision(), 0);
+        assert!(!document.can_undo() && !document.can_redo() && !document.dirty());
+        assert_eq!(
+            scene.lifecycle,
+            Scene::sequence(document.project(), self.owner, self.owner).lifecycle
+        );
+        assert!(
+            scene
+                .lines
+                .iter()
+                .flat_map(|line| &line.points)
+                .all(|p| p.x.is_finite() && p.y.is_finite())
+        );
+        scene
+    }
+}
+
+fn intervals(scene: &Scene, lifeline: Id, scope: Id) -> Vec<(f32, f32, Life)> {
+    scene
+        .lifecycle
+        .lifetimes
+        .iter()
+        .find(|lane| lane.lifeline == lifeline)
+        .unwrap()
+        .intervals
+        .iter()
+        .filter(|i| i.scope == scope)
+        .map(|i| (i.span.start, i.span.end, i.life))
+        .collect()
+}
+
+#[test]
+fn real_scene_long_header_title_and_detail_keep_names_and_have_bounded_clips() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        for name in [
+            "W".repeat(18),
+            "界".repeat(24),
+            "e\u{301}".repeat(24),
+            "👩\u{200d}🔧".repeat(12),
+        ] {
+            let mut f = Fixture::new(layer);
+            f.project.elements.get_mut(&f.receiver).unwrap().name = name.clone();
+            f.project.elements.get_mut(&f.work).unwrap().name = name.clone();
+            let scene = f.scene();
+            let header = scene.boxes.iter().find(|b| b.id == f.receiver).unwrap();
+            assert_eq!(header.title, format!("Lane · {name}"));
+            assert_eq!(header.detail, name);
+            assert_eq!(header.rect.size(), Size::new(204., 70.));
+            assert_eq!(scene.hit(header.rect.center()), Some(f.receiver));
+            // Scroll offset is handled by the existing outer canvas/scrollable;
+            // these are the local drawing frame's coordinates, not screen input.
+            for scale in [0.05, 0.5, 0.512, 0.64, 0.8, 1., 1.953125, 2.] {
+                let clip = crate::behavior::box_text_clip(
+                    iced::Vector::ZERO,
+                    header.rect,
+                    scale,
+                    Size::new(2000., 2000.),
+                )
+                .unwrap();
+                let world = Rectangle::new(
+                    Point::new(clip.x / scale, clip.y / scale),
+                    Size::new(clip.width / scale, clip.height / scale),
+                );
+                assert!((world.x - header.rect.x - 10.).abs() < 0.001);
+                assert!((world.y - header.rect.y - 8.).abs() < 0.001);
+                assert!((world.width - 184.).abs() < 0.001);
+                assert!((world.height - 54.).abs() < 0.001);
+                assert!(header.rect.contains(world.position()));
+                assert!(
+                    header
+                        .rect
+                        .contains(Point::new(world.x + world.width, world.y + world.height,))
+                );
+            }
+        }
+    }
+}
+
+#[test]
+fn box_text_clip_intersects_parent_viewport_and_rejects_empty_interiors() {
+    use crate::behavior::box_text_clip;
+    let card = Rectangle::new(Point::new(100., 200.), Size::new(204., 70.));
+    assert_eq!(
+        box_text_clip(iced::Vector::ZERO, card, 2., Size::new(300., 500.)),
+        Some(Rectangle::new(Point::new(220., 416.), Size::new(80., 84.)))
+    );
+    assert_eq!(
+        box_text_clip(
+            iced::Vector::ZERO,
+            Rectangle::new(Point::new(-20., -10.), card.size()),
+            2.,
+            Size::new(300., 500.),
+        ),
+        Some(Rectangle::new(Point::ORIGIN, Size::new(300., 104.)))
+    );
+    for viewport in [Size::new(200., 500.), Size::new(300., 400.), Size::ZERO] {
+        assert_eq!(box_text_clip(iced::Vector::ZERO, card, 2., viewport), None);
+    }
+    for scale in [0., -1., f32::NAN, f32::INFINITY] {
+        assert_eq!(
+            box_text_clip(iced::Vector::ZERO, card, scale, Size::new(1000., 1000.)),
+            None
+        );
+    }
+    for size in [Size::new(20., 70.), Size::new(204., 16.), Size::ZERO] {
+        assert_eq!(
+            box_text_clip(
+                iced::Vector::ZERO,
+                Rectangle::new(Point::ORIGIN, size),
+                1.,
+                card.size()
+            ),
+            None
+        );
+    }
+}
+
+#[test]
+fn real_scene_wide_latin_header_exceeds_old_character_budget() {
+    use iced::advanced::text::{self, Paragraph as _};
+    let mut f = Fixture::new(Layer::Oa);
+    f.project.elements.get_mut(&f.receiver).unwrap().name = "W".repeat(18);
+    f.project.elements.get_mut(&f.work).unwrap().name = "W".repeat(24);
+    let scene = f.scene();
+    let header = scene.boxes.iter().find(|b| b.id == f.receiver).unwrap();
+    for (content, size, divisor) in [(&header.title, 13., 7.), (&header.detail, 11., 6.)] {
+        let label = iced::widget::canvas::Text {
+            content: crate::views::short(content, ((header.rect.width - 25.) / divisor) as usize),
+            size: size.into(),
+            ..Default::default()
+        };
+        // Use the same real paragraph/font/shaping defaults as canvas Text.
+        // The native defect survives short(): glyph width, not scalar count,
+        // is what exceeds the card. This is a font witness, not a pixel gate.
+        let paragraph = <iced::Renderer as text::Renderer>::Paragraph::with_text(text::Text {
+            content: label.content.as_str(),
+            bounds: Size::INFINITE,
+            size: label.size,
+            line_height: label.line_height,
+            font: label.font,
+            align_x: label.align_x,
+            align_y: label.align_y,
+            shaping: label.shaping,
+            wrapping: text::Wrapping::default(),
+        });
+        let old_available = header.rect.width - 12.;
+        assert!(
+            paragraph.min_width() > old_available,
+            "wide glyph fixture must overflow the old unbounded card: {} <= {old_available}",
+            paragraph.min_width()
+        );
+    }
+}
+
+#[test]
+fn birth_label_clip_keeps_padded_world_bounds_at_each_scene_scale() {
+    let capsule = Rectangle::new(Point::new(100., 200.), Size::new(140., 28.));
+    for (scale, expected) in [
+        (
+            0.05,
+            Rectangle::new(Point::new(5.4, 10.2), Size::new(6.2, 1.)),
+        ),
+        (
+            0.5,
+            Rectangle::new(Point::new(54., 102.), Size::new(62., 10.)),
+        ),
+        (
+            1.,
+            Rectangle::new(Point::new(108., 204.), Size::new(124., 20.)),
+        ),
+        (
+            2.,
+            Rectangle::new(Point::new(216., 408.), Size::new(248., 40.)),
+        ),
+    ] {
+        let clip =
+            birth_label_clip(iced::Vector::ZERO, capsule, scale, Size::new(1000., 1000.)).unwrap();
+        for (actual, expected) in [
+            (clip.x, expected.x),
+            (clip.y, expected.y),
+            (clip.width, expected.width),
+            (clip.height, expected.height),
+        ] {
+            assert!((actual - expected).abs() < 0.0001);
+        }
+        assert!(capsule.contains(Point::new(clip.x / scale, clip.y / scale)));
+        assert!(capsule.contains(Point::new(
+            (clip.x + clip.width) / scale,
+            (clip.y + clip.height) / scale,
+        )));
+    }
+}
+
+#[test]
+fn birth_label_clip_preserves_parent_viewport_bounds() {
+    let capsule = Rectangle::new(Point::new(100., 200.), Size::new(140., 28.));
+    assert_eq!(
+        birth_label_clip(iced::Vector::ZERO, capsule, 2., Size::new(300., 420.)),
+        Some(Rectangle::new(Point::new(216., 408.), Size::new(84., 12.)))
+    );
+    let crossing_origin = Rectangle::new(Point::new(-20., -10.), Size::new(140., 28.));
+    assert_eq!(
+        birth_label_clip(
+            iced::Vector::ZERO,
+            crossing_origin,
+            2.,
+            Size::new(300., 420.)
+        ),
+        Some(Rectangle::new(Point::ORIGIN, Size::new(224., 28.)))
+    );
+    for viewport in [Size::new(200., 420.), Size::new(300., 400.), Size::ZERO] {
+        assert_eq!(
+            birth_label_clip(iced::Vector::ZERO, capsule, 2., viewport),
+            None
+        );
+    }
+    for scale in [0., -1., f32::NAN, f32::INFINITY] {
+        assert_eq!(
+            birth_label_clip(iced::Vector::ZERO, capsule, scale, Size::new(1000., 1000.)),
+            None
+        );
+    }
+}
+
+#[test]
+fn real_scene_empty_and_create_only_use_visible_root_extents_not_insertion_bounds() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = Fixture::new(layer);
+        let empty = f.scene();
+        assert_eq!(empty.sequence_bounds[&f.owner], (106., 106.));
+        assert_eq!(
+            intervals(&empty, f.receiver, f.owner),
+            vec![(85., empty.size.height - 20., Life::Alive)]
+        );
+        assert!(empty.lines.is_empty(), "lane guides are not message lines");
+        let create = f.message(f.owner, MessageKind::Create);
+        let scene = f.scene();
+        let birth = scene.rows[&create].1;
+        assert_eq!(birth, 148.);
+        assert_eq!(scene.sequence_bounds[&f.owner], (106., 198.));
+        assert_eq!(
+            intervals(&scene, f.receiver, f.owner),
+            vec![
+                (85., birth, Life::Absent),
+                (birth, scene.size.height - 20., Life::Alive),
+            ]
+        );
+        assert_eq!(
+            intervals(&scene, f.sender, f.owner),
+            vec![(85., scene.size.height - 20., Life::Alive)]
+        );
+        assert_eq!(scene.slots[0].y, 106.);
+        assert_eq!(
+            scene.lane_at(Point::new(scene.lanes[&f.receiver], 90.)),
+            Some(f.receiver)
+        );
+    }
+}
+
+#[test]
+fn real_scene_birth_death_markers_align_endpoints_and_win_selection_without_mutating_source() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = Fixture::new(layer);
+        let create = f.message(f.owner, MessageKind::Create);
+        f.occurrence(
+            f.owner,
+            "Work",
+            OccurrenceBody::Action {
+                action: Some(f.work),
+                lifeline: Some(f.receiver),
+            },
+        );
+        let delete = f.message(f.owner, MessageKind::Delete);
+        let mut scene = f.scene();
+        let birth = scene.rows[&create].1;
+        let death = scene.rows[&delete].1;
+        assert_eq!(
+            intervals(&scene, f.receiver, f.owner),
+            vec![
+                (85., birth, Life::Absent),
+                (birth, death, Life::Alive),
+                (death, scene.size.height - 20., Life::Absent),
+            ]
+        );
+        let capsule = scene
+            .lifecycle
+            .markers
+            .iter()
+            .find(|m| m.event.occurrence == create)
+            .unwrap()
+            .capsule;
+        let line = scene.lines.iter().find(|l| l.id == create).unwrap();
+        let expected_x = if scene.lanes[&f.sender] < scene.lanes[&f.receiver] {
+            capsule.x
+        } else {
+            capsule.x + capsule.width
+        };
+        assert_eq!(line.points.last(), Some(&Point::new(expected_x, birth)));
+        assert!(
+            line.label_at.y + 22. < capsule.y,
+            "message caption clears birth capsule"
+        );
+        let line = scene.lines.iter().find(|l| l.id == delete).unwrap();
+        assert_eq!(
+            line.points.last(),
+            Some(&Point::new(scene.lanes[&f.receiver], death))
+        );
+        for scale in [0.5, 1., 2.] {
+            scene.scale = scale;
+            assert_eq!(
+                scene.hit(Point::new(scene.lanes[&f.receiver], birth)),
+                Some(create)
+            );
+            assert_eq!(
+                scene.hit(Point::new(scene.lanes[&f.receiver], death)),
+                Some(delete)
+            );
+            assert_eq!(
+                scene.hit(Point::new(
+                    scene.lanes[&f.receiver],
+                    scene.size.height - 25.
+                )),
+                Some(f.receiver)
+            );
+            assert_eq!(
+                scene.hit(Point::new(scene.lanes[&f.receiver], 40.)),
+                Some(f.receiver)
+            );
+        }
+    }
+}
+
+#[test]
+fn real_scene_branch_delete_clips_only_its_activation_and_keeps_unanswered_call_visible() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = Fixture::new(layer);
+        let call = f.message(f.owner, MessageKind::Call);
+        let fragment = f.fragment(f.owner, FragmentOperator::Alternative);
+        let left = f.branch(fragment);
+        let delete = f.message(left, MessageKind::Delete);
+        let right = f.branch(fragment);
+        let scene = f.scene();
+        let death = scene.rows[&delete].1;
+        let (left_start, left_end) = scene.sequence_bounds[&left];
+        let (right_start, _) = scene.sequence_bounds[&right];
+        let bars: Vec<_> = scene
+            .boxes
+            .iter()
+            .filter(|b| b.id == call && b.rect.width == 8.)
+            .map(|b| b.rect)
+            .collect();
+        assert!(
+            bars.iter()
+                .any(|r| r.y == left_start && r.y + r.height == death)
+        );
+        assert!(
+            !bars
+                .iter()
+                .any(|r| r.y < left_end && r.y + r.height > death && r.y >= left_start)
+        );
+        assert!(
+            bars.iter().any(|r| r.y == right_start && r.height == 26.),
+            "empty exclusive sibling retains its own open activation"
+        );
+        assert_eq!(
+            intervals(&scene, f.receiver, right),
+            vec![(right_start, right_start + 26., Life::Alive)]
+        );
+        let frame_end = scene.boxes.iter().find(|b| b.id == fragment).unwrap().rect;
+        assert!(
+            !bars.iter().any(|r| r.y >= frame_end.y + frame_end.height),
+            "uncertain post-fragment lifetime cannot carry a definite activation bar"
+        );
+        assert!(
+            scene
+                .open_calls
+                .iter()
+                .any(|p| p.y < death && p.y > left_start)
+        );
+        assert!(scene.open_calls.iter().any(|p| p.y > right_start));
+        assert_eq!(
+            intervals(&scene, f.receiver, left),
+            vec![
+                (left_start, death, Life::Alive),
+                (death, left_end, Life::Absent)
+            ]
+        );
+        assert_eq!(
+            intervals(&scene, f.receiver, f.owner).last().unwrap().2,
+            Life::Unresolved
+        );
+        assert!(!f.project.elements.values().any(|e| matches!(
+            e.shared(),
+            Some(SharedBody::Occurrence {
+                body: OccurrenceBody::Exchange {
+                    message_kind: MessageKind::Reply,
+                    ..
+                },
+                ..
+            })
+        )));
+    }
+}
+
+#[test]
+fn real_scene_unassigned_lanes_and_explicit_incomplete_receiver_keep_real_marker_identity() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = Fixture::new(layer);
+        *f.project
+            .elements
+            .get_mut(&f.receiver)
+            .unwrap()
+            .shared_mut()
+            .unwrap() = SharedBody::Lifeline { represented: None };
+        let create = f.message(f.owner, MessageKind::Create);
+        if let Some(SharedBody::Occurrence {
+            body: OccurrenceBody::Exchange { exchange, .. },
+            ..
+        }) = f.project.elements.get_mut(&create).unwrap().shared_mut()
+        {
+            *exchange = None;
+        }
+        let scene = f.scene();
+        assert!(
+            !scene.lanes.contains_key(&f.receiver),
+            "authoring eligibility remains separate"
+        );
+        let x = scene.lifecycle.lanes[&f.receiver];
+        assert_eq!(scene.lifecycle.markers[0].lifeline, f.receiver);
+        assert_eq!(
+            scene.hit(Point::new(x, scene.rows[&create].1)),
+            Some(create)
+        );
+        assert_eq!(scene.hit(Point::new(x, 40.)), Some(f.receiver));
+        assert_eq!(
+            scene.hit(Point::new(x, scene.size.height - 25.)),
+            Some(f.receiver)
+        );
+        assert_eq!(scene.lane_at(Point::new(x, 90.)), None);
+        if let Some(SharedBody::Occurrence {
+            body: OccurrenceBody::Exchange {
+                receiver, exchange, ..
+            },
+            ..
+        }) = f.project.elements.get_mut(&create).unwrap().shared_mut()
+        {
+            *receiver = None;
+            *exchange = Some(f.exchange);
+        }
+        let missing = f.scene();
+        assert!(
+            missing.lifecycle.markers.is_empty(),
+            "do not infer receiver from global exchange"
+        );
+    }
+}
+
+#[test]
+fn real_scene_minimum_zoom_marker_halos_do_not_steal_adjacent_capsule_or_header_hits() {
+    let mut f = Fixture::new(Layer::Sa);
+    *f.project
+        .elements
+        .get_mut(&f.receiver)
+        .unwrap()
+        .shared_mut()
+        .unwrap() = SharedBody::Lifeline { represented: None };
+    let create = f.message(f.owner, MessageKind::Create);
+    let delete = f.message(f.owner, MessageKind::Delete);
+    for event in [create, delete] {
+        if let Some(SharedBody::Occurrence {
+            body: OccurrenceBody::Exchange { exchange, .. },
+            ..
+        }) = f.project.elements.get_mut(&event).unwrap().shared_mut()
+        {
+            *exchange = None;
+        }
+    }
+    let mut scene = f.scene();
+    let x = scene.lifecycle.lanes[&f.receiver];
+    assert_eq!(scene.rows[&delete].1 - scene.rows[&create].1, 92.);
+    for scale in [0.05, 0.1, 0.5, 1., 2.] {
+        scene.scale = scale;
+        assert_eq!(
+            scene.hit(Point::new(x, scene.rows[&create].1)),
+            Some(create)
+        );
+        assert_eq!(
+            scene.hit(Point::new(x, scene.rows[&delete].1)),
+            Some(delete)
+        );
+        assert_eq!(scene.hit(Point::new(x, 40.)), Some(f.receiver));
+        if scale <= 0.1 {
+            for offset in [-25., -15., 15., 25.] {
+                assert_eq!(
+                    scene.hit(Point::new(x, scene.rows[&delete].1 + offset)),
+                    Some(delete),
+                    "a nearby death halo must beat an earlier message's wider tolerance"
+                );
+            }
+        }
+    }
+}
+
+#[test]
+fn real_scene_minimum_zoom_near_ordinary_message_wins_over_lifecycle_halos() {
+    let mut f = Fixture::new(Layer::Sa);
+    f.message(f.owner, MessageKind::Create);
+    let ordinary = f.message(f.owner, MessageKind::Asynchronous);
+    f.message(f.owner, MessageKind::Delete);
+    let mut scene = f.scene();
+    let x = (scene.lanes[&f.sender] + scene.lanes[&f.receiver]) / 2.;
+    for scale in [0.05, 0.1] {
+        scene.scale = scale;
+        assert_eq!(
+            scene.hit(Point::new(x, scene.rows[&ordinary].1 + 2.)),
+            Some(ordinary)
+        );
+    }
+}
+
+#[test]
+fn real_scene_self_lifecycle_elbows_end_on_recorded_marker_rows() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        for kind in [MessageKind::Create, MessageKind::Delete] {
+            let mut f = Fixture::new(layer);
+            let event = f.message(f.owner, kind);
+            if let Some(SharedBody::Occurrence {
+                body:
+                    OccurrenceBody::Exchange {
+                        exchange, sender, ..
+                    },
+                ..
+            }) = f.project.elements.get_mut(&event).unwrap().shared_mut()
+            {
+                *exchange = None;
+                *sender = Some(f.receiver);
+            }
+            let scene = f.scene();
+            let marker = &scene.lifecycle.markers[0];
+            let line = scene.lines.iter().find(|l| l.id == event).unwrap();
+            assert_eq!(line.points.len(), 4);
+            assert_eq!(line.points[0].y, marker.center.y - 24.);
+            assert_eq!(line.points[3].y, marker.center.y);
+            assert_eq!(
+                line.points[3].x,
+                if marker.event.kind == MarkerKind::Birth {
+                    marker.capsule.x + marker.capsule.width
+                } else {
+                    marker.center.x
+                }
+            );
+            assert!(line.points[1].x > marker.capsule.x + marker.capsule.width);
+            assert_eq!(scene.hit(marker.center), Some(event));
+        }
+    }
+}
+
+#[test]
+fn real_scene_self_delete_caption_clears_the_preceding_action_box() {
+    let mut f = Fixture::new(Layer::Sa);
+    let action = f.occurrence(
+        f.owner,
+        "Finish work",
+        OccurrenceBody::Action {
+            action: Some(f.work),
+            lifeline: Some(f.receiver),
+        },
+    );
+    let delete = f.message(f.owner, MessageKind::Delete);
+    if let Some(SharedBody::Occurrence {
+        body: OccurrenceBody::Exchange {
+            exchange, sender, ..
+        },
+        ..
+    }) = f.project.elements.get_mut(&delete).unwrap().shared_mut()
+    {
+        *exchange = None;
+        *sender = Some(f.receiver);
+    }
+    let scene = f.scene();
+    let action = scene.boxes.iter().find(|b| b.id == action).unwrap();
+    let line = scene.lines.iter().find(|l| l.id == delete).unwrap();
+    assert!(line.label_at.y > action.rect.y + action.rect.height);
+    assert!(line.label_at.y + 22. < line.points[0].y);
+    assert_eq!(line.points[3].y, scene.rows[&delete].1);
+    assert_eq!(
+        scene
+            .slots
+            .iter()
+            .find(|s| s.slot.before == Some(delete))
+            .unwrap()
+            .y,
+        scene.rows[&delete].1 - 42.
+    );
+}
+
+#[test]
+fn real_scene_conditional_repeated_and_parallel_scopes_do_not_claim_definite_continuation() {
+    for operator in [
+        FragmentOperator::Alternative,
+        FragmentOperator::Optional,
+        FragmentOperator::Loop,
+        FragmentOperator::Parallel,
+    ] {
+        let mut f = Fixture::new(Layer::Sa);
+        let fragment = f.fragment(f.owner, operator);
+        let first = f.branch(fragment);
+        let create = f.message(first, MessageKind::Create);
+        let scene = f.scene();
+        assert_eq!(scene.lifecycle.markers[0].event.occurrence, create);
+        assert_eq!(
+            intervals(&scene, f.receiver, f.owner).first().unwrap().2,
+            Life::Unresolved
+        );
+        assert_eq!(
+            intervals(&scene, f.receiver, f.owner).last().unwrap().2,
+            Life::Unresolved
+        );
+        assert!(
+            scene
+                .lifecycle
+                .lifetimes
+                .iter()
+                .find(|l| l.lifeline == f.sender)
+                .unwrap()
+                .intervals
+                .iter()
+                .all(|i| i.life == Life::Alive)
+        );
+    }
+}
+
+#[test]
+fn real_scene_lifecycle_edit_undo_redo_restores_exact_source_and_changed_geometry() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = Fixture::new(layer);
+        let create = f.message(f.owner, MessageKind::Create);
+        let mut document = f.document();
+        let before = document.snapshot();
+        let geometry = Scene::sequence(document.project(), f.owner, create).lifecycle;
+        let mut edited = document.project().elements[&create].clone();
+        if let Some(SharedBody::Occurrence {
+            body: OccurrenceBody::Exchange { message_kind, .. },
+            ..
+        }) = edited.shared_mut()
+        {
+            *message_kind = MessageKind::Asynchronous;
+        }
+        document
+            .execute(Command::EditElement(create, edited))
+            .unwrap();
+        let after = document.snapshot();
+        let changed = Scene::sequence(document.project(), f.owner, create).lifecycle;
+        assert_ne!(geometry, changed);
+        assert!(changed.markers.is_empty());
+        assert_ne!(before.bundle, after.bundle);
+        assert!(document.undo());
+        assert_eq!(document.project(), &before.decoded.project);
+        assert_eq!(document.bundle(), &before.bundle);
+        assert_eq!(
+            Scene::sequence(document.project(), f.owner, create).lifecycle,
+            geometry
+        );
+        assert!(!document.can_undo() && document.can_redo());
+        assert!(document.redo());
+        assert_eq!(document.project(), &after.decoded.project);
+        assert_eq!(document.bundle(), &after.bundle);
+        assert_eq!(
+            Scene::sequence(document.project(), f.owner, create).lifecycle,
+            changed
+        );
+        assert!(!document.can_redo());
+    }
+}
+
+#[test]
+fn panned_header_and_create_clips_use_screen_translation_and_actual_viewport() {
+    use crate::behavior::box_text_clip;
+    use iced::Vector;
+    let header = Rectangle::new(Point::new(100., 200.), Size::new(204., 70.));
+    let capsule = Rectangle::new(header.position(), Size::new(140., 28.));
+    let rect = |x, y, w, h| Rectangle::new(Point::new(x, y), Size::new(w, h));
+    for (pan, scale, viewport, header_expected, birth_expected) in [
+        (
+            Vector::new(37., -41.),
+            0.5,
+            Size::new(300., 400.),
+            rect(92., 63., 92., 27.),
+            rect(91., 61., 62., 10.),
+        ),
+        (
+            Vector::new(37., -41.),
+            1.,
+            Size::new(300., 400.),
+            rect(147., 167., 153., 54.),
+            rect(145., 163., 124., 20.),
+        ),
+        (
+            Vector::new(37., -41.),
+            2.,
+            Size::new(300., 400.),
+            rect(257., 375., 43., 25.),
+            rect(253., 367., 47., 33.),
+        ),
+        (
+            Vector::new(-200., -400.),
+            2.,
+            Size::new(300., 100.),
+            rect(20., 16., 280., 84.),
+            rect(16., 8., 248., 40.),
+        ),
+        (
+            Vector::new(-237., -411.),
+            2.,
+            Size::new(300., 100.),
+            rect(0., 5., 300., 95.),
+            rect(0., 0., 227., 37.),
+        ),
+    ] {
+        assert_eq!(
+            box_text_clip(pan, header, scale, viewport),
+            Some(header_expected)
+        );
+        assert_eq!(
+            birth_label_clip(pan, capsule, scale, viewport),
+            Some(birth_expected)
+        );
+    }
+    for pan in [
+        Vector::new(1000., 1000.),
+        Vector::new(-1000., -1000.),
+        Vector::new(f32::NAN, 0.),
+        Vector::new(0., f32::INFINITY),
+    ] {
+        assert_eq!(box_text_clip(pan, header, 2., Size::new(300., 100.)), None);
+        assert_eq!(
+            birth_label_clip(pan, capsule, 2., Size::new(300., 100.)),
+            None
+        );
+    }
+}
+
+#[test]
+fn real_scene_panned_zoomed_program_keeps_header_birth_and_death_hit_identity() {
+    use crate::{
+        app::Message,
+        behavior::{
+            SequenceInput,
+            scenario::{CanvasEvent, CanvasTool},
+        },
+    };
+    use iced::{Vector, mouse, widget::canvas};
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut f = Fixture::new(layer);
+        f.project.elements.get_mut(&f.receiver).unwrap().name = "界".repeat(24);
+        let create = f.message(f.owner, MessageKind::Create);
+        let delete = f.message(f.owner, MessageKind::Delete);
+        let document = f.document();
+        let before = document.snapshot();
+        for scale in [0.5, 1., 2.] {
+            for pan in [Vector::new(35., 40.), Vector::new(-35., -5.)] {
+                let mut scene = f.scene();
+                scene.scale = scale;
+                scene.camera_pan = pan;
+                let context = crate::behavior::scenario::direct_tests::context(f.owner);
+                scene.interaction = Some((context, CanvasTool::Select, true));
+                let header = scene.boxes.iter().find(|b| b.id == f.sender).unwrap();
+                let targets = [
+                    (f.sender, header.rect.center()),
+                    (
+                        create,
+                        scene
+                            .lifecycle
+                            .markers
+                            .iter()
+                            .find(|m| m.event.occurrence == create)
+                            .unwrap()
+                            .center,
+                    ),
+                    (
+                        delete,
+                        scene
+                            .lifecycle
+                            .markers
+                            .iter()
+                            .find(|m| m.event.occurrence == delete)
+                            .unwrap()
+                            .center,
+                    ),
+                ];
+                // Absolute widget origin models the outer layout/scroll translation;
+                // camera pan remains local screen units and must be subtracted once.
+                let bounds = Rectangle::new(Point::new(73., 119.), Size::new(2000., 1200.));
+                for (expected, world) in targets {
+                    let screen =
+                        bounds.position() + pan + Vector::new(world.x * scale, world.y * scale);
+                    assert!(bounds.contains(screen));
+                    let mut state = SequenceInput::default();
+                    let mut published = Vec::new();
+                    for event in [
+                        mouse::Event::CursorMoved { position: screen },
+                        mouse::Event::ButtonPressed(mouse::Button::Left),
+                        mouse::Event::ButtonReleased(mouse::Button::Left),
+                    ] {
+                        if let Some(message) = canvas::Program::update(
+                            &scene,
+                            &mut state,
+                            &canvas::Event::Mouse(event),
+                            bounds,
+                            mouse::Cursor::Available(screen),
+                        )
+                        .and_then(|a| a.into_inner().0)
+                        {
+                            published.push(message);
+                        }
+                    }
+                    assert!(
+                        matches!(published.as_slice(), [Message::ScenarioCanvas(CanvasEvent::Select(actual_context, actual))] if *actual_context == context && *actual == expected),
+                        "Pan/zoom must retain the typed hit identity"
+                    );
+                }
+                assert_eq!(scene.lifecycle, f.scene().lifecycle);
+            }
+        }
+        assert_eq!(document.project(), &before.decoded.project);
+        assert_eq!(document.bundle(), &before.bundle);
+        assert!(!document.can_undo() && !document.dirty());
+    }
+}
@@ -38,6 +38,7 @@ impl Tool {
 }
 #[derive(Debug, Clone)]
 pub enum Event {
+    Source(super::source_draft::Event),
    Start(Id, Tool, Option<Id>),
    Cancel,
    Submit,
@@ -58,7 +59,6 @@ pub enum Event {
 }
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum Shelf {
-    Tools,
    Selection,
 }
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -79,10 +79,11 @@ pub struct State {
    identity: Option<(Id, Id)>,
    tool: CanvasTool,
    expanded: BTreeSet<Id>,
-    scroll_offsets: [iced::Vector; 2],
-    return_to: Vec<(Id, Id, Option<oa_core::topology_context::ContextAddress>)>,
+    details_offset: iced::Vector,
+    return_to: Vec<direct::ReturnFrame>,
    draft: Option<Draft>,
    viewport: Option<Size>,
+    pan: iced::Vector,
    zoom: Option<f32>,
    fit: bool,
    pub(crate) focused: bool,
@@ -90,15 +91,22 @@ pub struct State {
    selected_context: Option<oa_core::topology_context::ContextAddress>,
    shelf: Option<Shelf>,
 }
-#[derive(Default, serde::Serialize, serde::Deserialize)]
+#[derive(Clone, Default, serde::Serialize, serde::Deserialize)]
 #[serde(deny_unknown_fields)]
 struct Browser {
    search: String,
    page: usize,
 }
-#[derive(serde::Serialize, serde::Deserialize)]
+#[derive(Clone, serde::Serialize, serde::Deserialize)]
 #[serde(deny_unknown_fields)]
 struct Draft {
+    #[serde(default)]
+    source: super::source_draft::State,
+    #[serde(default = "Id::new_v4")]
+    invocation: Id,
+    #[serde(default)]
+    source_origin: Option<(Id, oa_core::Element)>,
+
    #[serde(with = "recovery_insertion")]
    insertion: Insertion,
    fixed: bool,
@@ -117,6 +125,40 @@ struct Draft {
    contextual: Option<contextual::Draft>,
 }
 impl State {
+    pub(crate) fn camera_boundary(&self) -> impl PartialEq + use<> {
+        (
+            self.tool,
+            self.focused,
+            self.shelf,
+            self.viewport,
+            self.pan,
+            self.zoom,
+            self.fit,
+        )
+    }
+
+    pub(super) fn pending_name(&self) -> Option<&str> {
+        self.draft.as_ref().map(|d| d.name.as_str())
+    }
+    pub(super) fn source_view<'a>(&'a self, p: &'a Project) -> Option<iced::Element<'a, Event>> {
+        self.draft
+            .as_ref()?
+            .source
+            .view(p)
+            .map(|v| v.map(Event::Source))
+    }
+
+    pub fn source_active(&self) -> bool {
+        self.draft.as_ref().is_some_and(|d| d.source.engaged())
+    }
+
+    pub fn source_open(&self) -> bool {
+        self.draft.as_ref().is_some_and(|d| d.source.is_open())
+    }
+    pub fn source_back(&mut self) -> bool {
+        self.draft.as_mut().is_some_and(|d| d.source.back())
+    }
+
    pub(super) fn recovery_snapshot(&self) -> Result<Option<serde_json::Value>, String> {
        self.draft
            .as_ref()
@@ -152,6 +194,58 @@ impl State {
    }

    pub fn update(&mut self, p: &Project, event: Event) -> Result<Option<Command>, String> {
+        if let Event::Source(event) = event {
+            if self
+                .draft
+                .as_mut()
+                .ok_or("Start the consumer form first.")?
+                .source
+                .dismiss(&event)?
+            {
+                return Ok(None);
+            }
+            let d = self
+                .draft
+                .as_ref()
+                .ok_or("Start the consumer form first.")?;
+            if d.tool != Tool::Work {
+                return Err("This reference does not support staged source creation.".into());
+            }
+            if d.source_origin.as_ref().is_some_and(|(document, owner)| {
+                *document != p.id || p.elements.get(&d.owner) != Some(owner)
+            }) {
+                return Err("The original consumer changed. Cancel and reopen its form; the current draft is retained.".into());
+            }
+            if d.source_origin.is_none() && d.source.engaged() {
+                return Err("The recovered source draft has no original document binding. Go Back or cancel it.".into());
+            }
+            let mut next = d.clone();
+            if next.source_origin.is_none() && matches!(&event, super::source_draft::Event::Open(_))
+            {
+                next.source_origin = Some((
+                    p.id,
+                    p.elements
+                        .get(&d.owner)
+                        .ok_or("The consumer owner no longer exists.")?
+                        .clone(),
+                ));
+            }
+            if let Some(id) = next.source.update(
+                p,
+                super::source_draft::Scope::Work { owner: d.owner },
+                d.invocation,
+                event,
+            )? {
+                next.target = Some(id);
+                next.command(p)?;
+            }
+            self.draft = Some(next);
+            return Ok(None);
+        }
+        if self.source_open() && !matches!(&event, Event::Cancel) {
+            return Err("Use the new source or go Back before editing the parent form.".into());
+        }
+
        if self.draft.is_some() && matches!(&event, Event::Start(..)) {
            return Err(PENDING_DRAFT.into());
        }
@@ -184,6 +278,9 @@ impl State {
                    }
                });
                self.draft = Some(Draft {
+                    source: Default::default(),
+                    invocation: Id::new_v4(),
+                    source_origin: Some((p.id, p.elements[&owner].clone())),
                    insertion: Insertion::default(),
                    fixed: false,
                    browsers: Default::default(),
@@ -253,8 +350,8 @@ impl State {
    }

    fn fit_area(&self, fallback_width: f32) -> Size {
-        // The sensor measures the inner scroller, independent of graph content.
-        // Leave a small gutter for scrollbars; before first layout use a compact
+        // The sensor measures the viewport, independent of graph content.
+        // Leave a small content gutter; before first layout use a compact
        // provisional viewport and recompute when the sensor reports actual size.
        let viewport = self.viewport.unwrap_or(Size::new(fallback_width, 180.));
        Size::new(
@@ -263,10 +360,7 @@ impl State {
        )
    }

-    fn canvas_offset(&self) -> iced::Vector {
-        self.scroll_offsets[0]
-    }
-
+    #[cfg(test)]
    fn fit_limited(&self, graph: Size, fallback_width: f32) -> bool {
        let available = self.fit_area(fallback_width);
        self.fit && (graph.width * 0.05 > available.width || graph.height * 0.05 > available.height)
@@ -508,6 +602,22 @@ fn link(p: &Project, source: Id, target: Id, guard: &str) -> Command {
 }
 impl Draft {
    fn command(&self, p: &Project) -> Result<Command, String> {
+        if self.source.engaged()
+            && self.source_origin.as_ref().is_none_or(|(document, owner)| {
+                *document != p.id || p.elements.get(&self.owner) != Some(owner)
+            })
+        {
+            return Err("The original consumer document or owner changed. Cancel and reopen its form; your draft is retained.".into());
+        }
+        self.source.check_scope(
+            super::source_draft::Scope::Work { owner: self.owner },
+            self.target,
+        )?;
+        let preview = self.source.preview(p, self.target)?;
+        let command = self.consumer_command(preview.as_ref().unwrap_or(p))?;
+        self.source.combine(p, self.target, command)
+    }
+    fn consumer_command(&self, p: &Project) -> Result<Command, String> {
        let owner = p
            .elements
            .get(&self.owner)
@@ -615,6 +725,8 @@ impl Draft {
        });
        let name = if self.name.trim().is_empty() {
            default_name
+        } else if self.source.label(self.target).is_some() {
+            self.name.as_str()
        } else {
            self.name.trim()
        };
@@ -866,7 +978,8 @@ mod contextual_routing;
 struct Graph<'a> {
    project: &'a Project,
    interaction: Option<(Context, CanvasTool, bool)>,
-    scroll_offset: iced::Vector,
+    camera_pan: iced::Vector,
+    pending_insertion: Option<Insertion>,
    nodes: Vec<GraphNode>,
    edges: Vec<GraphEdge>,
    ordered_paths: Vec<OrderedPath>,
@@ -1198,7 +1311,8 @@ impl<'a> Graph<'a> {
        Self {
            project: p,
            interaction: None,
-            scroll_offset: iced::Vector::ZERO,
+            camera_pan: iced::Vector::ZERO,
+            pending_insertion: None,
            nodes,
            edges,
            ordered_paths,
@@ -1298,6 +1412,7 @@ impl canvas::Program<Message> for Graph<'_> {
    ) -> Vec<canvas::Geometry> {
        let mut f = Frame::new(renderer, bounds.size());
        f.fill_rectangle(Point::ORIGIN, bounds.size(), Color::WHITE);
+        f.translate(self.camera_pan);
        f.scale(self.scale);
        for pass in PAINT_PASSES {
            match pass {
@@ -1513,7 +1628,10 @@ impl canvas::Program<Message> for Graph<'_> {
        cursor: mouse::Cursor,
    ) -> mouse::Interaction {
        if cursor.position_in(bounds).is_some_and(|p| {
-            let p = Point::new(p.x / self.scale, p.y / self.scale);
+            let p = Point::new(
+                (p.x - self.camera_pan.x) / self.scale,
+                (p.y - self.camera_pan.y) / self.scale,
+            );
            self.nodes.iter().any(|n| n.rect.contains(p))
                || self.ordered_paths.iter().any(|path| {
                    path.points.windows(2).any(|pair| {
@@ -1587,6 +1705,9 @@ mod tests {
    }
    fn branch(owner: Id, a: Id, b: Id, before: Id, after: Id) -> Draft {
        Draft {
+            source: Default::default(),
+            invocation: Id::new_v4(),
+            source_origin: None,
            insertion: Insertion::default(),
            fixed: false,
            browsers: Default::default(),
@@ -2043,7 +2164,6 @@ mod tests {
        let accepted = app.document.snapshot();
        assert!(app.behavior.prepare_pending(app.project()).is_err());
        for (shelf, expected) in [
-            (Shelf::Tools, Some(Shelf::Tools)),
            (Shelf::Selection, Some(Shelf::Selection)),
            (Shelf::Selection, None),
        ] {
@@ -2060,10 +2180,12 @@ mod tests {
    }

    #[test]
-    fn process_fit_canvas_selection_ignores_retained_ordered_page_scroll() {
+    fn process_camera_selection_ignores_independent_details_scroll() {
        let (p, owner, _, _, _, _) = fixture();
        let mut state = State::default();
-        state.scrolled(scenario::ScrollArea::Canvas, iced::Vector::new(11., 19.));
+        state.camera(crate::behavior::canvas_workspace::Event::Pan(
+            iced::Vector::new(11., 19.),
+        ));
        state.scrolled(scenario::ScrollArea::Page, iced::Vector::new(0., 370.));
        let context = Context {
            document: p.id,
@@ -2074,16 +2196,17 @@ mod tests {
        for scale in [0.45, 1.] {
            let mut graph = Graph::new(&p, owner, owner);
            graph.scale = scale;
-            graph.scroll_offset = state.canvas_offset();
+            graph.camera_pan = state.pan;
            graph.interaction = Some((context, CanvasTool::Select, true));
            let node = &graph.nodes[0];
            let id = node.id;
            let point = node.rect.center();
            let bounds = Rectangle::new(Point::new(40., 100.), Size::new(800., 300.));
            let screen = Point::new(
-                bounds.x + point.x * scale - 11.,
-                bounds.y + point.y * scale - 19.,
+                bounds.x + point.x * scale + 11.,
+                bounds.y + point.y * scale + 19.,
            );
+            assert!(bounds.contains(screen));
            let message = graph
                .input(
                    &mut Input::default(),
@@ -33,7 +33,7 @@ pub enum Event {
    Search(String),
    Page(usize),
 }
-#[derive(Default, serde::Serialize, serde::Deserialize)]
+#[derive(Clone, Default, serde::Serialize, serde::Deserialize)]
 #[serde(deny_unknown_fields)]
 pub(super) struct Draft {
    edit: Option<Id>,
@@ -608,7 +608,11 @@ mod tests {
            "Authored endpoint is retained for explicit repair"
        );
        assert!(state.prepare_pending(&deleted).is_err());
-        state.remember(owner, reference);
+        state.remember(
+            owner,
+            reference,
+            super::super::direct::referenced(&p, owner, reference).unwrap(),
+        );
        assert_eq!(state.back(&deleted), Some((owner, reference)));
        assert!(state.selected_context.is_none());
        state.draft = None;
@@ -60,6 +60,7 @@ pub enum CanvasEvent {
    Open(Context, Id),
    Back(Context),
    Zoom(Context, Option<f32>),
+    Camera(Context, u64, super::super::canvas_workspace::Event),
    Focus(Context),
    Viewport(Context, Size),
 }
@@ -77,6 +78,7 @@ impl CanvasEvent {
            | Self::Back(c)
            | Self::AppendExchange(c)
            | Self::Zoom(c, ..)
+            | Self::Camera(c, ..)
            | Self::Focus(c)
            | Self::Viewport(c, ..) => *c,
            Self::Begin { context, .. }
@@ -86,6 +88,19 @@ impl CanvasEvent {
        }
    }
 }
+pub(super) struct ReturnFrame {
+    identity: Option<(Id, Id)>,
+    owner: Id,
+    occurrence: Id,
+    target: Id,
+    address: Option<oa_core::topology_context::ContextAddress>,
+    pan: iced::Vector,
+    zoom: Option<f32>,
+    fit: bool,
+    viewport: Option<Size>,
+    expanded: BTreeSet<Id>,
+    contextual_expanded: BTreeSet<OccurrenceEndpoint>,
+}
 impl State {
    pub(crate) fn select_context(&mut self, address: oa_core::topology_context::ContextAddress) {
        self.selected_context = Some(address);
@@ -138,35 +153,49 @@ impl State {
        if self.identity != Some((document, owner)) {
            self.identity = Some((document, owner));
            self.tool = CanvasTool::Select;
+            self.pan = iced::Vector::ZERO;
            self.zoom = Some(1.);
            self.fit = false;
            self.viewport = None;
            self.expanded.clear();
-            self.scroll_offsets = [iced::Vector::ZERO; 2];
+            self.details_offset = iced::Vector::ZERO;
        }
    }
    #[cfg(test)]
-    pub(crate) fn scroll_offset(&self) -> iced::Vector {
-        self.scroll_offsets[0] + self.scroll_offsets[1]
+    pub(crate) fn details_offset(&self) -> iced::Vector {
+        self.details_offset
    }
-    pub(crate) fn scrolled(&mut self, area: scenario::ScrollArea, offset: iced::Vector) -> bool {
-        let index = match area {
-            scenario::ScrollArea::Canvas => 0,
-            scenario::ScrollArea::Page => 1,
-        };
-        let changed = self.scroll_offsets[index] != offset;
-        self.scroll_offsets[index] = offset;
+    pub(crate) fn scrolled(
+        &mut self,
+        scenario::ScrollArea::Page: scenario::ScrollArea,
+        offset: iced::Vector,
+    ) -> bool {
+        if !offset.x.is_finite() || !offset.y.is_finite() || offset.x < 0. || offset.y < 0. {
+            return false;
+        }
+        let changed = self.details_offset != offset;
+        self.details_offset = offset;
        changed
    }
    pub(crate) fn choose(&mut self, tool: CanvasTool) {
        // Choosing how to edit must retain the user's current view.
        self.tool = tool;
    }
+    pub(crate) fn camera(&mut self, event: super::super::canvas_workspace::Event) -> bool {
+        super::super::canvas_workspace::change(&mut self.pan, &mut self.zoom, &mut self.fit, event)
+    }
    pub(crate) fn zoom(&mut self, value: Option<f32>) {
        self.fit = value.is_none();
-        self.zoom = value.map(|v| v.clamp(0.5, 2.));
+        self.zoom = value.map(|v| v.clamp(0.05, 3.));
    }
    pub(crate) fn viewport(&mut self, size: Size) -> bool {
+        if !size.width.is_finite()
+            || !size.height.is_finite()
+            || size.width <= 0.
+            || size.height <= 0.
+        {
+            return false;
+        }
        let changed = self.viewport != Some(size);
        self.viewport = Some(size);
        changed
@@ -188,26 +217,83 @@ impl State {
        }
        true
    }
-    pub(crate) fn remember(&mut self, owner: Id, occurrence: Id) {
-        self.return_to
-            .push((owner, occurrence, self.selected_context.clone()));
+    pub(crate) fn remember(&mut self, owner: Id, occurrence: Id, target: Id) {
+        if self.return_to.len() == 32 {
+            self.return_to.remove(0);
+        }
+        self.return_to.push(ReturnFrame {
+            identity: self.identity,
+            owner,
+            occurrence,
+            target,
+            address: self.selected_context.clone(),
+            pan: self.pan,
+            zoom: self.zoom,
+            fit: self.fit,
+            viewport: self.viewport,
+            expanded: self.expanded.clone(),
+            contextual_expanded: self.contextual_expanded.clone(),
+        });
    }
    pub(crate) fn back(&mut self, p: &Project) -> Option<(Id, Id)> {
-        while let Some((owner, occurrence, address)) = self.return_to.pop() {
-            if is_contribution(p, owner, occurrence) {
-                self.selected_context = address.filter(|address| {
-                    address.owner == owner
-                        && oa_core::topology_context::TopologyIndex::new(p)
-                            .resolve(owner, &address.endpoint)
-                            .is_ok()
+        while let Some(frame) = self.return_to.pop() {
+            if frame.identity.map(|i| i.0) != self.identity.map(|i| i.0) {
+                continue;
+            }
+            let valid = referenced(p, frame.owner, frame.occurrence) == Some(frame.target)
+                || if let Some(address) = &frame.address {
+                    oa_core::topology_context::TopologyIndex::new(p)
+                        .resolve(frame.owner, &address.endpoint)
+                        .is_ok_and(|r| r.defining_sequence == frame.target)
+                } else {
+                    false
+                };
+            if valid && is_contribution(p, frame.owner, frame.occurrence) {
+                self.identity = frame.identity;
+                self.selected_context = frame.address.filter(|a| {
+                    oa_core::topology_context::TopologyIndex::new(p)
+                        .resolve(frame.owner, &a.endpoint)
+                        .is_ok()
                });
-                return Some((owner, occurrence));
+                self.pan = frame.pan;
+                self.zoom = frame.zoom;
+                self.fit = frame.fit;
+                self.viewport = frame.viewport;
+                self.expanded = frame.expanded;
+                self.contextual_expanded = frame.contextual_expanded;
+                return Some((frame.owner, frame.occurrence));
            }
        }
        None
    }
-    pub(crate) fn created_selection(&self, command: &Command) -> Option<Id> {
+    pub(crate) fn camera_zoom(&mut self, p: &Project, owner: Id, zoom: Option<f32>) {
+        let graph =
+            Graph::expanded_qualified(p, owner, owner, &self.expanded, &self.contextual_expanded);
+        let old = self.scale(graph.size, 500.);
+        if let Some(next) = zoom {
+            let size = self.viewport.unwrap_or(Size::new(500., 300.));
+            self.camera(super::super::canvas_workspace::Event::Zoom {
+                factor: next / old,
+                at: Point::new(size.width / 2., size.height / 2.),
+                base: old,
+            });
+        } else {
+            self.zoom(None);
+            let fitted = self.scale(graph.size, 500.);
+            self.zoom(Some(fitted));
+            self.pan = iced::Vector::ZERO;
+        }
+    }
+    pub(crate) fn created_selection(&self, p: &Project, command: &Command) -> Option<Id> {
        let owner = self.pending_owner()?;
+        if self
+            .draft
+            .as_ref()
+            .is_some_and(|d| d.source.label(d.target).is_some())
+            && self.prepare_pending(p).ok().as_ref() != Some(command)
+        {
+            return None;
+        }
        if let Command::CreateRelation(r) | Command::EditRelation(_, r) = command
            && matches!(&r.body, RelationBody::ContextualLink { owner: caller, .. } if *caller == owner)
        {
@@ -539,7 +625,7 @@ impl Graph<'_> {
                {
                    *moved |= position.distance(*start) >= 3.;
                }
-                mouse::Cursor::Available(*position + self.scroll_offset)
+                mouse::Cursor::Available(*position)
            }
            canvas::Event::Mouse(mouse::Event::WheelScrolled { .. } | mouse::Event::CursorLeft)
            | canvas::Event::Window(
@@ -558,18 +644,19 @@ impl Graph<'_> {
            }
            canvas::Event::Mouse(
                mouse::Event::ButtonPressed(_) | mouse::Event::ButtonReleased(_),
-            ) => state
-                .pointer
-                .map_or(cursor, |p| mouse::Cursor::Available(p + self.scroll_offset)),
+            ) => state.pointer.map_or(cursor, mouse::Cursor::Available),
            canvas::Event::Window(iced::window::Event::RedrawRequested(_)) => {
-                state.pointer = cursor.position().map(|p| p - self.scroll_offset);
+                state.pointer = cursor.position();
                cursor
            }
            _ => cursor,
        };
-        let world = cursor
-            .position_in(bounds)
-            .map(|p| Point::new(p.x / self.scale, p.y / self.scale));
+        let world = cursor.position_in(bounds).map(|p| {
+            Point::new(
+                (p.x - self.camera_pan.x) / self.scale,
+                (p.y - self.camera_pan.y) / self.scale,
+            )
+        });
        let publish = |event| Some(Action::publish(Message::TopologyCanvas(event)).and_capture());
        match event {
            canvas::Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)) if visible => {
@@ -583,7 +670,7 @@ impl Graph<'_> {
                if !editable {
                    return None;
                }
-                let start = cursor.position()? - self.scroll_offset;
+                let start = cursor.position()?;
                match tool {
                    CanvasTool::Add(..) => {
                        state.press = Some(Press::Add {
@@ -722,15 +809,35 @@ impl Graph<'_> {
        let Some((context, tool, editable)) = self.interaction else {
            return;
        };
+        if let Some(insertion) = self.pending_insertion {
+            if let Some(edge) = insertion
+                .link
+                .and_then(|id| self.edges.iter().find(|e| e.id == id))
+            {
+                draw_arrow(f, &edge.points, style::TEAL, 3.);
+            } else if let Some(node) = insertion
+                .before
+                .and_then(|id| self.nodes.iter().find(|n| n.id == id))
+            {
+                f.stroke(
+                    &Path::rounded_rectangle(node.rect.position(), node.rect.size(), 10.into()),
+                    Stroke::default().with_color(style::TEAL).with_width(3.),
+                );
+            }
+        }
        if !editable {
            return;
        }
        let point = state
            .pointer
-            .map(|p| p + self.scroll_offset)
            .or_else(|| cursor.position())
            .filter(|p| bounds.contains(*p))
-            .map(|p| Point::new((p.x - bounds.x) / self.scale, (p.y - bounds.y) / self.scale));
+            .map(|p| {
+                Point::new(
+                    (p.x - bounds.x - self.camera_pan.x) / self.scale,
+                    (p.y - bounds.y - self.camera_pan.y) / self.scale,
+                )
+            });
        let live =
            state.context == Some(context) && state.tool == tool && state.bounds == Some(bounds);
        if live && let Some(source) = state.source {
@@ -845,12 +952,7 @@ impl Graph<'_> {
 }

 impl State {
-    pub(crate) fn selection_offset(
-        &self,
-        p: &Project,
-        owner: Id,
-        id: Id,
-    ) -> Option<scrollable::AbsoluteOffset> {
+    pub(crate) fn reveal_selection(&mut self, p: &Project, owner: Id, id: Id) -> bool {
        let graph =
            Graph::expanded_qualified(p, owner, id, &self.expanded, &self.contextual_expanded);
        let scale = self.scale(graph.size, 500.);
@@ -862,10 +964,25 @@ impl State {
                self.qualified_selection(p, owner)
                    .map_or(n.rect, |a| n.endpoint_rect(&a.endpoint))
            })
-            .or_else(|| graph.edges.iter().find(|e| e.id == id).map(|e| e.label))?;
-        Some(scrollable::AbsoluteOffset {
-            x: (rect.x * scale - 12.).max(0.),
-            y: (rect.y * scale - 12.).max(0.),
-        })
+            .or_else(|| graph.edges.iter().find(|e| e.id == id).map(|e| e.label));
+        let Some(rect) = rect else {
+            return false;
+        };
+        let viewport = self.viewport.unwrap_or(Size::new(500., 300.));
+        let x = rect.x * scale + self.pan.x;
+        let y = rect.y * scale + self.pan.y;
+        let delta = iced::Vector::new(
+            if x < 12. || x + rect.width * scale > viewport.width - 12. {
+                12. - x
+            } else {
+                0.
+            },
+            if y < 12. || y + rect.height * scale > viewport.height - 12. {
+                12. - y
+            } else {
+                0.
+            },
+        );
+        self.camera(super::super::canvas_workspace::Event::Pan(delta))
    }
 }
@@ -540,7 +540,7 @@ fn send(
        input,
        &canvas::Event::Mouse(event),
        bounds,
-        mouse::Cursor::Available(point + graph.scroll_offset),
+        mouse::Cursor::Available(point),
    )
    .and_then(|a| a.into_inner().0)
 }
@@ -554,16 +554,20 @@ fn position(graph: &Graph<'_>, id: Id) -> Point {
        .center()
 }
 #[test]
-fn direct_process_production_click_click_drag_insert_and_scroll_coordinates() {
+fn direct_process_production_click_click_drag_insert_and_camera_coordinates() {
    let f = fixture(Layer::Oa);
    for drag in [false, true] {
        let mut graph = graph(&f, CanvasTool::Connect);
-        graph.scroll_offset = iced::Vector::new(35., 90.);
-        let bounds = Rectangle::new(Point::new(10., 20.), graph.size);
+        graph.camera_pan = iced::Vector::new(35., 90.);
+        let bounds = Rectangle::new(
+            Point::new(10., 20.),
+            Size::new(graph.size.width + 70., graph.size.height + 180.),
+        );
        let screen =
-            |id| position(&graph, id) + iced::Vector::new(bounds.x, bounds.y) - graph.scroll_offset;
+            |id| position(&graph, id) + iced::Vector::new(bounds.x, bounds.y) + graph.camera_pan;
        let a = screen(f.nodes[0]);
        let b = screen(f.nodes[2]);
+        assert!(bounds.contains(a) && bounds.contains(b));
        let mut input = Input::default();
        send(
            &graph,
@@ -732,7 +736,7 @@ fn direct_process_readable_default_fit_expansion_and_bounded_choices() {
    state.zoom(None);
    assert!(state.scale(Size::new(3262., 220.), 500.) < 0.2);
    state.zoom(Some(0.1));
-    assert_eq!(state.scale(Size::new(3262., 220.), 500.), 0.5);
+    assert_eq!(state.scale(Size::new(3262., 220.), 500.), 0.1);
    state.enter(Id::new_v4(), f.owner);
    assert_eq!(state.scale(Size::new(3262., 220.), 500.), 1.);
    let mut all = Vec::new();
@@ -1331,7 +1335,9 @@ fn direct_process_palette_preserves_fit_and_manual_camera() {
        let document = Id::new_v4();
        state.enter(document, f.owner);
        state.viewport(Size::new(500., 300.));
-        state.scrolled(scenario::ScrollArea::Canvas, iced::Vector::new(35., 90.));
+        state.camera(super::super::canvas_workspace::Event::Pan(
+            iced::Vector::new(35., 90.),
+        ));
        state.scrolled(scenario::ScrollArea::Page, iced::Vector::new(0., 120.));
        for camera in [None, Some(0.75), Some(1.5)] {
            state.zoom(camera);
@@ -1353,90 +1359,16 @@ fn direct_process_palette_preserves_fit_and_manual_camera() {
                    "{layer:?} {camera:?} {tool:?}"
                );
                assert_eq!(state.fit, camera.is_none());
-                assert_eq!(state.scroll_offset(), iced::Vector::new(35., 210.));
+                assert_eq!(state.pan, iced::Vector::new(35., 90.));
+                assert_eq!(state.details_offset(), iced::Vector::new(0., 120.));
                state.enter(document, f.owner);
                assert_eq!(state.scale(size, 500.), before);
            }
        }
        state.enter(Id::new_v4(), f.owner);
        assert_eq!(state.scale(Size::new(690., 250.), 500.), 1.);
-        assert_eq!(state.scroll_offset(), iced::Vector::ZERO);
-    }
-}
-
-#[test]
-fn direct_process_pending_form_diff_retains_the_canvas_scroll_state() {
-    use iced::advanced::widget::{Tree, tree};
-    use std::rc::Rc;
-    fn path_to(tree: &Tree, tag: tree::Tag) -> Option<Vec<usize>> {
-        if tree.tag == tag {
-            return Some(Vec::new());
-        }
-        tree.children.iter().enumerate().find_map(|(index, child)| {
-            let mut path = path_to(child, tag)?;
-            path.insert(0, index);
-            Some(path)
-        })
-    }
-    fn at<'a>(mut tree: &'a mut Tree, path: &[usize]) -> &'a mut Tree {
-        for &index in path {
-            tree = &mut tree.children[index];
-        }
-        tree
-    }
-    for layer in [Layer::Oa, Layer::Sa] {
-        for size in [Size::new(1440., 900.), Size::new(1100., 700.)] {
-            for tool in [Tool::Control, Tool::Branch, Tool::Connect] {
-                let f = fixture(layer);
-                let mut app = App::with_project(f.p.clone());
-                let _ = app.update(Message::Select(f.nodes[1]));
-                let _ = app.update(Message::Page(crate::app::Page::Behavior));
-                app.window_size = size;
-                let original = app.document.snapshot();
-                let graph: Element<'_, Message> =
-                    canvas::Canvas::new(Graph::new(app.project(), f.owner, f.nodes[1])).into();
-                let canvas_tag = Tree::new(graph.as_widget()).tag;
-                drop(graph);
-                let scroll: Element<'_, Message> = scrollable(text("")).into();
-                let scroll_tag = Tree::new(scroll.as_widget()).tag;
-                let mut tree = Tree::new(view::view(&app, f.owner, Column::new()).as_widget());
-                let mut scroll_path = path_to(&tree, canvas_tag).unwrap();
-                scroll_path.pop();
-                assert_eq!(at(&mut tree, &scroll_path).tag, scroll_tag);
-                // Scrollable::diff treats its local state as opaque. A retained marker
-                // proves the real Iced diff preserves the state that owns the offsets.
-                // No layout or input operation runs on this test-only marker state.
-                let marker = Rc::new(());
-                at(&mut tree, &scroll_path).state = tree::State::new(Rc::clone(&marker));
-                let _ = app.update(Message::Behavior(super::super::Event::Topology(
-                    Event::Start(f.owner, tool, Some(f.nodes[1])),
-                )));
-                assert!(app.behavior.has_pending());
-                tree.diff(view::view(&app, f.owner, Column::new()).as_widget());
-                assert_eq!(
-                    Rc::strong_count(&marker),
-                    2,
-                    "form open: {layer:?} {size:?} {tool:?}"
-                );
-                let mut current_path = path_to(&tree, canvas_tag).unwrap();
-                current_path.pop();
-                assert_eq!(current_path, scroll_path);
-                assert!(Rc::ptr_eq(
-                    at(&mut tree, &scroll_path).state.downcast_ref::<Rc<()>>(),
-                    &marker,
-                ));
-                let _ = app.update(Message::Behavior(super::super::Event::Topology(
-                    Event::Cancel,
-                )));
-                tree.diff(view::view(&app, f.owner, Column::new()).as_widget());
-                assert_eq!(
-                    Rc::strong_count(&marker),
-                    2,
-                    "form cancel: {layer:?} {size:?} {tool:?}"
-                );
-                assert!(std::sync::Arc::ptr_eq(&app.document.snapshot(), &original));
-            }
-        }
+        assert_eq!(state.pan, iced::Vector::ZERO);
+        assert_eq!(state.details_offset(), iced::Vector::ZERO);
    }
 }

@@ -1447,15 +1379,18 @@ fn direct_process_scaled_control_and_link_gestures_use_visible_positions() {
        for scale in [0.15, 0.6898551, 1.5] {
            let mut graph = graph(&f, CanvasTool::Add(Tool::Control, ControlKind::Choice));
            graph.scale = scale;
-            graph.scroll_offset = iced::Vector::new(11., 19.);
+            graph.camera_pan = iced::Vector::new(11., 19.);
            let bounds = Rectangle::new(
                Point::new(40., 70.),
-                Size::new(graph.size.width * scale, graph.size.height * scale),
+                Size::new(
+                    graph.size.width * scale + 22.,
+                    graph.size.height * scale + 38.,
+                ),
            );
            let screen = |world: Point| {
                Point::new(
-                    world.x * scale + bounds.x - 11.,
-                    world.y * scale + bounds.y - 19.,
+                    world.x * scale + bounds.x + 11.,
+                    world.y * scale + bounds.y + 19.,
                )
            };
            let edge = &graph.edges[0];
@@ -1463,6 +1398,7 @@ fn direct_process_scaled_control_and_link_gestures_use_visible_positions() {
                (edge.points[0].x + edge.points[1].x) / 2.,
                edge.points[0].y,
            ));
+            assert!(bounds.contains(point));
            let mut input = Input::default();
            send(
                &graph,
@@ -1493,6 +1429,7 @@ fn direct_process_scaled_control_and_link_gestures_use_visible_positions() {
                let mut input = Input::default();
                let a = screen(position(&graph, f.nodes[0]));
                let b = screen(position(&graph, f.nodes[2]));
+                assert!(bounds.contains(a) && bounds.contains(b));
                send(
                    &graph,
                    &mut input,
@@ -66,107 +66,7 @@ pub(super) fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Ele
    let pending = state.draft.is_some();
    let ordered = !legacy_order(p, owner).is_empty();
    let selected = is_contribution(p, owner, app.selected).then_some(app.selected);
-    let choose = |tool| Message::TopologyCanvas(CanvasEvent::Choose(context, tool));
-    let mut controls = Column::new().spacing(6);
-    if !pending {
-        controls = controls
-            .push(
-                row![
-                    button("Select / reorder")
-                        .style(if state.tool == CanvasTool::Select {
-                            button::primary
-                        } else {
-                            style::nav
-                        })
-                        .on_press(choose(CanvasTool::Select)),
-                    button("Work")
-                        .style(
-                            if state.tool == CanvasTool::Add(Tool::Work, ControlKind::Choice) {
-                                button::primary
-                            } else {
-                                style::nav
-                            }
-                        )
-                        .on_press(choose(CanvasTool::Add(Tool::Work, ControlKind::Choice))),
-                    button("Exchange")
-                        .style(
-                            if state.tool == CanvasTool::Add(Tool::Exchange, ControlKind::Choice) {
-                                button::primary
-                            } else {
-                                style::nav
-                            }
-                        )
-                        .on_press(choose(CanvasTool::Add(Tool::Exchange, ControlKind::Choice))),
-                    button("Reuse")
-                        .style(
-                            if state.tool == CanvasTool::Add(Tool::Reuse, ControlKind::Choice) {
-                                button::primary
-                            } else {
-                                style::nav
-                            }
-                        )
-                        .on_press(choose(CanvasTool::Add(Tool::Reuse, ControlKind::Choice)))
-                ]
-                .spacing(6),
-            )
-            .push(
-                row![
-                    pick_list(
-                        vec![
-                            ControlKind::Choice,
-                            ControlKind::Merge,
-                            ControlKind::Fork,
-                            ControlKind::Join,
-                            ControlKind::Loop
-                        ]
-                        .into_iter()
-                        .map(ControlChoice)
-                        .collect::<Vec<_>>(),
-                        if let CanvasTool::Add(Tool::Control, kind) = state.tool {
-                            Some(ControlChoice(kind))
-                        } else {
-                            None
-                        },
-                        move |c| Message::TopologyCanvas(CanvasEvent::Choose(
-                            context,
-                            CanvasTool::Add(Tool::Control, c.0)
-                        ))
-                    )
-                    .placeholder("Draw control…")
-                    .text_size(12)
-                    .padding(8),
-                    button("Sequence link")
-                        .style(if state.tool == CanvasTool::Connect {
-                            button::primary
-                        } else {
-                            style::nav
-                        })
-                        .on_press(choose(CanvasTool::Connect)),
-                    button("Two paths…").on_press(event(Event::Start(
-                        owner,
-                        Tool::Branch,
-                        selected
-                    )))
-                ]
-                .spacing(6),
-            );
-    }
-    controls=controls.push(label(if pending{"Pending contribution · apply or cancel below"}else if ordered{"Ordered exchange path · click a path to insert or empty canvas to continue; the edit preserves its order"}else{match state.tool{
-        CanvasTool::Select=>"Select local contributions and paths · drag path endpoints to reconnect · ↕ reorders within a column",
-        CanvasTool::Connect=>"Sequence link · click or drag from preceding to following contribution · Escape cancels",
-        CanvasTool::Add(..)=>"Choose a highlighted path or contribution position · existing work stays shared · Escape cancels"}}));
-    if !pending && ordered {
-        controls = controls.push(button("Append exchange…").on_press(Message::TopologyCanvas(
-            CanvasEvent::AppendExchange(context),
-        )));
-        let commands = preserved_order(p, owner, None);
-        if !commands.is_empty() {
-            controls = controls.push(
-                button("Edit path links and guards")
-                    .on_press(Message::Command(unique_batch(p, commands))),
-            );
-        }
-    }
+    let clean = !app.behavior.has_pending() && !app.draft_dirty() && !app.source_dirty();
    // A fixed sibling keeps Iced's canvas scroll state through selection/form changes.
    let mut navigation = column![].spacing(6);
    if let Some(Relation {
@@ -211,11 +111,6 @@ pub(super) fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Ele
            );
        }
    }
-    if !pending {
-        controls = controls.push(button("Qualified link / assembly…").on_press(event(
-            Event::Start(owner, Tool::Contextual, Some(app.selected)),
-        )));
-    }
    if let Some(id) = selected {
        let mut actions =
            row![button("Contribution properties").on_press(Message::EditProperties(id))]
@@ -256,27 +151,79 @@ pub(super) fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Ele
            button("Back to caller").on_press(Message::TopologyCanvas(CanvasEvent::Back(context))),
        );
    }
-    let diagram = {
-        let mut graph = Graph::expanded_qualified(
-            p,
-            owner,
-            app.selected,
-            &state.expanded,
-            &state.contextual_expanded,
+    navigation = navigation
+        .push(
+            button("Two paths...").on_press_maybe(clean.then_some(event(Event::Start(
+                owner,
+                Tool::Branch,
+                selected,
+            )))),
+        )
+        .push(
+            button("Qualified link / assembly...").on_press_maybe(clean.then_some(event(
+                Event::Start(owner, Tool::Contextual, Some(app.selected)),
+            ))),
        );
-        graph.scale = state.scale(graph.size, (app.window_size.width - 600.).max(200.));
-        graph.interaction = Some((
-            context,
-            state.tool,
-            !app.behavior.has_pending() && !app.draft_dirty() && !app.source_dirty(),
-        ));
-        // Explicit graphs no longer have a scrolling page ancestor. A retained
-        // offset from an ordered view must not distort their pointer coordinates.
-        graph.scroll_offset = state.canvas_offset();
-        let scale = graph.scale;
-        let mut header = column![
-            row![
-                out.width(Fill),
+    if ordered {
+        navigation = navigation.push(button("Append exchange...").on_press_maybe(clean.then_some(
+            Message::TopologyCanvas(CanvasEvent::AppendExchange(context)),
+        )));
+        let commands = preserved_order(p, owner, None);
+        if !commands.is_empty() {
+            navigation = navigation.push(
+                button("Edit path links and guards")
+                    .on_press_maybe(clean.then_some(Message::Command(unique_batch(p, commands)))),
+            );
+        }
+    }
+    let mut graph = Graph::expanded_qualified(
+        p,
+        owner,
+        app.selected,
+        &state.expanded,
+        &state.contextual_expanded,
+    );
+    graph.scale = state.scale(graph.size, (app.window_size.width - 600.).max(200.));
+    graph.camera_pan = state.pan;
+    graph.pending_insertion = state
+        .draft
+        .as_ref()
+        .filter(|d| d.owner == owner && d.fixed)
+        .map(|d| d.insertion);
+    graph.interaction = Some((context, state.tool, clean));
+    let scale = graph.scale;
+    let scope = super::super::canvas_workspace::Scope {
+        document: context.document,
+        owner,
+        revision: context.revision,
+        epoch: app.camera_epoch,
+    };
+    let keyboard = clean && super::super::canvas_workspace::keyboard_enabled(app);
+    let camera = move |e| Message::TopologyCanvas(CanvasEvent::Camera(context, scope.epoch, e));
+    let canvas = container(
+        iced::widget::sensor(
+            super::super::canvas_workspace::Viewport::new(
+                canvas::Canvas::new(graph).width(Fill).height(Fill),
+                scope,
+                scale,
+                keyboard,
+                camera,
+            )
+            .pan_background(state.tool == CanvasTool::Select),
+        )
+        .key((context.document, owner))
+        .on_show(move |size| Message::TopologyCanvas(CanvasEvent::Viewport(context, size)))
+        .on_resize(move |size| Message::TopologyCanvas(CanvasEvent::Viewport(context, size))),
+    )
+    .id("process-viewport")
+    .width(Fill)
+    .height(Fill)
+    .style(style::card)
+    .into();
+    let header = column![
+        row![
+            out.width(Fill),
+            super::super::canvas_workspace::Control::new(
                button(
                    text(if state.focused {
                        "Restore panels"
@@ -285,368 +232,352 @@ pub(super) fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Ele
                    })
                    .size(12)
                )
-                .on_press(Message::TopologyCanvas(CanvasEvent::Focus(context)))
                .padding(6)
-            ]
-            .spacing(6)
-            .align_y(iced::Center),
-            row![
-                button(text("Tools").size(12))
-                    .padding(6)
-                    .style(if state.shelf == Some(Shelf::Tools) {
-                        button::primary
-                    } else {
-                        style::nav
-                    })
-                    .on_press(event(Event::Shelf(Shelf::Tools))),
-                button(text("Selection details").size(12))
-                    .padding(6)
-                    .style(if state.shelf == Some(Shelf::Selection) {
-                        button::primary
-                    } else {
-                        style::nav
-                    })
-                    .on_press(event(Event::Shelf(Shelf::Selection))),
-                button(text("Fit overview").size(12))
-                    .padding(6)
-                    .on_press(Message::TopologyCanvas(CanvasEvent::Zoom(context, None))),
-                button(text("−").size(12))
-                    .padding(6)
-                    .on_press(Message::TopologyCanvas(CanvasEvent::Zoom(
-                        context,
-                        Some(scale / 1.25)
-                    ))),
-                label(format!("{:.0}%", scale * 100.)),
-                button(text("+").size(12))
-                    .padding(6)
-                    .on_press(Message::TopologyCanvas(CanvasEvent::Zoom(
-                        context,
-                        Some(scale * 1.25)
-                    ))),
-                button(text("100%").size(12))
-                    .padding(6)
-                    .on_press(Message::TopologyCanvas(CanvasEvent::Zoom(
-                        context,
-                        Some(1.)
-                    )))
-            ]
-            .spacing(6)
-            .wrap(),
+                .on_press(super::super::canvas_workspace::intent(
+                    scope,
+                    "Panels",
+                    Message::TopologyCanvas(CanvasEvent::Focus(context))
+                )),
+                scope,
+                "Panels",
+                keyboard,
+                Some(super::super::canvas_workspace::intent(
+                    scope,
+                    "Panels",
+                    Message::TopologyCanvas(CanvasEvent::Focus(context))
+                )),
+                camera
+            )
        ]
-        .spacing(6);
-        if state.fit_limited(graph.size, (app.window_size.width - 600.).max(200.)) {
-            header = header
-                .push(text("Minimum zoom reached · scroll to see the remaining graph.").size(11));
-        }
-        if graph.nodes.is_empty() {
-            controls = controls.push(label(
-                "Choose Work, Exchange, Reuse or a control, then click the canvas to start.",
-            ));
-        }
-        let size = Size::new(graph.size.width * scale, graph.size.height * scale);
-        let canvas = scrollable(
-            canvas::Canvas::new(graph)
-                .width(size.width)
-                .height(size.height),
-        )
-        .id("process-canvas")
-        .direction(scrollable::Direction::Both {
-            vertical: scrollable::Scrollbar::default(),
-            horizontal: scrollable::Scrollbar::default(),
-        })
-        .width(Fill)
-        .height(Fill);
-        let canvas = container(
-            iced::widget::sensor(super::super::scenario_scroll::observe_topology(
+        .spacing(6),
+        super::super::canvas_workspace::controls(
+            scope,
+            keyboard,
+            scale,
+            event(Event::Shelf(Shelf::Selection)),
+            clean.then_some(Message::TopologyCanvas(CanvasEvent::Camera(
                context,
-                scenario::ScrollArea::Canvas,
-                canvas,
-            ))
-            .on_show(move |size| Message::TopologyCanvas(CanvasEvent::Viewport(context, size)))
-            .on_resize(move |size| Message::TopologyCanvas(CanvasEvent::Viewport(context, size))),
+                scope.epoch,
+                super::super::canvas_workspace::Event::Focus
+            ))),
+            move |zoom| Message::TopologyCanvas(CanvasEvent::Zoom(context, zoom)),
+            camera
        )
-        .padding(8)
-        .width(Fill)
-        .height(Fill)
-        .style(style::card);
-        let details: Element<'_, Message> = match state.shelf {
-            Some(Shelf::Tools) => controls.into(),
-            _ => navigation.push(text("Full qualified identities and definition actions appear here for the selected contribution or link.").size(11)).into(),
-        };
-        explicit_pane(
-            header.into(),
-            details,
-            canvas.into(),
-            state.shelf.is_some(),
-            pending,
-        )
-    };
+    ]
+    .spacing(4);
+    let entries = [
+        ("S", "Select contributions or paths", CanvasTool::Select),
+        (
+            "W",
+            "Work: click a path or empty space",
+            CanvasTool::Add(Tool::Work, ControlKind::Choice),
+        ),
+        (
+            "E",
+            "Exchange: click a path or empty space",
+            CanvasTool::Add(Tool::Exchange, ControlKind::Choice),
+        ),
+        (
+            "ref",
+            "Reuse process / chain",
+            CanvasTool::Add(Tool::Reuse, ControlKind::Choice),
+        ),
+        (
+            "OR",
+            "Choice",
+            CanvasTool::Add(Tool::Control, ControlKind::Choice),
+        ),
+        (
+            "M",
+            "Merge",
+            CanvasTool::Add(Tool::Control, ControlKind::Merge),
+        ),
+        (
+            "AND",
+            "Fork",
+            CanvasTool::Add(Tool::Control, ControlKind::Fork),
+        ),
+        (
+            "J",
+            "Join",
+            CanvasTool::Add(Tool::Control, ControlKind::Join),
+        ),
+        (
+            "IT",
+            "Loop",
+            CanvasTool::Add(Tool::Control, ControlKind::Loop),
+        ),
+        (
+            "->",
+            "Sequence link: click or drag between contributions",
+            CanvasTool::Connect,
+        ),
+    ];
+    let palette = super::super::canvas_workspace::palette(
+        scope,
+        keyboard,
+        camera,
+        entries.into_iter().map(|(glyph, label, choice)| {
+            (
+                glyph,
+                label,
+                choice == state.tool,
+                clean.then_some(Message::TopologyCanvas(CanvasEvent::Choose(
+                    context, choice,
+                ))),
+            )
+        }),
+    );
+    let details = scrollable(navigation.push(text("Layout is derived. The reorder handle changes display order within its column; it does not author a position.").size(11)))
+        .id("process-details").width(Fill).height(Fill).into();
    let mut form_panel: Element<'_, Message> = iced::widget::Space::new().height(0).into();
    if let Some(d) = state.draft.as_ref().filter(|d| d.owner == owner) {
-        let mut form = column![text(d.tool.title()).size(16)].spacing(8);
-        if let Some(contextual) = &d.contextual {
-            form = form
-                .push(
-                    text_input("Link name (retain current when blank)", &d.name)
-                        .on_input(|v| event(Event::Name(v)))
-                        .padding(8)
-                        .size(12),
-                )
-                .push(super::contextual::view(p, owner, contextual));
+        if let Some(child) = d.source.view(p) {
+            form_panel = column![
+                text(format!(
+                    "Consumer name: {}",
+                    crate::views::short(&d.name, 60)
+                ))
+                .size(12),
+                child.map(|e| event(Event::Source(e)))
+            ]
+            .spacing(6)
+            .height(Fill)
+            .into();
        } else {
-            if let Some(link) = d.insertion.link.and_then(|id| p.relations.get(&id)) {
-                let guard = if let RelationBody::SequenceLink { guard, .. } = &link.body {
-                    guard.as_str()
-                } else {
-                    ""
-                };
-                form = form.push(label(format!(
-                    "Insert on {} → {} · preserve path identity and condition [{}]",
-                    p.named(link.source()),
-                    p.named(link.target()),
-                    guard
-                )));
-            } else if d.fixed && ordered {
-                form = form.push(label(match (d.before, d.after) {
-                    (Some(before), Some(after)) => format!(
-                        "Insert between {} → {} · preserve the ordered path",
-                        p.named(before),
-                        p.named(after)
-                    ),
-                    (Some(before), None) => format!("Continue after {}", p.named(before)),
-                    (None, Some(after)) => format!("Insert before {}", p.named(after)),
-                    _ => "Start the ordered path".into(),
-                }));
-            } else if d.fixed
-                && d.tool == Tool::Exchange
-                && let Some(before) = d.before
-            {
-                form = form.push(label(format!(
-                    "Append after {} → new exchange · Create adds an explicit sequence link",
-                    p.named(before)
-                )));
-            } else if d.fixed && d.tool != Tool::Connect {
-                form = form.push(label(
-                    d.insertion
-                        .before
-                        .map_or("Append an unconnected contribution".into(), |id| {
-                            format!("Unconnected contribution before {}", p.named(id))
-                        }),
-                ));
-            }
-            if !legacy_order(p, owner).is_empty() {
-                form = form.push(label(
+            let mut form = column![text(d.tool.title()).size(16)].spacing(8);
+            if let Some(contextual) = &d.contextual {
+                form = form
+                    .push(
+                        text_input("Link name (retain current when blank)", &d.name)
+                            .on_input(|v| event(Event::Name(v)))
+                            .padding(8)
+                            .size(12),
+                    )
+                    .push(super::contextual::view(p, owner, contextual));
+            } else {
+                if let Some(link) = d.insertion.link.and_then(|id| p.relations.get(&id)) {
+                    let guard = if let RelationBody::SequenceLink { guard, .. } = &link.body {
+                        guard.as_str()
+                    } else {
+                        ""
+                    };
+                    form = form.push(label(format!(
+                        "Insert on {} → {} · preserve path identity and condition [{}]",
+                        p.named(link.source()),
+                        p.named(link.target()),
+                        guard
+                    )));
+                } else if d.fixed && ordered {
+                    form = form.push(label(match (d.before, d.after) {
+                        (Some(before), Some(after)) => format!(
+                            "Insert between {} → {} · preserve the ordered path",
+                            p.named(before),
+                            p.named(after)
+                        ),
+                        (Some(before), None) => format!("Continue after {}", p.named(before)),
+                        (None, Some(after)) => format!("Insert before {}", p.named(after)),
+                        _ => "Start the ordered path".into(),
+                    }));
+                } else if d.fixed
+                    && d.tool == Tool::Exchange
+                    && let Some(before) = d.before
+                {
+                    form = form.push(label(format!(
+                        "Append after {} → new exchange · Create adds an explicit sequence link",
+                        p.named(before)
+                    )));
+                } else if d.fixed && d.tool != Tool::Connect {
+                    form = form.push(label(
+                        d.insertion
+                            .before
+                            .map_or("Append an unconnected contribution".into(), |id| {
+                                format!("Unconnected contribution before {}", p.named(id))
+                            }),
+                    ));
+                }
+                if d.tool == Tool::Work {
+                    if let Some(title) = d.source.label(d.target) {
+                        form = form.push(label(title)).push(label("Create commits the new work and contribution together at the chosen path position."));
+                    }
+                    form = form.push(button("Create new source…").on_press(event(Event::Source(
+                        super::super::source_draft::Event::Open(d.invocation),
+                    ))));
+                }
+                if !legacy_order(p, owner).is_empty() {
+                    form = form.push(label(
                    "This edit preserves the ordered path as explicit links in the same undo step.",
                ));
-            }
-            if matches!(
-                d.tool,
-                Tool::Work | Tool::Exchange | Tool::Reuse | Tool::Branch
-            ) {
-                let choices = targets(p, owner, d.tool)
-                    .into_iter()
-                    .filter(|c| compatible_source(p, d, c.id))
-                    .collect();
-                if d.tool == Tool::Branch {
-                    form = form.push(label("First path work"));
                }
-                form = form.push(picker(
-                    choices,
-                    d,
-                    0,
-                    d.target,
+                if matches!(
+                    d.tool,
+                    Tool::Work | Tool::Exchange | Tool::Reuse | Tool::Branch
+                ) {
+                    let choices = targets(p, owner, d.tool)
+                        .into_iter()
+                        .filter(|c| compatible_source(p, d, c.id))
+                        .collect();
                    if d.tool == Tool::Branch {
-                        "Choose first path work…"
+                        form = form.push(label("First path work"));
+                    }
+                    form = form.push(picker(
+                        choices,
+                        d,
+                        0,
+                        d.target,
+                        if d.tool == Tool::Branch {
+                            "Choose first path work…"
+                        } else {
+                            "Choose existing source…"
+                        },
+                        Event::Target,
+                    ));
+                }
+                if d.tool != Tool::Connect {
+                    form = form.push(
+                        text_input("Contribution name (defaults to source)", &d.name)
+                            .on_input(|v| event(Event::Name(v)))
+                            .padding(8)
+                            .size(12),
+                    );
+                }
+                if matches!(d.tool, Tool::Control | Tool::Branch) {
+                    let kinds = if d.tool == Tool::Branch {
+                        vec![ControlKind::Choice, ControlKind::Fork]
                    } else {
-                        "Choose existing source…"
-                    },
-                    Event::Target,
-                ));
-            }
-            if d.tool != Tool::Connect {
-                form = form.push(
-                    text_input("Contribution name (defaults to source)", &d.name)
-                        .on_input(|v| event(Event::Name(v)))
+                        vec![
+                            ControlKind::Choice,
+                            ControlKind::Merge,
+                            ControlKind::Fork,
+                            ControlKind::Join,
+                            ControlKind::Loop,
+                        ]
+                    };
+                    form = form.push(
+                        pick_list(
+                            kinds.into_iter().map(ControlChoice).collect::<Vec<_>>(),
+                            Some(ControlChoice(d.control)),
+                            |v| event(Event::Control(v)),
+                        )
+                        .padding(8)
+                        .text_size(12),
+                    );
+                }
+                if d.tool == Tool::Branch {
+                    form = form.push(label("Second path work")).push(picker(
+                        targets(p, owner, Tool::Work),
+                        d,
+                        1,
+                        d.alternate,
+                        "Second path work…",
+                        Event::Alternate,
+                    ));
+                    if d.control != ControlKind::Fork {
+                        form = form
+                            .push(label("First path guard"))
+                            .push(
+                                text_input("First path guard", &d.guard)
+                                    .on_input(|v| event(Event::Guard(v)))
+                                    .padding(8),
+                            )
+                            .push(label("Second path guard"))
+                            .push(
+                                text_input("Second path guard (e.g. else)", &d.alternate_guard)
+                                    .on_input(|v| event(Event::AlternateGuard(v)))
+                                    .padding(8),
+                            );
+                    }
+                }
+                if d.fixed {
+                    if let (Some(a), Some(b)) = (d.before, d.after) {
+                        form = form.push(label(format!("{} → {}", p.named(a), p.named(b))));
+                    }
+                } else {
+                    form = form
+                        .push(label("Preceding contribution"))
+                        .push(picker(
+                            contributions(p, owner),
+                            d,
+                            2,
+                            d.before,
+                            "After contribution…",
+                            Event::Before,
+                        ))
+                        .push(button("Clear preceding").on_press(event(Event::ClearBefore)))
+                        .push(label("Following contribution"))
+                        .push(picker(
+                            contributions(p, owner),
+                            d,
+                            3,
+                            d.after,
+                            "Before contribution…",
+                            Event::After,
+                        ))
+                        .push(button("Clear following").on_press(event(Event::ClearAfter)));
+                }
+                if d.tool != Tool::Branch
+                    && d.insertion.link.is_none()
+                    && (d.before.is_some() || d.tool == Tool::Connect)
+                {
+                    form = form.push(
+                        text_input(
+                            "Path condition (empty remains a Choice / Loop warning)",
+                            &d.guard,
+                        )
+                        .on_input(|v| event(Event::Guard(v)))
                        .padding(8)
                        .size(12),
-                );
+                    );
+                }
            }
-            if matches!(d.tool, Tool::Control | Tool::Branch) {
-                let kinds = if d.tool == Tool::Branch {
-                    vec![ControlKind::Choice, ControlKind::Fork]
+            let valid = match d.command(p) {
+                Ok(_) => true,
+                Err(problem) => {
+                    form = form.push(label(problem));
+                    false
+                }
+            };
+            let actions = row![
+                button(if d.contextual.is_some() {
+                    "Apply link"
                } else {
-                    vec![
-                        ControlKind::Choice,
-                        ControlKind::Merge,
-                        ControlKind::Fork,
-                        ControlKind::Join,
-                        ControlKind::Loop,
-                    ]
-                };
-                form = form.push(
-                    pick_list(
-                        kinds.into_iter().map(ControlChoice).collect::<Vec<_>>(),
-                        Some(ControlChoice(d.control)),
-                        |v| event(Event::Control(v)),
-                    )
-                    .padding(8)
-                    .text_size(12),
-                );
-            }
-            if d.tool == Tool::Branch {
-                form = form.push(label("Second path work")).push(picker(
-                    targets(p, owner, Tool::Work),
-                    d,
-                    1,
-                    d.alternate,
-                    "Second path work…",
-                    Event::Alternate,
-                ));
-                if d.control != ControlKind::Fork {
-                    form = form
-                        .push(label("First path guard"))
-                        .push(
-                            text_input("First path guard", &d.guard)
-                                .on_input(|v| event(Event::Guard(v)))
-                                .padding(8),
-                        )
-                        .push(label("Second path guard"))
-                        .push(
-                            text_input("Second path guard (e.g. else)", &d.alternate_guard)
-                                .on_input(|v| event(Event::AlternateGuard(v)))
-                                .padding(8),
-                        );
-                }
-            }
-            if d.fixed {
-                if let (Some(a), Some(b)) = (d.before, d.after) {
-                    form = form.push(label(format!("{} → {}", p.named(a), p.named(b))));
-                }
-            } else {
-                form = form
-                    .push(label("Preceding contribution"))
-                    .push(picker(
-                        contributions(p, owner),
-                        d,
-                        2,
-                        d.before,
-                        "After contribution…",
-                        Event::Before,
-                    ))
-                    .push(button("Clear preceding").on_press(event(Event::ClearBefore)))
-                    .push(label("Following contribution"))
-                    .push(picker(
-                        contributions(p, owner),
-                        d,
-                        3,
-                        d.after,
-                        "Before contribution…",
-                        Event::After,
-                    ))
-                    .push(button("Clear following").on_press(event(Event::ClearAfter)));
-            }
-            if d.tool != Tool::Branch
-                && d.insertion.link.is_none()
-                && (d.before.is_some() || d.tool == Tool::Connect)
-            {
-                form = form.push(
-                    text_input(
-                        "Path condition (empty remains a Choice / Loop warning)",
-                        &d.guard,
-                    )
-                    .on_input(|v| event(Event::Guard(v)))
-                    .padding(8)
-                    .size(12),
-                );
-            }
+                    "Create"
+                })
+                .on_press_maybe(valid.then(|| event(Event::Submit))),
+                button("Cancel").on_press(event(Event::Cancel))
+            ]
+            .spacing(7);
+            form_panel = editor_panel(d.invocation, actions.into(), form.into());
        }
-        let valid = match d.command(p) {
-            Ok(_) => true,
-            Err(problem) => {
-                form = form.push(label(problem));
-                false
-            }
-        };
-        let actions = row![
-            button(if d.contextual.is_some() {
-                "Apply link"
-            } else {
-                "Create"
-            })
-            .on_press_maybe(valid.then(|| event(Event::Submit))),
-            button("Cancel").on_press(event(Event::Cancel))
-        ]
-        .spacing(7);
-        form_panel = editor_panel(actions.into(), form.into());
    }
-    panes(diagram, form_panel, pending)
-}
-
-/// A permanent three-slot tree: variable controls never remount the canvas.
-/// The shelf scrolls independently; the canvas receives actual remaining height.
-fn explicit_pane<'a, R: iced::advanced::text::Renderer + 'a>(
-    header: iced::Element<'a, Message, iced::Theme, R>,
-    details: iced::Element<'a, Message, iced::Theme, R>,
-    canvas: iced::Element<'a, Message, iced::Theme, R>,
-    show_details: bool,
-    pending: bool,
-) -> iced::Element<'a, Message, iced::Theme, R> {
-    // Column::push drops Fixed(0) children. from_vec retains the closed shelf
-    // slot so its disclosure cannot move/remount the following canvas tree.
-    Column::from_vec(vec![
-        container(header).width(Fill).into(),
-        scrollable(details)
-            .id("process-details")
-            .width(Fill)
-            .height(if show_details {
-                if pending { 64. } else { 112. }
-            } else {
-                0.
-            })
-            .into(),
-        container(canvas).width(Fill).height(Fill).into(),
-    ])
-    .spacing(6)
-    .padding(8)
-    .width(Fill)
-    .height(Fill)
-    .into()
-}
-
-/// Keep the diagram mounted while an independent editor uses the remaining
-/// workspace height. The editor must never be clipped by the page scrollable.
-fn panes<'a, R: iced::advanced::Renderer + 'a>(
-    diagram: iced::Element<'a, Message, iced::Theme, R>,
-    form: iced::Element<'a, Message, iced::Theme, R>,
-    pending: bool,
-) -> iced::Element<'a, Message, iced::Theme, R> {
-    column![
-        container(diagram).width(Fill).height(if pending {
-            iced::Length::FillPortion(1)
-        } else {
-            Fill
-        }),
-        container(form).width(Fill).height(if pending {
-            iced::Length::FillPortion(1)
-        } else {
-            iced::Length::Shrink
-        }),
-    ]
-    .width(Fill)
-    .height(Fill)
-    .into()
+    let editor = if pending {
+        Some(form_panel)
+    } else {
+        state.shelf.map(|_| details)
+    };
+    super::super::canvas_workspace::host(header.into(), palette, canvas, editor)
 }

 fn editor_panel<'a, R: iced::advanced::text::Renderer + 'a>(
+    session: Id,
    actions: iced::Element<'a, Message, iced::Theme, R>,
    fields: iced::Element<'a, Message, iced::Theme, R>,
 ) -> iced::Element<'a, Message, iced::Theme, R> {
    container(
-        container(column![actions, scrollable(fields).id("process-form").height(Fill)].spacing(8))
-            .width(Fill)
-            .height(Fill)
-            .padding(12)
-            .style(style::card),
+        container(
+            column![
+                container(actions).id("process-actions"),
+                super::super::form_session::reset_on_change(
+                    session,
+                    scrollable(fields).id("process-form").height(Fill)
+                )
+            ]
+            .spacing(8),
+        )
+        .width(Fill)
+        .height(Fill)
+        .padding(12)
+        .style(style::card),
    )
    .width(Fill)
    .height(Fill)
@@ -95,7 +95,7 @@ pub struct Document {
    past: Vec<HistoryEntry>,
    future: Vec<HistoryEntry>,
    current_bytes: usize,
-    saved: Arc<SourceBundle>,
+    saved: Option<Arc<SourceBundle>>,
    revision: u64,
    view_index: std::cell::OnceCell<oa_core::view_options::ViewIndex>,
    limits: ProjectLimits,
@@ -125,7 +125,7 @@ impl Document {
            current_bytes,
            past: Vec::new(),
            future: Vec::new(),
-            saved: Arc::new(bundle),
+            saved: Some(Arc::new(bundle)),
            revision: 0,
            view_index: Default::default(),
            limits,
@@ -156,7 +156,7 @@ impl Document {
    }

    pub fn dirty(&self) -> bool {
-        self.recovered_unsaved || self.bundle() != self.saved.as_ref()
+        self.recovered_unsaved || self.saved.as_deref() != Some(self.bundle())
    }

    /// Recovered work is a detached copy until explicitly saved by its user.
@@ -181,10 +181,24 @@ impl Document {
    /// Records the bytes actually saved, even when later edits remain current.
    /// The I/O adapter owns document identity and save completion ordering.
    pub fn mark_saved(&mut self, snapshot: Arc<CompiledSourceProject>) {
-        self.saved = Arc::new(snapshot.bundle.clone());
+        self.saved = Some(Arc::new(snapshot.bundle.clone()));
        self.recovered_unsaved = false;
    }

+    /// Bind an installed or recovered repair destination to source read there.
+    /// These bytes may be invalid or differ from the retained accepted model,
+    /// but must replace the previous disk baseline. Accepted history is retained;
+    /// applying or undoing to old saved content does not save this destination.
+    pub(crate) fn bind_repair_baseline(&mut self, source: SourceBundle) {
+        self.saved = Some(Arc::new(source));
+    }
+
+    /// Recovery changed the current destination, but its source could not be
+    /// reloaded. No accepted or historical snapshot is known to be saved there.
+    pub(crate) fn invalidate_saved_baseline(&mut self) {
+        self.saved = None;
+    }
+
    /// Check a source Save as before writing any files. A retained included file
    /// must never be displaced by the new entry, including on a later Undo.
    pub fn check_save_entry(&self, entry: &str) -> Result<(), DocumentError> {
@@ -18,6 +18,7 @@ mod context_fields;
 mod data_fields;
 mod history_fields;
 mod port_fields;
+pub(crate) mod reference_chooser;
 mod view_fields;

 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -85,6 +86,8 @@ pub struct Draft {
    pub value_browsers: BTreeMap<String, ValueBrowser>,
    pub reference_browsers: BTreeMap<String, ReferenceBrowser>,
    history: history_fields::State,
+    reference_session: Id,
+    reference_generation: Id,
 }

 #[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
@@ -209,11 +212,14 @@ impl Draft {
            value_browsers: BTreeMap::new(),
            reference_browsers: BTreeMap::new(),
            history: Default::default(),
+            reference_session: Id::new_v4(),
+            reference_generation: Id::new_v4(),
        };
        draft.rebuild();
        Some(draft)
    }
    fn rebuild(&mut self) {
+        self.reference_generation = Id::new_v4();
        // Array/variant edits can change the meaning of a row path.
        self.value_browsers.clear();
        self.inputs.clear();
@@ -274,6 +280,9 @@ impl Draft {
            .unwrap_or_else(|| self.materialize().unwrap_or_else(|_| self.value.clone()))
    }
    pub fn set_context(&mut self, context: Option<Value>) {
+        if self.context != context {
+            self.reference_generation = Id::new_v4();
+        }
        self.context = context;
    }
    /// Materialize selected scalar subtrees without parsing retained, unselected drafts.
@@ -359,6 +368,9 @@ impl Draft {
    }
    pub fn input(&mut self, path: &str, value: String) {
        if let Some(input) = self.inputs.get_mut(path) {
+            if input.raw != value {
+                self.reference_generation = Id::new_v4();
+            }
            input.editor = text_editor::Content::with_text(&value);
            input.raw = value;
        }
@@ -366,7 +378,11 @@ impl Draft {
    pub fn edit_text(&mut self, path: &str, action: text_editor::Action) {
        if let Some(input) = self.inputs.get_mut(path) {
            input.editor.perform(action);
-            input.raw = input.editor.text();
+            let raw = input.editor.text();
+            if input.raw != raw {
+                self.reference_generation = Id::new_v4();
+            }
+            input.raw = raw;
        }
    }
    pub fn shape(&mut self, path: &str, value: Value) -> Result<(), String> {
@@ -1795,7 +1811,7 @@ pub fn view<'a>(draft: &'a Draft, project: &'a Project) -> View<'a, Message> {
            ));
        }
    }
-    content.into()
+    reference_chooser::trigger::scope(content, draft.reference_session)
 }

 /// Render one closed property subtree for a workflow-owned typed draft.
@@ -1937,41 +1953,12 @@ fn property<'a>(
        return out.into();
    }
    if reference(path) && (value.is_string() || value.is_null()) {
-        let raw = draft
-            .inputs
-            .get(path)
-            .map(|v| v.raw.as_str())
-            .or_else(|| value.as_str());
-        let current = raw.and_then(|s| s.parse::<Id>().ok()).unwrap_or(Id::nil());
-        let choices = reference_choices(draft, project, path, current);
-        let selected = choices.iter().find(|c| c.id == current).cloned();
-        let owned_path = path.to_string();
-        let optional = optional_reference(path);
-        let mut content = column![
+        return column![
            label_view(),
-            pick_list(choices, selected, move |choice| Message::FieldShape(
-                owned_path.clone(),
-                if choice.id.is_nil() && optional {
-                    Value::Null
-                } else {
-                    json!(choice.id)
-                }
-            ))
-            .text_size(12)
-            .padding(8)
-            .width(Fill)
+            reference_chooser::adapter::field(draft, project, path)
        ]
-        .spacing(5);
-        if let Some(raw) = raw
-            && raw.parse::<Id>().is_err()
-        {
-            content = content.push(
-                text(format!("Invalid reference retained in the draft: {raw}"))
-                    .size(11)
-                    .color(style::MUTED),
-            );
-        }
-        return content.into();
+        .spacing(5)
+        .into();
    }
    match value {
        Value::Object(map) => {
@@ -670,7 +670,7 @@ mod tests {
    }
    fn semantic_send(app: &mut crate::app::App, event: crate::semantic_review::RowEvent) {
        let event = semantic_state(app).address_event(event);
-        let _ = app.update(Message::Workflow(crate::workflow::Event::Semantic(event)));
+        let _ = app.update(Message::Workflow(crate::workflow::Event::semantic(event)));
    }
    fn semantic_decide(app: &mut crate::app::App, facet: FieldFacet, decision: SemanticDecision) {
        use crate::semantic_review::RowEvent as Event;
@@ -579,11 +579,11 @@ fn render<'a>(
            for (index, item) in items.iter().enumerate().skip(page * PAGE_SIZE).take(PAGE_SIZE) {
                let item_path = format!("{path}/{index}");
                let mut card = column![render(draft, project, item_schema, Some(item), &item_path, &format!("{} {}", title, index + 1), depth + 1)].spacing(8);
-                if path == FACETS {
-                    if let Some(current) = current_observation(draft, project, &item_path) {
-                        card = card.push(button("Use current counterpart observations")
-                            .on_press(Message::FieldShape(item_path.clone(), json!(current))).style(style::nav));
-                    }
+                if path == FACETS
+                    && let Some(current) = current_observation(draft, project, &item_path)
+                {
+                    card = card.push(button("Use current counterpart observations")
+                        .on_press(Message::FieldShape(item_path.clone(), json!(current))).style(style::nav));
                }
                card = card.push(row![
                    button("↑").on_press_maybe((index > 0).then(|| Message::FieldArray(path.into(), Some(index), -1))),
@@ -0,0 +1,389 @@
+//! Isolated live-reference chooser experiment, declared only under cfg(test).
+//! The host supplies an eligible catalog and revalidates every
+//! Write intent against the current document before changing a staged scalar.
+//! No core command, draft serialization, or App message belongs in this module.
+use oa_core::Id;
+use std::collections::BTreeSet;
+
+pub mod adapter;
+#[cfg(test)]
+mod tests;
+pub mod trigger;
+pub mod widget;
+
+pub const MAX_ROWS: usize = 6;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Context {
+    pub document: Id,
+    pub revision: u64,
+    pub draft: Id,
+    pub record: Id,
+    pub path: String,
+    pub optional: bool,
+}
+impl Context {
+    /// This is an additional historical-path guard, not live schema discovery.
+    /// Call only after the parent form has identified a live reference field.
+    pub fn live(
+        document: Id,
+        revision: u64,
+        draft: Id,
+        record: Id,
+        path: impl Into<String>,
+        optional: bool,
+    ) -> Result<Self, &'static str> {
+        let path = path.into();
+        if !path.starts_with('/') || path.split('/').any(|part| part == "baseline") {
+            return Err("The chooser requires a live reference property.");
+        }
+        Ok(Self {
+            document,
+            revision,
+            draft,
+            record,
+            path,
+            optional,
+        })
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Candidate {
+    /// For a diagram placement this is the placement ID, not its element ID.
+    pub id: Id,
+    pub name: String,
+    pub alias: String,
+    pub kind: String,
+    pub scope: String,
+    pub containment: String,
+}
+impl Candidate {
+    pub fn context_label(&self) -> String {
+        format!("{} · {} · {}", self.scope, self.kind, self.containment)
+    }
+    pub fn detail(&self) -> String {
+        format!(
+            "{} · @{} · {} · {}",
+            self.name,
+            self.alias,
+            self.context_label(),
+            self.id
+        )
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Current {
+    Unassigned,
+    Valid(Candidate),
+    Incompatible(Candidate),
+    Missing(Id),
+    InvalidRaw(String),
+}
+impl Current {
+    pub fn label(&self) -> String {
+        match self {
+            Self::Unassigned => "Not assigned".into(),
+            Self::Valid(c) => format!("Current: {} · @{}", c.name, c.alias),
+            Self::Incompatible(c) => {
+                format!("Current choice needs review: {} · @{}", c.name, c.alias)
+            }
+            Self::Missing(id) => format!("Missing reference: {id}"),
+            Self::InvalidRaw(raw) => format!("Invalid reference retained: {raw}"),
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+struct Searchable {
+    candidate: Candidate,
+    all: String,
+    alias: String,
+    name: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Stamp {
+    pub context: Context,
+    pub invocation: Id,
+    pub results: u64,
+}
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Close {
+    Escape,
+    Tab { backwards: bool },
+    Outside,
+    WindowChanged,
+}
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Action {
+    /// The mounted text input numbers emitted edits. Multiple edits in one
+    /// runtime batch may share the old result stamp; none may be dropped.
+    Query {
+        text: String,
+        serial: u64,
+    },
+    Move {
+        delta: i32,
+        rows: usize,
+    },
+    Page {
+        delta: i32,
+        rows: usize,
+    },
+    Highlight(Id),
+    Choose(Id),
+    Clear,
+    Close(Close),
+}
+impl Action {
+    pub fn writes_staged_value(&self) -> bool {
+        matches!(self, Self::Choose(_) | Self::Clear)
+    }
+}
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Event {
+    pub stamp: Stamp,
+    pub action: Action,
+}
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Outcome {
+    Ignored,
+    Browsed,
+    Closed(Close),
+    /// The host must still check current eligibility and scoped draft guards.
+    Write {
+        context: Context,
+        value: Option<Id>,
+    },
+}
+
+#[derive(Debug, Clone)]
+pub struct State {
+    context: Context,
+    invocation: Id,
+    results: u64,
+    serial: u64,
+    open: bool,
+    candidates: Vec<Searchable>,
+    filtered: Vec<usize>,
+    query: String,
+    start: usize,
+    highlight: Option<usize>,
+    pub current: Current,
+    pub scope_label: String,
+}
+impl State {
+    pub fn open(
+        context: Context,
+        candidates: Vec<Candidate>,
+        current: Current,
+        scope_label: impl Into<String>,
+    ) -> Result<Self, &'static str> {
+        // Context fields are public for host comparisons; check again in case
+        // a caller constructed one without the live-path constructor.
+        if !context.path.starts_with('/') || context.path.split('/').any(|p| p == "baseline") {
+            return Err("Historical values are not live reference candidates.");
+        }
+        let mut seen = BTreeSet::new();
+        let mut indexed = Vec::with_capacity(candidates.len());
+        for candidate in candidates {
+            if candidate.id.is_nil() || !seen.insert(candidate.id) {
+                return Err("Eligible references must have distinct, non-nil identities.");
+            }
+            indexed.push(Searchable {
+                all: candidate.detail().to_lowercase(),
+                alias: candidate.alias.to_lowercase(),
+                name: candidate.name.to_lowercase(),
+                candidate,
+            });
+        }
+        indexed.sort_by(|a, b| {
+            (&a.name, &a.alias, a.candidate.id).cmp(&(&b.name, &b.alias, b.candidate.id))
+        });
+        let filtered: Vec<_> = (0..indexed.len()).collect();
+        let highlight = (!filtered.is_empty()).then_some(0);
+        Ok(Self {
+            context,
+            invocation: Id::new_v4(),
+            results: 0,
+            serial: 0,
+            open: true,
+            candidates: indexed,
+            filtered,
+            query: String::new(),
+            start: 0,
+            highlight,
+            current,
+            scope_label: scope_label.into(),
+        })
+    }
+    pub fn stamp(&self) -> Stamp {
+        Stamp {
+            context: self.context.clone(),
+            invocation: self.invocation,
+            results: self.results,
+        }
+    }
+    pub fn event(&self, action: Action) -> Event {
+        Event {
+            stamp: self.stamp(),
+            action,
+        }
+    }
+    pub fn is_open(&self) -> bool {
+        self.open
+    }
+    pub fn query(&self) -> &str {
+        &self.query
+    }
+    pub fn query_serial(&self) -> u64 {
+        self.serial
+    }
+    pub fn count(&self) -> usize {
+        self.filtered.len()
+    }
+    pub fn start(&self) -> usize {
+        self.start
+    }
+    pub fn optional(&self) -> bool {
+        self.context.optional
+    }
+    pub fn highlighted(&self) -> Option<&Candidate> {
+        self.highlight.and_then(|i| self.at(i))
+    }
+    fn at(&self, index: usize) -> Option<&Candidate> {
+        self.filtered
+            .get(index)
+            .map(|i| &self.candidates[*i].candidate)
+    }
+    pub fn visible(&self, rows: usize) -> impl Iterator<Item = &Candidate> {
+        self.filtered
+            .iter()
+            .skip(self.start)
+            .take(rows.min(MAX_ROWS))
+            .map(|index| &self.candidates[*index].candidate)
+    }
+    /// The host calls this before rendering on any path/document/facet/context
+    /// replacement. Existing events remain tied to the old invocation.
+    pub fn invalidate(&mut self) {
+        self.open = false;
+    }
+
+    pub fn update(&mut self, event: Event) -> Outcome {
+        if !self.open
+            || event.stamp.context != self.context
+            || event.stamp.invocation != self.invocation
+        {
+            return Outcome::Ignored;
+        }
+        // Absolute row actions require exactly the presented result set.
+        // Relative navigation and dismissal are processed in input order within
+        // this session: typing must not make a following Escape stale.
+        if matches!(event.action, Action::Choose(_) | Action::Highlight(_))
+            && event.stamp.results != self.results
+        {
+            return Outcome::Ignored;
+        }
+        match event.action {
+            Action::Query { text, serial } => {
+                if serial <= self.serial {
+                    return Outcome::Ignored;
+                }
+                self.serial = serial;
+                self.query = text;
+                let query = self.query.to_lowercase();
+                let terms: Vec<_> = query.split_whitespace().collect();
+                self.filtered = self
+                    .candidates
+                    .iter()
+                    .enumerate()
+                    .filter_map(|(i, c)| {
+                        terms
+                            .iter()
+                            .all(|term| match term.strip_prefix('@') {
+                                Some(alias) => c.alias.contains(alias),
+                                None => c.all.contains(term),
+                            })
+                            .then_some(i)
+                    })
+                    .collect();
+                self.start = 0;
+                self.highlight = (!self.filtered.is_empty()).then_some(0);
+            }
+            Action::Page { delta, rows } => {
+                let rows = rows.clamp(1, MAX_ROWS);
+                if self.filtered.is_empty() {
+                    return Outcome::Ignored;
+                }
+                let relative = self
+                    .highlight
+                    .unwrap_or(self.start)
+                    .saturating_sub(self.start)
+                    .min(rows - 1);
+                let last_page = (self.filtered.len() - 1) / rows * rows;
+                self.start = (self.start as i64 + i64::from(delta) * rows as i64)
+                    .clamp(0, last_page as i64) as usize;
+                self.highlight = Some((self.start + relative).min(self.filtered.len() - 1));
+            }
+            Action::Move { delta, rows } => {
+                let rows = rows.clamp(1, MAX_ROWS);
+                if self.filtered.is_empty() {
+                    return Outcome::Ignored;
+                }
+                let current = self.highlight.unwrap_or(self.start) as i64;
+                let next =
+                    (current + i64::from(delta)).clamp(0, self.filtered.len() as i64 - 1) as usize;
+                self.highlight = Some(next);
+                if next < self.start {
+                    self.start = next;
+                }
+                if next >= self.start + rows {
+                    self.start = next + 1 - rows;
+                }
+            }
+            Action::Highlight(id) => {
+                let Some(index) = self
+                    .filtered
+                    .iter()
+                    .position(|i| self.candidates[*i].candidate.id == id)
+                else {
+                    return Outcome::Ignored;
+                };
+                if self.highlight == Some(index) {
+                    return Outcome::Ignored;
+                }
+                self.highlight = Some(index);
+            }
+            Action::Choose(id) => {
+                if !self
+                    .filtered
+                    .iter()
+                    .any(|i| self.candidates[*i].candidate.id == id)
+                {
+                    return Outcome::Ignored;
+                }
+                self.open = false;
+                return Outcome::Write {
+                    context: self.context.clone(),
+                    value: Some(id),
+                };
+            }
+            Action::Clear if self.context.optional => {
+                self.open = false;
+                return Outcome::Write {
+                    context: self.context.clone(),
+                    value: None,
+                };
+            }
+            Action::Clear => return Outcome::Ignored,
+            Action::Close(reason) => {
+                self.open = false;
+                return Outcome::Closed(reason);
+            }
+        }
+        self.results = self.results.wrapping_add(1);
+        Outcome::Browsed
+    }
+}
@@ -0,0 +1,307 @@
+//! Live form adapter. Compatibility stays in the existing parent adapter;
+//! browser metadata and scoped writes never reinterpret historical UUID text.
+use super::super::{Draft, friendly, history_fields, optional_reference, reference, reference_ids};
+use super::{Candidate, Context, Current, State, trigger};
+use crate::{app::Message, style};
+use iced::{
+    Element, Fill, Rectangle,
+    widget::{column, container, row, text, tooltip},
+};
+use oa_core::{Id, Project};
+use serde_json::{Value, json};
+use std::collections::BTreeSet;
+
+#[derive(Debug, Clone)]
+pub struct Open {
+    pub document: Id,
+    pub session: Id,
+    pub generation: Id,
+    pub record: Id,
+    pub path: String,
+    pub anchor: Rectangle,
+}
+#[derive(Debug, Clone)]
+pub struct Set {
+    pub context: Context,
+    pub generation: Id,
+    pub value: Option<Id>,
+}
+impl Draft {
+    pub fn reference_session(&self) -> Id {
+        self.reference_session
+    }
+    pub fn reference_generation(&self) -> Id {
+        self.reference_generation
+    }
+    pub fn reference_open(&self, project: &Project, path: &str, anchor: Rectangle) -> Open {
+        Open {
+            document: project.id,
+            session: self.reference_session,
+            generation: self.reference_generation,
+            record: self.original,
+            path: path.into(),
+            anchor,
+        }
+    }
+    pub fn reference_matches(&self, request: &Open) -> bool {
+        self.reference_session == request.session
+            && self.reference_generation == request.generation
+            && self.original == request.record
+            && self.live_reference(&request.path)
+    }
+    fn live_reference(&self, path: &str) -> bool {
+        !history_fields::is_path(path)
+            && reference(path)
+            && self
+                .value
+                .pointer(path)
+                .is_some_and(|v| v.is_string() || v.is_null())
+    }
+    pub fn reference_catalog(
+        &self,
+        project: &Project,
+        request: &Open,
+        revision: u64,
+    ) -> Result<State, String> {
+        if request.document != project.id || !self.reference_matches(request) {
+            return Err("The reference field changed. Open its chooser again.".into());
+        }
+        let allowed: BTreeSet<_> = reference_ids(self, project, &request.path)
+            .into_iter()
+            .filter(|id| !id.is_nil())
+            .collect();
+        let candidates = allowed
+            .iter()
+            .filter_map(|id| candidate(project, *id))
+            .collect();
+        let raw = self
+            .inputs
+            .get(&request.path)
+            .map(|v| v.raw.as_str())
+            .or_else(|| self.value.pointer(&request.path).and_then(Value::as_str));
+        let current = match raw {
+            None => Current::Unassigned,
+            Some(raw) => match raw.parse::<Id>() {
+                Ok(id) if id.is_nil() => Current::Unassigned,
+                Ok(id) => match candidate(project, id) {
+                    Some(c) if allowed.contains(&id) => Current::Valid(c),
+                    Some(c) => Current::Incompatible(c),
+                    None => Current::Missing(id),
+                },
+                Err(_) => Current::InvalidRaw(raw.into()),
+            },
+        };
+        let context = Context::live(
+            project.id,
+            revision,
+            self.reference_session,
+            self.original,
+            &request.path,
+            optional_reference(&request.path),
+        )
+        .map_err(str::to_owned)?;
+        State::open(
+            context,
+            candidates,
+            current,
+            format!(
+                "{} · compatible references",
+                friendly(request.path.rsplit('/').next().unwrap_or("Reference"))
+            ),
+        )
+        .map_err(str::to_owned)
+    }
+    pub fn reference_set(&mut self, project: &Project, intent: &Set) -> Result<(), String> {
+        let value = self.reference_value(project, intent)?;
+        self.shape_scoped(&intent.context.path, value)
+    }
+    pub fn reference_value(&self, project: &Project, intent: &Set) -> Result<Value, String> {
+        let context = &intent.context;
+        if context.document != project.id
+            || context.draft != self.reference_session
+            || context.record != self.original
+            || intent.generation != self.reference_generation
+            || !self.live_reference(&context.path)
+            || context.optional != optional_reference(&context.path)
+        {
+            return Err("The originating reference field is no longer current.".into());
+        }
+        let value = match intent.value {
+            Some(id)
+                if !id.is_nil() && reference_ids(self, project, &context.path).contains(&id) =>
+            {
+                json!(id)
+            }
+            None if context.optional => Value::Null,
+            _ => return Err("Choose a currently compatible reference.".into()),
+        };
+        Ok(value)
+    }
+}
+
+fn named(project: &Project, id: Id) -> String {
+    if let Some(e) = project.elements.get(&id) {
+        format!("{} · @{}", e.name, e.alias)
+    } else {
+        project.named(id).into()
+    }
+}
+fn ancestry(project: &Project, id: Id) -> String {
+    let mut parts = vec![];
+    let mut seen = BTreeSet::new();
+    let mut current = project.elements.get(&id).and_then(|e| e.parent);
+    while let Some(id) = current {
+        if !seen.insert(id) {
+            parts.push("[containment cycle]".into());
+            break;
+        }
+        parts.push(named(project, id));
+        current = project.elements.get(&id).and_then(|e| e.parent);
+    }
+    parts.reverse();
+    if parts.is_empty() {
+        project.name.clone()
+    } else {
+        parts.join(" / ")
+    }
+}
+pub(crate) fn candidate(project: &Project, id: Id) -> Option<Candidate> {
+    let layer = |layer| format!("{layer:?}").to_uppercase();
+    if id == project.id {
+        return Some(Candidate {
+            id,
+            name: project.name.clone(),
+            alias: project.alias.clone(),
+            kind: "Project".into(),
+            scope: "Model".into(),
+            containment: "Model root".into(),
+        });
+    }
+    if let Some(e) = project.elements.get(&id) {
+        return Some(Candidate {
+            id,
+            name: e.name.clone(),
+            alias: e.alias.clone(),
+            kind: e.kind().to_string(),
+            scope: layer(e.layer()),
+            containment: ancestry(project, id),
+        });
+    }
+    if let Some(r) = project.relations.get(&id) {
+        return Some(Candidate {
+            id,
+            name: r.name.clone(),
+            alias: r.alias.clone(),
+            kind: r.kind().to_string(),
+            scope: project.layer_of(id).map_or_else(|| "Model".into(), layer),
+            containment: format!(
+                "{} → {}",
+                named(project, r.source()),
+                named(project, r.target())
+            ),
+        });
+    }
+    for diagram in project.diagrams.values() {
+        if id == diagram.id {
+            return Some(Candidate {
+                id,
+                name: diagram.name.clone(),
+                alias: diagram.alias.clone(),
+                kind: format!("{:?} diagram", diagram.projection),
+                scope: layer(diagram.layer),
+                containment: project.name.clone(),
+            });
+        }
+        if let Some(node) = diagram.nodes.get(&id) {
+            return Some(Candidate {
+                id,
+                name: project.named(node.element).into(),
+                alias: node.alias.clone(),
+                kind: "Placement".into(),
+                scope: layer(diagram.layer),
+                containment: format!(
+                    "{} · @{} / {}",
+                    diagram.name,
+                    diagram.alias,
+                    named(project, node.element)
+                ),
+            });
+        }
+    }
+    if let Some(link) = project.artifact_links.get(&id) {
+        return Some(Candidate {
+            id,
+            name: link.name.clone(),
+            alias: link.alias.clone(),
+            kind: "Artifact link".into(),
+            scope: project
+                .layer_of(link.owner)
+                .map_or_else(|| "Model".into(), layer),
+            containment: named(project, link.owner),
+        });
+    }
+    project.traces.get(&id).map(|trace| Candidate {
+        id,
+        name: trace.name.clone(),
+        alias: trace.alias.clone(),
+        kind: "Trace".into(),
+        scope: "OA ↔ SA".into(),
+        containment: format!(
+            "{} ↔ {}",
+            named(project, trace.oa),
+            named(project, trace.sa)
+        ),
+    })
+}
+
+pub fn field<'a, R: iced::advanced::text::Renderer<Font = iced::Font> + 'a>(
+    draft: &'a Draft,
+    project: &'a Project,
+    path: &str,
+) -> Element<'a, Message, iced::Theme, R> {
+    let raw = draft
+        .inputs
+        .get(path)
+        .map(|v| v.raw.as_str())
+        .or_else(|| draft.value.pointer(path).and_then(Value::as_str));
+    let (label, detail) = match raw {
+        None => (
+            if optional_reference(path) {
+                "Not assigned"
+            } else {
+                "Choose a reference…"
+            }
+            .into(),
+            String::new(),
+        ),
+        Some(raw) => match raw.parse::<Id>() {
+            Ok(id) if id.is_nil() => ("Choose a reference…".into(), String::new()),
+            Ok(id) => match candidate(project, id) {
+                Some(c) => (format!("{} · @{}", c.name, c.alias), c.detail()),
+                None => ("Missing reference".into(), raw.into()),
+            },
+            Err(_) => ("Invalid reference retained".into(), raw.into()),
+        },
+    };
+    let label = crate::views::short(&label, 35);
+    let body = container(row![text(label).size(12).width(Fill), text("⌄").size(12)].spacing(6))
+        .padding(8)
+        .width(Fill);
+    let path = path.to_owned();
+    let id = trigger::field_id(draft.reference_generation, &path);
+    let field = trigger::Field::new(body, id, move |anchor| {
+        Message::FieldReferenceOpen(draft.reference_open(project, &path, anchor))
+    });
+    if detail.is_empty() {
+        field.into()
+    } else {
+        tooltip(
+            field,
+            container(column![text(detail).size(11)])
+                .padding(8)
+                .style(style::card),
+            tooltip::Position::Left,
+        )
+        .into()
+    }
+}
@@ -0,0 +1,803 @@
+use super::*;
+use iced::{
+    Element, Event as Input, Point, Rectangle, Size, Theme, Vector,
+    advanced::{Layout, Shell, layout, widget::Tree},
+    keyboard, mouse,
+    widget::{Space, mouse_area},
+};
+
+fn context(optional: bool) -> Context {
+    Context::live(
+        Id::from_u128(1),
+        7,
+        Id::from_u128(2),
+        Id::from_u128(3),
+        "/body/SequenceUse/sequence",
+        optional,
+    )
+    .unwrap()
+}
+fn candidate(index: u128) -> Candidate {
+    Candidate {
+        id: Id::from_u128(10_000 + index),
+        name: "Control".into(),
+        alias: format!("controller_{index:04}"),
+        kind: "Function".into(),
+        scope: "SA".into(),
+        containment: format!("System / Subsystem {} / Controller", index / 100),
+    }
+}
+fn thousand(current: Current, optional: bool) -> State {
+    // Reverse the fixture input to falsify accidental dependence on ingestion
+    // order. Expected IDs and aliases below are literal fixture identities.
+    State::open(
+        context(optional),
+        (0..1_000).rev().map(candidate).collect(),
+        current,
+        "SA · compatible functions",
+    )
+    .unwrap()
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+enum Message {
+    Chooser(Event),
+    UnderPress,
+    UnderRelease,
+}
+
+#[derive(Default)]
+struct Clipboard(Option<String>);
+impl iced::advanced::Clipboard for Clipboard {
+    fn read(&self, _: iced::advanced::clipboard::Kind) -> Option<String> {
+        self.0.clone()
+    }
+    fn write(&mut self, _: iced::advanced::clipboard::Kind, text: String) {
+        self.0 = Some(text);
+    }
+}
+
+struct Mount {
+    tree: Option<Tree>,
+    size: Size,
+    anchor: Rectangle,
+    clipboard: Clipboard,
+}
+impl Default for Mount {
+    fn default() -> Self {
+        Self {
+            tree: None,
+            size: Size::new(1100., 700.),
+            anchor: Rectangle {
+                x: 790.,
+                y: 640.,
+                width: 278.,
+                height: 32.,
+            },
+            clipboard: Clipboard::default(),
+        }
+    }
+}
+impl Mount {
+    fn batch(
+        &mut self,
+        state: Option<&State>,
+        events: &[(Input, Option<Point>)],
+    ) -> (Vec<Message>, Option<layout::Node>) {
+        let underneath: Element<'_, Message, Theme, ()> =
+            mouse_area(Space::new().width(iced::Fill).height(iced::Fill))
+                .on_press(Message::UnderPress)
+                .on_release(Message::UnderRelease)
+                .into();
+        let mut view: Element<'_, Message, Theme, ()> =
+            widget::Popup::new(underneath, state, self.anchor, Message::Chooser).into();
+        let tree = self.tree.get_or_insert_with(|| Tree::new(view.as_widget()));
+        view.as_widget().diff(tree);
+        let node =
+            view.as_widget_mut()
+                .layout(tree, &(), &layout::Limits::new(Size::ZERO, self.size));
+        let viewport = Rectangle::with_size(self.size);
+        let overlay_node = view
+            .as_widget_mut()
+            .overlay(tree, Layout::new(&node), &(), &viewport, Vector::ZERO)
+            .map(|mut overlay| overlay.as_overlay_mut().layout(&(), self.size));
+        let mut messages = Vec::new();
+        for (event, point) in events {
+            let cursor = point.map_or(mouse::Cursor::Unavailable, mouse::Cursor::Available);
+            let mut shell = Shell::new(&mut messages);
+            if let Some(overlay_node) = &overlay_node {
+                // Reconstruct the overlay between layout and every input, as
+                // Iced does. Geometry must live in the measured layout tree.
+                let mut overlay = view
+                    .as_widget_mut()
+                    .overlay(tree, Layout::new(&node), &(), &viewport, Vector::ZERO)
+                    .unwrap();
+                overlay.as_overlay_mut().update(
+                    event,
+                    Layout::new(overlay_node),
+                    cursor,
+                    &(),
+                    &mut self.clipboard,
+                    &mut shell,
+                );
+                overlay.as_overlay().draw(
+                    &mut (),
+                    &crate::style::theme(),
+                    &iced::advanced::renderer::Style {
+                        text_color: iced::Color::BLACK,
+                    },
+                    Layout::new(overlay_node),
+                    cursor,
+                );
+                if matches!(
+                    event,
+                    Input::Mouse(_) | Input::Keyboard(_) | Input::Touch(_) | Input::InputMethod(_)
+                ) {
+                    assert!(shell.is_event_captured(), "An open chooser owns input");
+                }
+            } else {
+                view.as_widget_mut().update(
+                    tree,
+                    event,
+                    Layout::new(&node),
+                    cursor,
+                    &(),
+                    &mut self.clipboard,
+                    &mut shell,
+                    &viewport,
+                );
+            }
+        }
+        (messages, overlay_node)
+    }
+    fn send(&mut self, state: &mut State, event: Input) -> Vec<Outcome> {
+        let (messages, _) = self.batch(Some(state), &[(event, None)]);
+        messages
+            .into_iter()
+            .map(|message| match message {
+                Message::Chooser(event) => state.update(event),
+                _ => panic!("Popup leaked input to its parent"),
+            })
+            .collect()
+    }
+    fn type_text(&mut self, state: &mut State, text: &str) -> Vec<Outcome> {
+        let (messages, _) = self.batch(Some(state), &typing(text));
+        messages
+            .into_iter()
+            .map(|message| match message {
+                Message::Chooser(event) => state.update(event),
+                _ => panic!("Typing leaked input to its parent"),
+            })
+            .collect()
+    }
+    fn geometry(&mut self, state: &State) -> widget::Geometry {
+        let (_, node) = self.batch(Some(state), &[]);
+        widget::Geometry::from_bounds(node.unwrap().children()[0].bounds())
+    }
+    fn click(&mut self, state: &State, point: Point) -> Vec<Message> {
+        self.batch(
+            Some(state),
+            &[
+                (
+                    Input::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
+                    Some(point),
+                ),
+                (
+                    Input::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left)),
+                    Some(point),
+                ),
+            ],
+        )
+        .0
+    }
+}
+
+fn named(key: keyboard::key::Named) -> Input {
+    Input::Keyboard(keyboard::Event::KeyPressed {
+        key: keyboard::Key::Named(key),
+        modified_key: keyboard::Key::Named(key),
+        physical_key: keyboard::key::Physical::Code(keyboard::key::Code::Space),
+        location: keyboard::Location::Standard,
+        modifiers: keyboard::Modifiers::empty(),
+        text: None,
+        repeat: false,
+    })
+}
+// Iced 0.14's physical-key path intentionally inserts one scalar from text.
+// Whole-string typing is several key events; paste and IME commit are separate
+// input paths and are exercised below rather than faked as one physical key.
+fn typed(character: char) -> Input {
+    let text = character.to_string();
+    Input::Keyboard(keyboard::Event::KeyPressed {
+        key: keyboard::Key::Character(text.clone().into()),
+        modified_key: keyboard::Key::Character(text.clone().into()),
+        physical_key: keyboard::key::Physical::Code(keyboard::key::Code::KeyA),
+        location: keyboard::Location::Standard,
+        modifiers: keyboard::Modifiers::empty(),
+        text: Some(text.into()),
+        repeat: false,
+    })
+}
+fn typing(text: &str) -> Vec<(Input, Option<Point>)> {
+    text.chars()
+        .map(|character| (typed(character), None))
+        .collect()
+}
+fn query(state: &mut State, value: &str) {
+    let event = state.event(Action::Query {
+        text: value.into(),
+        serial: state.query_serial() + 1,
+    });
+    assert_eq!(state.update(event), Outcome::Browsed);
+}
+
+#[test]
+fn catalog_search_disambiguates_repeated_names_containment_alias_and_exact_placement_identity() {
+    let mut state = thousand(Current::Unassigned, false);
+    assert_eq!(
+        state.visible(6).map(|c| c.id).collect::<Vec<_>>(),
+        (10_000..10_006).map(Id::from_u128).collect::<Vec<_>>()
+    );
+    query(&mut state, "control subsystem 6 @controller_0617");
+    assert_eq!(state.count(), 1);
+    assert_eq!(state.highlighted().unwrap().id, Id::from_u128(10_617));
+    query(&mut state, "OA");
+    assert_eq!(state.count(), 0);
+    query(&mut state, &Id::from_u128(10_617).to_string());
+    assert_eq!(state.count(), 1);
+    assert_eq!(state.highlighted().unwrap().alias, "controller_0617");
+
+    let placement = Candidate {
+        id: Id::from_u128(20_001),
+        name: "Control".into(),
+        alias: "control_placement".into(),
+        kind: "Placement".into(),
+        scope: "SA".into(),
+        containment: "Architecture / Main diagram / Control".into(),
+    };
+    let mut state = State::open(
+        context(false),
+        vec![placement],
+        Current::Unassigned,
+        "SA · placements",
+    )
+    .unwrap();
+    query(&mut state, "placement main");
+    assert_eq!(state.highlighted().unwrap().id, Id::from_u128(20_001));
+    let event = state.event(Action::Choose(Id::from_u128(20_000)));
+    assert_eq!(
+        state.update(event),
+        Outcome::Ignored,
+        "Semantic ID is not the placement identity"
+    );
+    assert!(
+        State::open(
+            context(false),
+            vec![candidate(1), candidate(1)],
+            Current::Unassigned,
+            "SA"
+        )
+        .is_err()
+    );
+}
+
+#[test]
+fn mounted_overlay_clamps_at_three_field_positions_and_keeps_results_and_query_bounded() {
+    let state = thousand(Current::InvalidRaw("not a uuid".into()), true);
+    for size in [
+        Size::new(1100., 700.),
+        Size::new(1600., 1000.),
+        Size::new(320., 320.),
+    ] {
+        for y in [5., size.height / 2., size.height - 34.] {
+            let mut mount = Mount {
+                size,
+                anchor: Rectangle {
+                    x: size.width - 300.,
+                    y,
+                    width: 278.,
+                    height: 32.,
+                },
+                ..Default::default()
+            };
+            let (_, node) = mount.batch(Some(&state), &[]);
+            let node = node.unwrap();
+            let bounds = node.children()[0].bounds();
+            let geometry = widget::Geometry::from_bounds(bounds);
+            assert!(bounds.x >= 8. && bounds.y >= 8.);
+            assert!(bounds.x + bounds.width <= size.width - 8.);
+            assert!(bounds.y + bounds.height <= size.height - 8.);
+            assert!(bounds.width <= 420. && bounds.height <= 360.);
+            assert!(geometry.rows > 0 && geometry.rows <= 6);
+            assert_eq!(geometry.rows, if size.height == 320. { 4 } else { 6 });
+            let search = node.children()[1].bounds();
+            assert!(
+                bounds.contains(search.position())
+                    && bounds.contains(Point::new(
+                        search.x + search.width,
+                        search.y + search.height
+                    ))
+            );
+            assert!(geometry.row(geometry.rows - 1).y + 34. <= geometry.detail.y);
+            assert_eq!(state.visible(geometry.rows).count(), geometry.rows);
+        }
+    }
+}
+
+#[test]
+fn mounted_input_preserves_rapid_same_batch_typing_and_cursor_across_controlled_rebuilds() {
+    let mut state = thousand(Current::Unassigned, false);
+    let mut mount = Mount::default();
+    let (messages, _) = mount.batch(Some(&state), &[(typed('a'), None), (typed('b'), None)]);
+    assert_eq!(
+        messages.len(),
+        2,
+        "Actual focused input must publish each edit"
+    );
+    let mut queries = Vec::new();
+    for message in messages {
+        let Message::Chooser(event) = message else {
+            panic!("Unexpected parent event")
+        };
+        let Action::Query { text, .. } = &event.action else {
+            panic!("Typing must not choose a reference")
+        };
+        queries.push(text.clone());
+        assert_eq!(state.update(event), Outcome::Browsed);
+    }
+    assert_eq!(queries, ["a", "ab"]);
+    assert_eq!(state.query(), "ab");
+    assert!(
+        mount
+            .send(&mut state, named(keyboard::key::Named::Home))
+            .is_empty()
+    );
+    assert_eq!(mount.send(&mut state, typed('z')), [Outcome::Browsed]);
+    assert_eq!(
+        state.query(),
+        "zab",
+        "Rebuilding the controlled widget must not refocus at the end"
+    );
+    assert_eq!(state.current, Current::Unassigned);
+}
+
+#[test]
+fn mounted_keyboard_pages_and_selects_only_the_highlighted_visible_candidate_once() {
+    let mut state = thousand(Current::Unassigned, false);
+    let mut mount = Mount::default();
+    assert_eq!(
+        mount.send(&mut state, named(keyboard::key::Named::PageDown)),
+        [Outcome::Browsed]
+    );
+    assert_eq!(state.start(), 6);
+    assert_eq!(state.highlighted().unwrap().id, Id::from_u128(10_006));
+    assert_eq!(
+        mount.send(&mut state, named(keyboard::key::Named::ArrowDown)),
+        [Outcome::Browsed]
+    );
+    assert_eq!(state.highlighted().unwrap().id, Id::from_u128(10_007));
+    let (messages, _) = mount.batch(
+        Some(&state),
+        &[
+            (named(keyboard::key::Named::Enter), None),
+            (named(keyboard::key::Named::Enter), None),
+        ],
+    );
+    assert_eq!(messages.len(), 1);
+    let Message::Chooser(event) = messages.into_iter().next().unwrap() else {
+        panic!()
+    };
+    assert!(event.action.writes_staged_value());
+    assert_eq!(
+        state.update(event),
+        Outcome::Write {
+            context: context(false),
+            value: Some(Id::from_u128(10_007))
+        }
+    );
+    assert!(!state.is_open());
+}
+
+#[test]
+fn mounted_filtered_row_click_uses_the_displayed_identity_and_scoped_write_intent() {
+    let mut state = thousand(Current::Missing(Id::from_u128(99)), false);
+    let mut mount = Mount::default();
+    let query = "@controller_0731";
+    assert_eq!(
+        mount.type_text(&mut state, query),
+        vec![Outcome::Browsed; query.chars().count()]
+    );
+    assert_eq!(state.query(), query);
+    assert_eq!(state.count(), 1);
+    let point = mount.geometry(&state).row(0).center();
+    let messages = mount.click(&state, point);
+    assert_eq!(messages.len(), 1);
+    let Message::Chooser(event) = messages[0].clone() else {
+        panic!()
+    };
+    assert_eq!(
+        state.update(event),
+        Outcome::Write {
+            context: context(false),
+            value: Some(Id::from_u128(10_731))
+        }
+    );
+    assert_eq!(state.current, Current::Missing(Id::from_u128(99)));
+}
+
+#[test]
+fn mounted_query_change_rejects_old_release_and_old_result_events_without_locking_popup() {
+    let mut state = thousand(Current::Unassigned, false);
+    let mut mount = Mount::default();
+    let point = mount.geometry(&state).row(4).center();
+    let captured = mount.click(&state, point);
+    let Message::Chooser(old_choice) = captured[0].clone() else {
+        panic!()
+    };
+    query(&mut state, "@controller_0700");
+    assert_eq!(state.update(old_choice), Outcome::Ignored);
+    // The rejected old Choose had marked the widget closing; a changed result
+    // context must unlock it so an explicit current click can complete.
+    let point = mount.geometry(&state).row(0).center();
+    let messages = mount.click(&state, point);
+    assert_eq!(messages.len(), 1);
+    let Message::Chooser(event) = messages[0].clone() else {
+        panic!()
+    };
+    assert_eq!(
+        state.update(event),
+        Outcome::Write {
+            context: context(false),
+            value: Some(Id::from_u128(10_700))
+        }
+    );
+
+    let mut state = thousand(Current::Unassigned, false);
+    let point = mount.geometry(&state).row(0).center();
+    assert!(
+        mount
+            .batch(
+                Some(&state),
+                &[(
+                    Input::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
+                    Some(point)
+                )]
+            )
+            .0
+            .is_empty()
+    );
+    query(&mut state, "@controller_0319");
+    assert!(
+        mount
+            .batch(
+                Some(&state),
+                &[(
+                    Input::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left)),
+                    Some(point)
+                )]
+            )
+            .0
+            .is_empty()
+    );
+    assert!(state.is_open());
+}
+
+#[test]
+fn captured_choice_cannot_cross_document_revision_draft_record_or_array_path() {
+    let source = thousand(Current::Unassigned, false);
+    let mut mount = Mount::default();
+    let point = mount.geometry(&source).row(0).center();
+    let Message::Chooser(event) = mount.click(&source, point).remove(0) else {
+        panic!()
+    };
+    for changed in 0..6 {
+        let mut destination = context(false);
+        match changed {
+            0 => destination.document = Id::from_u128(999),
+            1 => destination.revision += 1,
+            2 => destination.draft = Id::from_u128(999),
+            3 => destination.record = Id::from_u128(999),
+            4 => destination.path = "/body/SomeList/members/1/scenario".into(),
+            _ => {} // A new invocation even with every semantic ID unchanged.
+        }
+        let mut state = State::open(
+            destination,
+            vec![candidate(0)],
+            Current::InvalidRaw("unfinished".into()),
+            "SA",
+        )
+        .unwrap();
+        assert_eq!(state.update(event.clone()), Outcome::Ignored);
+        assert_eq!(state.current, Current::InvalidRaw("unfinished".into()));
+        assert!(state.is_open());
+    }
+    let mut invalidated = source.clone();
+    invalidated.invalidate();
+    assert_eq!(invalidated.update(event), Outcome::Ignored);
+}
+
+#[test]
+fn empty_search_escape_tab_and_optional_clear_do_not_silently_choose_nil() {
+    for current in [
+        Current::Missing(Id::from_u128(999)),
+        Current::InvalidRaw("@incomplete/".into()),
+        Current::Incompatible(candidate(999)),
+    ] {
+        let mut state = thousand(current.clone(), false);
+        let mut mount = Mount::default();
+        let query = "no match exists";
+        assert_eq!(
+            mount.type_text(&mut state, query),
+            vec![Outcome::Browsed; query.chars().count()]
+        );
+        assert_eq!(state.query(), query);
+        assert_eq!(
+            state.count(),
+            0,
+            "Verify actual input reached the empty-result state before Enter"
+        );
+        assert!(
+            mount
+                .send(&mut state, named(keyboard::key::Named::Enter))
+                .is_empty()
+        );
+        assert!(state.is_open());
+        assert_eq!(state.current, current);
+        assert_eq!(
+            mount.send(&mut state, named(keyboard::key::Named::Escape)),
+            [Outcome::Closed(Close::Escape)]
+        );
+        assert_eq!(state.current, current);
+    }
+    let mut state = thousand(Current::Unassigned, false);
+    let mut mount = Mount::default();
+    assert_eq!(
+        mount.send(&mut state, named(keyboard::key::Named::Tab)),
+        [Outcome::Closed(Close::Tab { backwards: false })]
+    );
+    let mut state = thousand(Current::InvalidRaw("?".into()), true);
+    let point = mount.geometry(&state).clear.center();
+    let Message::Chooser(event) = mount.click(&state, point).remove(0) else {
+        panic!()
+    };
+    assert_eq!(
+        state.update(event),
+        Outcome::Write {
+            context: context(true),
+            value: None
+        }
+    );
+    let mut required = thousand(Current::Unassigned, false);
+    let clear = required.event(Action::Clear);
+    assert_eq!(required.update(clear), Outcome::Ignored);
+}
+
+#[test]
+fn dismissal_swallows_matching_release_across_closed_rebuild_but_next_click_reaches_parent() {
+    let mut state = thousand(Current::Unassigned, false);
+    let mut mount = Mount::default();
+    let outside = Point::new(20., 20.);
+    let (messages, _) = mount.batch(
+        Some(&state),
+        &[(
+            Input::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
+            Some(outside),
+        )],
+    );
+    let [Message::Chooser(event)] = messages.as_slice() else {
+        panic!("Expected only popup dismissal")
+    };
+    assert_eq!(state.update(event.clone()), Outcome::Closed(Close::Outside));
+    let release = Input::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left));
+    assert!(
+        mount
+            .batch(None, &[(release.clone(), Some(outside))])
+            .0
+            .is_empty()
+    );
+    assert_eq!(
+        mount
+            .batch(
+                None,
+                &[
+                    (
+                        Input::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
+                        Some(outside)
+                    ),
+                    (release, Some(outside)),
+                ]
+            )
+            .0,
+        [Message::UnderPress, Message::UnderRelease]
+    );
+}
+
+#[test]
+fn historical_paths_never_open_and_only_explicit_choice_or_clear_is_a_write() {
+    for path in [
+        "/baseline",
+        "/baseline/oa/value",
+        "/baseline/sa/value/TypeRef/Named",
+    ] {
+        assert!(
+            Context::live(
+                Id::from_u128(1),
+                0,
+                Id::from_u128(2),
+                Id::from_u128(3),
+                path,
+                true
+            )
+            .is_err()
+        );
+        let mut forged = context(true);
+        forged.path = path.into();
+        assert!(State::open(forged, vec![candidate(0)], Current::Unassigned, "History").is_err());
+    }
+    for action in [
+        Action::Query {
+            text: "Control".into(),
+            serial: 1,
+        },
+        Action::Highlight(Id::from_u128(10_000)),
+        Action::Move { delta: 1, rows: 6 },
+        Action::Page { delta: 1, rows: 6 },
+        Action::Close(Close::Escape),
+    ] {
+        assert!(!action.writes_staged_value());
+    }
+    assert!(Action::Choose(Id::from_u128(10_000)).writes_staged_value());
+    assert!(Action::Clear.writes_staged_value());
+}
+
+#[test]
+fn out_of_order_query_serials_cannot_restore_obsolete_results() {
+    let mut state = thousand(Current::Unassigned, false);
+    let old = state.event(Action::Query {
+        text: "@controller_0001".into(),
+        serial: 1,
+    });
+    let new = state.event(Action::Query {
+        text: "@controller_0999".into(),
+        serial: 2,
+    });
+    assert_eq!(state.update(new), Outcome::Browsed);
+    assert_eq!(state.update(old), Outcome::Ignored);
+    assert_eq!(state.highlighted().unwrap().id, Id::from_u128(10_999));
+}
+
+#[test]
+fn mounted_query_then_escape_in_one_batch_closes_and_relative_keys_keep_input_order() {
+    let mut state = thousand(Current::InvalidRaw("unfinished".into()), false);
+    let mut mount = Mount::default();
+    let query = "@controller_0720";
+    let mut inputs = typing(query);
+    inputs.push((named(keyboard::key::Named::Escape), None));
+    let (messages, _) = mount.batch(Some(&state), &inputs);
+    let outcomes: Vec<_> = messages
+        .into_iter()
+        .map(|message| {
+            let Message::Chooser(event) = message else {
+                panic!("Input escaped the popup")
+            };
+            state.update(event)
+        })
+        .collect();
+    let mut expected = vec![Outcome::Browsed; query.chars().count()];
+    expected.push(Outcome::Closed(Close::Escape));
+    assert_eq!(outcomes, expected);
+    assert_eq!(state.query(), "@controller_0720");
+    assert_eq!(state.current, Current::InvalidRaw("unfinished".into()));
+
+    let mut state = thousand(Current::Unassigned, false);
+    let old_absolute_row = state.event(Action::Choose(Id::from_u128(10_000)));
+    let (messages, _) = mount.batch(
+        Some(&state),
+        &[
+            (named(keyboard::key::Named::PageDown), None),
+            (named(keyboard::key::Named::PageDown), None),
+            (named(keyboard::key::Named::ArrowUp), None),
+        ],
+    );
+    assert_eq!(messages.len(), 3);
+    for message in messages {
+        let Message::Chooser(event) = message else {
+            panic!("Input escaped the popup")
+        };
+        assert_eq!(state.update(event), Outcome::Browsed);
+    }
+    assert_eq!(state.highlighted().unwrap().id, Id::from_u128(10_011));
+    assert_eq!(state.start(), 11);
+    assert_eq!(state.update(old_absolute_row), Outcome::Ignored);
+    assert!(state.is_open());
+}
+
+#[test]
+fn mounted_clipboard_paste_and_ime_commit_preserve_whole_strings_without_selecting() {
+    let mut state = thousand(Current::Unassigned, false);
+    let mut mount = Mount::default();
+    mount.clipboard.0 = Some("@controller_0472".into());
+    let paste = Input::Keyboard(keyboard::Event::KeyPressed {
+        key: keyboard::Key::Character("v".into()),
+        modified_key: keyboard::Key::Character("v".into()),
+        physical_key: keyboard::key::Physical::Code(keyboard::key::Code::KeyV),
+        location: keyboard::Location::Standard,
+        modifiers: keyboard::Modifiers::COMMAND,
+        text: None,
+        repeat: false,
+    });
+    let (messages, _) = mount.batch(
+        Some(&state),
+        &[
+            (
+                Input::Keyboard(keyboard::Event::ModifiersChanged(
+                    keyboard::Modifiers::COMMAND,
+                )),
+                None,
+            ),
+            (paste, None),
+            (
+                Input::Keyboard(keyboard::Event::ModifiersChanged(
+                    keyboard::Modifiers::empty(),
+                )),
+                None,
+            ),
+        ],
+    );
+    let [Message::Chooser(event)] = messages.as_slice() else {
+        panic!("Paste should emit exactly one whole-string query")
+    };
+    assert_eq!(state.update(event.clone()), Outcome::Browsed);
+    assert_eq!(state.query(), "@controller_0472");
+    assert_eq!(state.count(), 1);
+    assert_eq!(state.highlighted().unwrap().id, Id::from_u128(10_472));
+    assert_eq!(state.current, Current::Unassigned);
+    assert!(state.is_open());
+
+    let unicode_name = "Режим Δ負荷";
+    let unicode = Candidate {
+        id: Id::from_u128(30_111),
+        name: unicode_name.into(),
+        alias: "mode_unicode".into(),
+        kind: "Function".into(),
+        scope: "SA".into(),
+        containment: "Система / 控制".into(),
+    };
+    let mut state = State::open(
+        context(false),
+        vec![unicode],
+        Current::InvalidRaw("retained".into()),
+        "SA",
+    )
+    .unwrap();
+    use iced::advanced::input_method::Event as Ime;
+    let preedit = [
+        (Input::InputMethod(Ime::Opened), None),
+        (
+            Input::InputMethod(Ime::Preedit(unicode_name.into(), None)),
+            None,
+        ),
+    ];
+    assert!(
+        mount.batch(Some(&state), &preedit).0.is_empty(),
+        "Composition is not a committed query"
+    );
+    assert_eq!(state.query(), "");
+    let (messages, _) = mount.batch(
+        Some(&state),
+        &[
+            (Input::InputMethod(Ime::Preedit(String::new(), None)), None),
+            (Input::InputMethod(Ime::Commit(unicode_name.into())), None),
+            (Input::InputMethod(Ime::Closed), None),
+        ],
+    );
+    let [Message::Chooser(event)] = messages.as_slice() else {
+        panic!("IME commit should emit one complete query")
+    };
+    assert_eq!(state.update(event.clone()), Outcome::Browsed);
+    assert_eq!(state.query(), unicode_name);
+    assert_eq!(state.count(), 1);
+    assert_eq!(state.highlighted().unwrap().id, Id::from_u128(30_111));
+    assert_eq!(state.current, Current::InvalidRaw("retained".into()));
+    assert!(state.is_open());
+}
@@ -0,0 +1,447 @@
+//! Keyboard entry and focus operations scoped to one property form. Focus
+//! targets include the draft generation so delayed operations cannot focus a
+//! replacement array row or a recovered document with the same semantic IDs.
+use crate::style;
+use iced::{
+    Border, Color, Element, Event, Length, Rectangle, Size, Task, Theme, Vector,
+    advanced::{
+        Clipboard, Layout, Shell, Widget, layout, overlay, renderer,
+        widget::{Id, Operation, Tree, operation, tree},
+    },
+    keyboard, mouse,
+    widget::container,
+};
+use oa_core::Id as ModelId;
+mod focus;
+
+#[derive(Clone, Copy)]
+pub struct FormScope {
+    pub session: ModelId,
+    pub modal: bool,
+}
+pub(super) struct FormOwner(pub Option<FormScope>);
+const REVIEW_MODAL: &str = "reference-owning-review-modal";
+
+/// Marks the entire Review dialog without changing its layout or event flow.
+pub fn modal<'a, Message: 'a, R: renderer::Renderer + 'a>(
+    content: impl Into<Element<'a, Message, Theme, R>>,
+) -> Element<'a, Message, Theme, R> {
+    Field {
+        content: content.into(),
+        id: Some(Id::new(REVIEW_MODAL)),
+        on_open: None,
+    }
+    .into()
+}
+
+pub fn field_id(generation: ModelId, path: &str) -> Id {
+    Id::from(format!("reference:{generation}:{path}"))
+}
+pub fn scope_id(session: ModelId) -> Id {
+    Id::from(format!("reference-form:{session}"))
+}
+
+#[derive(Default)]
+struct Interaction {
+    focused: bool,
+    pressed: bool,
+    identity: Option<Id>,
+    anchor: Option<Rectangle>,
+}
+impl operation::Focusable for Interaction {
+    fn is_focused(&self) -> bool {
+        self.focused
+    }
+    fn focus(&mut self) {
+        self.focused = true;
+    }
+    fn unfocus(&mut self) {
+        self.focused = false;
+        self.pressed = false;
+    }
+}
+pub struct Field<'a, Message, R = iced::Renderer>
+where
+    R: renderer::Renderer,
+{
+    content: Element<'a, Message, Theme, R>,
+    id: Option<Id>,
+    on_open: Option<Box<dyn Fn(Rectangle) -> Message + 'a>>,
+}
+impl<'a, Message, R: renderer::Renderer> Field<'a, Message, R> {
+    pub fn new(
+        content: impl Into<Element<'a, Message, Theme, R>>,
+        id: Id,
+        on_open: impl Fn(Rectangle) -> Message + 'a,
+    ) -> Self {
+        Self {
+            content: content.into(),
+            id: Some(id),
+            on_open: Some(Box::new(on_open)),
+        }
+    }
+}
+pub fn scope<'a, Message: 'a, R: renderer::Renderer + 'a>(
+    content: impl Into<Element<'a, Message, Theme, R>>,
+    session: ModelId,
+) -> Element<'a, Message, Theme, R> {
+    container(Field {
+        content: content.into(),
+        id: None,
+        on_open: None,
+    })
+    .id(scope_id(session))
+    .width(Length::Fill)
+    .into()
+}
+
+fn run<Message, R: renderer::Renderer>(
+    content: &mut Element<'_, Message, Theme, R>,
+    tree: &mut Tree,
+    layout: Layout<'_>,
+    renderer: &R,
+    mut operation: Box<dyn Operation>,
+) -> bool {
+    let mut changed = false;
+    loop {
+        content
+            .as_widget_mut()
+            .operate(tree, layout, renderer, &mut *operation);
+        match operation.finish() {
+            operation::Outcome::Chain(next) => {
+                operation = next;
+                changed = true;
+            }
+            _ => break,
+        }
+    }
+    changed
+}
+
+pub(super) fn tab<Message, R: renderer::Renderer>(
+    content: &mut Element<'_, Message, Theme, R>,
+    tree: &mut Tree,
+    layout: Layout<'_>,
+    renderer: &R,
+    scope: FormScope,
+    backwards: bool,
+) -> bool {
+    run(
+        content,
+        tree,
+        layout,
+        renderer,
+        Box::new(focus::relative(scope.session, backwards, scope.modal)),
+    )
+}
+pub(super) fn own_input<Message, R: renderer::Renderer>(
+    content: &mut Element<'_, Message, Theme, R>,
+    tree: &mut Tree,
+    layout: Layout<'_>,
+    renderer: &R,
+) {
+    content
+        .as_widget_mut()
+        .operate(tree, layout, renderer, &mut focus::exclusive());
+}
+impl<Message, R: renderer::Renderer> Widget<Message, Theme, R> for Field<'_, Message, R> {
+    fn tag(&self) -> tree::Tag {
+        tree::Tag::of::<Interaction>()
+    }
+    fn state(&self) -> tree::State {
+        tree::State::new(Interaction {
+            identity: self.id.clone(),
+            ..Default::default()
+        })
+    }
+    fn children(&self) -> Vec<Tree> {
+        vec![Tree::new(self.content.as_widget())]
+    }
+    fn diff(&self, tree: &mut Tree) {
+        let state = tree.state.downcast_mut::<Interaction>();
+        if state.identity != self.id {
+            *state = Interaction {
+                identity: self.id.clone(),
+                ..Default::default()
+            };
+        }
+        tree.diff_children(std::slice::from_ref(&self.content));
+    }
+    fn size(&self) -> Size<Length> {
+        self.content.as_widget().size()
+    }
+    fn layout(&mut self, tree: &mut Tree, renderer: &R, limits: &layout::Limits) -> layout::Node {
+        self.content
+            .as_widget_mut()
+            .layout(&mut tree.children[0], renderer, limits)
+    }
+    fn operate(
+        &mut self,
+        tree: &mut Tree,
+        layout: Layout<'_>,
+        renderer: &R,
+        operation: &mut dyn Operation,
+    ) {
+        if let Some(id) = &self.id
+            && self.on_open.is_some()
+        {
+            operation.focusable(
+                Some(id),
+                layout.bounds(),
+                tree.state.downcast_mut::<Interaction>(),
+            );
+            operation.custom(
+                Some(id),
+                layout.bounds(),
+                tree.state.downcast_mut::<Interaction>(),
+            );
+        }
+        if self.on_open.is_none() {
+            operation.container(self.id.as_ref(), layout.bounds());
+            operation.traverse(&mut |operation| {
+                self.content.as_widget_mut().operate(
+                    &mut tree.children[0],
+                    layout,
+                    renderer,
+                    operation,
+                )
+            });
+        } else {
+            self.content.as_widget_mut().operate(
+                &mut tree.children[0],
+                layout,
+                renderer,
+                operation,
+            );
+        }
+    }
+    fn update(
+        &mut self,
+        tree: &mut Tree,
+        event: &Event,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        renderer: &R,
+        clipboard: &mut dyn Clipboard,
+        shell: &mut Shell<'_, Message>,
+        viewport: &Rectangle,
+    ) {
+        if let Some(on_open) = &self.on_open {
+            let state = tree.state.downcast_mut::<Interaction>();
+            let visible = layout.bounds().intersection(viewport);
+            let hovered = visible.is_some_and(|bounds| cursor.is_over(bounds));
+            let activate = match event {
+                Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)) if hovered => {
+                    state.focused = true;
+                    state.pressed = true;
+                    shell.capture_event();
+                    shell.request_redraw();
+                    false
+                }
+                Event::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left)) => {
+                    let activate = state.pressed && hovered;
+                    if state.pressed {
+                        shell.capture_event();
+                    }
+                    state.pressed = false;
+                    activate
+                }
+                Event::Keyboard(keyboard::Event::KeyPressed {
+                    key:
+                        keyboard::Key::Named(keyboard::key::Named::Enter | keyboard::key::Named::Space),
+                    repeat: false,
+                    ..
+                }) if state.focused => true,
+                Event::Mouse(mouse::Event::ButtonPressed(_)) => {
+                    state.focused = false;
+                    state.pressed = false;
+                    false
+                }
+                _ => false,
+            };
+            if activate && let Some(bounds) = state.anchor {
+                shell.publish(on_open(bounds));
+                shell.capture_event();
+                return;
+            }
+        }
+        self.content.as_widget_mut().update(
+            &mut tree.children[0],
+            event,
+            layout,
+            cursor,
+            renderer,
+            clipboard,
+            shell,
+            viewport,
+        );
+    }
+    fn draw(
+        &self,
+        tree: &Tree,
+        renderer: &mut R,
+        theme: &Theme,
+        renderer_style: &renderer::Style,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        viewport: &Rectangle,
+    ) {
+        if self.on_open.is_some() {
+            let focus = tree.state.downcast_ref::<Interaction>().focused;
+            renderer.fill_quad(
+                renderer::Quad {
+                    bounds: layout.bounds(),
+                    border: Border {
+                        color: if focus || cursor.is_over(layout.bounds()) {
+                            style::TEAL
+                        } else {
+                            style::LINE
+                        },
+                        width: if focus { 2. } else { 1. },
+                        radius: 5.into(),
+                    },
+                    ..Default::default()
+                },
+                Color::WHITE,
+            );
+        }
+        self.content.as_widget().draw(
+            &tree.children[0],
+            renderer,
+            theme,
+            renderer_style,
+            layout,
+            cursor,
+            viewport,
+        );
+    }
+    fn mouse_interaction(
+        &self,
+        tree: &Tree,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        viewport: &Rectangle,
+        renderer: &R,
+    ) -> mouse::Interaction {
+        if self.on_open.is_some() && cursor.is_over(layout.bounds()) {
+            mouse::Interaction::Pointer
+        } else {
+            self.content.as_widget().mouse_interaction(
+                &tree.children[0],
+                layout,
+                cursor,
+                viewport,
+                renderer,
+            )
+        }
+    }
+    fn overlay<'b>(
+        &'b mut self,
+        tree: &'b mut Tree,
+        layout: Layout<'b>,
+        renderer: &R,
+        viewport: &Rectangle,
+        translation: Vector,
+    ) -> Option<overlay::Element<'b, Message, Theme, R>> {
+        self.content.as_widget_mut().overlay(
+            &mut tree.children[0],
+            layout,
+            renderer,
+            viewport,
+            translation,
+        )
+    }
+}
+
+/// Scrollable child updates use content coordinates. The root visits the
+/// retained tree before each input, so field anchors use current window
+/// coordinates even when a wheel event and activation share one runtime batch.
+pub(super) fn measure<Message, R: renderer::Renderer>(
+    content: &mut Element<'_, Message, Theme, R>,
+    tree: &mut Tree,
+    layout: Layout<'_>,
+    renderer: &R,
+    viewport: Rectangle,
+) {
+    content.as_widget_mut().operate(
+        tree,
+        layout,
+        renderer,
+        &mut Measure {
+            translation: Vector::ZERO,
+            viewport: Some(viewport),
+            pending: None,
+        },
+    );
+}
+struct Measure {
+    translation: Vector,
+    viewport: Option<Rectangle>,
+    pending: Option<(Vector, Option<Rectangle>)>,
+}
+impl Operation for Measure {
+    fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn Operation)) {
+        let previous = (self.translation, self.viewport);
+        if let Some((translation, viewport)) = self.pending.take() {
+            self.translation = translation;
+            self.viewport = viewport;
+        }
+        visit(self);
+        (self.translation, self.viewport) = previous;
+    }
+    fn scrollable(
+        &mut self,
+        _: Option<&Id>,
+        bounds: Rectangle,
+        _: Rectangle,
+        translation: Vector,
+        _: &mut dyn operation::Scrollable,
+    ) {
+        let bounds = Rectangle {
+            x: bounds.x - self.translation.x,
+            y: bounds.y - self.translation.y,
+            ..bounds
+        };
+        self.pending = Some((
+            self.translation + translation,
+            self.viewport
+                .and_then(|viewport| viewport.intersection(&bounds)),
+        ));
+    }
+    fn custom(&mut self, _: Option<&Id>, bounds: Rectangle, state: &mut dyn std::any::Any) {
+        if let Some(state) = state.downcast_mut::<Interaction>() {
+            let bounds = Rectangle {
+                x: bounds.x - self.translation.x,
+                y: bounds.y - self.translation.y,
+                ..bounds
+            };
+            state.anchor = self
+                .viewport
+                .and_then(|viewport| viewport.intersection(&bounds));
+        }
+    }
+}
+impl<'a, Message: 'a, R: renderer::Renderer + 'a> From<Field<'a, Message, R>>
+    for Element<'a, Message, Theme, R>
+{
+    fn from(field: Field<'a, Message, R>) -> Self {
+        Element::new(field)
+    }
+}
+
+pub fn focus_operation(
+    session: ModelId,
+    generation: ModelId,
+    path: &str,
+    step: i32,
+) -> impl Operation + 'static {
+    focus::exact(session, generation, path, step)
+}
+pub fn focus<Message: Send + 'static>(
+    session: ModelId,
+    generation: ModelId,
+    path: &str,
+    step: i32,
+) -> Task<Message> {
+    iced::advanced::widget::operate(focus_operation(session, generation, path, step)).discard()
+}
@@ -0,0 +1,313 @@
+//! Focus movement and reveal share one root traversal. A form may be inside a
+//! scrollable; restricting traversal to its container would hide that ancestor.
+use super::{FormOwner, Id, ModelId, Operation, Rectangle, Vector, field_id, operation, scope_id};
+use std::collections::BTreeMap;
+
+enum Origin {
+    Current,
+    Exact(Id),
+}
+#[derive(Clone)]
+struct Scroll {
+    index: usize,
+    bounds: Rectangle,
+    capacity: Vector,
+    offset: Vector,
+}
+struct Field {
+    id: Option<Id>,
+    bounds: Rectangle,
+    ancestors: Vec<Scroll>,
+}
+pub(super) struct Collect {
+    scope: Id,
+    origin: Origin,
+    step: i32,
+    inside: bool,
+    entering: Option<bool>,
+    translation: Vector,
+    scrolls: Vec<Scroll>,
+    pending_scroll: Option<Scroll>,
+    scroll_index: usize,
+    fields: Vec<Field>,
+    focused: Option<usize>,
+    outside_focused: bool,
+    modal: bool,
+    owner_valid: bool,
+}
+impl Collect {
+    fn new(scope: Id, origin: Origin, step: i32) -> Self {
+        let owner_valid = matches!(origin, Origin::Current);
+        Self {
+            scope,
+            origin,
+            step,
+            inside: false,
+            entering: None,
+            translation: Vector::ZERO,
+            scrolls: vec![],
+            pending_scroll: None,
+            scroll_index: 0,
+            fields: vec![],
+            focused: None,
+            outside_focused: false,
+            modal: false,
+            owner_valid,
+        }
+    }
+}
+pub(super) fn relative(session: ModelId, backwards: bool, modal: bool) -> Collect {
+    Collect {
+        modal,
+        ..Collect::new(
+            scope_id(session),
+            Origin::Current,
+            if backwards { -1 } else { 1 },
+        )
+    }
+}
+pub(super) fn exact(session: ModelId, generation: ModelId, path: &str, step: i32) -> Collect {
+    Collect::new(
+        scope_id(session),
+        Origin::Exact(field_id(generation, path)),
+        step,
+    )
+}
+impl Operation for Collect {
+    fn custom(&mut self, _: Option<&Id>, _: Rectangle, state: &mut dyn std::any::Any) {
+        if let Some(owner) = state.downcast_ref::<FormOwner>() {
+            self.owner_valid = owner
+                .0
+                .is_some_and(|owner| scope_id(owner.session) == self.scope);
+            self.modal = owner.0.is_some_and(|owner| owner.modal);
+        }
+    }
+    fn container(&mut self, id: Option<&Id>, _: Rectangle) {
+        self.entering = Some(self.inside || id == Some(&self.scope));
+    }
+    fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn Operation)) {
+        let previous = (self.inside, self.translation, self.scrolls.len());
+        if let Some(inside) = self.entering.take() {
+            self.inside = inside;
+        }
+        if let Some(scroll) = self.pending_scroll.take() {
+            self.translation += scroll.offset;
+            self.scrolls.push(scroll);
+        }
+        visit(self);
+        self.inside = previous.0;
+        self.translation = previous.1;
+        self.scrolls.truncate(previous.2);
+    }
+    fn scrollable(
+        &mut self,
+        _: Option<&Id>,
+        bounds: Rectangle,
+        content: Rectangle,
+        offset: Vector,
+        _: &mut dyn operation::Scrollable,
+    ) {
+        self.pending_scroll = Some(Scroll {
+            index: self.scroll_index,
+            bounds: translated(bounds, self.translation),
+            capacity: Vector::new(
+                (content.width - bounds.width).max(0.),
+                (content.height - bounds.height).max(0.),
+            ),
+            offset,
+        });
+        self.scroll_index += 1;
+    }
+    fn focusable(
+        &mut self,
+        id: Option<&Id>,
+        bounds: Rectangle,
+        state: &mut dyn operation::Focusable,
+    ) {
+        if !self.inside {
+            self.outside_focused |= state.is_focused();
+            return;
+        }
+        if state.is_focused() {
+            self.focused = Some(self.fields.len());
+        }
+        self.fields.push(Field {
+            id: id.cloned(),
+            bounds: translated(bounds, self.translation),
+            ancestors: self.scrolls.clone(),
+        });
+    }
+    fn finish(&self) -> operation::Outcome<()> {
+        if !self.owner_valid || self.fields.is_empty() {
+            return operation::Outcome::None;
+        }
+        let origin = match &self.origin {
+            Origin::Current if self.focused.is_none() && self.outside_focused && !self.modal => {
+                return operation::Outcome::None;
+            }
+            Origin::Current => self
+                .focused
+                .map(|index| index as i64)
+                .unwrap_or(if self.step < 0 {
+                    self.fields.len() as i64
+                } else {
+                    -1
+                }),
+            Origin::Exact(id) => {
+                let Some(index) = self
+                    .fields
+                    .iter()
+                    .position(|field| field.id.as_ref() == Some(id))
+                else {
+                    return operation::Outcome::None;
+                };
+                index as i64
+            }
+        };
+        // A form keeps a reachable focus at both boundaries. Initial Tab enters
+        // the first field; initial Shift+Tab enters the last field.
+        let target = (origin + i64::from(self.step)).rem_euclid(self.fields.len() as i64) as usize;
+        let field = &self.fields[target];
+        let mut bounds = field.bounds;
+        let mut shifts = BTreeMap::new();
+        for ancestor in field.ancestors.iter().rev() {
+            let dx = reveal_axis(
+                bounds.x,
+                bounds.width,
+                ancestor.bounds.x,
+                ancestor.bounds.width,
+            );
+            let dy = reveal_axis(
+                bounds.y,
+                bounds.height,
+                ancestor.bounds.y,
+                ancestor.bounds.height,
+            );
+            // Iced reports rounded drawing offsets, while capacity can be
+            // fractional. Clamping an already-visible axis can move it a pixel.
+            let delta = Vector::new(
+                if dx == 0. {
+                    0.
+                } else {
+                    (ancestor.offset.x + dx).clamp(0., ancestor.capacity.x) - ancestor.offset.x
+                },
+                if dy == 0. {
+                    0.
+                } else {
+                    (ancestor.offset.y + dy).clamp(0., ancestor.capacity.y) - ancestor.offset.y
+                },
+            );
+            if delta != Vector::ZERO {
+                shifts.insert(ancestor.index, delta);
+            }
+            bounds = translated(bounds, delta);
+        }
+        operation::Outcome::Chain(Box::new(Apply {
+            scope: self.scope.clone(),
+            inside: false,
+            entering: None,
+            target,
+            field_index: 0,
+            scroll_index: 0,
+            shifts,
+            owner_valid: matches!(self.origin, Origin::Current),
+            clear_outside: self.modal,
+            preserve_inside: false,
+        }))
+    }
+}
+fn translated(bounds: Rectangle, delta: Vector) -> Rectangle {
+    Rectangle {
+        x: bounds.x - delta.x,
+        y: bounds.y - delta.y,
+        ..bounds
+    }
+}
+fn reveal_axis(start: f32, length: f32, viewport_start: f32, viewport_length: f32) -> f32 {
+    if start < viewport_start || length > viewport_length {
+        start - viewport_start
+    } else {
+        (start + length - viewport_start - viewport_length).max(0.)
+    }
+}
+pub(super) struct Apply {
+    scope: Id,
+    inside: bool,
+    entering: Option<bool>,
+    target: usize,
+    field_index: usize,
+    scroll_index: usize,
+    shifts: BTreeMap<usize, Vector>,
+    owner_valid: bool,
+    clear_outside: bool,
+    preserve_inside: bool,
+}
+pub(super) fn exclusive() -> Apply {
+    Apply {
+        scope: Id::new(super::REVIEW_MODAL),
+        inside: false,
+        entering: None,
+        target: 0,
+        field_index: 0,
+        scroll_index: 0,
+        shifts: BTreeMap::new(),
+        owner_valid: true,
+        clear_outside: true,
+        preserve_inside: true,
+    }
+}
+impl Operation for Apply {
+    fn custom(&mut self, _: Option<&Id>, _: Rectangle, state: &mut dyn std::any::Any) {
+        if let Some(owner) = state.downcast_ref::<FormOwner>() {
+            self.owner_valid = owner
+                .0
+                .is_some_and(|owner| scope_id(owner.session) == self.scope);
+            self.clear_outside = owner.0.is_some_and(|owner| owner.modal);
+        }
+    }
+    fn container(&mut self, id: Option<&Id>, _: Rectangle) {
+        self.entering = Some(self.inside || id == Some(&self.scope));
+    }
+    fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn Operation)) {
+        let previous = self.inside;
+        if let Some(inside) = self.entering.take() {
+            self.inside = inside;
+        }
+        visit(self);
+        self.inside = previous;
+    }
+    fn scrollable(
+        &mut self,
+        _: Option<&Id>,
+        bounds: Rectangle,
+        content: Rectangle,
+        _: Vector,
+        state: &mut dyn operation::Scrollable,
+    ) {
+        if self.owner_valid
+            && let Some(delta) = self.shifts.get(&self.scroll_index)
+        {
+            state.scroll_by(
+                operation::scrollable::AbsoluteOffset {
+                    x: delta.x,
+                    y: delta.y,
+                },
+                bounds,
+                content,
+            );
+        }
+        self.scroll_index += 1;
+    }
+    fn focusable(&mut self, _: Option<&Id>, _: Rectangle, state: &mut dyn operation::Focusable) {
+        if self.owner_valid && self.inside && !self.preserve_inside {
+            if self.field_index == self.target {
+                state.focus();
+            } else {
+                state.unfocus();
+            }
+            self.field_index += 1;
+        } else if self.owner_valid && !self.inside && self.clear_outside {
+            state.unfocus();
+        }
+    }
+}
@@ -0,0 +1,994 @@
+//! Root overlay adapter. Keep the wrapper mounted while closed so the release
+//! from a dismissal gesture cannot reach the underlying content. Parent modal
+//! ownership is supplied by the host (pass no chooser while a modal is active).
+use super::{Action, Close, Event as ChoiceEvent, MAX_ROWS, Stamp, State as Chooser};
+use crate::style;
+use iced::{
+    Border, Color, Element, Event, Font, Length, Point, Rectangle, Size, Theme, Vector,
+    advanced::{
+        Clipboard, Layout, Shell, Widget, layout, overlay, renderer,
+        text::{self, Paragraph as _},
+        widget::{Operation, Tree, tree},
+    },
+    alignment, keyboard, mouse, touch,
+    widget::text_input,
+    window,
+};
+use std::{cell::Cell, rc::Rc};
+
+const ROW: f32 = 34.;
+const MARGIN: f32 = 8.;
+
+#[derive(Debug, Clone, Copy)]
+pub(super) struct Geometry {
+    pub popup: Rectangle,
+    pub search: Rectangle,
+    pub current: Rectangle,
+    pub detail: Rectangle,
+    pub close: Rectangle,
+    pub previous: Rectangle,
+    pub next: Rectangle,
+    pub clear: Rectangle,
+    pub rows: usize,
+}
+impl Geometry {
+    fn new(anchor: Rectangle, viewport: Size) -> Self {
+        let width = anchor
+            .width
+            .clamp(278., 420.)
+            .min((viewport.width - 2. * MARGIN).max(0.));
+        let height = 360f32.min((viewport.height - 2. * MARGIN).max(0.));
+        let x = anchor.x.clamp(
+            MARGIN.min(viewport.width / 2.),
+            (viewport.width - MARGIN - width).max(MARGIN.min(viewport.width / 2.)),
+        );
+        let below = anchor.y + anchor.height + 4.;
+        let preferred = if below + height + MARGIN <= viewport.height {
+            below
+        } else {
+            anchor.y - height - 4.
+        };
+        let y = preferred.clamp(
+            MARGIN.min(viewport.height / 2.),
+            (viewport.height - MARGIN - height).max(MARGIN.min(viewport.height / 2.)),
+        );
+        Self::from_bounds(Rectangle {
+            x,
+            y,
+            width,
+            height,
+        })
+    }
+    pub(super) fn from_bounds(popup: Rectangle) -> Self {
+        let inner = (popup.width - 16.).max(0.);
+        let rect = |left, top, width, height| Rectangle {
+            x: popup.x + left,
+            y: popup.y + top,
+            width,
+            height,
+        };
+        let footer = (popup.height - 32.).max(0.);
+        let detail_height = if popup.height >= 180. { 32. } else { 0. };
+        let detail_top = (footer - detail_height - 4.).max(84.);
+        let rows = (((detail_top - 88.).max(0.) / ROW) as usize).min(MAX_ROWS);
+        Self {
+            popup,
+            search: rect(8., 28., inner, 30.),
+            current: rect(8., 62., inner, 18.),
+            detail: rect(8., detail_top, inner, detail_height),
+            close: rect((popup.width - 58.).max(0.), 4., 50f32.min(popup.width), 22.),
+            previous: rect(8., footer, 28., 24.),
+            next: rect(40., footer, 28., 24.),
+            clear: rect((popup.width - 84.).max(0.), footer, 76., 24.),
+            rows,
+        }
+    }
+    pub fn row(&self, index: usize) -> Rectangle {
+        Rectangle {
+            x: self.popup.x + 8.,
+            y: self.popup.y + 84. + index as f32 * ROW,
+            width: (self.popup.width - 16.).max(0.),
+            height: ROW,
+        }
+    }
+    fn hit(&self, chooser: &Chooser, point: Point) -> Option<Action> {
+        if self.close.contains(point) {
+            return Some(Action::Close(Close::Escape));
+        }
+        if self.previous.contains(point) && chooser.start() > 0 {
+            return Some(Action::Page {
+                delta: -1,
+                rows: self.rows,
+            });
+        }
+        if self.next.contains(point) && chooser.start() + self.rows < chooser.count() {
+            return Some(Action::Page {
+                delta: 1,
+                rows: self.rows,
+            });
+        }
+        if self.clear.contains(point) && chooser.optional() {
+            return Some(Action::Clear);
+        }
+        chooser
+            .visible(self.rows)
+            .enumerate()
+            .find_map(|(i, c)| self.row(i).contains(point).then_some(Action::Choose(c.id)))
+    }
+}
+
+#[derive(Default)]
+struct Interaction {
+    stamp: Option<Stamp>,
+    serial: u64,
+    pressed: Option<(ChoiceEvent, Pointer)>,
+    closing: bool,
+    swallow_mouse: Option<mouse::Button>,
+    swallow_touch: Option<touch::Finger>,
+    held_mouse: Option<mouse::Button>,
+    held_touch: Option<touch::Finger>,
+    detail_scroll: f32,
+}
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum Pointer {
+    Mouse,
+    Touch(touch::Finger),
+}
+impl Interaction {
+    fn swallow(&mut self, event: &Event) -> bool {
+        match event {
+            Event::Mouse(mouse::Event::ButtonReleased(button))
+                if self.swallow_mouse == Some(*button) =>
+            {
+                self.swallow_mouse = None;
+                true
+            }
+            Event::Touch(
+                touch::Event::FingerLifted { id, .. } | touch::Event::FingerLost { id, .. },
+            ) if self.swallow_touch == Some(*id) => {
+                self.swallow_touch = None;
+                true
+            }
+            _ => false,
+        }
+    }
+}
+
+pub struct Popup<'a, Message, R = iced::Renderer>
+where
+    R: text::Renderer<Font = Font>,
+{
+    content: Element<'a, Message, Theme, R>,
+    input: Element<'a, String, Theme, R>,
+    chooser: Option<&'a Chooser>,
+    anchor: Rectangle,
+    on_event: Rc<dyn Fn(ChoiceEvent) -> Message + 'a>,
+    focus_scope: Option<super::trigger::FormScope>,
+}
+impl<'a, Message: Clone + 'a, R: text::Renderer<Font = Font> + 'a> Popup<'a, Message, R> {
+    pub fn new(
+        content: impl Into<Element<'a, Message, Theme, R>>,
+        chooser: Option<&'a Chooser>,
+        anchor: Rectangle,
+        on_event: impl Fn(ChoiceEvent) -> Message + 'a,
+    ) -> Self {
+        let chooser = chooser.filter(|state| state.is_open());
+        let input = text_input(
+            "Name, @alias, kind or containment",
+            chooser.map_or("", Chooser::query),
+        )
+        .on_input(std::convert::identity)
+        .size(12)
+        .padding(6)
+        .width(Length::Fill)
+        .into();
+        Self {
+            content: content.into(),
+            input,
+            chooser,
+            anchor,
+            on_event: Rc::new(on_event),
+            focus_scope: None,
+        }
+    }
+    pub fn focus_scope(mut self, scope: Option<super::trigger::FormScope>) -> Self {
+        self.focus_scope = scope;
+        self
+    }
+    fn reconcile(&self, tree: &mut Tree) {
+        let state = tree.state.downcast_mut::<Interaction>();
+        let stamp = self.chooser.map(Chooser::stamp);
+        if state.stamp.as_ref().map(|s| s.invocation) != stamp.as_ref().map(|s| s.invocation) {
+            let input = tree.children[1]
+                .state
+                .downcast_mut::<text_input::State<R::Paragraph>>();
+            if stamp.is_some() {
+                input.focus();
+            } else {
+                input.unfocus();
+            }
+            state.closing = false;
+            state.serial = self.chooser.map_or(0, Chooser::query_serial);
+        }
+        if state.stamp != stamp {
+            state.pressed = None;
+            // A queued Choose can be rejected after a preceding query changed
+            // the result generation. Reconciliation must unlock this view.
+            state.closing = false;
+            state.detail_scroll = 0.;
+        }
+        state.stamp = stamp;
+    }
+}
+impl<Message: Clone, R: text::Renderer<Font = Font>> Widget<Message, Theme, R>
+    for Popup<'_, Message, R>
+{
+    fn tag(&self) -> tree::Tag {
+        tree::Tag::of::<Interaction>()
+    }
+    fn state(&self) -> tree::State {
+        tree::State::new(Interaction::default())
+    }
+    fn children(&self) -> Vec<Tree> {
+        vec![
+            Tree::new(self.content.as_widget()),
+            Tree::new(self.input.as_widget()),
+        ]
+    }
+    fn diff(&self, tree: &mut Tree) {
+        tree.children[0].diff(self.content.as_widget());
+        tree.children[1].diff(self.input.as_widget());
+        self.reconcile(tree);
+    }
+    fn size(&self) -> Size<Length> {
+        self.content.as_widget().size()
+    }
+    fn layout(&mut self, tree: &mut Tree, renderer: &R, limits: &layout::Limits) -> layout::Node {
+        self.reconcile(tree);
+        self.content
+            .as_widget_mut()
+            .layout(&mut tree.children[0], renderer, limits)
+    }
+    fn operate(
+        &mut self,
+        tree: &mut Tree,
+        layout: Layout<'_>,
+        renderer: &R,
+        operation: &mut dyn Operation,
+    ) {
+        let mut owner =
+            super::trigger::FormOwner(self.focus_scope.filter(|_| self.chooser.is_none()));
+        operation.custom(None, layout.bounds(), &mut owner);
+        self.content
+            .as_widget_mut()
+            .operate(&mut tree.children[0], layout, renderer, operation);
+    }
+    fn update(
+        &mut self,
+        tree: &mut Tree,
+        event: &Event,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        renderer: &R,
+        clipboard: &mut dyn Clipboard,
+        shell: &mut Shell<'_, Message>,
+        viewport: &Rectangle,
+    ) {
+        let state = tree.state.downcast_mut::<Interaction>();
+        if state.swallow(event) || self.chooser.is_some() && is_input(event) {
+            shell.capture_event();
+            return;
+        }
+        if is_input(event) && self.focus_scope.is_some_and(|scope| scope.modal) {
+            super::trigger::own_input(&mut self.content, &mut tree.children[0], layout, renderer);
+        }
+        if let Event::Keyboard(keyboard::Event::KeyPressed {
+            key: keyboard::Key::Named(keyboard::key::Named::Tab),
+            modifiers,
+            ..
+        }) = event
+            && let Some(scope) = self.focus_scope
+            && super::trigger::tab(
+                &mut self.content,
+                &mut tree.children[0],
+                layout,
+                renderer,
+                scope,
+                modifiers.shift(),
+            )
+        {
+            shell.capture_event();
+            shell.request_redraw();
+            return;
+        }
+        super::trigger::measure(
+            &mut self.content,
+            &mut tree.children[0],
+            layout,
+            renderer,
+            *viewport,
+        );
+        self.content.as_widget_mut().update(
+            &mut tree.children[0],
+            event,
+            layout,
+            cursor,
+            renderer,
+            clipboard,
+            shell,
+            viewport,
+        );
+    }
+    fn draw(
+        &self,
+        tree: &Tree,
+        renderer: &mut R,
+        theme: &Theme,
+        style: &renderer::Style,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        viewport: &Rectangle,
+    ) {
+        self.content.as_widget().draw(
+            &tree.children[0],
+            renderer,
+            theme,
+            style,
+            layout,
+            if self.chooser.is_some() {
+                mouse::Cursor::Unavailable
+            } else {
+                cursor
+            },
+            viewport,
+        );
+    }
+    fn mouse_interaction(
+        &self,
+        tree: &Tree,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        viewport: &Rectangle,
+        renderer: &R,
+    ) -> mouse::Interaction {
+        if self.chooser.is_some() {
+            mouse::Interaction::None
+        } else {
+            self.content.as_widget().mouse_interaction(
+                &tree.children[0],
+                layout,
+                cursor,
+                viewport,
+                renderer,
+            )
+        }
+    }
+    fn overlay<'b>(
+        &'b mut self,
+        tree: &'b mut Tree,
+        layout: Layout<'b>,
+        renderer: &R,
+        viewport: &Rectangle,
+        translation: Vector,
+    ) -> Option<overlay::Element<'b, Message, Theme, R>> {
+        if let Some(chooser) = self.chooser {
+            Some(overlay::Element::new(Box::new(ChooserOverlay {
+                chooser,
+                anchor: self.anchor,
+                state: tree.state.downcast_mut(),
+                input: &mut self.input,
+                input_tree: &mut tree.children[1],
+                on_event: &*self.on_event,
+            })))
+        } else {
+            self.content.as_widget_mut().overlay(
+                &mut tree.children[0],
+                layout,
+                renderer,
+                viewport,
+                translation,
+            )
+        }
+    }
+}
+impl<'a, Message: Clone + 'a, R: text::Renderer<Font = Font> + 'a> From<Popup<'a, Message, R>>
+    for Element<'a, Message, Theme, R>
+{
+    fn from(popup: Popup<'a, Message, R>) -> Self {
+        Element::new(popup)
+    }
+}
+
+struct ChooserOverlay<'b, 'a, Message, R: text::Renderer<Font = Font>> {
+    chooser: &'a Chooser,
+    anchor: Rectangle,
+    state: &'b mut Interaction,
+    input: &'b mut Element<'a, String, Theme, R>,
+    input_tree: &'b mut Tree,
+    on_event: &'b dyn Fn(ChoiceEvent) -> Message,
+}
+impl<Message, R: text::Renderer<Font = Font>> ChooserOverlay<'_, '_, Message, R> {
+    fn geometry(&self, layout: Layout<'_>) -> Geometry {
+        Geometry::from_bounds(
+            layout
+                .children()
+                .next()
+                .expect("measured chooser bounds")
+                .bounds(),
+        )
+    }
+    fn publish(&mut self, action: Action, shell: &mut Shell<'_, Message>) {
+        if self.state.closing {
+            return;
+        }
+        if action.writes_staged_value() || matches!(action, Action::Close(_)) {
+            self.state.closing = true;
+            self.state.swallow_mouse = self.state.held_mouse.or(self.state.swallow_mouse);
+            self.state.swallow_touch = self.state.held_touch.or(self.state.swallow_touch);
+        }
+        shell.publish((self.on_event)(self.chooser.event(action)));
+    }
+    fn press(
+        &mut self,
+        point: Point,
+        pointer: Pointer,
+        geometry: Geometry,
+        shell: &mut Shell<'_, Message>,
+    ) {
+        if !geometry.popup.contains(point) {
+            self.publish(Action::Close(Close::Outside), shell);
+        } else {
+            self.state.pressed = geometry
+                .hit(self.chooser, point)
+                .map(|action| (self.chooser.event(action), pointer));
+        }
+    }
+    fn release(
+        &mut self,
+        point: Point,
+        pointer: Pointer,
+        geometry: Geometry,
+        shell: &mut Shell<'_, Message>,
+    ) {
+        if let Some((pressed, origin)) = self.state.pressed.take()
+            && origin == pointer
+            && pressed.stamp == self.chooser.stamp()
+            && geometry.hit(self.chooser, point).as_ref() == Some(&pressed.action)
+        {
+            self.publish(pressed.action, shell);
+        }
+    }
+}
+impl<Message: Clone, R: text::Renderer<Font = Font>> overlay::Overlay<Message, Theme, R>
+    for ChooserOverlay<'_, '_, Message, R>
+{
+    fn layout(&mut self, renderer: &R, bounds: Size) -> layout::Node {
+        let geometry = Geometry::new(self.anchor, bounds);
+        let input = self
+            .input
+            .as_widget_mut()
+            .layout(
+                self.input_tree,
+                renderer,
+                &layout::Limits::new(Size::ZERO, geometry.search.size()),
+            )
+            .move_to(geometry.search.position());
+        layout::Node::with_children(
+            bounds,
+            vec![
+                layout::Node::new(geometry.popup.size()).move_to(geometry.popup.position()),
+                input,
+            ],
+        )
+    }
+    fn operate(&mut self, layout: Layout<'_>, renderer: &R, operation: &mut dyn Operation) {
+        self.input.as_widget_mut().operate(
+            self.input_tree,
+            layout.children().nth(1).unwrap(),
+            renderer,
+            operation,
+        );
+    }
+    fn update(
+        &mut self,
+        event: &Event,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        renderer: &R,
+        clipboard: &mut dyn Clipboard,
+        shell: &mut Shell<'_, Message>,
+    ) {
+        let geometry = self.geometry(layout);
+        match event {
+            Event::Mouse(mouse::Event::ButtonPressed(button)) => {
+                self.state.held_mouse = Some(*button)
+            }
+            Event::Mouse(mouse::Event::ButtonReleased(button))
+                if self.state.held_mouse == Some(*button) =>
+            {
+                self.state.held_mouse = None
+            }
+            Event::Touch(touch::Event::FingerPressed { id, .. }) => {
+                self.state.held_touch = Some(*id)
+            }
+            Event::Touch(
+                touch::Event::FingerLifted { id, .. } | touch::Event::FingerLost { id, .. },
+            ) if self.state.held_touch == Some(*id) => self.state.held_touch = None,
+            _ => {}
+        }
+        if self.state.swallow(event) {
+            shell.capture_event();
+            return;
+        }
+        if self.state.closing {
+            if is_input(event) {
+                shell.capture_event();
+            }
+            return;
+        }
+        let mut handled = false;
+        match event {
+            Event::Keyboard(keyboard::Event::KeyPressed { key, modifiers, .. }) => {
+                use keyboard::key::Named;
+                let action = match key {
+                    keyboard::Key::Named(Named::Escape) => Some(Action::Close(Close::Escape)),
+                    keyboard::Key::Named(Named::Tab) => Some(Action::Close(Close::Tab {
+                        backwards: modifiers.shift(),
+                    })),
+                    keyboard::Key::Named(Named::ArrowDown) => Some(Action::Move {
+                        delta: 1,
+                        rows: geometry.rows,
+                    }),
+                    keyboard::Key::Named(Named::ArrowUp) => Some(Action::Move {
+                        delta: -1,
+                        rows: geometry.rows,
+                    }),
+                    keyboard::Key::Named(Named::PageDown) => Some(Action::Page {
+                        delta: 1,
+                        rows: geometry.rows,
+                    }),
+                    keyboard::Key::Named(Named::PageUp) => Some(Action::Page {
+                        delta: -1,
+                        rows: geometry.rows,
+                    }),
+                    keyboard::Key::Named(Named::Enter) => {
+                        handled = true;
+                        self.chooser
+                            .highlighted()
+                            .filter(|c| self.chooser.visible(geometry.rows).any(|v| v.id == c.id))
+                            .map(|c| Action::Choose(c.id))
+                    }
+                    keyboard::Key::Character(c)
+                        if modifiers.control()
+                            && modifiers.shift()
+                            && c.eq_ignore_ascii_case("c") =>
+                    {
+                        clipboard.write(
+                            iced::advanced::clipboard::Kind::Standard,
+                            self.chooser
+                                .highlighted()
+                                .map_or_else(|| self.chooser.current.label(), |c| c.detail()),
+                        );
+                        handled = true;
+                        None
+                    }
+                    _ => None,
+                };
+                if let Some(action) = action {
+                    self.publish(action, shell);
+                    handled = true;
+                }
+            }
+            Event::Window(window::Event::Resized(_) | window::Event::Unfocused) => {
+                self.publish(Action::Close(Close::WindowChanged), shell);
+                handled = true;
+            }
+            Event::Mouse(mouse::Event::ButtonPressed(button)) => {
+                if let Some(point) = cursor.position() {
+                    if !geometry.popup.contains(point) {
+                        self.state.swallow_mouse = Some(*button);
+                        self.press(point, Pointer::Mouse, geometry, shell);
+                        handled = true;
+                    } else if *button == mouse::Button::Left && !geometry.search.contains(point) {
+                        self.press(point, Pointer::Mouse, geometry, shell);
+                        handled = true;
+                    }
+                }
+            }
+            Event::Mouse(mouse::Event::ButtonReleased(mouse::Button::Left))
+                if self.state.pressed.is_some() =>
+            {
+                if let Some(point) = cursor.position() {
+                    self.release(point, Pointer::Mouse, geometry, shell);
+                } else {
+                    self.state.pressed = None;
+                }
+                handled = true;
+            }
+            Event::Mouse(mouse::Event::CursorMoved { position })
+                if self.state.pressed.is_none() =>
+            {
+                if let Some(Action::Choose(id)) = geometry.hit(self.chooser, *position)
+                    && self
+                        .chooser
+                        .highlighted()
+                        .is_none_or(|candidate| candidate.id != id)
+                {
+                    self.publish(Action::Highlight(id), shell);
+                }
+            }
+            Event::Mouse(mouse::Event::WheelScrolled { delta }) => {
+                let (x, y) = match delta {
+                    mouse::ScrollDelta::Lines { x, y } => (*x * 24., *y * 24.),
+                    mouse::ScrollDelta::Pixels { x, y } => (*x, *y),
+                };
+                self.state.pressed = None;
+                if cursor
+                    .position()
+                    .is_some_and(|p| geometry.detail.contains(p))
+                {
+                    let detail = self
+                        .chooser
+                        .highlighted()
+                        .map_or_else(|| self.chooser.current.label(), |c| c.detail());
+                    let max = (measure::<R>(&detail, 11., renderer.default_font())
+                        - geometry.detail.width)
+                        .max(0.);
+                    self.state.detail_scroll =
+                        (self.state.detail_scroll - if x != 0. { x } else { y }).clamp(0., max);
+                    shell.request_redraw();
+                } else if y != 0. {
+                    self.publish(
+                        Action::Page {
+                            delta: if y < 0. { 1 } else { -1 },
+                            rows: geometry.rows,
+                        },
+                        shell,
+                    );
+                }
+                handled = true;
+            }
+            Event::Touch(touch::Event::FingerPressed { id, position })
+                if !geometry.search.contains(*position) =>
+            {
+                if !geometry.popup.contains(*position) {
+                    self.state.swallow_touch = Some(*id);
+                }
+                self.press(*position, Pointer::Touch(*id), geometry, shell);
+                handled = true;
+            }
+            Event::Touch(touch::Event::FingerLifted { id, position })
+                if self.state.pressed.is_some() =>
+            {
+                self.release(*position, Pointer::Touch(*id), geometry, shell);
+                handled = true;
+            }
+            Event::Touch(touch::Event::FingerLost { .. } | touch::Event::FingerMoved { .. }) => {
+                self.state.pressed = None;
+            }
+            _ => {}
+        }
+        if !handled {
+            let mut messages = Vec::new();
+            let mut input_shell = Shell::new(&mut messages);
+            self.input.as_widget_mut().update(
+                self.input_tree,
+                event,
+                layout.children().nth(1).unwrap(),
+                cursor,
+                renderer,
+                clipboard,
+                &mut input_shell,
+                &geometry.popup,
+            );
+            let serial = Cell::new(self.state.serial);
+            shell.merge(input_shell, |text| {
+                serial.set(serial.get().saturating_add(1));
+                (self.on_event)(self.chooser.event(Action::Query {
+                    text,
+                    serial: serial.get(),
+                }))
+            });
+            self.state.serial = serial.get();
+        }
+        if is_input(event) {
+            shell.capture_event();
+        }
+    }
+    fn draw(
+        &self,
+        renderer: &mut R,
+        theme: &Theme,
+        renderer_style: &renderer::Style,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+    ) {
+        let geometry = self.geometry(layout);
+        renderer.fill_quad(
+            renderer::Quad {
+                bounds: geometry.popup,
+                border: Border {
+                    color: style::LINE,
+                    width: 1.,
+                    radius: 8.into(),
+                },
+                ..Default::default()
+            },
+            Color::WHITE,
+        );
+        renderer.with_layer(geometry.popup, |renderer| {
+            label(
+                renderer,
+                &self.chooser.scope_label,
+                11.,
+                style::MUTED,
+                Rectangle {
+                    x: geometry.popup.x + 8.,
+                    y: geometry.popup.y + 4.,
+                    width: (geometry.popup.width - 78.).max(0.),
+                    height: 22.,
+                },
+            );
+            label(renderer, "Close", 11., style::TEAL, geometry.close);
+            label(
+                renderer,
+                &self.chooser.current.label(),
+                11.,
+                style::MUTED,
+                geometry.current,
+            );
+            for (i, candidate) in self.chooser.visible(geometry.rows).enumerate() {
+                let row = geometry.row(i);
+                if self
+                    .chooser
+                    .highlighted()
+                    .is_some_and(|c| c.id == candidate.id)
+                {
+                    renderer.fill_quad(
+                        renderer::Quad {
+                            bounds: row,
+                            ..Default::default()
+                        },
+                        Color::from_rgb8(218, 238, 235),
+                    );
+                }
+                let alias_width = (row.width * 0.42).min(
+                    measure::<R>(
+                        &format!("@{}", candidate.alias),
+                        11.,
+                        renderer.default_font(),
+                    ) + 4.,
+                );
+                label(
+                    renderer,
+                    &candidate.name,
+                    12.,
+                    style::INK,
+                    Rectangle {
+                        width: (row.width - alias_width - 6.).max(0.),
+                        height: 17.,
+                        ..row
+                    },
+                );
+                label(
+                    renderer,
+                    &format!("@{}", candidate.alias),
+                    11.,
+                    style::INK,
+                    Rectangle {
+                        x: row.x + row.width - alias_width,
+                        width: alias_width,
+                        height: 17.,
+                        ..row
+                    },
+                );
+                label(
+                    renderer,
+                    &candidate.context_label(),
+                    10.,
+                    style::MUTED,
+                    Rectangle {
+                        y: row.y + 17.,
+                        height: 17.,
+                        ..row
+                    },
+                );
+            }
+            if self.chooser.count() == 0 {
+                label(
+                    renderer,
+                    "No compatible matches. Clear the query.",
+                    11.,
+                    style::MUTED,
+                    geometry.row(0),
+                );
+            }
+            let detail = self
+                .chooser
+                .highlighted()
+                .map_or_else(|| self.chooser.current.label(), |c| c.detail());
+            renderer.with_layer(geometry.detail, |renderer| {
+                raw_label(
+                    renderer,
+                    detail,
+                    11.,
+                    style::MUTED,
+                    Rectangle {
+                        x: geometry.detail.x - self.state.detail_scroll,
+                        width: geometry.detail.width + self.state.detail_scroll,
+                        height: 16.,
+                        ..geometry.detail
+                    },
+                );
+                label(
+                    renderer,
+                    "Scroll details · Ctrl+Shift+C copies",
+                    10.,
+                    style::MUTED,
+                    Rectangle {
+                        y: geometry.detail.y + 16.,
+                        height: 16.,
+                        ..geometry.detail
+                    },
+                );
+            });
+            label(
+                renderer,
+                "‹",
+                15.,
+                if self.chooser.start() > 0 {
+                    style::TEAL
+                } else {
+                    style::MUTED
+                },
+                geometry.previous,
+            );
+            label(
+                renderer,
+                "›",
+                15.,
+                if self.chooser.start() + geometry.rows < self.chooser.count() {
+                    style::TEAL
+                } else {
+                    style::MUTED
+                },
+                geometry.next,
+            );
+            let count = if self.chooser.count() == 0 {
+                "0 results".into()
+            } else {
+                format!(
+                    "{}–{} / {}",
+                    self.chooser.start() + 1,
+                    (self.chooser.start() + geometry.rows).min(self.chooser.count()),
+                    self.chooser.count()
+                )
+            };
+            label(
+                renderer,
+                &count,
+                11.,
+                style::MUTED,
+                Rectangle {
+                    x: geometry.next.x + 30.,
+                    width: (geometry.clear.x - geometry.next.x - 32.).max(0.),
+                    ..geometry.next
+                },
+            );
+            if self.chooser.optional() {
+                label(
+                    renderer,
+                    "Clear reference",
+                    10.,
+                    style::TEAL,
+                    geometry.clear,
+                );
+            }
+            self.input.as_widget().draw(
+                self.input_tree,
+                renderer,
+                theme,
+                renderer_style,
+                layout.children().nth(1).unwrap(),
+                cursor,
+                &geometry.popup,
+            );
+        });
+    }
+    fn mouse_interaction(
+        &self,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        renderer: &R,
+    ) -> mouse::Interaction {
+        let geometry = self.geometry(layout);
+        if cursor
+            .position()
+            .is_some_and(|p| geometry.hit(self.chooser, p).is_some())
+        {
+            mouse::Interaction::Pointer
+        } else {
+            self.input.as_widget().mouse_interaction(
+                self.input_tree,
+                layout.children().nth(1).unwrap(),
+                cursor,
+                &geometry.popup,
+                renderer,
+            )
+        }
+    }
+}
+
+fn is_input(event: &Event) -> bool {
+    matches!(
+        event,
+        Event::Mouse(_) | Event::Touch(_) | Event::Keyboard(_) | Event::InputMethod(_)
+    )
+}
+fn measure<R: text::Renderer<Font = Font>>(content: &str, size: f32, font: Font) -> f32 {
+    R::Paragraph::with_text(text::Text {
+        content,
+        bounds: Size::INFINITE,
+        size: size.into(),
+        line_height: text::LineHeight::default(),
+        font,
+        align_x: text::Alignment::Left,
+        align_y: alignment::Vertical::Center,
+        shaping: text::Shaping::Advanced,
+        wrapping: text::Wrapping::None,
+    })
+    .min_width()
+}
+fn label<R: text::Renderer<Font = Font>>(
+    renderer: &mut R,
+    content: &str,
+    size: f32,
+    color: Color,
+    bounds: Rectangle,
+) {
+    let font = renderer.default_font();
+    let mut display = content.to_owned();
+    if measure::<R>(content, size, font) > bounds.width {
+        let ends: Vec<_> = content
+            .char_indices()
+            .map(|(i, _)| i)
+            .chain(std::iter::once(content.len()))
+            .collect();
+        let (mut low, mut high) = (0, ends.len());
+        while low + 1 < high {
+            let middle = (low + high) / 2;
+            if measure::<R>(&format!("{}…", &content[..ends[middle]]), size, font) <= bounds.width
+            {
+                low = middle;
+            } else {
+                high = middle;
+            }
+        }
+        display = format!("{}…", &content[..ends[low]]);
+    }
+    raw_label(renderer, display, size, color, bounds);
+}
+fn raw_label<R: text::Renderer<Font = Font>>(
+    renderer: &mut R,
+    content: String,
+    size: f32,
+    color: Color,
+    bounds: Rectangle,
+) {
+    renderer.fill_text(
+        text::Text {
+            content,
+            bounds: bounds.size(),
+            size: size.into(),
+            line_height: text::LineHeight::default(),
+            font: renderer.default_font(),
+            align_x: text::Alignment::Left,
+            align_y: alignment::Vertical::Center,
+            shaping: text::Shaping::Advanced,
+            wrapping: text::Wrapping::None,
+        },
+        Point::new(bounds.x, bounds.center_y()),
+        color,
+        bounds,
+    );
+}
@@ -445,28 +445,32 @@ fn article(topic: Topic) -> Article {
                        walkthrough(
                            "Describe a path through exchanges",
                            &[
-                                "First create the activities/functions and their exchanges. Check the source and target work for every exchange.",
-                                "Open Behavior & scenarios. Create Process in OA or Functional chain in SA using Create element and + At root.",
-                                "Select that behavior in the page's selector. Open Tools and choose Work or Exchange, then a highlighted path or contribution position to involve an existing source. Each contribution keeps its own identity while referring to the shared engineering definition.",
-                                "In Tools, choose Sequence link and click or drag from the preceding contribution to the following contribution. Choose Tools → Select / reorder to drag a selected path endpoint and reconnect it; a contribution's ↕ handle changes its position within a column. These are local contributions and sequence links, not new architecture exchanges.",
-                                "Select a contribution, then add another after it. Tools → Two paths… creates a split, two paths and their merge in one undoable edit. Enter explicit alternative conditions. Fit overview uses the visible canvas area; 100% keeps working scale with scrollbars. If the minimum zoom is reached, scroll to inspect the remainder.",
+                                "On an empty path, choose Work (W) from the right palette and click the canvas. You can use existing work or stage a new source in that form; exchanges still need explicit compatible source and target work.",
+                                "Open Behavior & scenarios → New. Choose Operational process in OA or Functional chain in SA, enter its exact name, then Create and open. The new behavior belongs at the layer root and opens immediately; Undo removes the creation as one edit.",
+                                "Choose Work (W) or Exchange (E) from the permanent palette on the right, then a highlighted position. Hover a palette button to read its tool name. In Work, Create new source keeps the contribution name and position while you name its Activity/Function and choose its semantic parent. Use this new source stages it; Create commits source and contribution in one Undo. An adjacent exchange may require a particular existing work identity.",
+                                "Choose Sequence link (->) and click or drag from the preceding contribution to the following contribution. Choose Select contributions or paths (S) to drag a selected path endpoint and reconnect it. A contribution's ↕ handle reorders contributions within the same column; links determine the columns. These are local contributions and sequence links, not new architecture exchanges.",
+                                "Select a contribution, then add another after it. Details → Two paths... creates a split, two paths and their merge in one undoable edit. Enter explicit alternative conditions.",
                                "Use Chain involvement from the Process/Functional chain to the capability it supports. Read Model checks for unfinished or disconnected paths.",
                            ],
                        ),
+                        explain(
+                            "Navigate the canvas",
+                            "The header and palette stay available while Details and creation forms overlay the canvas. Fit frames the contents; −/+ changes zoom and 100% restores working scale. Focus the canvas to zoom with the wheel or pan with middle-button drag or Space + left drag. F6 enters or leaves canvas controls; Tab moves to the next control, Enter/Space activates it, and Escape leaves canvas controls or cancels a gesture.",
+                        ),
                        explain(
                            "Choose the right behavioral description",
                            "A chain concentrates on a route through existing exchanges. A scenario can also carry actions, state observations, lifelines and nested fragments. The architecture diagram remains a view of the possible relationships rather than an execution trace.",
                        ),
                        explain(
                            "Review the path as an engineer",
-                            "Check that exchanges express meaningful handoffs and that the links and branch guards support the selected outcome. Use Tools → Reuse to involve an existing process or chain as a nested reference. For an imported ordered exchange path, Append exchange… continues that path; Convert ordered path to explicit links exposes its implied links for topology editing. Conversion preserves the original order in one undoable change.",
+                            "Check that exchanges express meaningful handoffs and that the links and branch guards support the selected outcome. Use Reuse process / chain (ref) in the palette to involve an existing process or chain as a nested reference. For an imported ordered exchange path, Details → Append exchange... continues that path; Edit path links and guards exposes its implied links for topology editing. Conversion preserves the original order in one undoable change.",
                        ),
                        walkthrough(
                            "Connect a particular use of a procedure",
                            &[
-                                "Choose Focus canvas for more working space; Restore panels brings the explorer and properties back. Select a contribution inside a reusable preview, then open Selection details to read its complete caller and reference identity.",
-                                "In Selection details, use Expand nested reference or Fold nested reference to inspect that instance. Open source or Open contribution definition visits the shared definition; Back to caller returns to the original caller context.",
-                                "Open Tools → Qualified link / assembly… and choose its source and target. Use Enter reference to open an instance's contributions, Up one reference for its caller scope, or Root for the link owner. Search and page through all contributions in that scope, then select the exact endpoint. The first and second uses of a procedure remain different choices even when their work has the same name.",
+                                "Choose Focus canvas for more working space; Restore panels brings the explorer and properties back. Select a contribution inside a reusable preview, then open Details to read its complete caller and reference identity.",
+                                "In Details, use Expand nested reference or Fold nested reference to inspect that instance. Open source or Open contribution definition visits the shared definition; Back to caller returns to the original caller context.",
+                                "Open Details → Qualified link / assembly... and choose its source and target. Use Enter reference to open an instance's contributions, Up one reference for its caller scope, or Root for the link owner. Search and page through all contributions in that scope, then select the exact endpoint. The first and second uses of a procedure remain different choices even when their work has the same name.",
                                "Choose Precedence to describe order and its guard, Exchange assembly to identify a work exchange between the contributions, or Common work incidence to state that both use the same work. Select the engineering identity when required, then Apply link.",
                            ],
                        ),
@@ -484,28 +488,40 @@ fn article(topic: Topic) -> Article {
            const {
                Article {
                    summary: "Use a scenario to tell a concrete behavioral story, including repeated messages, actions, state observations and guarded alternatives.",
-                    keywords: "scenario sequence lifeline sender receiver fragment branch alternative loop guard parallel strict optional occurrence exchange action state interface operation allocation call reply unresolved",
+                    keywords: "scenario sequence lifeline lifetime lifecycle birth death capsule sender receiver fragment branch alternative loop guard parallel strict optional occurrence exchange action state interface operation allocation call reply unresolved",
                    sections: &[
                        walkthrough(
                            "Create a scenario",
                            &[
-                                "Open Behavior & scenarios, choose Scenario under Create element and add it at a legal root/owner. Select the scenario in the behavior selector.",
-                                "Use + Lifeline and choose the participant or work it represents. Choices follow the scenario's viewpoint: operational activities, operational participants, system functions or system boundary participants.",
-                                "Choose a message style in the tool selector. Start at a highlighted sequence position on a lifeline, then click or drag to the receiving lifeline. Complete the exchange and details in the form, which retains that sequence position. Escape cancels the gesture.",
-                                "Call + correlated reply creates both occurrences in one edit. Reply to existing call offers valid unanswered calls. A local timer has an expression and a lifeline, with no global exchange. Create and delete messages describe participant lifetime; Model checks also flag risks inside repeated loops.",
-                                "Choose Add action, Observe state, Reuse scenario or Add fragment and click the intended sequence position. Clicking an action or observation on a lifeline also selects that lifeline. Complete any remaining choices before Create.",
-                                "In Select / reorder, click an occurrence and drag its ↕ handle to another position within the same sequence. The ordered list's up/down controls provide another way to reorder. Select an occurrence to inspect its particular use of the exchange, including its message values.",
+                                "Open Behavior & scenarios → New → Scenario and enter its name. Explicitly choose Activities or Participants in OA, or Functions or System boundary in SA. Add optional context only when needed: this is a reference, while the scenario itself belongs at the layer root. Create and open starts the empty scenario.",
+                                "Choose Lifeline (L) in the permanent palette on the right, then click the canvas. Choose existing work/participant or Create new source. The explicit viewpoint limits its kinds; choose participant kinds deliberately. Source name and lifeline name are separate, and the source semantic parent is independent of the scenario. No allocation or capability involvement is inferred.",
+                                "Choose a message style from the palette; hover a button to read its tool name. Start at a highlighted sequence position on a lifeline, then click or drag to the receiving lifeline. Complete the exchange and details in the form, which retains that sequence position. Escape cancels the gesture.",
+                                "Call and correlated reply (C/R) creates both occurrences in one edit. Reply to existing call offers valid unanswered calls. A local timer has an expression and a lifeline, with no global exchange. Create and delete messages describe participant lifetime; Model checks also flag risks inside repeated loops.",
+                                "Choose Action (A), State observation (St), Reuse scenario (ref) or Fragment (alt) and click the intended sequence position. Clicking an action or observation on a lifeline also selects that lifeline. Complete any remaining choices before Create.",
+                                "Choose Select / reorder occurrences (S) and drag an occurrence itself to another position within the same sequence. A drag into another fragment operand is refused. Open Details for the ordered list's up/down controls or Properties for the selected occurrence, including its message values.",
                            ],
                        ),
+                        explain(
+                            "Navigate the canvas",
+                            "The header and palette stay available while Details and creation forms overlay the canvas. Fit frames the contents; −/+ changes zoom and 100% restores working scale. Focus the canvas to zoom with the wheel or pan with middle-button drag or Space + left drag. F6 enters or leaves canvas controls; Tab moves to the next control, Enter/Space activates it, and Escape leaves canvas controls or cancels a gesture.",
+                        ),
                        walkthrough(
                            "Describe alternatives",
                            &[
-                                "Choose Add fragment, click its sequence position and select ALT, PAR, LOOP or OPT. Enter the branch conditions; the tool creates the fragment and its operands together.",
+                                "Choose Fragment (alt), click its sequence position and select ALT, PAR, LOOP or OPT. Enter the branch conditions; the tool creates the fragment and its operands together.",
                                "Click the highlighted position inside an operand to place the next message, action or reference there. The form shows its destination and insertion position. Append to this sequence instead explicitly moves the pending insertion to that sequence's end.",
-                                "Choose Reuse scenario and click its position, then bind every referenced lifeline to a compatible local lifeline explicitly. Select the resulting use and choose Open definition. Back to caller returns to that exact use and its viewport after you apply or cancel pending edits.",
+                                "Choose Reuse scenario and click its position, then bind every referenced lifeline to a compatible local lifeline explicitly. Select the resulting use and choose Details → Open definition. Back returns to that exact use and its viewport after you apply or cancel pending edits.",
                                "Inspect the scenario projection and Model checks. State exactly what each guard means, including units and assumptions where relevant.",
                            ],
                        ),
+                        explain(
+                            "Read lifeline creation and deletion",
+                            "The Lane header and dotted guide identify a lifeline; the guide alone does not establish its lifetime. The stronger solid line shows where the lifeline is known to exist on this scenario path. Create starts that line at a named capsule; Delete ends it at an X. Select the capsule or X to edit that message occurrence. Select the header or guide to inspect the lifeline.",
+                        ),
+                        explain(
+                            "Distinguish uncertain lifetime from an unanswered call",
+                            "A ? means lifetime depends on an alternative, optional, repeated or parallel path. Operands have independent lifetimes: Delete in one alternative does not delete a lifeline in another. Beyond such a fragment, the guide can continue without a definite solid line. This uncertainty is not by itself a model error. The … beside an activation marks a Call that remains unanswered on that path. A reused scenario's internal Create/Delete events appear when you choose Open definition; they do not create or delete the caller's lifelines.",
+                        ),
                        walkthrough(
                            "Invoke an interface operation",
                            &[
@@ -543,7 +559,9 @@ fn article(topic: Topic) -> Article {
                        walkthrough(
                            "Build a state machine",
                            &[
-                                "In Behavior & scenarios, create or select a State machine, then choose Create diagram. This places its existing regions and vertices in a saved view. + View creates another independent layout.",
+                                "In Behavior & scenarios → New → State machine, enter its name and search for the existing same-layer participant that owns it. Candidate labels show parent context and alias to distinguish repeated names.",
+                                "If the owner does not exist, Create new owner retains the machine name and first-view option. Choose its participant kind and semantic parent explicitly. Use this new source returns without changing the model; Create and open commits owner, machine and optional view together.",
+                                "Optionally select Create the first state view, then Create and open. The new machine starts without regions or states. For an existing machine, Create diagram places its existing regions and vertices in a saved view; + View creates another independent layout.",
                                "Choose + Region and click the highlighted machine, or a State/Mode for a nested region. Choose Initial, State, Mode or another kind from + State / symbol, then click its highlighted owning region. Rename the new element in Properties.",
                                "Choose Transition and drag from a source vertex to a compatible target, or click the source and then the target. In Select / move, drag states or containers to arrange them; a container moves its descendant placements without changing ownership.",
                                "Select a drawn transition and drag its endpoint handle to reconnect it. Its right-click menu also offers Reconnect source and Reconnect target; choose one, then click a compatible vertex.",
@@ -898,6 +916,10 @@ fn article(topic: Topic) -> Article {
                            "A property draft is not yet the model",
                            "Apply changes validates the candidate. When it is rejected, correct the retained draft or use Revert. The canvas continues to show accepted values. Navigation that needs to apply an invalid draft may remain on the current record so your work is not lost. You can read this guide without applying or discarding that draft.",
                        ),
+                        explain(
+                            "A new behavior is still a draft",
+                            "Inside a source subform, Back or the first Escape returns to the unchanged parent. Use this new source stages the prerequisite only. Canceling the parent discards it; choosing an existing reference excludes the staged source from creation. Recovery retains both forms and their reserved identities. An open dialog still receives Escape first. Behavior → New keeps the exact name, owner and viewpoint choices outside the model until Create and open succeeds. Cancel or Escape discards only this draft; if a dialog is open, the first Escape dismisses that dialog. New refuses other unfinished property, source or behavior drafts without applying them. Recovery restores the creation form in its original layer, including rejected raw text, for correction or cancellation.",
+                        ),
                        explain(
                            "Aliases and references",
                            "Stable source aliases must follow the language's identifier rules and avoid reserved words. Use a simple descriptive identifier such as assess_incident. Spaces belong in the displayed Name, not the alias. Reference pickers offer compatible model records; creating the required target first is often the missing step.",
@@ -87,6 +87,9 @@ pub enum RowEvent {
    ValuePath(String, crate::data_values::FieldPathKey),
    ValueBrowse(String, Option<crate::data_values::FieldPathKey>, usize),
    ReferenceBrowse(String, String, usize),
+    ReferenceOpen(crate::forms::reference_chooser::adapter::Open),
+    ReferenceEvent(crate::forms::reference_chooser::Event),
+    ReferenceSet(crate::forms::reference_chooser::adapter::Set),
    OperationOmission(bool),
    OperationRationale(String),
    Tab(Tab),
@@ -296,6 +296,51 @@ impl State {
        }
        Ok(())
    }
+    pub(crate) fn reference_form(&self, project: &Project) -> Option<&Draft> {
+        let facet = self.active.selected.as_ref()?;
+        if self.frozen(project).is_err()
+            || self.active.tab != Tab::Facts
+            || self.active.decisions.get(facet) != Some(&SemanticDecision::Candidate)
+        {
+            return None;
+        }
+        self.active.candidate_draft(facet)
+    }
+    pub(crate) fn reference_draft(
+        &self,
+        project: &Project,
+        address: Option<RowAddress>,
+        facet: &FacetSelector,
+        path: &str,
+    ) -> Option<&Draft> {
+        if self.frozen(project).is_err()
+            || self.active_address != address
+            || self.active.tab != Tab::Facts
+        {
+            return None;
+        }
+        self.active.reference_draft(project, facet, path)
+    }
+    pub(crate) fn set_reference(
+        &mut self,
+        project: &Project,
+        address: Option<RowAddress>,
+        facet: &FacetSelector,
+        intent: crate::forms::reference_chooser::adapter::Set,
+    ) -> Result<(), String> {
+        self.reference_draft(project, address, facet, &intent.context.path)
+            .ok_or("The originating review row or property is no longer active.")?
+            .reference_value(project, &intent)?;
+        self.update(
+            project,
+            Event::Row {
+                address,
+                facet: Some(facet.clone()),
+                event: RowEvent::ReferenceSet(intent),
+            },
+        );
+        Ok(())
+    }
    pub fn update(&mut self, project: &Project, event: impl Into<Event>) {
        let event = event.into();
        #[cfg(test)]
@@ -303,6 +348,30 @@ impl State {
            Event::Editor(event) => self.address_event(event),
            other => other,
        };
+        match &event {
+            Event::Row {
+                event: RowEvent::ReferenceOpen(_) | RowEvent::ReferenceEvent(_),
+                ..
+            }
+            | Event::Editor(RowEvent::ReferenceOpen(_) | RowEvent::ReferenceEvent(_)) => return,
+            Event::Row {
+                address,
+                facet,
+                event: RowEvent::ReferenceSet(intent),
+            } => {
+                let valid = facet
+                    .as_ref()
+                    .and_then(|facet| {
+                        self.reference_draft(project, *address, facet, &intent.context.path)
+                    })
+                    .is_some_and(|draft| draft.reference_value(project, intent).is_ok());
+                if !valid {
+                    return;
+                }
+            }
+            Event::Editor(RowEvent::ReferenceSet(_)) => return,
+            _ => {}
+        }
        if let Err(error) = self.frozen(project) {
            // Withdrawing a pending reset is authored intent only. Retain it while
            // keeping the original accepted base and disabling every stale plan.
@@ -464,7 +533,8 @@ impl State {
                            );
                            let scoped_edit = matches!(
                                event,
-                                RowEvent::Input(_, _)
+                                RowEvent::ReferenceSet(_)
+                                    | RowEvent::Input(_, _)
                                    | RowEvent::Text(_, _)
                                    | RowEvent::Shape(_, _)
                                    | RowEvent::Variant(_, _)
@@ -624,7 +694,7 @@ impl State {
            Fill,
            widget::{button, checkbox, column, pick_list, row, text},
        };
-        let message = |event| Message::Workflow(crate::workflow::Event::Semantic(event));
+        let message = |event| Message::Workflow(crate::workflow::Event::semantic(event));
        let mut available: Vec<_> = self
            .base
            .traces
@@ -747,13 +817,19 @@ impl State {
        if let Some(notice) = &self.notice {
            header = header.push(text(notice).size(11));
        }
-        self.active
+        let view = self
+            .active
            .view(&self.base, header.into(), self.can_apply())
            .map(move |message| match message {
-                Message::Workflow(crate::workflow::Event::Semantic(Event::Editor(event))) => {
-                    Message::Workflow(crate::workflow::Event::Semantic(self.address_event(event)))
+                Message::Workflow(crate::workflow::Event::Semantic(event)) => {
+                    let event = match *event {
+                        Event::Editor(event) => self.address_event(event),
+                        other => other,
+                    };
+                    Message::Workflow(crate::workflow::Event::semantic(event))
                }
                other => other,
-            })
+            });
+        crate::forms::reference_chooser::trigger::modal(view)
    }
 }
@@ -522,10 +522,10 @@ fn batch_apply_is_one_exact_source_and_history_undo_redo_roundtrip() {
        &mut app,
        RowEvent::Input(path(f.direction, "minimum"), "120".into()),
    );
-    let _ = app.update(Message::Workflow(crate::workflow::Event::Semantic(
+    let _ = app.update(Message::Workflow(crate::workflow::Event::semantic(
        Event::ChooseTrace(view::choice(&f.project, f.traces[1])),
    )));
-    let _ = app.update(Message::Workflow(crate::workflow::Event::Semantic(
+    let _ = app.update(Message::Workflow(crate::workflow::Event::semantic(
        Event::OpenTrace,
    )));
    tests::decide(
@@ -166,6 +166,14 @@ impl ReviewRow {
    pub fn update(&mut self, project: &Project, event: RowEvent) {
        let mut replan = true;
        let result = match event {
+            // Browser messages belong to the app overlay and must never replan.
+            RowEvent::ReferenceOpen(_) | RowEvent::ReferenceEvent(_) => return,
+            RowEvent::ReferenceSet(intent) => {
+                let path = intent.context.path.clone();
+                self.edit(project, &path, |draft| {
+                    draft.reference_set(project, &intent)
+                })
+            }
            RowEvent::OperationOmission(enabled) => {
                self.operation_omission =
                    enabled.then(|| self.operation_omission.clone().unwrap_or_default());
@@ -518,6 +526,25 @@ impl ReviewRow {
        }
    }

+    pub(super) fn reference_draft(
+        &self,
+        project: &Project,
+        facet: &FacetSelector,
+        path: &str,
+    ) -> Option<&Draft> {
+        if self.selected.as_ref() != Some(facet)
+            || self.decisions.get(facet) != Some(&SemanticDecision::Candidate)
+            || matches!(path, "/id" | "/alias" | "/body" | "/layer")
+            || !self
+                .candidate_roots(project, facet)?
+                .iter()
+                .any(|root| path == root || path.starts_with(&format!("{root}/")))
+        {
+            return None;
+        }
+        self.candidate_draft(facet)
+    }
+
    fn edit(
        &mut self,
        project: &Project,
@@ -895,7 +922,9 @@ pub fn form_event(message: Message) -> Message {
        Message::FieldReferenceBrowse(path, query, page) => {
            RowEvent::ReferenceBrowse(path, query, page)
        }
+        Message::FieldReferenceOpen(request) => RowEvent::ReferenceOpen(request),
+        Message::FieldReferenceEvent(event) => RowEvent::ReferenceEvent(event),
        _ => RowEvent::Preview,
    };
-    Message::Workflow(crate::workflow::Event::Semantic(Event::Editor(event)))
+    Message::Workflow(crate::workflow::Event::semantic(Event::Editor(event)))
 }
@@ -3,7 +3,7 @@ use crate::{app::App, document::Document, workflow::Workflow};
 use serde_json::json;

 pub(super) fn send(app: &mut App, event: RowEvent) {
-    let _ = app.update(Message::Workflow(crate::workflow::Event::Semantic(
+    let _ = app.update(Message::Workflow(crate::workflow::Event::semantic(
        state(app).address_event(event),
    )));
 }
@@ -13,7 +13,7 @@ use iced::{
 mod reserved_artifact_tests;

 fn event(event: RowEvent) -> Message {
-    Message::Workflow(crate::workflow::Event::Semantic(Event::Editor(event)))
+    Message::Workflow(crate::workflow::Event::semantic(Event::Editor(event)))
 }
 fn action<'a>(
    label: impl Into<String>,
@@ -867,7 +867,13 @@ impl ReviewRow {
        ) {
            detail = detail.push(text("Attached facts are separate from referenced definitions. Removing membership never implies deleting a semantic object.").size(11).color(style::MUTED));
        }
-        detail.into()
+        if self.decisions.get(&fact.selector) == Some(&SemanticDecision::Candidate)
+            && let Some(draft) = self.candidate_draft(&fact.selector)
+        {
+            crate::forms::reference_chooser::trigger::scope(detail, draft.reference_session())
+        } else {
+            detail.into()
+        }
    }

    fn members_view<'a>(&'a self, project: &'a Project) -> Element<'a, Message> {
@@ -1663,3 +1663,388 @@ fn adding_bend_between_close_ports_stays_outside_owner_clearance() {
        }]
    );
 }
+
+#[test]
+fn child_work_preserves_allocated_context_and_atomic_history() {
+    use oa_core::projection::project_view;
+    for (layer, performer_kind, work_kind) in [
+        (Layer::Oa, Kind::Entity, Kind::Activity),
+        (Layer::Sa, Kind::System, Kind::Function),
+    ] {
+        for folded in [false, true] {
+            let mut p = Project::empty();
+            let performer = p
+                .add_element(performer_kind, layer, "Performer", None)
+                .unwrap();
+            let work = p
+                .add_element(work_kind, layer, "Parent work", None)
+                .unwrap();
+            let allocation = p.relate(
+                RelationKind::Allocation,
+                "Engineering assignment",
+                performer,
+                work,
+            );
+            p.relations.get_mut(&allocation).unwrap().description =
+                "Retain assignment metadata".into();
+            let original = p.relations[&allocation].clone();
+            let diagram = p.ensure_diagram(layer);
+            p.diagrams.get_mut(&diagram).unwrap().projection = ProjectionKind::Allocation;
+            let performer_node = p.place(diagram, performer, Position { x: 60., y: 60. });
+            let work_node = p.place(diagram, work, Position { x: 84., y: 124. });
+            p = execute_batch(&p, &[Command::Layout(diagram)]).unwrap();
+            for node in [performer_node, work_node] {
+                p.diagrams
+                    .get_mut(&diagram)
+                    .unwrap()
+                    .nodes
+                    .get_mut(&node)
+                    .unwrap()
+                    .collapsed = folded;
+            }
+            let mut app = App::with_project(p);
+            send(&mut app, Message::Layer(layer));
+            send(&mut app, Message::Page(Page::Diagram));
+            send(
+                &mut app,
+                Message::Diagram(crate::app::Choice {
+                    id: diagram,
+                    label: String::new(),
+                }),
+            );
+            let mut first = None;
+            for step in 0..3 {
+                let parent = if step == 2 { first.unwrap() } else { work };
+                send(&mut app, Message::Select(parent));
+                let before = app.project().clone();
+                let before_source = app.document.bundle().clone();
+                send(&mut app, Message::CreateContextElement(work_kind, true));
+                let created = app.selected;
+                assert!(
+                    !before.elements.contains_key(&created),
+                    "{layer:?} step {step}: {}",
+                    app.status
+                );
+                assert_eq!(app.project().elements.len(), before.elements.len() + 1);
+                assert_eq!(app.project().elements[&created].parent, Some(parent));
+                for (id, element) in &before.elements {
+                    assert_eq!(&app.project().elements[id], element);
+                }
+                assert!(
+                    !oa_core::validation::validate(app.project())
+                        .iter()
+                        .any(|i| i.severity == oa_core::validation::Severity::Error)
+                );
+                assert_eq!(
+                    oa_core::validation::allocation_summary(app.project(), work),
+                    Some(performer)
+                );
+                assert_eq!(
+                    oa_core::validation::effective_performer(app.project(), created),
+                    Some(performer)
+                );
+                assert!(
+                    !app.project()
+                        .relations
+                        .values()
+                        .any(|r| r.kind() == RelationKind::Allocation && r.target() == parent)
+                );
+                if step != 1 {
+                    let mut expected = original.clone();
+                    if let RelationBody::Allocation { target, .. } = &mut expected.body {
+                        *target = created;
+                    }
+                    assert_eq!(app.project().relations[&allocation], expected);
+                } else {
+                    assert_eq!(
+                        app.project().relations[&allocation],
+                        before.relations[&allocation]
+                    );
+                }
+                assert_eq!(
+                    app.project().relations.len(),
+                    before.relations.len() + usize::from(step == 1)
+                );
+                let view = project_view(app.project(), diagram);
+                let parent_node = view.nodes.iter().find(|n| n.element == parent).unwrap();
+                let child_node = view.nodes.iter().find(|n| n.element == created).unwrap();
+                let root_node = view.nodes.iter().find(|n| n.element == work).unwrap();
+                assert_eq!(root_node.visual_parent, Some(performer_node));
+                assert_eq!(child_node.visual_parent, Some(parent_node.id));
+                assert!(!app.project().diagrams[&diagram].nodes[&performer_node].collapsed);
+                assert!(!app.project().diagrams[&diagram].nodes[&parent_node.id].collapsed);
+                assert!(child_node.position.x >= parent_node.position.x);
+                assert!(child_node.position.y >= parent_node.position.y + 64.);
+                assert!(
+                    child_node.position.x + child_node.size.width
+                        <= parent_node.position.x + parent_node.size.width
+                );
+                assert!(
+                    child_node.position.y + child_node.size.height
+                        <= parent_node.position.y + parent_node.size.height
+                );
+                for sibling in view
+                    .nodes
+                    .iter()
+                    .filter(|n| n.visual_parent == Some(parent_node.id) && n.id != child_node.id)
+                {
+                    assert!(sibling.position.y + sibling.size.height <= child_node.position.y);
+                }
+                let after = app.project().clone();
+                let after_source = app.document.bundle().clone();
+                send(&mut app, Message::Undo);
+                assert_eq!(
+                    app.project(),
+                    &before,
+                    "creation, allocation and reveal/reflow undo together"
+                );
+                assert_eq!(app.document.bundle(), &before_source);
+                send(&mut app, Message::Redo);
+                assert_eq!(app.project(), &after);
+                assert_eq!(app.document.bundle(), &after_source);
+                if step == 0 {
+                    first = Some(created);
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn child_work_does_not_invent_unallocated_or_mixed_performers() {
+    for (layer, performer_kind, other_kind, work_kind) in [
+        (Layer::Oa, Kind::Entity, Kind::Entity, Kind::Activity),
+        (Layer::Sa, Kind::System, Kind::SystemActor, Kind::Function),
+    ] {
+        // Root leaf, partly unallocated composite, and mixed-performer composite.
+        for context in 0..3 {
+            let mut p = Project::empty();
+            let performer = p
+                .add_element(performer_kind, layer, "Performer", None)
+                .unwrap();
+            let other = p
+                .add_element(other_kind, layer, "Other performer", None)
+                .unwrap();
+            let work = p
+                .add_element(work_kind, layer, "Parent work", None)
+                .unwrap();
+            let mut placed = vec![performer, other, work];
+            if context != 0 {
+                let first = p
+                    .add_element(work_kind, layer, "First leaf", Some(work))
+                    .unwrap();
+                let second = p
+                    .add_element(work_kind, layer, "Second leaf", Some(work))
+                    .unwrap();
+                p.relate(
+                    RelationKind::Allocation,
+                    "First assignment",
+                    performer,
+                    first,
+                );
+                if context == 2 {
+                    p.relate(RelationKind::Allocation, "Other assignment", other, second);
+                }
+                placed.extend([first, second]);
+            }
+            assert_eq!(oa_core::validation::allocation_summary(&p, work), None);
+            let diagram = p.ensure_diagram(layer);
+            p.diagrams.get_mut(&diagram).unwrap().projection = ProjectionKind::Allocation;
+            for id in placed {
+                p.place(diagram, id, Position { x: 60., y: 60. });
+            }
+            p = execute_batch(&p, &[Command::Layout(diagram)]).unwrap();
+            let mut app = App::with_project(p);
+            send(&mut app, Message::Layer(layer));
+            send(&mut app, Message::Page(Page::Diagram));
+            send(
+                &mut app,
+                Message::Diagram(crate::app::Choice {
+                    id: diagram,
+                    label: String::new(),
+                }),
+            );
+            send(&mut app, Message::Select(work));
+            let before = app.project().clone();
+            let before_source = app.document.bundle().clone();
+            send(&mut app, Message::CreateContextElement(work_kind, true));
+            let child = app.selected;
+            assert!(!before.elements.contains_key(&child), "{}", app.status);
+            assert_eq!(app.project().elements[&child].parent, Some(work));
+            assert_eq!(app.project().relations, before.relations);
+            assert_eq!(
+                oa_core::validation::effective_performer(app.project(), child),
+                None
+            );
+            assert_eq!(
+                oa_core::validation::allocation_summary(app.project(), work),
+                None
+            );
+            let after = app.project().clone();
+            let after_source = app.document.bundle().clone();
+            send(&mut app, Message::Undo);
+            assert_eq!(app.project(), &before);
+            assert_eq!(app.document.bundle(), &before_source);
+            send(&mut app, Message::Redo);
+            assert_eq!(app.project(), &after);
+            assert_eq!(app.document.bundle(), &after_source);
+        }
+    }
+}
+
+#[test]
+fn child_work_transfers_leaf_roles_without_fabricating_responsibilities() {
+    // Direct allocation + matching roles, uniquely realized roles only,
+    // unresolved roles, and roles realized by different performers.
+    for context in 0..4 {
+        let mut p = Project::empty();
+        let performer = p
+            .add_element(Kind::Entity, Layer::Oa, "Performer", None)
+            .unwrap();
+        let other = p
+            .add_element(Kind::Entity, Layer::Oa, "Other performer", None)
+            .unwrap();
+        let work = p
+            .add_element(Kind::Activity, Layer::Oa, "Responsible work", None)
+            .unwrap();
+        let mut responsibilities = Vec::new();
+        if context == 0 {
+            responsibilities.push(p.relate(
+                RelationKind::Allocation,
+                "Direct responsibility",
+                performer,
+                work,
+            ));
+        }
+        for index in 0..2 {
+            let role = p
+                .add_element(Kind::Role, Layer::Oa, &format!("Role {index}"), None)
+                .unwrap();
+            responsibilities.push(p.relate(
+                RelationKind::RoleAssignment,
+                &format!("Assigned role {index}"),
+                role,
+                work,
+            ));
+            if context != 2 {
+                let source = if context == 3 && index == 1 {
+                    other
+                } else {
+                    performer
+                };
+                p.relate(RelationKind::RoleRealization, "Realizes role", source, role);
+            }
+        }
+        for (index, id) in responsibilities.iter().enumerate() {
+            let relation = p.relations.get_mut(id).unwrap();
+            relation.description =
+                format!("Responsibility {index}: preserve engineering rationale");
+            let link = Id::new_v4();
+            p.artifact_links.insert(
+                link,
+                ArtifactLink {
+                    id: link,
+                    alias: format!("responsibility_evidence_{index}"),
+                    name: format!("Responsibility evidence {index}"),
+                    description: "Preserve the reference to this exact relation".into(),
+                    owner: *id,
+                    relation: ArtifactRelation::References,
+                    uri: format!("https://example.invalid/responsibility/{index}"),
+                    revision: Some("review-7".into()),
+                    fragment: Some("assignment".into()),
+                },
+            );
+        }
+        let original_relations = p.relations.clone();
+        let diagram = p.ensure_diagram(Layer::Oa);
+        p.diagrams.get_mut(&diagram).unwrap().projection = ProjectionKind::Allocation;
+        p.place(diagram, performer, Position { x: 60., y: 60. });
+        p.place(diagram, work, Position { x: 84., y: 124. });
+        p = execute_batch(&p, &[Command::Layout(diagram)]).unwrap();
+        let expected_performer = (context < 2).then_some(performer);
+        assert_eq!(
+            oa_core::validation::allocation_summary(&p, work),
+            expected_performer
+        );
+        let mut app = App::with_project(p);
+        send(&mut app, Message::Page(Page::Diagram));
+        send(
+            &mut app,
+            Message::Diagram(crate::app::Choice {
+                id: diagram,
+                label: String::new(),
+            }),
+        );
+        let mut first = None;
+        for step in 0..2 {
+            send(&mut app, Message::Select(work));
+            let before = app.project().clone();
+            let before_source = app.document.bundle().clone();
+            send(
+                &mut app,
+                Message::CreateContextElement(Kind::Activity, true),
+            );
+            let child = app.selected;
+            assert!(
+                !before.elements.contains_key(&child),
+                "context {context}, step {step}: {}",
+                app.status
+            );
+            assert_eq!(app.project().elements[&child].parent, Some(work));
+            if step == 0 {
+                first = Some(child);
+            }
+            for (id, original) in &original_relations {
+                let mut expected = original.clone();
+                if responsibilities.contains(id) {
+                    match &mut expected.body {
+                        RelationBody::Allocation { target, .. }
+                        | RelationBody::RoleAssignment { target, .. } => *target = first.unwrap(),
+                        _ => unreachable!(),
+                    }
+                }
+                assert_eq!(app.project().relations[id], expected);
+            }
+            assert_eq!(app.project().artifact_links, before.artifact_links);
+            assert!(!app.project().artifact_links.is_empty());
+            let added = usize::from(step == 1 && expected_performer.is_some());
+            assert_eq!(
+                app.project().relations.len(),
+                before.relations.len() + added
+            );
+            assert_eq!(
+                oa_core::validation::effective_performer(app.project(), child),
+                expected_performer
+            );
+            assert_eq!(
+                app.project()
+                    .relations
+                    .values()
+                    .filter(|r| r.kind() == RelationKind::RoleAssignment && r.target() == child)
+                    .count(),
+                if step == 0 { 2 } else { 0 }
+            );
+            if context != 0 && step == 0 {
+                assert!(
+                    !app.project()
+                        .relations
+                        .values()
+                        .any(|r| r.kind() == RelationKind::Allocation)
+                );
+            }
+            assert!(
+                !oa_core::validation::validate(app.project())
+                    .iter()
+                    .any(|i| i.severity == oa_core::validation::Severity::Error)
+            );
+            let after = app.project().clone();
+            let after_source = app.document.bundle().clone();
+            send(&mut app, Message::Undo);
+            assert_eq!(app.project(), &before);
+            assert_eq!(app.document.bundle(), &before_source);
+            send(&mut app, Message::Redo);
+            assert_eq!(app.project(), &after);
+            assert_eq!(app.document.bundle(), &after_source);
+        }
+    }
+}
@@ -12,6 +12,7 @@ use iced::{
    },
 };
 use oa_core::*;
+use unicode_segmentation::UnicodeSegmentation;

 pub fn label<'a>(s: impl Into<String>) -> widget::Text<'a> {
    text(s.into()).size(11).color(style::MUTED)
@@ -24,10 +25,12 @@ pub fn action<'a>(s: &str, m: Message) -> widget::Button<'a, Message> {
 }
 pub fn short(s: &str, limit: usize) -> String {
    let s = s.split_whitespace().collect::<Vec<_>>().join(" ");
-    if s.chars().count() > limit {
+    if s.graphemes(true).count() > limit {
        format!(
            "{}…",
-            s.chars().take(limit.saturating_sub(1)).collect::<String>()
+            s.graphemes(true)
+                .take(limit.saturating_sub(1))
+                .collect::<String>()
        )
    } else {
        s
@@ -1290,3 +1293,57 @@ fn checks(app: &App) -> View<'_, Message> {
    }
    scrollable(out.padding(24)).into()
 }
+
+#[cfg(test)]
+mod tests {
+    use super::short;
+
+    #[test]
+    fn short_preserves_native_lifeline_clusters_at_cutoff() {
+        let oa = "abcdefghijklmnope\u{0301}尾";
+        assert_eq!(short(oa, 17), "abcdefghijklmnop…");
+        assert_eq!(short(oa, 18), oa);
+        assert_eq!(short(oa, 19), oa);
+
+        let sa = "abcdefghijklmnop👩\u{200d}🔬 tail";
+        assert_eq!(short(sa, 17), "abcdefghijklmnop…");
+        assert_eq!(short(sa, 18), "abcdefghijklmnop👩\u{200d}🔬…");
+        assert_eq!(short(sa, 19), "abcdefghijklmnop👩\u{200d}🔬 …");
+        assert_eq!(short(sa, 22), sa);
+    }
+
+    #[test]
+    fn short_never_splits_retained_extended_graphemes() {
+        for cluster in ["e\u{0301}", "👩\u{200d}🔬", "👍🏽", "🇫🇷"] {
+            let value = format!("A{cluster}BC");
+            assert_eq!(short(&value, 2), "A…");
+            assert_eq!(short(&value, 3), format!("A{cluster}…"));
+            assert_eq!(short(&value, 4), value);
+        }
+    }
+
+    #[test]
+    fn short_preserves_ascii_cjk_and_whitespace_policy() {
+        assert_eq!(short("abcd", 3), "ab…");
+        assert_eq!(short("abcd", 4), "abcd");
+        assert_eq!(short("abcd", 5), "abcd");
+        assert_eq!(short("甲乙丙丁", 3), "甲乙…");
+        assert_eq!(short("甲乙丙丁", 4), "甲乙丙丁");
+        assert_eq!(short(" \tA\r\n e\u{0301}\u{2003}B  ", 5), "A e\u{0301} B");
+        assert_eq!(short(" \tA\r\n e\u{0301}\u{2003}B  ", 4), "A e\u{0301}…");
+    }
+
+    #[test]
+    fn short_preserves_empty_and_small_limit_policy() {
+        for limit in [0, 1, 2] {
+            assert_eq!(short("", limit), "");
+            assert_eq!(short(" \t\r\n", limit), "");
+        }
+        assert_eq!(short("A", 0), "…");
+        assert_eq!(short("A", 1), "A");
+        assert_eq!(short("AB", 1), "…");
+        assert_eq!(short("e\u{0301}", 0), "…");
+        assert_eq!(short("e\u{0301}", 1), "e\u{0301}");
+        assert_eq!(short("e\u{0301}B", 1), "…");
+    }
+}
@@ -19,7 +19,7 @@ mod transition_tests;

 #[derive(Debug, Clone)]
 pub enum Event {
-    Semantic(crate::semantic_review::Event),
+    Semantic(Box<crate::semantic_review::Event>),
    Port(crate::port_workflow::Event),
    ExchangeItem(Id, bool),
    Endpoint(bool, EndpointChoice),
@@ -41,6 +41,11 @@ pub enum Event {
    Resolve(Id, TransitionField, FieldDecision),
    Preview,
 }
+impl Event {
+    pub fn semantic(event: crate::semantic_review::Event) -> Self {
+        Self::Semantic(Box::new(event))
+    }
+}
 pub enum Workflow {
    Semantic(Box<crate::semantic_review::State>),
    Ports(Box<crate::port_workflow::State>),
@@ -752,7 +752,7 @@ lists all additional fields. <span class="docutils literal">ref</span> means <sp
 </tr>
 <tr><td><p><span class="docutils literal">oa_scenario</span>, <span class="docutils literal">sa_scenario</span></p></td>
 <td><p><span class="docutils literal">viewpoint</span>: ScenarioViewpoint; <span class="docutils literal">context</span>: ref?; <span class="docutils literal">precondition</span>, <span class="docutils literal">postcondition</span>: strings; <span class="docutils literal">steps</span>: occurrence refs</p></td>
-<td><p>MixedLegacy for omitted schema-2 source; none; <span class="docutils literal">&quot;&quot;</span>; <span class="docutils literal">&quot;&quot;</span>; <span class="docutils literal">[]</span></p></td>
+<td><p>MixedLegacy when viewpoint is omitted, including newly authored source 7 (see section 4.3); none; <span class="docutils literal">&quot;&quot;</span>; <span class="docutils literal">&quot;&quot;</span>; <span class="docutils literal">[]</span></p></td>
 </tr>
 <tr><td><p><span class="docutils literal">oa_lifeline</span>, <span class="docutils literal">sa_lifeline</span></p></td>
 <td><p><span class="docutils literal">represented</span>: participant, work, or role ref?</p></td>
@@ -792,49 +792,71 @@ An Enumeration contains unique string literals. For example:</p>
 <pre class="code text literal-block"><code>definition { Enumeration { literals [&quot;Clear&quot;, &quot;Fog&quot;]; }; };
 type_ref { Named &#64;weather_classification; };</code></pre>
 <p>These are typed constructors with named fields, not embedded JSON documents.
-Constructor field names and enum spellings are case-sensitive. When replacing
-a constructor, all of its fields MUST be supplied; the containing declaration
-defaults do not silently fill a different constructor's missing fields.
-During schema-2 compatibility, the new Exchange fields <span class="docutils literal">message_kind</span>,
-<span class="docutils literal">reply_to</span> and <span class="docutils literal">values</span> are exceptions: omitted values hydrate as
-Asynchronous, none and [] respectively. Canonical output writes them explicitly.
-This preserves older schema-2 source/JSON without inventing call correlation or
-value annotations. It is not a rule for an unspecified future schema.</p>
+Constructor field names and enum spellings are case-sensitive. A selected
+constructor uses its own field contract; it does not inherit the payload of a
+different constructor from the declaration default. Required fields MUST be
+supplied. Nullability and omission are separate properties: <span class="docutils literal">?</span> denotes a
+value that can be <span class="docutils literal">none</span>; a constructor's omission contract determines whether
+the field may be absent. There is no general all-constructor-fields-required
+rule. Other typed constructors use their contracts in the corresponding
+sections; the occurrence rules below do not establish defaults for them.</p>
+<p>The following table records the source-7 OccurrenceBody contracts. Optional
+references may be omitted and then mean <span class="docutils literal">none</span>. Exchange also admits omitted
+<span class="docutils literal">message_kind</span> and <span class="docutils literal">values</span>, meaning Asynchronous and <span class="docutils literal">[]</span> respectively.
+These omissions are accepted in newly authored source 7, not only in schema-2
+compatibility input. Earlier schema admission of constructors and fields is
+still governed by its version rules.</p>
+<p>Canonical formatting writes the hydrated occurrence references and default
+<span class="docutils literal">message_kind</span>, <span class="docutils literal">reply_to</span> and <span class="docutils literal">values</span> explicitly. An absent
+<span class="docutils literal">operation</span> remains omitted in canonical output. Lossless no-op updates and
+unrelated name edits retain authored omissions; canonical formatting is a
+different operation. An admitted incomplete occurrence can still produce model
+checks requesting its missing work, exchange, lifeline or referenced scenario.</p>
 <table>
 <caption>Occurrence body constructors</caption>
 <colgroup>
-<col style="width: 22.0%" />
-<col style="width: 78.0%" />
+<col style="width: 18.0%" />
+<col style="width: 36.0%" />
+<col style="width: 46.0%" />
 </colgroup>
 <thead>
 <tr><th class="head"><p>Constructor</p></th>
 <th class="head"><p>Required fields</p></th>
+<th class="head"><p>Fields that may be omitted, with their resulting values</p></th>
 </tr>
 </thead>
 <tbody>
 <tr><td><p>Exchange</p></td>
-<td><p><span class="docutils literal">exchange</span>: exchange relation ref?; <span class="docutils literal">sender</span>, <span class="docutils literal">receiver</span>: lifeline refs?; <span class="docutils literal">message_kind</span>: MessageKind; <span class="docutils literal">reply_to</span>: occurrence ref?; <span class="docutils literal">values</span>: MessageValue records</p></td>
+<td><p>None</p></td>
+<td><p><span class="docutils literal">exchange</span>: exchange relation ref?, <span class="docutils literal">sender</span>, <span class="docutils literal">receiver</span>: lifeline refs?, <span class="docutils literal">reply_to</span>: occurrence ref?, <span class="docutils literal">operation</span>: OperationUse? → <span class="docutils literal">none</span>; <span class="docutils literal">message_kind</span>: MessageKind → Asynchronous; <span class="docutils literal">values</span>: MessageValue records → <span class="docutils literal">[]</span></p></td>
 </tr>
 <tr><td><p>Action</p></td>
-<td><p><span class="docutils literal">action</span>: activity/function ref?; <span class="docutils literal">lifeline</span>: ref?</p></td>
+<td><p>None</p></td>
+<td><p><span class="docutils literal">action</span>: activity/function ref?, <span class="docutils literal">lifeline</span>: ref? → <span class="docutils literal">none</span></p></td>
 </tr>
 <tr><td><p>Control</p></td>
 <td><p><span class="docutils literal">kind</span>: Choice, Merge, Fork, Join, Loop</p></td>
+<td><p>None</p></td>
 </tr>
 <tr><td><p>SequenceReference</p></td>
-<td><p><span class="docutils literal">sequence</span>: process/functional-chain ref?</p></td>
+<td><p>None</p></td>
+<td><p><span class="docutils literal">sequence</span>: process/functional-chain ref? → <span class="docutils literal">none</span></p></td>
 </tr>
 <tr><td><p>ScenarioUse</p></td>
-<td><p><span class="docutils literal">scenario</span>: scenario ref?; <span class="docutils literal">bindings</span>: LifelineBinding records</p></td>
+<td><p><span class="docutils literal">bindings</span>: LifelineBinding records</p></td>
+<td><p><span class="docutils literal">scenario</span>: scenario ref? → <span class="docutils literal">none</span></p></td>
 </tr>
 <tr><td><p>State</p></td>
-<td><p><span class="docutils literal">state</span>: state/mode ref?; <span class="docutils literal">lifeline</span>: ref?</p></td>
+<td><p>None</p></td>
+<td><p><span class="docutils literal">state</span>: state/mode ref?, <span class="docutils literal">lifeline</span>: ref? → <span class="docutils literal">none</span></p></td>
 </tr>
 <tr><td><p>Fragment</p></td>
 <td><p><span class="docutils literal">operator</span>: Alternative, Parallel, Loop, Optional; <span class="docutils literal">branches</span>: branch occurrence refs</p></td>
+<td><p>None</p></td>
 </tr>
 <tr><td><p>Branch</p></td>
 <td><p><span class="docutils literal">guard</span>: string; <span class="docutils literal">occurrences</span>: occurrence refs</p></td>
+<td><p>None</p></td>
 </tr>
 </tbody>
 </table>
@@ -1274,9 +1296,21 @@ reference checks.</p>
 <p>Omitted schema-2 viewpoints hydrate as MixedLegacy in both source and JSON.
 This preserves pre-extension mixed work/participant scenes without discarding
 their lifelines or silently assigning a stricter meaning. MixedLegacy emits a
-review warning. New graphical factories explicitly select OperationalActivity
-or Functional by layer. Authors can select a strict viewpoint after reviewing
-the legacy scene; canonical source then records that choice.</p>
+review warning. Source parsing also uses MixedLegacy when <span class="docutils literal">viewpoint</span> is
+omitted from a newly authored source-7 scenario; it does not infer a strict
+viewpoint from the layer or lifelines. Write the intended viewpoint explicitly
+when starting a scenario. For example, this new OA source project starts an
+activity-based scenario whose lifelines and occurrences can be added later:</p>
+<pre class="literal-block">arcadia 7;
+project response &quot;Distress response&quot; {
+    oa_scenario assessment &quot;Assess the distress report&quot; {
+        viewpoint OperationalActivity;
+    }
+}</pre>
+<p>An empty scenario can produce completeness warnings while remaining editable.
+The desktop's Behavior <strong>New</strong> flow asks authors to choose one of the layer's
+two strict viewpoints explicitly. Authors can also select a strict viewpoint
+after reviewing a legacy scene; canonical source then records that choice.</p>
 <p>MessageKind is Asynchronous, Call, Reply, Create, Delete, or
 <span class="docutils literal">{ Timer { expression &quot;after 5 s&quot;; }; }</span>. A process/chain exchange
 contribution MUST remain Asynchronous with no reply correlation. Call/reply,
@@ -1285,16 +1319,25 @@ references a Call occurrence in the same scenario. The call MUST precede the
 reply on a guaranteed common sequence/enclosing branch path. Reply lifelines
 reverse the call's sender/receiver; it may reuse the call's exchange in reverse
 or use an explicit reverse-direction exchange. A second reply to the same call
-on that guaranteed path is an error. Missing reply correlation is a draft
+that can follow another reply on a shared execution path, including conditional
+or parallel operands, is an error. Missing reply correlation is a draft
 warning; non-Reply messages MUST NOT have <span class="docutils literal">reply_to</span>.</p>
-<p>Create identifies the receiver lifeline's creation. An earlier guaranteed use
-of that lifeline is an error. Delete identifies its destruction; a later
-guaranteed use is an error. Ordering checks respect branch ownership; they MUST
-NOT flatten alternative branches into a false unconditional order. A Timer is
+<p>Create identifies the receiver lifeline's creation. Another use that can precede
+its creation on a shared execution path is an error. Delete identifies its
+destruction; another use that can follow it on a shared execution path is an
+error. These checks include conditional and parallel operands but exclude
+mutually exclusive alternatives. Ordering checks respect branch ownership; they
+MUST NOT flatten alternative branches into a false unconditional order. A Timer is
 local to its sender lifeline, has no global exchange or values, and has either
 no receiver or the same receiver as sender. Its nonempty expression describes
 the delay/deadline; an empty expression warns. Conditions and expressions are
 stored engineering annotations, not an executable simulation language.</p>
+<p>These ordering checks compare distinct stored occurrences along structural
+paths; they do not simulate repeated loop iterations. Repetition risks use
+<span class="docutils literal">reply_repetition</span> and <span class="docutils literal">lifeline_repetition</span> warnings separately. For example,
+a loop containing one Reply to an outer Call can warn about repetition without
+containing two distinct replies; a same-operand Create/use/Delete lifetime can
+repeat without its previous iteration being treated as an earlier stored use.</p>
 <p>Each MessageValue is <span class="docutils literal">{ path [&#64;parameter]; field &#64;data_field; expression &quot;value expression&quot;; }</span>.
 Its identity is the pair (path, field), so two uses of one Record can have
 different values for the same terminal field. Path contains enclosing DataField
@@ -2217,6 +2260,23 @@ strings use JSON string escaping, including <span class="docutils literal">\n</s
 and Unicode escapes. Literal unescaped newlines inside strings are invalid.
 Numbers use JSON decimal/exponent syntax; NaN, infinity, hexadecimal numbers,
 leading plus signs, and leading zeroes are invalid.</p>
+<p>A small model may begin with engineering declarations alone. This complete
+source describes two participants, their work, responsibility and an exchange:</p>
+<pre class="literal-block">arcadia 7;
+project distress &quot;Distress response&quot; {
+    oa_actor vessel &quot;Vessel in distress&quot; {}
+    oa_entity rescue &quot;Rescue coordination&quot; {}
+    oa_activity report &quot;Report distress&quot; {}
+    oa_activity assess &quot;Assess incident&quot; {}
+    allocation vessel_reports &quot;Crew reports&quot; { source &#64;vessel; target &#64;report; }
+    allocation rescue_assesses &quot;Team assesses&quot; { source &#64;rescue; target &#64;assess; }
+    interaction distress_report &quot;Distress report&quot; { source &#64;report; target &#64;assess; }
+}</pre>
+<p>No diagram, placement, empty description or explicit root parent is required.
+The accepted source adds identities; keep those clauses during later edits.
+Changing <span class="docutils literal">&quot;Assess incident&quot;</span> changes the display name while <span class="docutils literal">&#64;assess</span> still
+resolves to the same activity. Behavior-coverage warnings permit this intermediate
+model to be saved. Allocation remains explicit and distinct from decomposition.</p>
 <p>Aliases match <span class="docutils literal"><span class="pre">[A-Za-z_][A-Za-z0-9_]*</span></span>. The following aliases are reserved:
 arcadia, project, id, oa, sa, element, relation, diagram, node, artifact,
 trace, body, alias, name, description, parent, from, to, entity, actor,
@@ -2227,7 +2287,7 @@ spellings can be used in alias positions because references begin with <span cla
 <span class="docutils literal"><span class="pre">element-kind</span></span> and <span class="docutils literal"><span class="pre">relation-kind</span></span> are exactly the corresponding declaration
 keywords listed above. Typed field
 sets and enum constructors are closed by sections 3–5.</p>
-<pre class="code text literal-block"><code>document    = &quot;arcadia&quot; &quot;5&quot; &quot;;&quot; project
+<pre class="code text literal-block"><code>document    = &quot;arcadia&quot; &quot;7&quot; &quot;;&quot; project
 project     = &quot;project&quot; alias string identity? &quot;{&quot; project-entry* &quot;}&quot;
 project-entry = &quot;description&quot; string &quot;;&quot; | declaration
 declaration = element
@@ -2589,6 +2649,41 @@ leaving dangling references. Deleting a sequence does not delete the semantic
 exchanges it references. Cross-layer counterparts are not owned descendants.
 Text edits describe a complete candidate and must remove or repair dependencies
 explicitly before Apply succeeds.</p>
+<section id="scenario-lifetime-presentation">
+<h3>8.1. Scenario lifetime presentation</h3>
+<p>Scenario lifetime geometry is derived from the stored occurrences and their
+sequence/operand ownership. It adds no model records, source annotations or
+history entries. A lifeline's identity header and neutral editing guide remain
+available before creation, after deletion and when its represented element is
+unfinished. The guide MUST be visually distinguishable from a live interval;
+it is an editing axis, not a statement that the participant exists.</p>
+<p>A directly ordered Create starts the receiver's live interval at its occurrence;
+Delete ends that receiver's interval at its occurrence. Create uses a named birth
+marker and Delete an X, each selectable through the original occurrence identity.
+The message's receiving endpoint MUST align with its marker, including self
+messages. A pre-existing lifeline without a creation has a live interval from
+below its header; without deletion it extends to the visible scenario bottom,
+including in an empty scenario. A missing lifecycle receiver MUST NOT be inferred from
+the exchange. An explicit local receiver remains meaningful when its exchange
+reference is unfinished.</p>
+<p>Operands MUST be projected independently from their enclosing entry context.
+A lifetime change in an alternative, optional, loop or parallel operand MUST
+NOT imply the same change in its displayed sibling or a definite lifetime
+after the fragment. When local structure does not establish one lifetime across
+the represented paths, the continuation is visually unresolved. A subsequent
+explicit Create or Delete in the enclosing sequence can establish a definite interval.
+Neither guard text, screen order nor a guessed loop count proves execution.
+ScenarioUse remains opaque: opening its definition may show its lifecycle,
+but a callee's geometry MUST NOT create or destroy a caller lifeline.</p>
+<p>Call activation is distinct from lifetime. A branch-local Delete clips that
+branch's visible activation at the death marker without inventing a Reply,
+removing an unresolved-call warning or terminating sibling paths.
+Solid activation bars are restricted to definite live intervals; an unresolved
+continuation retains its uncertainty/call diagnostic rather than depicting
+definite survival after a possible deletion. Selection,
+insertion slots, source edits and Undo/Redo retain the same semantic identities
+and validation boundary regardless of the rendered intervals.</p>
+</section>
 </section>
 <section id="persistence-and-explicit-migration">
 <h2>9. Persistence and explicit migration</h2>
@@ -120,7 +120,7 @@ lists all additional fields. ``ref`` means ``@alias``; ``ref?`` also accepts
     - No implicit contract; ``legacy`` defaults none. OA admits Legacy only.
   * - ``oa_scenario``, ``sa_scenario``
     - ``viewpoint``: ScenarioViewpoint; ``context``: ref?; ``precondition``, ``postcondition``: strings; ``steps``: occurrence refs
-     - MixedLegacy for omitted schema-2 source; none; ``""``; ``""``; ``[]``
+     - MixedLegacy when viewpoint is omitted, including newly authored source 7 (see section 4.3); none; ``""``; ``""``; ``[]``
   * - ``oa_lifeline``, ``sa_lifeline``
     - ``represented``: participant, work, or role ref?
     - none
@@ -155,37 +155,60 @@ An Enumeration contains unique string literals. For example:
    type_ref { Named @weather_classification; };

 These are typed constructors with named fields, not embedded JSON documents.
-Constructor field names and enum spellings are case-sensitive. When replacing
-a constructor, all of its fields MUST be supplied; the containing declaration
-defaults do not silently fill a different constructor's missing fields.
-During schema-2 compatibility, the new Exchange fields ``message_kind``,
-``reply_to`` and ``values`` are exceptions: omitted values hydrate as
-Asynchronous, none and [] respectively. Canonical output writes them explicitly.
-This preserves older schema-2 source/JSON without inventing call correlation or
-value annotations. It is not a rule for an unspecified future schema.
+Constructor field names and enum spellings are case-sensitive. A selected
+constructor uses its own field contract; it does not inherit the payload of a
+different constructor from the declaration default. Required fields MUST be
+supplied. Nullability and omission are separate properties: ``?`` denotes a
+value that can be ``none``; a constructor's omission contract determines whether
+the field may be absent. There is no general all-constructor-fields-required
+rule. Other typed constructors use their contracts in the corresponding
+sections; the occurrence rules below do not establish defaults for them.
+
+The following table records the source-7 OccurrenceBody contracts. Optional
+references may be omitted and then mean ``none``. Exchange also admits omitted
+``message_kind`` and ``values``, meaning Asynchronous and ``[]`` respectively.
+These omissions are accepted in newly authored source 7, not only in schema-2
+compatibility input. Earlier schema admission of constructors and fields is
+still governed by its version rules.
+
+Canonical formatting writes the hydrated occurrence references and default
+``message_kind``, ``reply_to`` and ``values`` explicitly. An absent
+``operation`` remains omitted in canonical output. Lossless no-op updates and
+unrelated name edits retain authored omissions; canonical formatting is a
+different operation. An admitted incomplete occurrence can still produce model
+checks requesting its missing work, exchange, lifeline or referenced scenario.

 .. list-table:: Occurrence body constructors
   :header-rows: 1
-   :widths: 22 78
+   :widths: 18 36 46

   * - Constructor
     - Required fields
+     - Fields that may be omitted, with their resulting values
   * - Exchange
-     - ``exchange``: exchange relation ref?; ``sender``, ``receiver``: lifeline refs?; ``message_kind``: MessageKind; ``reply_to``: occurrence ref?; ``values``: MessageValue records
+     - None
+     - ``exchange``: exchange relation ref?, ``sender``, ``receiver``: lifeline refs?, ``reply_to``: occurrence ref?, ``operation``: OperationUse? → ``none``; ``message_kind``: MessageKind → Asynchronous; ``values``: MessageValue records → ``[]``
   * - Action
-     - ``action``: activity/function ref?; ``lifeline``: ref?
+     - None
+     - ``action``: activity/function ref?, ``lifeline``: ref? → ``none``
   * - Control
     - ``kind``: Choice, Merge, Fork, Join, Loop
+     - None
   * - SequenceReference
-     - ``sequence``: process/functional-chain ref?
+     - None
+     - ``sequence``: process/functional-chain ref? → ``none``
   * - ScenarioUse
-     - ``scenario``: scenario ref?; ``bindings``: LifelineBinding records
+     - ``bindings``: LifelineBinding records
+     - ``scenario``: scenario ref? → ``none``
   * - State
-     - ``state``: state/mode ref?; ``lifeline``: ref?
+     - None
+     - ``state``: state/mode ref?, ``lifeline``: ref? → ``none``
   * - Fragment
     - ``operator``: Alternative, Parallel, Loop, Optional; ``branches``: branch occurrence refs
+     - None
   * - Branch
     - ``guard``: string; ``occurrences``: occurrence refs
+     - None

 For example, ``body { Action { action @assess; lifeline @operator_line; }; };``
 selects an Action occurrence. Processes and functional chains contain Exchange,
@@ -631,9 +654,23 @@ reference checks.
 Omitted schema-2 viewpoints hydrate as MixedLegacy in both source and JSON.
 This preserves pre-extension mixed work/participant scenes without discarding
 their lifelines or silently assigning a stricter meaning. MixedLegacy emits a
-review warning. New graphical factories explicitly select OperationalActivity
-or Functional by layer. Authors can select a strict viewpoint after reviewing
-the legacy scene; canonical source then records that choice.
+review warning. Source parsing also uses MixedLegacy when ``viewpoint`` is
+omitted from a newly authored source-7 scenario; it does not infer a strict
+viewpoint from the layer or lifelines. Write the intended viewpoint explicitly
+when starting a scenario. For example, this new OA source project starts an
+activity-based scenario whose lifelines and occurrences can be added later::
+
+    arcadia 7;
+    project response "Distress response" {
+        oa_scenario assessment "Assess the distress report" {
+            viewpoint OperationalActivity;
+        }
+    }
+
+An empty scenario can produce completeness warnings while remaining editable.
+The desktop's Behavior **New** flow asks authors to choose one of the layer's
+two strict viewpoints explicitly. Authors can also select a strict viewpoint
+after reviewing a legacy scene; canonical source then records that choice.

 MessageKind is Asynchronous, Call, Reply, Create, Delete, or
 ``{ Timer { expression "after 5 s"; }; }``. A process/chain exchange
@@ -643,18 +680,28 @@ references a Call occurrence in the same scenario. The call MUST precede the
 reply on a guaranteed common sequence/enclosing branch path. Reply lifelines
 reverse the call's sender/receiver; it may reuse the call's exchange in reverse
 or use an explicit reverse-direction exchange. A second reply to the same call
-on that guaranteed path is an error. Missing reply correlation is a draft
+that can follow another reply on a shared execution path, including conditional
+or parallel operands, is an error. Missing reply correlation is a draft
 warning; non-Reply messages MUST NOT have ``reply_to``.

-Create identifies the receiver lifeline's creation. An earlier guaranteed use
-of that lifeline is an error. Delete identifies its destruction; a later
-guaranteed use is an error. Ordering checks respect branch ownership; they MUST
-NOT flatten alternative branches into a false unconditional order. A Timer is
+Create identifies the receiver lifeline's creation. Another use that can precede
+its creation on a shared execution path is an error. Delete identifies its
+destruction; another use that can follow it on a shared execution path is an
+error. These checks include conditional and parallel operands but exclude
+mutually exclusive alternatives. Ordering checks respect branch ownership; they
+MUST NOT flatten alternative branches into a false unconditional order. A Timer is
 local to its sender lifeline, has no global exchange or values, and has either
 no receiver or the same receiver as sender. Its nonempty expression describes
 the delay/deadline; an empty expression warns. Conditions and expressions are
 stored engineering annotations, not an executable simulation language.

+These ordering checks compare distinct stored occurrences along structural
+paths; they do not simulate repeated loop iterations. Repetition risks use
+``reply_repetition`` and ``lifeline_repetition`` warnings separately. For example,
+a loop containing one Reply to an outer Call can warn about repetition without
+containing two distinct replies; a same-operand Create/use/Delete lifetime can
+repeat without its previous iteration being treated as an earlier stored use.
+
 Each MessageValue is ``{ path [@parameter]; field @data_field; expression "value expression"; }``.
 Its identity is the pair (path, field), so two uses of one Record can have
 different values for the same terminal field. Path contains enclosing DataField
@@ -1582,6 +1629,26 @@ and Unicode escapes. Literal unescaped newlines inside strings are invalid.
 Numbers use JSON decimal/exponent syntax; NaN, infinity, hexadecimal numbers,
 leading plus signs, and leading zeroes are invalid.

+A small model may begin with engineering declarations alone. This complete
+source describes two participants, their work, responsibility and an exchange::
+
+    arcadia 7;
+    project distress "Distress response" {
+        oa_actor vessel "Vessel in distress" {}
+        oa_entity rescue "Rescue coordination" {}
+        oa_activity report "Report distress" {}
+        oa_activity assess "Assess incident" {}
+        allocation vessel_reports "Crew reports" { source @vessel; target @report; }
+        allocation rescue_assesses "Team assesses" { source @rescue; target @assess; }
+        interaction distress_report "Distress report" { source @report; target @assess; }
+    }
+
+No diagram, placement, empty description or explicit root parent is required.
+The accepted source adds identities; keep those clauses during later edits.
+Changing ``"Assess incident"`` changes the display name while ``@assess`` still
+resolves to the same activity. Behavior-coverage warnings permit this intermediate
+model to be saved. Allocation remains explicit and distinct from decomposition.
+
 Aliases match ``[A-Za-z_][A-Za-z0-9_]*``. The following aliases are reserved:
 arcadia, project, id, oa, sa, element, relation, diagram, node, artifact,
 trace, body, alias, name, description, parent, from, to, entity, actor,
@@ -1596,7 +1663,7 @@ sets and enum constructors are closed by sections 3–5.

 .. code-block:: text

-    document    = "arcadia" "5" ";" project
+    document    = "arcadia" "7" ";" project
    project     = "project" alias string identity? "{" project-entry* "}"
    project-entry = "description" string ";" | declaration
    declaration = element
@@ -2005,6 +2072,45 @@ exchanges it references. Cross-layer counterparts are not owned descendants.
 Text edits describe a complete candidate and must remove or repair dependencies
 explicitly before Apply succeeds.

+8.1. Scenario lifetime presentation
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Scenario lifetime geometry is derived from the stored occurrences and their
+sequence/operand ownership. It adds no model records, source annotations or
+history entries. A lifeline's identity header and neutral editing guide remain
+available before creation, after deletion and when its represented element is
+unfinished. The guide MUST be visually distinguishable from a live interval;
+it is an editing axis, not a statement that the participant exists.
+
+A directly ordered Create starts the receiver's live interval at its occurrence;
+Delete ends that receiver's interval at its occurrence. Create uses a named birth
+marker and Delete an X, each selectable through the original occurrence identity.
+The message's receiving endpoint MUST align with its marker, including self
+messages. A pre-existing lifeline without a creation has a live interval from
+below its header; without deletion it extends to the visible scenario bottom,
+including in an empty scenario. A missing lifecycle receiver MUST NOT be inferred from
+the exchange. An explicit local receiver remains meaningful when its exchange
+reference is unfinished.
+
+Operands MUST be projected independently from their enclosing entry context.
+A lifetime change in an alternative, optional, loop or parallel operand MUST
+NOT imply the same change in its displayed sibling or a definite lifetime
+after the fragment. When local structure does not establish one lifetime across
+the represented paths, the continuation is visually unresolved. A subsequent
+explicit Create or Delete in the enclosing sequence can establish a definite interval.
+Neither guard text, screen order nor a guessed loop count proves execution.
+ScenarioUse remains opaque: opening its definition may show its lifecycle,
+but a callee's geometry MUST NOT create or destroy a caller lifeline.
+
+Call activation is distinct from lifetime. A branch-local Delete clips that
+branch's visible activation at the death marker without inventing a Reply,
+removing an unresolved-call warning or terminating sibling paths.
+Solid activation bars are restricted to definite live intervals; an unresolved
+continuation retains its uncertainty/call diagnostic rather than depicting
+definite survival after a possible deletion. Selection,
+insertion slots, source edits and Undo/Redo retain the same semantic identities
+and validation boundary regardless of the rendered intervals.
+
 9. Persistence and explicit migration
 -------------------------------------

@@ -1,6 +1,6 @@
 # Linux packaging and deployment inputs

-The packaging command stages **already-built** desktop/server executables for `x86_64-unknown-linux-gnu`. It runs on Windows PowerShell 5.1 or PowerShell 7 (including Linux) with Python 3.11+ standard library, Git, and the matching Rust/Cargo dependency cache. It does not build, download, install runtime libraries or launch the application. Python creates and reads back the tar archive; end users do not need Python, PowerShell or Rust.
+The packaging command stages **already-built** desktop, server and source CLI executables for `x86_64-unknown-linux-gnu`. It runs on Windows PowerShell 5.1 or PowerShell 7 (including Linux) with Python 3.11+ standard library, Git, and the matching Rust/Cargo dependency cache. It does not build, download, install runtime libraries or launch the application. Python creates and reads back the tar archive; end users do not need Python, PowerShell or Rust.

 Build and validate first in a source checkout. The current runtime validation baseline is Ubuntu 24.04 x86-64. A glibc symbol inventory is not a claim that every distribution with that glibc version supports the renderer and dialogs.

@@ -9,23 +9,25 @@ Build and validate first in a source checkout. The current runtime validation ba
  -Version 0.2.0-rc1 -BinaryDirectory ./target/release -Python python3
 ```

-For an explicit-target build, use `target/x86_64-unknown-linux-gnu/release`. A cross-build may supply another directory containing both `arcadia-studio` and `arcadia-server`. Select the Rust compiler used for the intended build before packaging; its Linux target libraries, copyright reports and locked source/archive cache must be installed. Read-only `cargo metadata --locked --offline --filter-platform x86_64-unknown-linux-gnu` and Rust version/sysroot queries are the only Rust commands run by packaging. When packaging from Windows, `-Python C:/path/to/python.exe` selects Python explicitly.
+For an explicit-target build, use `target/x86_64-unknown-linux-gnu/release`. A cross-build may supply another directory containing all three executables: `arcadia-studio`, `arcadia-server` and `arcadia`. Select the Rust compiler used for the intended build before packaging; its Linux target libraries, copyright reports and locked source/archive cache must be installed. Read-only `cargo metadata --locked --offline --filter-platform x86_64-unknown-linux-gnu` and Rust version/sysroot queries are the only Rust commands run by packaging. When packaging from Windows, `-Python C:/path/to/python.exe` selects Python explicitly.

-The script refuses existing output/claim names. It creates `dist/ArcadiaStudio-<version>-x86_64-unknown-linux-gnu/`, a `.tar.gz`, and an adjacent `.sha256`. A failed attempt leaves its claim and any partial outputs for diagnosis; choose a fresh version or output root rather than overwriting them. Archives use sorted paths, zero timestamps and uid/gid, 0755 for the two Linux executables and 0644 for other files. Every entry is read back and compared against staging, including permissions. The same unchanged inputs on the same Python/zlib implementation produce the same bytes; this does not promise reproducible compiler output.
+The script refuses existing output/claim names. It creates `dist/ArcadiaStudio-<version>-x86_64-unknown-linux-gnu/`, a `.tar.gz`, and an adjacent `.sha256`. A failed attempt leaves its claim and any partial outputs for diagnosis; choose a fresh version or output root rather than overwriting them. Archives use sorted paths, zero timestamps and uid/gid, 0755 for the three Linux executables and 0644 for other files. Every entry is read back and compared against staging, including permissions. The same unchanged inputs on the same Python/zlib implementation produce the same bytes; this does not promise reproducible compiler output.

 ## Contents and provenance

-Both executables, the MIT license, a package-specific README, complete tracked examples (including all water-pressure teaching/evidence files), deployment references and the reachable documentation closure are included. Relative Markdown/reST/HTML file links are checked before archiving; upstream license texts are preserved verbatim and their internal source-tree hyperlinks are outside that documentation check. Untracked private files, caches and unrelated harness history are not included merely because they exist on disk.
+All three executables, the MIT license, a package-specific README, complete tracked examples (including all water-pressure teaching/evidence files), deployment references and the reachable documentation closure are included. Relative Markdown/reST/HTML file links are checked before archiving; upstream license texts are preserved verbatim and their internal source-tree hyperlinks are outside that documentation check. Untracked private files, caches and unrelated harness history are not included merely because they exist on disk.

-`package.json` records input hashes and static ELF dependencies. `SHA256SUMS.txt` inventories every file except itself; the archive checksum covers that inventory too. `dependency-notices.json`, `THIRD-PARTY-NOTICES.txt` and `licenses/` use the same strict collector as Windows: exact target-filtered normal/build dependency graph, locked crate archives, actual source hashes, checksum-bound supplements and embedded fonts, Rust distribution notices and target-library hashes. Unknown sources, absent notices or changed supplements stop packaging. No Linux system libraries are bundled by this pipeline; their runtime distribution supplies them and its notices.
+`package.json` records input hashes and static ELF dependencies. `SHA256SUMS.txt` inventories every file except itself; the archive checksum covers that inventory too. `dependency-notices.json`, `THIRD-PARTY-NOTICES.txt` and `licenses/` use the same strict collector as Windows: exact target-filtered normal/build dependency graph rooted at `oa-desktop`, `oa-server` and `oa-cli`, locked crate archives, actual source hashes, checksum-bound supplements and embedded fonts, Rust distribution notices and target-library hashes. Unknown sources, absent notices or changed supplements stop packaging. No Linux system libraries are bundled by this pipeline; their runtime distribution supplies them and its notices.

 ELF preflight requires little-endian x86-64 executables/PIE, the glibc dynamic loader, no RPATH/RUNPATH and a reviewed set of direct libc/compiler-runtime imports. Unknown libraries require an explicit packaging design instead of being silently copied from a developer machine. Graphics/window/portal libraries loaded at runtime are outside that static import list.

-Optionally pass `-BuildEvidence <json-file>`, containing nonempty `source_identity`, `profile`, `compiler`, exact `target`, and `binary_sha256` keyed by `arcadia-studio` and `arcadia-server`. Hash strings must be lowercase SHA256. Target and binary hashes are checked; other fields remain explicit caller assertions. Omission records build provenance as unknown. Never label a development binary an optimized release because of its directory or package version.
+Optionally pass `-BuildEvidence <json-file>`, containing nonempty `source_identity`, `profile`, `compiler`, exact `target`, and `binary_sha256` keyed by `arcadia-studio`, `arcadia-server` and `arcadia`. Hash strings must be lowercase SHA256. Target and binary hashes are checked; other fields remain explicit caller assertions. Omission records build provenance as unknown. Never label a development binary an optimized release because of its directory or package version.

 ## Native extracted-bundle checks

-Extract into a fresh user-writable Linux directory and run from an unrelated working directory. Verify SHA256SUMS, file permissions, `file`/`ldd` and actual desktop/runtime libraries. A typical Ubuntu runtime needs X11/XKB and Wayland clients, Vulkan loader/Mesa Vulkan drivers, and working session DBus plus an xdg-desktop-portal backend for file dialogs. A successful `ldd` alone is insufficient because these libraries can be loaded dynamically.
+The source authoring CLI is `./arcadia`. Run `./arcadia --help` for `check`, `lint`, `stabilize` and `rename-alias`; each takes an explicit `.arcadia` entry file. Mutation commands preview by default and require `--write` to apply their candidate; `--json` produces a machine-readable report. Test writes on a separate project copy. CLI use does not require a display, a server or Rust. Include CLI check, preview, write and unchanged-repeat checks in extracted-bundle acceptance, alongside desktop and server checks.
+
+Extract into a fresh user-writable Linux directory and run from an unrelated working directory. Verify SHA256SUMS, file permissions, `file`/`ldd` and actual desktop/runtime libraries. A typical Ubuntu runtime needs X11/XKB and Wayland clients and Vulkan loader/Mesa Vulkan drivers. Linux Open/Save uses the application's path-entry dialog and does not require an xdg-desktop-portal backend. A successful `ldd` alone is insufficient because graphics/window libraries can be loaded dynamically.

 For a software Vulkan trial, first locate the installed lavapipe ICD; only if it exists, use:

@@ -33,7 +35,7 @@ For a software Vulkan trial, first locate the installed lavapipe ICD; only if it
 WGPU_BACKEND=vulkan VK_DRIVER_FILES=/usr/share/vulkan/icd.d/lvp_icd.x86_64.json ./arcadia-studio
 ```

-A compatible native GPU may run without these variables. WSLg uses real Linux user space with a particular display environment; record the actual X11/Wayland backend and do not infer support for all Linux sessions from one trial. Exercise Home walkthrough, Help/search, native Open/Save dialogs, a multi-file project, diagram/source edits, Undo/Redo and reopening at normal/minimum window sizes. Compare complete saved model/source and inspect stderr, not merely whether a window appeared.
+A compatible native GPU may run without these variables. WSLg uses real Linux user space with a particular display environment; record the actual X11/Wayland backend and do not infer support for all Linux sessions from one trial. Exercise Home walkthrough, Help/search, Linux Open/Save path entry, existing-file handling, SVG export overwrite confirmation, a multi-file project, diagram/source edits, Undo/Redo and reopening at normal/minimum window sizes. Compare complete saved model/source and inspect stderr, not merely whether a window appeared.

 Run the server against a separate local data directory and unused loopback port. Follow [server configuration](server.md) for health, authentication, ETags, restart and backup/restore. Test create/import, a changed conditional update, unchanged no-op, stale/invalid rejection, and persistence after a clean restart. Record exact binary/archive/source/compiler hashes and platform. Packaging verification is separate from current-tree release acceptance.

@@ -0,0 +1,66 @@
+# Source CLI
+
+Use `arcadia` to check or update local `.arcadia` projects without opening Studio
+or starting a server. Pass the entry file explicitly; its relative include paths
+resolve from their containing source files.
+
+Build with `cargo build --locked -p oa-cli --bin arcadia`. The resulting command
+is `target/debug/arcadia.exe` on Windows or `target/debug/arcadia` on Linux unless
+your Cargo configuration chooses another target directory. A workspace release
+build also includes it. Use the platform's usual executable path prefix when
+running these examples.
+
+```sh
+arcadia check project.arcadia
+arcadia check project.arcadia --json
+arcadia stabilize project.arcadia
+arcadia stabilize project.arcadia --write
+arcadia rename-alias project.arcadia old_alias new_alias
+arcadia rename-alias project.arcadia old_alias new_alias --write --json
+```
+
+`lint` is an alias for `check`. Checks accept incomplete engineering models with
+warnings; syntax errors and structural violations fail. Located diagnostics
+refer to the named file and coordinate space. Line and column numbers are
+one-based and columns count Unicode scalar values; byte ranges are half-open
+UTF-8 offsets.
+
+`stabilize` previews missing persistent identities and any supported source
+migration. `rename-alias` changes one existing global alias and its typed
+references while preserving comments, strings and unrelated source. Pass alias
+names without `@`. The command does not rename an element's display name.
+
+Both editing commands preview by default. Human output writes unified file
+diffs to stdout and diagnostics to stderr. `--json` writes one versioned report
+with diagnostics, migration information, exact before/after text for every
+changed file, diffs and the write result. Unchanged files are not included in
+that report. They are still checked for conflicts before a write.
+
+Add `--write` to save the candidate prepared by that invocation. Even an empty
+diff checks the captured files and pending-save state before returning. A failed
+write reports `written: false` and retains its proposed diff. This does not
+guarantee rollback; the reported conflict or recovery outcome determines the
+next step. A pending save
+requires explicit recovery through the existing project recovery workflow;
+the CLI does not recover it automatically.
+
+Missing IDs in a separate earlier preview remain provisional. A later command
+may allocate different IDs until you save them. This CLI does not persist a
+review plan for later application. It does not canonicalize the whole project
+or delete detached files. Source versions 3–7 use the core's supported migration
+rules; invalid source is not rewritten.
+
+| Exit code | Meaning |
+| --- | --- |
+| 0 | Valid check or successful preview/write; warnings may remain |
+| 1 | Invalid source or refused semantic alias change |
+| 2 | Invalid command arguments |
+| 3 | File/path, conflict, pending-save or output failure |
+
+Admission bounds match the desktop: 256 files, include depth 32, 1024 include
+edges, 64 MiB total UTF-8, 100,000 graph objects, 250,000 records and 500,000
+ordered references. `arcadia --help` lists the commands and bounds. These limits
+are not a claim of interactive performance at the maximum project size.
+
+For the notation itself, start with [the text-first examples](../examples/text-first/README.md)
+and the [language contract](language.rst).
@@ -65,12 +65,12 @@ The integration oracle executes this exact semantic review and source update. It
 | `oa/`, `sa/` | Participants, work, data, capabilities and reusable behavior |
 | `views/` | Five saved views; filters and placements are presentation state |
 | `traceability.arcadia` | OA↔SA correspondence and review history |
-| `model.json` | Current schema-6 interchange of the final accepted model |
+| `model.json` | Current schema-7 interchange of the final accepted model |
 | `transition-before.json`, `transition-request.json` | Explicit first-transition replay inputs |
 | `evidence/repair-check.md` | Local teaching evidence linked from the SA conversation |
 | `model.rs` | Deterministic lesson builder shared by generator and tests |

-The REST routes are documented in [the API reference](../../docs/api.rst). Import `model.json` with `POST /api/v1/projects/import`; query the returned resource's `/model` and `/validation`. Expect schema 6 and the one warning above. JSON import provides canonical source; to retain the exact modular source layout, use `/api/v1/projects/import-source-project` with a SourceBundle containing entry `project.arcadia` and only the 30 reachable `.arcadia` file strings, keyed by slash-separated relative paths. Neither route reads the artifact target from your local filesystem.
+The REST routes are documented in [the API reference](../../docs/api.rst). Import `model.json` with `POST /api/v1/projects/import`; query the returned resource's `/model` and `/validation`. Expect schema 7 and the one warning above. JSON import provides canonical source; to retain the exact modular source layout, use `/api/v1/projects/import-source-project` with a SourceBundle containing entry `project.arcadia` and only the 30 reachable `.arcadia` file strings, keyed by slash-separated relative paths. Neither route reads the artifact target from your local filesystem.

 For transition replay, import `transition-before.json` instead. Submit `transition-request.json` to that baseline resource's `/transitions/preview` with its current ETag in `If-Match`. Review the returned plan, then follow the documented `/transitions/apply` protocol. Use the baseline resource for this exercise: the final model already contains the mapped records and subsequent refinements. This tutorial's automated evidence is core/source validation; it does not claim a separate native or HTTP acceptance run of this particular example.

@@ -0,0 +1,24 @@
+# Start a model in text
+
+Open `project.arcadia`, then choose **Textual model**. The model describes who
+reports distress, who assesses it, and the information passing between those
+activities. It needs no diagram or handwritten UUIDs.
+
+1. Read each declaration as **kind, alias, display name**. References such as
+   `@assess` use the alias. The two allocations state responsibility; the
+   interaction states the direction of the exchange.
+2. Change `"Assess incident"` to a name suited to your project. Use **Apply all**,
+   then **Save all**. Keep the identity clauses added to the accepted source:
+   they preserve the same model objects in later edits.
+3. Add work and exchanges as your understanding grows. Behavior coverage checks
+   identify activities and exchanges that still need process or scenario context;
+   these advisory checks allow you to save the intermediate model.
+
+Changing a display name keeps references intact. Changing an alias requires
+updating every `@alias` use. Nesting expresses decomposition; an allocation
+expresses who performs work. Neither implies the other.
+
+For a larger example with behavior, ports, views and OA/SA correspondence, use
+[the water-pressure walkthrough](../release1/README.md). The
+[language reference](../../docs/language.rst) defines all declarations and the
+rules for splitting a project into included files.
@@ -0,0 +1,10 @@
+arcadia 7;
+project distress "Distress response" {
+    oa_actor vessel "Vessel in distress" {}
+    oa_entity rescue "Rescue coordination" {}
+    oa_activity report "Report distress" {}
+    oa_activity assess "Assess incident" {}
+    allocation vessel_reports "Crew reports" { source @vessel; target @report; }
+    allocation rescue_assesses "Team assesses" { source @rescue; target @assess; }
+    interaction distress_report "Distress report" { source @report; target @assess; }
+}
@@ -319,3 +319,30 @@ Revisit if complete text/native tasks expose unacceptable hidden propagation,
 wrong-context edits or inability to preserve reproducible independent studies.
 The comparison establishes semantic/text maintenance evidence, not human task
 timings or full quantity/library integration acceptance.
+
+## Scenario lifetime rendering integration — 2026-09-11
+
+Codex-ytr83r /root. Adopt the [scoped lifecycle proposal](release-scenario-lifecycle-design-20260910.md)
+as derived presentation over existing source-7 semantics. Always retain a neutral
+identity header/editing guide; depict definite live intervals separately, with
+original-occurrence Create capsules and Delete crosses. Alternative, optional,
+loop and parallel operands inherit their enclosing entry independently and leave
+an unresolved continuation after a local lifetime change. Reused scenarios remain
+opaque. This does not execute guards or add model/source/history records.
+
+Full-height ordinary spines fail to communicate creation/deletion; one global
+earliest-birth/latest-death range would falsely order exclusive operands. Both
+alternatives lose to the scoped projection. The [independent review](release-scenario-lifecycle-independent-review-20260911.md)
+requires true visible root bounds, a complete rendering lane map and local
+activation clipping at Delete; insertion bounds/eligible lanes must keep their
+separate roles. Receiver endpoints and selectable markers must agree, including
+self messages. Those findings determine the integration contract in language
+section 8.1 and the real-Scene/native acceptance fixtures.
+
+Core/source semantics are unchanged. In section 4.3, replacing the old
+guaranteed-only lifetime/duplicate-reply wording with possible shared-path wording
+corrects documentation to `validation.rs` and the existing conditional/parallel
+regressions; it does not broaden admission or add a new rule. Compilation and
+native acceptance of the renderer are still pending at this decision. Revisit the
+visual encoding if actual minimum-size engineering workflows make marker identity,
+uncertain continuation or the distinction between guide and existence unclear.
@@ -1,75 +1,77 @@
+> Superseded on 2026-09-11. This document is a preserved historical checkpoint.
+> Live plans, priorities, ownership and handoffs now reside in [Gitea issue 1](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/1#issuecomment-410) and [issue 2](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/2).
+> Do not resume synchronizing this ledger. See [STATE.md](STATE.md) for the integrated checkpoint.
+
 # First release execution plan

-Updated 2026-09-11. [PROJECT_GOAL.md](../PROJECT_GOAL.md) is the authoritative
-current objective. [STATE.md](STATE.md) records exact execution/evidence and leases;
-[TASK_LEDGER.md](TASK_LEDGER.md) separates facts, assumptions and decisions.
-The complete previous plan is [preserved byte-for-byte](history/2026-09-10-ledgers-before-continuation-refresh/PLAN.md).
-Its earlier goal paths, active-process claims and Escape pauses are historical.
+Updated 2026-09-11 for the published Codex-ytr83r B4 source checkpoint.
+[PROJECT_GOAL.md](../PROJECT_GOAL.md) defines the full outcome;
+[STATE.md](STATE.md) scopes evidence/ownership and
+[TASK_LEDGER.md](TASK_LEDGER.md) separates facts from decisions.

-## Outcome and working principles
+## Immediate integration and verification

-Deliver usable, complete OA/SA engineering workflows on Windows and Linux, with
-one precise reST contract and equivalent graphical, textual and REST editing.
-Constraints/calculations, quantities/units and reusable libraries are explicit
-requirements alongside behavior/state modeling, traceability and navigable help.
-Small and large models must be practical to author entirely in uncluttered text;
-evaluate complete authored and stabilized models, not abbreviated grammar sketches.
-Later Arcadia layers remain future scope. Compilation, metadata fields and polished
-screens alone do not satisfy this outcome.
-
-Retain the shared typed core, stable identity, semantic ownership/allocation distinct
-from geometry, validated atomic commands and exact source/history. Persistent
-extensions need coherent references/deletion, transition, source/migration,
-API/schema and reachable graphical authoring. Define observable acceptance before
-broad downstream changes. Do not silently promote a design proposal to a decision.
+1. Preserve completed integration c81e285/e207b04/b853a1e and reviewed B4 source
+   52f6e17 on codex/release1-ytr83r. Do not replay equivalent3978/d114 changes.
+   CLI-only01b76a1 was reviewed and imported as023e3a8 without core/dependency
+   changes. Preserve the new AGENTS maintenance instruction and exact goal bytes.
+2. Core433, independent lifecycle-oracle admission, focused lifecycle22 and full
+   desktop675 passed on this host. Production freeze2908405 is unchanged by
+   evidence checkpoint3ade397. GUI build, both-layer history/reopen and corrected
+   workspace strict Clippy passed. Finish the affected test and Unicode/native
+   workflows below. Do not repeat the passed suites without a
+   source change or new finding. Root serializes writers and records exact scope.
+3. Use the imported evidence2ec creation-oracle v2 for native Undo comparisons.
+   Reject unknown/changed detached files while allowing exact files
+   retained from an explicit pre-Undo origin. Preserve full Project and reachable
+   SourceBundle equality and original role identities through Redo/reopen.
+4. Exercise current Windows UI at minimum/wide sizes: creation name/owner/viewpoint,
+   one-step history, stale/raw-draft rejection, first Escape/modal priority,
+   recovery, clicked root/ALT action/observation/reuse, exact caller return,
+   same-size Fit and natural subsequent scrolling. Use independent semantic
+   predictions, not only screenshots or serialization of observed outputs.
+5. Review current external Gitea handoffs before importing staged prerequisites,
+   empty-state actions, contextual chooser or source CLI. Validate final combined
+   workflows and preserve explicit ownership/qualification semantics.
+6. After actual B4 test/native acceptance, prepare a distinct runnable Windows
+   prerelease with current-toolchain notices and exact executable/source hashes.
+   Existing MCP credentials have now completed a scoped branch push and remote
+   readback; release attachment upload still needs concrete-artifact verification.
+   Codex-9e8r6t retains the earlier named-authoring prerelease ownership.
+7. Linux setup/downloads/builds/checking are paused by direct user instruction.
+   Wait for the user to resolve WSL2 networking and explicitly instruct resumption.
+   Preserve installed Ubuntu, exact VirtioProxy configuration and complete/partial
+   offline inputs. Networking remains unresolved; preparation is not Linux
+   acceptance. Follow the current WSL/offline records rather than old reboot plans.
+8. Incorporate the owner clarification in issue2: process/scenario interaction
+   should use consistent direct canvas workflows while preserving domain
+   constraints. Codex-956atf owns the shared canvas design; B4 rendering and
+   prerequisite forms support it but do not close this requirement.

 ## Capability milestones

-| Milestone | Work and acceptance | Dependency/current limit |
-| --- | --- | --- |
-| 1. Reliable direct authoring | Exercise actual minimum/wide native creation, allocation, editing, rejection, cancellation and history without implicit draft application or placement drift. Integrate compact named behavior creation after its coherent external gate. | Full local desktop suite passes 642/642 at80cf197; GUI build/native and strict lint remain open. Workspace/B3/palette/recovery/packages are imported. Root owns this host's Cargo/native lease. |
-| 2. Coherent process/scenario work | Interactive ordered/explicit process editing; clicked root/nested scenario insertion; exact reuse bindings and caller return; measured canvas/zoom/scroll; visible scoped Create/Delete lifetimes. Validate model/source/identity and no unintended edit during navigation, including stale/deleted/retargeted references and recovery. | B1/B2/B3 regressions pass in the full suite. B4 is cfg(test) projection only; real lifetime extents, branch-local activation clipping, incomplete lanes and self-arrow endpoints require integration. Use the independently self-checked oracle for native checkpoints. |
-| 3. Precise engineering analysis | Compare owned properties, analysis contexts and existing-data/external alternatives; settle quantity kind/unit/value, numerical policy, calculation/binding and Boolean/error/unknown semantics through falsifying examples. Implement mixed-unit budgets and reusable calculation/constraint definitions with full UI/source/REST parity and exact history/recovery. | New requirement audit confirms absence. Maximum-reasoning proposal tracks precede root synthesis and independent criticism; no semantic contract is ratified yet. Strings are not evaluation. |
-| 4. Maintained reusable libraries | Compare package/definition/instance alternatives. Establish pinned identity/version/dependency closure, local edits, import bindings, detach and explicit three-way updates. Demonstrate two projects, two independent instances, offline reopen, conflicting updates and stable unaffected identities. | Coordinate with milestone 3 definition references and migration. Same-project includes/reuse do not satisfy maintained cross-project libraries. No package contract implemented yet. |
-| 5. Understandable complete engineering tasks | Close teaching, OA↔SA transition/reconciliation, typed state/data/interface, artifact, saved-view and hosted workflows. Establish complete text-only creation/refactoring/modular maintenance with stable identity. Replace concrete long homogeneous selectors with contextual/searchable bounded choices; verify large models, keyboard access, minimum sizes and failure/recovery. Keep offline guide/examples aligned. | A complete warning-free text-only model probe passes source/identity/rename/reparent/file-move checks; measure usability separately. Anchored chooser is an undeclared widget experiment. Reassess current goal rather than copying historical scope exclusions. |
-| 6. Release confidence and delivery | Fresh current Windows/Linux suites, strict Clippy/format, normative reST/OpenAPI/migration/examples; actual GUI/service transport, optimized builds, runtime/notices/archive/provenance/checksums and clean-environment launch. Fresh independent requirements/domain/parity/architecture/UX/runtime review; resolve material findings, then final handoff. | Integrates all preceding capabilities. Linux runtime remains open; use an approved supported environment, preserving historical failed/denied experiments. Historical previews are not final distributions. |
+| Outcome | Work and acceptance |
+| --- | --- |
+| Usable direct behavior/state engineering | Continuous ordered/explicit process authoring, clicked root/nested scenario insertion, exact reuse bindings/caller return, state naming/creation, recovery and source-preserving history. Complete B4 lifetime rendering with actual lifetime bounds, branch-local Delete activation clipping, incomplete lanes and self-arrow endpoints. |
+| Precise engineering analysis | Refine property-owned baseline values/formulas plus explicit ModelBaseline/Case one-level overrides. Close quantity kind/unit/value, exact/approximate numerical policy, dependencies/cycles, false/missing/error, complete freeze and definition provenance. Implement coherent validated core/source/REST/GUI/history contracts. An exact-duration slice alone cannot satisfy the full goal. |
+| Maintained reusable libraries | Resolve source-only normalization, pinned offline definitions/closure, provenance versus checked same-origin compatibility, source→local instance maps, explicit three-way updates/local divergence, subjectless analysis closure and OA/SA mounted-data transition policy. Demonstrate two projects/two instances, cosmetic and semantic upgrades, conflicts/detach and rollback. |
+| Practical complete textual and graphical tasks | Measure small/large text-only creation, cross-file reference navigation, safe alias rename and lossless patch preview. Integrate source CLI and bounded contextual choices; actual keyboard/IME, repeated names, stale events, recovery and minimum geometry must pass. Keep offline guide/examples and normative source documentation aligned. |
+| Complete engineering stories | Close OA↔SA transition/reconciliation, typed data/interfaces/state, artifacts, saved views, hosted workflows and tutorial tasks against the full current goal. Confirm parity and precise specification rather than inheriting historical exclusions. |
+| Reproducible Windows/Linux release | Current tests/format/strict Clippy, reST/OpenAPI/migration/example gates; real GUI and REST transport/restart/ETag conflict acceptance; matching optimized desktop/server packages, complete notices/archive hashes and clean-runtime launch. Fresh independent requirements/domain/parity/architecture/UX/runtime review resolves material findings before release. |

-Milestones are capability gates, not a rigid serial schedule. Root can continue
-build/native acceptance while independent foundational investigations compare
-alternatives. Libraries and analysis share definition-resolution assumptions and
-must converge coherently before broad model/schema edits. User workflows and
-cross-representation evaluators guide implementation boundaries.
+Milestones run adaptively where independent work helps. Analysis and libraries
+share definition/identity assumptions and must converge before broad migrations.
+Other-host slices remain coordinated through issue #1 and Wiki. Native/Cargo
+leases are host-local; source ownership and exact transfer heads are shared.

-## Immediate execution sequence
+## Evaluator boundaries and replanning

-1. Finish the current GUI build and format/strict Clippy checks, then run native
-   engineering tasks. The current 642-test desktop suite has passed; rerun for new
-   code or unresolved failures, not as a substitute for runtime evaluation.
-2. Exchange exact verified commits with the separate host, preserving its workspace
-   ownership. Do not merge the bundle-transfer branch or assume remote publication.
-3. Use the self-checked [scenario oracle](scenario-authoring-contract.rs), follow
-   its [native procedure](fixtures/scenario-authoring/README.md), and compare exact
-   whole snapshots for Undo/Redo/reopen at minimum/wide sizes.
-4. Resolve the paired semantic criticism with concrete text-only package normalization,
-   cosmetic revision/type compatibility, subjectless analysis closure, OA/SA mounted
-   data transitions, baseline-versus-case maintenance and closed numeric algebra
-   experiments. Select coherent contracts before production metamodel expansion.
-5. Update current ledgers and durable decisions when evidence changes the plan.
-   Reassess unresolved assumptions before expanding downstream implementation.
+Use authoritative source semantics, exact UUID/source preservation and actual
+user workflows. Source-only experiments are not accepted new grammar; mounted
+widget tests are not native readability; synthetic packaging checks are not
+Linux runtime. Preserve old environmental failures as evidence without inventing
+current blockers. Continue independent work when platform or transfer work waits.

-## Coordination and evidence rules
-
-Use Gitea issue #1 and Wiki for current ownership/handoffs; read before resuming.
-Codex-956atf and Codex-9e8r6t are distinct hosts. Cargo/native leases are host-local;
-shared source ownership is coordinated. Root owns local integration and final
-responsibility. Both hosts currently lack direct push authentication; authenticated
-MCP and anonymous fetch support verified bundle exchange without shared-ref overwrite.
-
-Record exact source/binary, command exit, test scope and native model/source oracle.
-Do not add focused reruns to full-suite totals or transfer old binary acceptance.
-Older denied Linux workaround instructions remain applicable to that action; do
-not bypass them. Older stopped native sessions do not prevent currently authorized
-native work. The [archived plan](history/2026-09-10-ledgers-before-continuation-refresh/PLAN.md)
-and [archived progress](history/2026-09-10-ledgers-before-continuation-refresh/STATE.md)
-preserve all previous strategy and scoped evidence; archive report links resolve
-from their original `harness/` directory.
+[Archived prior plans](history/2026-09-11-ytr83r-integration/README.md) preserve
+all previous milestone detail. Update this plan when a counterexample changes
+the right next action; do not lower completion criteria after substantial effort.
@@ -0,0 +1,41 @@
+# Current engineering work and evidence
+
+Start with the [user goal](../PROJECT_GOAL.md), [current status](STATE.md),
+[execution plan](PLAN.md), [task ledger](TASK_LEDGER.md) and
+[decisions](DECISIONS.md). Follow [AGENTS.md](../AGENTS.md) and current
+[Gitea coordination](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/1)
+before changing shared work. Dated reports describe their own source, host and
+artifact; they are not current instructions or acceptance of later changes.
+
+## Runnable milestones
+
+- [Windows Studio and REST server authoring preview](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/releases/tag/v0.2.0-preview.authoring.20260911)
+- [Standalone Windows source CLI preview](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/releases/tag/cli-v0.2.0-preview.authoring.20260911)
+
+These are unfinished development milestones. Their release notes and validation
+attachments define exactly what was shipped and tested. Full OA/SA engineering,
+analysis, maintained libraries and current Linux acceptance remain unfinished.
+
+## Current local evidence
+
+| Question | Authoritative record |
+| --- | --- |
+| Which source was integrated? | [Integration audit](release-integration-ytr83r-20260911.md), [CLI import review](release-cli-integration-ytr83r-20260911.md) |
+| What does lifetime rendering mean? | [Implementation and corrected review findings](release-lifecycle-render-ytr83r-20260911.md), [language specification](../docs/language.rst) |
+| What will native behavior be compared against? | [Independent fixture and procedure](fixtures/scenario-lifecycle-native/README.md), [exact pre-native evidence](experiments/lifecycle-native-ytr83r-20260911/) |
+| Which checks ran on this host? | [Host build record](release-host-bootstrap-ytr83r-20260911.md), [current status](STATE.md) |
+| What remains for Windows packaging? | [Current runtime/notice preflight](release-b4-package-preflight-ytr83r-20260911.md), [publication path](release-publication-path-ytr83r-20260911.md) |
+| Is Linux available? | [WSL outcomes and current user pause](release-wsl-postboot-ytr83r-20260911.md), [preserved offline inputs](release-linux-offline-preparation-ytr83r-20260911.md); setup/build/checking waits for the user's networking-resolution signal |
+| What changed for Linux delivery? | [Three-binary CLI packaging and checks](release-linux-cli-packaging-ytr83r-20260911.md), [portable REST restart probe](release-rest-probe-portability-ytr83r-20260911.md); native execution remains pending |
+| Which bounded follow-ups are proposals? | [Explicit Action allocation](release-qualified-action-design-ytr83r-20260911.md), [inheritance scaling diagnosis](release-inheritance-scaling-diagnosis-ytr83r-20260911.md) |
+
+External staged-source, chooser and analysis/library owners maintain their current
+handoffs in Gitea and the [shared Wiki](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/wiki/Home).
+Import exact coherent source checkpoints before transferring conclusions to this checkout.
+
+## History
+
+[Archived integration ledgers](history/2026-09-11-ytr83r-integration/README.md)
+preserve source-specific facts and earlier ownership. Existing dated evidence and
+Git history remain available. Preserve unique findings and update links before
+moving or removing material; active issue #1 remains open for the unfinished goal.
@@ -0,0 +1,64 @@
+# Resume after the user-requested reboot — 2026-09-11
+
+Codex-ytr83r /root. The complete first-release goal remains active and unfinished.
+Read AGENTS.md, PROJECT_GOAL.md, current Gitea issues1/2 and Wiki before resuming.
+This is a pause for the user's reboot, not a completed milestone or failed test.
+
+## Saved source and evidence
+
+Branch: codex/release1-ytr83r. Production source is B4 lifetime rendering52f6e17
+plus CLI01b imported as023e3a8. b96286e records exact core/oracle evidence and
+current harness index. d041212 preserves owner instruction-sync history and the
+byte-exact supplied PROJECT_GOAL. a9a5768 records the Linux trial and contextual
+source integration review. Later checkpoint commits add this resumption note.
+
+Core all-targets passed433 tests, one intentionally ignored probe; the optional
+probe separately passed. The independent lifecycle oracle and all six frozen
+baseline/rename files passed before any native GUI launch. See the harness index.
+No current desktop compile/test/native acceptance has been established.
+
+## Interrupted Windows build
+
+Cargo session93786 was interrupted at the user's request while compiling Iced
+dependencies (last log entry cc1.4.5). It exited1 from interruption; no final gate
+status JSON was emitted. A readback found no cargo.exe/rustc.exe process. Exact
+partial log and explicit interruption record are in
+experiments/lifecycle-native-ytr83r-20260911/. Preserve cached target outputs.
+
+Use the existing ignored task-local toolchain, one Cargo job, after checking no
+other writer is active. From the repository root in PowerShell:
+
+```powershell
+& '.local\run-gate.ps1' -GateName 'ytr83r-desktop-lifecycle-resume' -CargoArgs @('test','--locked','--offline','-p','oa-desktop','scenario_lifecycle','--','--test-threads=1')
+```
+
+The wrapper loads .local/toolchain/env.ps1. Then run appropriate direct-canvas,
+full/strict desktop, server/CLI and GUI build gates serially. Review the new
+typography report: wide Unicode Create labels can overflow the fixed capsule.
+The proposed clipping correction is not implemented; preserve existing fixtures
+and define separate expected Unicode cases before native output. Actual Windows
+wide/minimum/Fit/Save/Undo/Redo/reopen acceptance and B4 packaging remain pending.
+
+## Linux after reboot
+
+Recheck wsl --status and wsl --list --verbose. Before reboot, no distribution was
+installed; WSL reported virtualization unavailable and Windows had a pending
+reboot. Hardware virtualization must be available (firmware or nested VM host).
+No host setting was changed and no reboot was performed by the agent.
+
+Prefer a working WSL2 Ubuntu for real Linux build/runtime validation. The verified
+Ubuntu image and QEMU cache remain under .local/linux-host-ytr83r. Its bounded
+UEFI/TCG pilot ended without guest-ready evidence; all owned pilot processes
+stopped. Do not repeat failed delivery or infer Linux acceptance from the image.
+
+## Coordination and next integration
+
+Codex-9e8r6t owns contextual prerequisites; df6f5956 is available locally and has
+a reviewed minimal import path, with two B4-preserving merges. Later short-host
+layout and Save-procedure corrections are separate; inspect the current remote
+handoff before import. Codex-956atf owns chooser, shared constrained canvas design
+for issue2, and analysis/library contracts. Local audit agents have stopped their
+assigned work. They must recheck coordination before taking new tasks.
+
+The two published Windows authoring/CLI prereleases remain available. No B4
+release should be published until actual current tests/native acceptance pass.
@@ -1,159 +1,57 @@
-# Progress Ledger — first release
+# Integrated checkpoint — 2026-09-12

-Updated 2026-09-11, coordination through Gitea #116. This ledger describes the
-Codex-956atf checkout; external-host evidence is labeled separately. The entire
-previous ledger is preserved [byte-for-byte](history/2026-09-10-ledgers-before-continuation-refresh/STATE.md).
-Historical dates, binaries, process IDs and stopped-session instructions in that
-archive are evidence history, not current status or authorization.
+Codex-ytr83r, isolated branch `codex/canvas-union-ytr83r-20260911`. Current source `33e30c1` combines the a57 canvas, cb91525 grapheme and narrow saved-destination repair corrections. Its 530 frozen inputs match HEAD; independent repair review found no actionable finding. Windows desktop tests, strict Clippy, GUI build and bounded matching native/package acceptance passed. The [canvas-repair Windows prerelease](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/releases/tag/v0.2.0-preview.canvas-repair.20260912) is published; ZIP, checksum and validation attachments were downloaded and hash-verified. [Publication record](release-canvas-repair-publication-20260912.md) preserves the exact identities. This is not a full [user-goal](../PROJECT_GOAL.md) completion claim. Live [canvas integration](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/2), [native/release acceptance](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/5), [saved-destination repair](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/6) and [project overview](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/1) retain ownership and plans. Earlier production `865483b` and its package remain preserved.

-## Current objective and source
+## Verified code and capabilities

-Deliver the complete, usable OA/SA first release in [PROJECT_GOAL.md](../PROJECT_GOAL.md),
-including graphical/source/REST parity, constraints/calculations, quantities/units,
-reusable model libraries, traceability, offline guidance and Windows/Linux release
-acceptance. Direct behavior/scenario authoring and reduced cognitive load remain
-immediate priorities. Complete small and large models must be practical to develop
-through uncluttered text alone. The release is incomplete.
+Source `33e30c1` binds repair dirty state to the actual saved destination, preserving accepted-model history even when Apply is an identical-content no-op. It selectively incorporates peer `33c6d83` in three files. Windows focused repair **5**, full desktop **761**, strict desktop all-targets Clippy and GUI build passed; the five are included in 761. All **530 files / 9,727,025 bytes** remained unchanged between gates and matched HEAD after the build. The preserved GUI `50486253…` passed matching repair/history/recovery and Unicode selection/passive-save checks, packaged walkthrough/help smoke and normal exit0 with empty logs. All559 package files stayed unchanged; fresh extracted server25-request editing/persistence checks passed. [Current validation and artifact hashes](release-canvas-repair-validation-20260912.md) links the exact raw archives and independent reviews. [Repair union and limits](release-repair-union-ytr83r-20260912.md), [closed gates and exact inputs](experiments/repair-union-windows-33e30c1-20260912/README.md), [verbatim independent review](release-saved-destination-independent-review-20260912.md).

-Local branch: `codex/behavior-authoring-20260910`; implementation checkpoint `80cf197be6f1d400bf0b9c84bf8557f88c895aa6`.
-The authoritative goal was copied byte-identically from attachment
-`a49d1780-25d5-4778-ad68-6140c60e4207/goal-objective.md`; SHA256
-`DD58F75C93D55FE16ED141A23D834898FB6EBC625AE7E7AE379DA552A8312435`.
-See [Task Ledger](TASK_LEDGER.md) for knowledge/decisions and [Plan](PLAN.md)
-for capability acceptance. Older goal paths are superseded.
+Source `cb91525` preserves extended grapheme clusters in the shared display helper. Its four focused tests, full desktop 756 and strict desktop Clippy passed; the four overlap the 756. Its GUI build was intentionally superseded by the repair union; matching combined33e native Unicode evidence is recorded above, without reattributing that result to cb91525. [Correction and limits](release-grapheme-shortening-ytr83r-20260911.md), [closed Windows evidence](experiments/grapheme-windows-cb91525-20260911/README.md).

-## Completed work and evidence
+The isolated `a57c334` union selectively combines peer `a31b40d` canvas/chooser/form prerequisites with B4 lifetime rendering and contextual source/child-work corrections. Windows lifecycle **27**, full desktop **752**, strict desktop Clippy and Studio build passed on 529 unchanged frozen inputs. GUI `69DBB90F…` passed bounded staged source/consumer creation, Cancel, Save, Undo/Redo and reopen checks: 13 oracles and 45 screenshots at the default wide window only. [Canvas checkpoint](release-canvas-union-ytr83r-20260911.md), [staged archive](experiments/staged-source-native-a57c334-20260911/README.md), [independent review](release-staged-native-a57-independent-review-20260911.md). A fresh a57 camera session subsequently passed bounded OA 100%/125%/Fit and minimum 1100×700 client Fit66 checks, OA/SA pan and moved Create/Delete hit selection, exact passive Save equality and normal exit 0. The 18 images support bounded clipping without toolbar bleed; labels are small at 66%. [Camera archive and limits](experiments/canvas-camera-a57c334-20260912/README.md), [verbatim independent review](release-camera-a57-independent-review-20260912.md). The [earlier picker failure](experiments/canvas-native-close-a57c334-20260911/README.md) remains historical evidence. These pre-grapheme a57 results do not establish current `33e30c1` native or complete usability acceptance.

-| Scope | Current evidence and limits |
-| --- | --- |
-| Reproducible local toolchain | Ignored `.local/toolchain/env.ps1` selects Rust/Cargo 1.98.1 GNU/LLVM and verified LLVM-MinGW 20260908 (clang 23.1.1), with one Cargo job. First cold desktop test build completed in 58m03s; one unused import warning was corrected separately. |
-| B1 process authoring | `01bb52a` includes interactive empty/ordered/explicit topology and presentation-only inferred paths; first conversion preserves ordered adjacency atomically. All topology regressions pass within the current full desktop suite. Native acceptance is pending. |
-| B2 scenario authoring | Clicked root/operand/slot and optional lifeline feed Action/State/Reuse/Fragment adapters. Pointer-to-App, cancellation, stale-event, recovery and history tests pass within the current full desktop suite. |
-| B3 caller navigation and workspace | External `3978bbe` imported as `865cd55` fixes visible-owner restoration, pending-draft guards and remaining-height workspace. Root `80cf197` keys the viewport Sensor by document/scenario; a real mounted regression failed before the fix and now passes. Current full desktop suite is green; native acceptance remains pending. |
-| Architecture palette | External palette commit `7d1df4f` was cherry-picked as `aed40d7`, retaining local invariant tests. Captured Escape, stale Submit/raw retention and bounded card fixes are source-integrated. External native results do not transfer to this checkout. |
-| Typed stored-history F1 | `b6b76ef` fixes nullable constructor cache discrimination; `4ecad78` fixes NotApplicable seeding by checking actual enum alternatives. Thirteen focused tests passed and are included in the current full suite; core validation remains authoritative. |
-| Lifeline lifecycle B4 | `eb5161b` adds pure local/scope-aware lifecycle projection with ten tests, declared under `cfg(test)` only. It is not production Scene wiring or native acceptance. [Design](release-scenario-lifecycle-design-20260910.md). |
-| Native scenario oracle | [Independent checker](scenario-authoring-contract.rs) compiled/self-checked and verified the generated62-element/two-source baseline. Native OA root Action and exact Save/Undo/Redo pass at minimum size; native caller identity/scroll return and source-neutral navigation pass. Remaining prescribed checkpoints are open. [Native scope](release-scenario-native-20260911.md), [oracle inputs](fixtures/scenario-authoring/README.md). |
-| Normative documentation | Strict Docutils 0.22.2 language HTML regeneration passed. `semantic_schema.py --check --validate` passed 72 source7 fixtures, 204 schemas, 14 families/90 scalar leaves. These are documentation/schema gates, not a Rust build or runtime pass. |
-| Comparable-product study | Actual isolated Capella 7.1 scenario/activity/lifeline/LOOP creation was saved and XML inspected, then closed normally. [Report](release-capella-scenario-benchmark-20260910.md). Current Studio native evidence is recorded separately. |
-| New requirement audit | [Independent delta report](release-requirements-delta-20260910.md) establishes that current expressions/unit labels are descriptive and source includes are not maintained cross-project libraries. Separate foundational design proposals remain under investigation, not ratified or implemented. |
-| Packaging integration | External `b98f135` imported as `6d2b961`; all 25 checked-in exact notices match the manifest. `scripts/test-package-artifacts.py` passes 11/11 and `scripts/test-windows-notices.ps1` passes synthetic package/runtime/source/font checks. Actual optimized distributions and clean-environment launches remain open. |
+Earlier published checkpoint `3ade397008cffe826d5f5a70e7c0233159e3bd42` contains production `29084050a7c020e0fb488be37c6e1ab235769cc0`; push and exact remote readback passed. It combines prior named behavior creation/history integration (`c81e285`, `e207b04`), corrected creation-oracle evidence (`b853a1e`), CLI-only integration (`023e3a8`) and B4 lifecycle rendering.

-## Active work, ownership and unresolved findings
+B4 renders local lifetimes, branch-local activation termination, neutral incomplete lanes, Create capsules and Delete markers with original occurrence identity. Real Windows OA/SA six-case matrices and separate name-only Save/Undo/Redo/reopen workflows passed complete independent Project, reachable-source and physical-file comparisons. These are bounded fixture checks, not complete product usability acceptance.

-Root Codex-956atf owns this host's integration, serialized Cargo and native UI.
-The integrated command `cargo test --locked -p oa-desktop --bin arcadia-studio -- --test-threads=1`
-completed with exit 0: **642 passed, zero failed/ignored**, tests 141.25 seconds,
-warning-free build 36.31 seconds. Log `.local/logs/desktop-integrated-20260911.log`.
-Implementation inputs match `80cf197`. The executable is
-`target/debug/deps/arcadia_studio-58e30cee1fd51a8b.exe`, SHA256
-`DF122CAF7CFB63A3A9D0D2F2098944CF88F53C4ADA2C43B576B2836F6FD42BE8`.
-The GUI build passed in3m28s; executable SHA256
-`A5ED6DF334B1BFB620425AFDF3E863F0B522990E6FB47C6C401A71CF4443954A`.
-Studio is running from immutable `.local/native-qa/studio-80cf197/`. Actual caller
-identity/scroll return, source-neutral navigation and minimum-size OA root Action
-creation with exact Save/Undo/Redo comparisons pass. [Native evidence and remaining
-gates](release-scenario-native-20260911.md). Formatting passed. Strict Clippy found
-two collapsible-if cases; root corrected them. The isolated chooser is now declared
-under cfg(test). Its warning-free first compile completed;9/12 focused tests pass.
-Three failures trace to test inputs that sent whole strings as single physical key
-events; the worker is correcting realistic typing and adding paste/IME coverage.
-No production chooser integration or current passing whole-suite claim follows.
+- [Native lifecycle observations and limits](release-lifecycle-native-ytr83r-20260911.md).
+- [OA evidence archive](lifecycle-native-ui-oa-archive-20260911.md) and [SA evidence archive](lifecycle-native-ui-sa-archive-20260911.md).
+- [Lifecycle implementation and independent findings](release-lifecycle-render-ytr83r-20260911.md).
+- [Creation and source integration evidence](release-staged-source-integration-ytr83r-20260911.md).

-Historical first-binary runs with `--test-threads=1` passed history 13/13, pure lifecycle
-10/10, topology 45/45, architecture authoring 18/18 and mounted scroll 5/5. Scenario
-direct tests passed 13/14 and reproduced the known caller-return assertion failure
-at `scenario.rs:2473`; do not count that filter as passing. Logs are
-`.local/logs/history-fields-focused.log` and `.local/logs/focused-*.log`. The current
-642/642 suite supersedes that known failure after its correction; do not add filter
-counts to the full total. Gitea #97's exact integration bundle was anonymously fetched,
-decoded, SHA256-verified and admitted with `git bundle verify`; selected source and
-packaging commits are integrated. Source the local toolchain before commands and keep
-one Cargo writer. The independent checker used completed rlibs without another
-Cargo writer; its evidence is separately scoped above.
+Source `321897fd55af9e07afa2c6ebf1e50be49e86f7d9` integrates the published contextual source-creation/minimum-card corrections from b2c3e540 with B4 and the header clipping correction. Its own Windows desktop all-targets gate passed 704 tests. [Exact selective integration, independent union review and Windows results](release-contextual-integration-update-ytr83r-20260911.md).

-Codex-9e8r6t is a separate host/team with a warm cache. It owns scenario workspace
-layout/B3 correction, local named behavior creation, palette and platform/packaging.
-Its coherent workspace and packaging checkpoint is imported. New local named
-behavior creation passed its 20 focused tests (#115), with broader checks/review
-and a verified transfer still pending. Its current native basic-editing checkpoint
-passed its independent model/four-source oracle; that is external evidence, not
-this host's acceptance. It owns docs/language.rst source7/default corrections,
-examples/release1 README schema correction and local-creation README guidance (#116).
+Published production `865483b4c66361a01fe0d9e731859220bafb4136` adds the reviewed child-work correction: first refinement transfers existing Allocation and RoleAssignment identities, metadata and artifact references to the child; later siblings inherit only a unique performer. OA/SA regressions cover nested children, roles, folded grouping, unallocated/mixed controls and exact history. The old extracted Studio `BF9C2E61…` passed OA first-child, sibling and grandchild Save/Undo/Redo checks, then confirmed OA reopen/Save and the SA first/sibling/grandchild, Undo/Redo and reopen/Save continuation. Original identity carriers and complete source/physical snapshots matched. These are native results for **865483b/BF9**, not a57/69DB. [Original OA evidence](experiments/native-child-oa-865483b-20260911/README.md), [closed continuation](experiments/native-child-continuation-865483b-20260911/README.md), [independent continuation review](release-native-child-continuation-review-20260911.md), [fixture/oracle](fixtures/child-work-native/README.md) and [issue4](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/4) preserve the exact scope.

-B3 diagnosis (#79): command execution may preselect an occurrence while another
-scenario remains visible; `select(same_id)` then returns without restoring the
-caller owner. The imported correction now establishes owner and selection together.
-Root's additional Sensor regression proves same-size owner/document changes must
-remeasure Fit; see `.local/logs/scenario-sensor-before-fix.log` for the red result.
-Exact source/history and mounted viewport checks pass in the integrated suite.
+## Verification scope

-Analysis/quantity and library proposals plus paired independent criticism are ready
-for synthesis. Remaining material questions: text-only instance base/map creation,
-cosmetic package updates versus quantity/type compatibility, subjectless case export
-closure, mounted data OA/SA transition policy, repeated case assumptions and closure
-of anonymous dimension operations. No production contract is ratified. Isolated
-text-only source experiments, baseline-versus-complete-case experiments and an
-undeclared anchored reference chooser widget are active; their passing claims must
-remain separate from the 642-test implementation. Root owns their integration.
+On this Windows host, core all-targets passed433 tests with one intentionally ignored scaling probe; that probe separately passed with unoptimized timings. Production29084050 passed focused lifecycle22 and full desktop675 tests (the22 are included in675), and the ordinary GUI build/launch. An equivalent test-helper let-chain correction subsequently passed strict workspace/all-targets Clippy and its focused regression1/1. These results predate the newly identified header-rendering correction.

-B4 independent Scene review (#114) identifies real integration boundaries: insertion
-sequence bounds are not lifetime extents; activation tails must not continue past
-branch-local Delete; incomplete represented=None lifelines still need geometry;
-self Create/Delete arrives at row+24. The pure projection has not yet been wired.
+- [Exact current-host logs and inputs](experiments/lifecycle-native-ytr83r-20260911/).
+- [Test-only Clippy correction](lifecycle-clippy-correction-ytr83r-20260911.md).
+- [Current-host toolchain setup](release-host-bootstrap-ytr83r-20260911.md).
+- [Independent Windows gap review](release-windows-gap-review-ytr83r-20260911.md).

-Both hosts report direct Git push authentication unavailable. Anonymous fetch and
-authenticated Gitea MCP remain usable. Exact verified bundles are exchanged on
-`codex/behavior-transfer-20260910`; do not merge that transfer branch. Existing
-bundles cover `01bb52a`, `b6b76ef`, `eb5161b` and incremental `4ecad78`; exact hashes,
-prerequisites and readback are preserved in the [archived ledger](history/2026-09-10-ledgers-before-continuation-refresh/STATE.md)
-and Gitea #65/#76. Latest verified outgoing transfer is `harness/transfers/behavior-aa40345.bundle.b64` on that branch (Gitea #92): 24,926 decoded bytes, prerequisite `4ecad78`, SHA256 `21B36D5016600953D95F064AE56569B6C8E7D3EA2B3B316C97222AD122FECA4F`. Later native oracle, proposals, ledgers and Sensor correction still need publication. Root owns subsequent transfer and integration.
+The closed 321897f Windows gate passed 704 desktop tests with zero failed/ignored/filtered; all 261 recorded build inputs remained unchanged. Matching server `ABA87A5F…` passed semantic HTTP checks (204 schemas, 19 values, 9 rejected invalid shapes) and the corrected REST probe's 25 requests. [Closed runtime evidence](experiments/windows-runtime-321897f-20260911/README.md) preserves both earlier source-version failures. [Earlier integration checkpoint evidence](experiments/contextual-lifecycle-integration-ytr83r-20260911/README.md) preserves server/CLI 68 across 7 targets, schema 72/204 after the missing-jsonschema correction, and the old GUI's wide-name passive Save comparison.

-## Remaining gates and highest-value next actions
+The later 865483b Windows desktop gate passed **707 tests**, including the three focused child-work regressions, with zero failed/ignored/filtered. All 261 recorded build inputs stayed unchanged. The matching debug GUI build and strict **desktop-only** all-targets Clippy passed; child-work and staged-source checker compilation/admission also passed. [Closed gates and exact inputs](experiments/windows-gates-865483b-20260911/README.md). These checks do not establish the remaining native rendering or packaged acceptance.

-1. Finish the active GUI build and current format/strict Clippy gates. The full
-   desktop suite has passed; repeat only for new source changes or unresolved risk.
-   Record exact implementation/binary and run the real application.
-2. Integrate the externally verified workspace/B3/local creation/palette/package
-   checkpoints without overwriting ownership or treating their earlier tests as new
-   local acceptance. Wire B4 only after coordinating actual Scene geometry.
-3. Use the self-checked independent oracle to exercise current Studio at
-   minimum/wide sizes: named creation, direct process/scenario edits, nested reuse,
-   caller return, lifeline lifecycle, invalid/cancel/recovery, Save/Undo/Redo/reopen.
-   Compare complete model/source and exact identities, not screenshots alone.
-4. Resolve analysis/quantity/library alternatives against real engineering budgets,
-   unit/kind failures and two-project reuse/update examples. Then implement precise
-   shared-core/source/API/graphical contracts and large-model selection workflows.
-5. Complete current teaching, transitions, semantic review, state/data, saved-view,
-   artifact, hosted transport and migration acceptance. Historical scoped passes
-   remain useful references, never blanket current acceptance.
-6. Complete Windows/Linux build/test/native/runtime and optimized package gates,
-   notices, provenance and clean-environment launch. WSL has no installed distro
-   here; Linux acceptance remains open. Historical denied guest workarounds must
-   not be retried or split to bypass review. No host restart is authorized.
-7. Run fresh independent cross-disciplinary end-state review, resolve material
-   findings and reconcile specification/help/coverage before final handoff.
+The extracted package's unchanged server `ABA87A5F…` passed the actual HTTP schema checks (204/19/9) and 25-request REST editing/persistence/restart probe with a restricted process PATH and unrelated working directory. Seven raw response pairs and exact source snapshots matched; all five test-owned server processes stopped. The first REST run's PowerShell-added PATH directory is preserved as historical evidence; the corrected restricted-PATH rerun is authoritative. [Packaged server evidence](experiments/packaged-server-865483b-20260911/README.md). This completed the earlier bounded server runtime acceptance. Fresh33e package/server/GUI results are linked above; the old receipts retain their own source attribution.

-## Reassessment
+## Material limitations

-Meaningful progress continues: concrete interaction defects have been found and
-corrected, all 642 desktop tests pass, exact native evaluation is prepared,
-and the revised semantic requirements are no longer hidden behind metadata.
-Passing older suites or accumulating prose would not close the user problem.
-Current highest information gain comes from actual build/native results and
-independently criticized foundational examples, while preserving existing identity,
-source and atomicity contracts. Replan when those results falsify a proposal.
+Earlier native wide Latin/CJK checks found neutral lifeline header text overflowing its card while Create labels stayed contained. The [header correction](lifecycle-header-overflow-correction-ytr83r-20260911.md) is included in 865483b and retained in a57. Actual corrected wide-W/CJK observations in BF9 show bounded headers and Create labels, including selected zoom, scroll and minimum-window cases. Both complete wide and cluster sources remained unchanged after passive Save. Cluster checks exposed a separate scalar-shortening defect: an accent or joined emoji can be split at the label cutoff. The later cb91525 correction and current33e accent/ZWJ selection/passive-save checks resolve the observed string-splitting case. Long wide labels can still be hard-clipped and arbitrary font/DPI presentation is unverified; see the historical [native typography record](experiments/lifecycle-header-correction-native-865483b-20260911/README.md).

-## Historical evidence access
+The earlier capture failures and pending Open dialog are historical: later confirmed OA and SA reopen/Save actions are preserved in the [continuation archive](experiments/native-child-continuation-865483b-20260911/README.md). Its first OA `reopened-1948` receipts remain data-only evidence. Bounded a57 staged and camera workflows above are complete; full focus/keyboard, every clipping edge/zoom and accessibility remain unverified. Bounded combined `33e30c1` native/package acceptance is now linked above. Small 66% labels are a recorded limitation. The BF9 Home page, scenario guide and bundled water-pressure example opened; one normal Alt+F4 then completed, with the process absent and empty stdout/stderr. The [old Home/Guide/close archive](experiments/packaged-gui-close-865483b-20260911/README.md) preserves those old865/BF9 observations and package readback. No exit code was captured for that older BF9 process; the separate a57 exit 0 does not change its evidence.

-The [complete prior STATE](history/2026-09-10-ledgers-before-continuation-refresh/STATE.md)
-retains exact historical binary hashes, counts, logs, process closure, bundle hashes
-and all report links. Links inside the byte-preserved archive retain their original
-`harness/` context; resolve those relative report paths from `harness/`.
-Useful direct entries: [source7 native](release-source7-native-acceptance-20260907.md),
-[teaching](release-teaching-native-20260906.md),
-[artifact native](release-artifacts-native-20260906.md),
-[coverage baseline](release-current-coverage-20260906.md),
-[Linux gate](release-source7-linux-gate-20260907.md),
-[Linux cross-build](release-source7-linux-gui-cross-build-20260907.md),
-[denied boot experiment](release-source7-linux-server-corrected-gate-20260907.md).
+The selected chooser/canvas union now has a57 source and Windows gate evidence; broader persistent graphical manipulation and separate text-navigation contributions retain their own integration/acceptance boundaries. Calculations, quantities/units, maintained libraries, practical large-model textual workflows, complete OA↔SA engineering parity, documentation and fresh cross-disciplinary review remain full-goal requirements. See the [analysis proposal](release-analysis-semantics-design-20260910.md), [library proposal](release-libraries-semantics-design-20260910.md), [text-authoring design](release-textual-authoring-design-20260911.md) and [decisions](DECISIONS.md) for attributed design evidence, not completed implementation claims.
+
+## Platform and published deliverables
+
+**Linux setup, downloads, builds and checks are paused by explicit user instruction until the user reports networking resolved and instructs resumption.** Ubuntu26.04/WSL2 shell execution was observed; guest networking remained unavailable. Offline preparation was a workaround, not a network fix or Linux acceptance. Host VPN settings were not inspected or changed. [WSL evidence](release-wsl-postboot-ytr83r-20260911.md) and [preserved offline inputs](release-linux-offline-preparation-ytr83r-20260911.md) retain exact outcomes.
+
+Peer Codex-9e8r6t published the separately verified [Windows contextual prerelease](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/releases/tag/v0.2.0-preview.contextual.20260911), source `b2c3e540`; [its publication handoff](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/2#issuecomment-406) binds its artifacts and original-host checks. It is not a B4 release from this branch.
+
+## Record navigation
+
+The [one-time record migration](history/2026-09-11-ytr83r-record-migration/README.md) preserves the exact prior STATE ledger and marks PLAN/TASK_LEDGER superseded. [Earlier integration history](history/2026-09-11-ytr83r-integration/README.md) preserves source-attributed older results. Historical leases, failed approaches and next-step wording do not override current Gitea coordination or the Linux pause.
@@ -1,199 +1,145 @@
+> Superseded on 2026-09-11. This document is a preserved historical checkpoint.
+> Live plans, priorities, ownership and handoffs now reside in [Gitea issue 1](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/1#issuecomment-410) and [issue 2](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/2).
+> Do not resume synchronizing this ledger. See [STATE.md](STATE.md) for the integrated checkpoint.
+
 # Task Ledger — first release

-Updated 2026-09-11. [STATE.md](STATE.md) owns current execution/evidence;
-[PLAN.md](PLAN.md) owns capability milestones. The entire former Task Ledger is
-[preserved byte-for-byte](history/2026-09-10-ledgers-before-continuation-refresh/TASK_LEDGER.md).
-Its old goal references, aggregate test claims and stopped-session directives retain
-historical scope. New semantic decisions are recorded explicitly in DECISIONS.md;
-prototype results retain their separate scope.
+Updated 2026-09-11 for Codex-ytr83r. The full
+[user goal](../PROJECT_GOAL.md) and [current progress](STATE.md) remain authoritative.
+[Exact host ledger archives](history/2026-09-11-ytr83r-integration/README.md)
+preserve prior facts, dates and reasoning without transferring their acceptance.

-## Goal and success criteria
+## Goal and given requirements

-Deliver the usable, feature-complete OA/SA first release specified in
-[PROJECT_GOAL.md](../PROJECT_GOAL.md). It is the exact copy of the user's revised
-`a49d1780-25d5-4778-ad68-6140c60e4207/goal-objective.md`, SHA256
-`DD58F75C93D55FE16ED141A23D834898FB6EBC625AE7E7AE379DA552A8312435`.
+Deliver a complete, usable OA/SA release on Windows and Linux, with one explicit
+reST semantic contract and equivalent graphical, textual and REST access. Include
+constraints/calculations, quantities/units, maintained libraries, behavior/state,
+traceability and navigable offline help. Reduce cognitive load and visual clutter;
+small and large models must be practical using text alone. Later Arcadia layers
+remain future scope. Compilation or a pleasant happy path is not completion.
+Issue2 further requires consistent direct process/scenario canvas interaction;
+the owner's clarification allows domain constraints rather than arbitrary movement.

-Success requires coherent explicit semantics, practical engineering workflows,
-equivalent graphical/textual/REST behavior, real Windows/Linux runtime evidence,
-recoverable authoring, relevant automated evaluators, precise documentation,
-reproducible packages and fresh independent cross-disciplinary end-state review.
-No known blocker or high-impact finding may remain unresolved. Later Arcadia
-layers remain future scope. Code, a passing slice or an attractive screen alone
-cannot establish completion.
-
-## Given facts
-
- Rust/Iced desktop and a deployable REST service serve system engineers. OA/SA
-  transitions in both directions must be understandable, explicit and useful.
- The revised goal explicitly requires constraints/calculations, quantities/units,
-  reusable model libraries, state/behavior modeling and strong standardized
-  specification/API, as well as textual/graphical notation and artifact traceability.
- Human/AI/Git-friendly source and a concrete unambiguous reST specification must
-  match graphical editing. The source editor needs highlighting/linting; help must
-  be offline, concise and navigable.
- The newest explicit goal requires uncluttered notation that reduces cognitive
-  load and supports development of complete small and large models using text alone.
- Direct behavior/scenario diagram authoring and reduced cognitive load are current
-  priorities. Long homogeneous selectors and bloated persistent creation controls
-  are rejected. Study actual Capella's useful domain workflows and nesting without
-  mechanically copying its interaction problems.
- The user authorizes autonomous bounded engineering, native Capella/Studio
-  evaluation and explicit independent delegation, exclusively with GPT-6 Astra
-  at effort appropriate to the question. Root owns synthesis/integration.
- Project instructions require Gitea coordination, ownership preservation and
-  durable handoffs. Current root reserves one Cargo/native operator per host.
-  Do not infer restart, usage reset or credential disclosure authorization.
+At15:28UTC on2026-09-11, the user explicitly deferred Linux builds and checking
+until they resolve WSL2 networking and instruct resumption. Linux setup/downloads
+are paused with inputs preserved. Continue independent Windows work; do not treat
+offline preparation as a networking fix or Linux acceptance.

 ## Verified facts

- The independent scenario checker compiled with warnings denied and passed its
-  self-check, deterministic fixture generation and complete baseline check on this
-  host. Its eight OA/SA checkpoints and exact UUID/source restoration comparisons
-  are evaluator evidence, not native Studio acceptance. Exact inputs/hashes are in
-  [the fixture instructions](fixtures/scenario-authoring/README.md).
+- Local start was cleanff615d0. Root decoded/hash-verified/imported published3978,
+  c6 and4bb bundles; merged c6 as c81e285 and integrated creation4bb at e207b04. There were
+  no production cherry-pick conflicts; docs/attributes require evidence union.
+  The current goal is copied from the user's latest file.
+- Read-only integration comparison finds equivalent workspace/Sensor code in c6;
+  replaying3978 or d114 is unnecessary. Core source is unchanged betweenff andc6.
+  B4 now has a production Scene bridge and independently reviewed source, with
+  focused lifecycle22/22 and full desktop675/675 passed on source2908405. The
+  ordinary GUI build and real OA/SA lifecycle matrices now ran; OA full name-only
+  Save/Undo/Redo/reopen and the corresponding SA workflow passed exact independent
+  comparisons. Corrected workspace/all-targets strict Clippy also passed0;
+  Unicode appearance remains open. See the
+  [native record](release-lifecycle-native-ytr83r-20260911.md) for exact scope.
+- Imported source implements named behavior creation, exact prepared-batch
+  correlation, success-only selection, raw-draft guards, recoverable original
+  layer and modal-priority Escape. These are source facts; combined local runtime
+  acceptance is pending.
+- Earlier-host desktop642 and653 suites, scoped native scenarios/creation,
+  packaging25 notices and source experiments retain exact attribution in
+  [STATE.md](STATE.md). They are not new local passes.
+- The original transferred creation oracle incorrectly equates physical disk files
+  with reachable sources during Undo. Later external v2 corrects the evaluator
+  with explicit origin/retained-byte rules; exact v2/evidence2ec was imported at
+  b853a1e after complete path/hash preflight. New host execution is still pending.
+- Isolated Rust1.98.1/LLVM23.1.1 and locked dependencies are available. Packaging
+  11/11 and synthetic Windows notice checks pass. Current core all-targets passed
+  433 tests; its optional inheritance probe separately passed with slow debug
+  timings that require controlled optimized interpretation. Focused lifecycle
+  passed22/22 after two installed-Iced API corrections; full desktop passed675/675.
+  Strict reST/HTML generation passes with Docutils0.22.2.
+- B4 independent criticism found and resolved self-caption overlap and two dense
+  minimum-Fit hit-selection counterexamples. Shared nearest marker/message-stroke
+  arbitration preserves exact marker/header/label selection. Ten real-Scene tests
+  and two clip geometry tests passed in the22-test focused gate. The independent twelve-scenario native oracle passed compile,
+  admission, self-check and exact baseline/name-only predictions before GUI output.
+- The separate baseline-context experiment passed218 assertions; explicit
+  one-level overrides reduce repeated stable assumptions while complete frozen
+  definition environments remain necessary. Proposed syntax is not source7.
+- After the user's virtualization/reboot change, supported Ubuntu26.04 install
+  completed exit0 and a real x86_64 WSL2 kernel shell completed. Later VM startups
+  timed out before apt. Owner328's exact VirtioProxy configuration now supports
+  a persistent root shell, but requested IP/DNS/HTTPS checks failed. Signed offline
+  dependency preparation advances without host VPN inspection or changes. This
+  establishes guest execution, not Linux builds or GUI acceptance; exact outcomes are
+  in the [WSL record](release-wsl-postboot-ytr83r-20260911.md).

- Current local implementation is `80cf197` on `codex/behavior-authoring-20260910`, following
-  baseline `1797516`. Local commits cover B1/B2/B3 authoring, nullable history cache
-  (`b6b76ef`), external palette integration (`aed40d7`), cfg(test) lifecycle projection
-  (`eb5161b`), history seed correction (`4ecad78`) and exact-identity native oracle.
-  Later imports add focus recovery, exact packaging notices and scenario workspace/
-  owner restoration. Root80cf197 fixes document/scenario viewport Sensor identity
-  with a real mounted red-before/green-after regression.
- This fresh host has task-local Rust/Cargo 1.98.1 GNU/LLVM and verified LLVM-MinGW.
-  The integrated full desktop suite passes642/642, zero failed/ignored, with a
-  warning-free build. History and pure lifecycle tests are included. Current GUI
-  build/native and strict lint remain open. [Exact hashes/logs](STATE.md).
- Strict language HTML regeneration and the source7 OpenAPI checker passed locally:
-  72 fixtures, 204 schemas and 90 scalar leaves. Actual isolated Capella scenario,
-  activity/lifeline and LOOP creation was saved/inspected; this is reference study,
-  not Studio acceptance. [Native benchmark](release-capella-scenario-benchmark-20260910.md).
- Core/source7 already implements substantial direct behavior, typed data/ports,
-  contextual chain links, maintained message-operation identity, semantic reviews,
-  artifacts, hosted source envelopes and recovery. Historical absence claims must
-  be checked against code and newer scoped evidence, not copied forward.
- [Requirements audit](release-requirements-delta-20260910.md): Constraint and other
-  expression strings are descriptive, with no calculation/binding/result evaluator;
-  unit strings persist/inherit without dimensional compatibility or conversion;
-  named types/sequence/scenario reuse and includes exist, but there is no maintained
-  cross-project package/version/instance/update contract. These are explicit gaps.
- The same audit identifies concrete unbounded Constraint target choices and generic
-  expanded collection editors. Explorer already has hierarchy/search/paging; the
-  problem is targeted, not a claim that all selection is flat.
- Gitea #79's same-selected-ID/visible-owner defect is fixed in the imported
-  scenario checkpoint; owner restoration and pending-draft guards pass current
-  tests. B4 independent review #114 adds Scene integration requirements for actual
-  lifetime extents, branch-local activation clipping, incomplete lanes and self arrows.
- Codex-9e8r6t is a separate host with independent Cargo/native leases. It owns
-  scenario workspace/B3/local behavior creation, palette and platform/packaging;
-  coherent workspace/package integration is imported, while newer named behavior
-  creation and docs changes await transfer. Both hosts report direct push auth
-  unavailable. MCP/anonymous fetch and verified bundle exchange remain usable.
- Current Linux acceptance is open; this host has no installed WSL distribution.
-  Historical Linux core/server/cross-build results have exact older snapshot scope.
-  The earlier denied guest workaround did not run and must not be bypassed.
+## Assumptions and unresolved questions

-## Assumptions
+- Combining already coherent desktop slices should preserve behavior; fresh build,
+  automated and native gates must test that assumption.
+- The baseline/library designs can fit existing atomic Project/Command/source
+  boundaries; exact references, deletion, transition, imports, freezing and
+  numeric rules still need ratified contracts and falsification.
+- Pinned package provenance must be distinguished from checked type compatibility;
+  unchanged quantity kinds cannot become incompatible merely through cosmetic
+  repackaging without a deliberate policy. Energy and Torque remain distinct.
+- Ubuntu26.04/WSL2 is the current supported Linux route; reliable repeat startup,
+  guest toolchain/dependencies and GUI/service/package execution remain open.
+  Initial shell success does not erase later startup timeouts. Old QEMU work is
+  retained as history, not the next route to repeat.
+- Large-model human/AI task usability, cross-file refactoring, actual chooser
+  latency/keyboard/minimum geometry and complete native lifecycle behavior remain
+  to be measured. Parser admission or a widget experiment is insufficient.

- Compact contextual tools and an adequately sized scenario workspace can reduce
-  friction; only actual engineering tasks at minimum/wide sizes can validate this.
- A bounded pure analysis model and pinned reusable packages may satisfy the new
-  requirements without full language/runtime adoption. This is a candidate, not a
-  selected architecture or a permission to treat metadata as semantics.
- Existing shared core/source/history boundaries remain suitable for additions;
-  foundational examples and independent criticism must test that assumption.
+## Candidate designs and selected directions

-## Open questions
+The imported [analysis proposal](release-analysis-semantics-design-20260910.md),
+[library proposal](release-libraries-semantics-design-20260910.md),
+[paired critique](release-semantic-proposals-review-20260910.md) and
+[textual authoring design](release-textual-authoring-design-20260911.md) retain
+alternatives and counterexamples. Metadata-only analysis and bare source includes
+do not meet evaluated quantities or maintained libraries.

- What precise owned-value, calculation, constraint-result, quantity-kind, unit and
-  numerical contracts meet mass/power/latency and affine/dimensional edge cases?
- Which library definition/instance/pinning/binding/update design preserves stable
-  identities, local engineering edits and offline reproducibility across projects?
- What migration and OA↔SA treatment follows from those contracts without guessing
-  executable meaning from old strings or silently changing old models?
- How can text-only creation establish library instance bases/maps, preserve
-  compatibility across cosmetic package revisions, export subjectless cases, and
-  transition mounted OA/SA data without hidden GUI normalization or silent forks?
- Do explicit baseline values with one-level case overrides or complete per-case
-  bindings better support repeated study maintenance and reproducible evaluation?
- Which source-preserving refactoring/navigation and grammar changes reduce actual
-  engineering effort while retaining stable identity and cross-file ownership?
- Do current real gestures, exact caller return, nested scopes and lifecycle markers
-  remain usable and correct under minimum sizing, scrolling, zoom and dirty drafts?
- Which uncovered teaching, traceability, transition, saved-view, state/data, hosted
-  and platform cases remain after current-binary acceptance? What supported Linux
-  environment can complete the remaining actual runtime gate?
- Does "standardized" require any external conformance beyond the project's precise
-  interoperable spec/API? Full OMG conformance is not inferred merely from comparison
-  to SysML v2; explicit claims require a mapped and verified contract.
+Codex-956atf root selected property-owned baseline values/formulas with explicit
+ModelBaseline/Case evaluation and one-level case overrides for contract refinement.
+No hidden default case or UI-dependent evaluation; inherited formulas use the
+effective requested case, and complete freeze captures definitions/provenance.
+Exact numeric, library normalization/type compatibility and transition details
+remain open. This direction is recorded in [DECISIONS.md](DECISIONS.md), not silently
+treated as completed production semantics.

-## Candidate hypotheses / designs
+The external staged prerequisite design reserves source/consumer identities,
+keeps the parent context/rawtext/slot, stages locally and creates source+consumer
+in one atomic final command. It must not implicitly allocate work, involve
+capabilities, retarget an Exchange-fixed endpoint or accept a different editor.
+Qualified Action allocation remains a distinct engineering choice.

-The [requirements delta](release-requirements-delta-20260910.md) compares metadata/
-snippets, bounded pure engineering analysis with maintained pinned libraries,
-external evaluators, and full standards adoption. Metadata alone fails the explicit
-new semantics; external tools alone still need binding/result contracts. The report
-recommends the bounded route for root synthesis, not as a ratified decision.
+## Retained implementation decisions

-Independent maximum-reasoning tracks now compare owned engineering properties
-versus analysis contexts; calculation definitions/applications; numeric/unit rules;
-and copy, linked-definition, live-instance or pinned-definition/editable-instance
-library architectures. Require concrete falsifiers, source/API migration effects,
-identity/history/recovery behavior and independent critique before convergence.
-The completed analysis/library proposals and paired review remain unratified.
-An isolated executable text-only fixture admits without warnings and passes exact
-source/identity/rename/reparent/file-move/default checks. Separate baseline-versus-
-complete-case and anchored chooser experiments are active, with no production
-metamodel or selector integration implied.
-
-The subsequent context experiment passed218 assertions: shared property baselines
-and one-level overrides reduce repeated input maintenance while retaining explicit
-independent freeze. Root selected that B direction for precise contract refinement;
-quantity/library/source details remain open. [Decision](DECISIONS.md),
-[experiment and limits](release-analysis-context-experiment-20260911.md).
-
-## Decisions retained
-
- Keep three Rust crates and one authoritative typed Project with validated atomic
-  Commands. Separate semantic identity/ownership, allocation/reference/order and
-  diagram geometry. Forms are closed adapters, not a second metamodel. New persistent
-  semantics require core/source/UI/API/reference/transition parity. [Decisions](DECISIONS.md).
- Preserve authored source ownership/comments/includes, exact identity and accepted
-  model/source history. Source writeback must succeed before adoption. Raw invalid,
-  excluded or rejected drafts survive; navigation/tools must not implicitly accept
-  another editor. Recovery validates/replans rather than trusting serialized commands.
+- Keep one authoritative typed Project, validated atomic Commands, stable
+  identities and explicit references. Semantic ownership/allocation/order and
+  diagram geometry remain distinct; forms are adapters, not a second metamodel.
+- Preserve source ownership/comments/includes and exact model/source history.
+  Writeback succeeds before adoption. Invalid/rejected raw drafts survive and
+  browsing/tool selection does not silently accept another editor. Recovery
+  validates/replans rather than trusting serialized commands.
 - Semantic reconciliation uses finite typed facets, frozen baselines, explicit
-  mappings, actual destination slots and a single atomic candidate. Do not infer
-  identity by name or apply reviewed rows as sequential independent edits.
-  [Foundation](release-semantic-batch-foundation-design.md),
-  [artifact contract](release-semantic-artifacts.md).
- Layer transitions are explicit engineering decisions, not automatic propagation.
-  Behavior-root navigation must establish the requested owner while preserving
-  unrelated architecture presentation. Ports/allocation and contextual occurrences
-  retain their distinct domain meaning. [Source7 contract](release-source7-integration-decision-20260906.md).
- Hosted revision/source envelopes and ETag checks remain atomic; credentials stay
-  out of persisted models and repository. Linux journal publication retains the
-  selected no-replace invariant, with measured limits, not an overwrite fallback.
-  [Journal decision](release-linux-journal-publication.md).
- Repair/evaluate the compact palette informed by native Capella evidence; do not
-  return to the rejected horizontal toolbar. Lifecycle projection remains isolated
-  under cfg(test) until coordinated Scene integration and actual acceptance.
- Preserve historical scope decisions as history. In particular, architecture-only
-  SVG is implemented and behavior SVG was deferred; that is not proof of satisfying
-  the revised release objective. Reassess older exclusions against current scope.
+  mappings and one atomic candidate. Names alone never establish identity.
+- OA↔SA transitions are explicit engineering decisions. New persistent semantics
+  need validation/reference/deletion/transition/source/API/UI/history parity.
+- Exact evidence bytes and host attribution survive integration. No focused
+  test total is added to a full-suite count; old binary acceptance does not
+  transfer to newly merged code.

-## Current strategy
+## Current strategy and coordination

-Finish the GUI/native loop after the green full desktop suite while separate
-agents investigate uncertain foundations. Integrate only coherent, verified
-external checkpoints respecting ownership. Use independently constructed complete
-model/source oracles and exact snapshot comparison for identity/history. Ratify
-analysis/library contracts through alternatives and falsifying examples, then
-implement shared semantics and ergonomic authoring together. Close current
-cross-platform/service/package and independent end-state gates before handoff.
+Root owns local integration, serialized builds, native inputs and final synthesis.
+The local audit resolves evidence and reviews source; independent server review
+has its own report. Codex-9e8r6t owns staged sources/first actions and source CLI;
+Codex-956atf owns chooser, semantic contracts and the shared canvas design. Read Gitea issues #1/#2 and Wiki before
+resuming, obtain exact coherent transfer heads, and respect their source ownership.

-The [archived Task Ledger](history/2026-09-10-ledgers-before-continuation-refresh/TASK_LEDGER.md)
-and [archived STATE](history/2026-09-10-ledgers-before-continuation-refresh/STATE.md)
-preserve all older claims, decisions and evidence links exactly. Relative report
-links inside those byte-preserved files resolve from their original `harness/`
-context. Their historical test totals and process holds are not live status.
+First finish and verify the integrated current source using the imported corrected
+evaluator and newly prepared independent lifetime oracle. Then close remaining modeling/textual,
+analysis/library and platform gates with independent criticism and whole-task
+acceptance. Update facts, assumptions and decisions as evidence changes them.
@@ -0,0 +1,676 @@
+//! Independent native creation oracle; no desktop producer is imported.
+//! self-check BASE | check STAGE BASE ACTUAL ROLES | same EXPECTED ACTUAL [UNDO_FROM]
+use oa_core::{source_project::*, *};
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    fs,
+    path::Path,
+};
+
+const PROCESS: &str = "Coordinate rescue";
+const SCENARIO: &str = "Rescue coordination conversation";
+const MACHINE: &str = "Rescue team operating modes";
+const VIEW: &str = "Rescue team operating modes · states";
+const CAPABILITY: u128 = 0xb451c00000004000800000000000001f;
+const OWNER: u128 = 0xc062944912094b50afacf558a9a0fc7f;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
+enum Stage {
+    Baseline,
+    Process,
+    Scenario,
+    Machine,
+}
+impl Stage {
+    fn parse(value: &str) -> Self {
+        match value {
+            "baseline" => Self::Baseline,
+            "process" => Self::Process,
+            "scenario" => Self::Scenario,
+            "machine" => Self::Machine,
+            _ => panic!("Stage must be baseline, process, scenario or machine"),
+        }
+    }
+    fn additions(self) -> usize {
+        match self {
+            Self::Baseline => 0,
+            Self::Process => 1,
+            Self::Scenario => 2,
+            Self::Machine => 3,
+        }
+    }
+}
+
+type DiskSources = BTreeMap<String, Vec<u8>>;
+
+fn source_paths(root: &Path, here: &Path, paths: &mut DiskSources) {
+    for entry in fs::read_dir(here).unwrap() {
+        let entry = entry.unwrap();
+        let kind = entry.file_type().unwrap();
+        assert!(
+            !kind.is_symlink(),
+            "Native checkpoint must contain ordinary files"
+        );
+        if kind.is_dir() {
+            source_paths(root, &entry.path(), paths);
+        } else if entry.path().extension().is_some_and(|ext| ext == "arcadia") {
+            assert!(kind.is_file());
+            paths.insert(
+                entry
+                    .path()
+                    .strip_prefix(root)
+                    .unwrap()
+                    .to_str()
+                    .unwrap()
+                    .replace('\\', "/"),
+                fs::read(entry.path()).unwrap(),
+            );
+        }
+    }
+}
+fn load_checkpoint(entry: &Path) -> (CompiledSourceProject, DiskSources) {
+    let files = source_files::load_project(entry, ProjectLimits::default()).unwrap();
+    let raw = files.reachable_bundle();
+    let compiled = compile_bundle(&raw, ProjectLimits::default()).unwrap();
+    assert_eq!(
+        compiled.bundle, raw,
+        "No migration, normalization or implicit identity insertion"
+    );
+    execute_batch(&compiled.decoded.project, &[]).unwrap();
+    let mut disk = BTreeMap::new();
+    let root = entry.parent().unwrap();
+    source_paths(root, root, &mut disk);
+    (compiled, disk)
+}
+fn predicted_disk(reachable: &SourceBundle, undo_from: Option<&DiskSources>) -> DiskSources {
+    // Saving Undo writes the restored reachable files and deliberately keeps
+    // detached files from the previously saved checkpoint. Never infer their
+    // bytes from the actual Undo directory: its explicit origin is the oracle.
+    let mut expected = undo_from.cloned().unwrap_or_default();
+    expected.extend(
+        reachable
+            .files
+            .iter()
+            .map(|(path, source)| (path.clone(), source.as_bytes().to_vec())),
+    );
+    expected
+}
+fn load(entry: &Path) -> CompiledSourceProject {
+    let (compiled, disk) = load_checkpoint(entry);
+    assert_eq!(
+        disk,
+        predicted_disk(&compiled.bundle, None),
+        "Ordinary checkpoints must contain exactly their reachable source files; retained Undo files require an explicit origin"
+    );
+    compiled
+}
+fn fnv1a(bytes: &[u8]) -> u64 {
+    bytes.iter().fold(0xcbf29ce484222325, |hash, byte| {
+        (hash ^ u64::from(*byte)).wrapping_mul(0x100000001b3)
+    })
+}
+fn pinned_baseline(base: &CompiledSourceProject) -> bool {
+    // Fixed byte fingerprints of the root-preserved transition/reopen input,
+    // recorded before any creation. SHA-256 provenance is in the fixture README.
+    let pins = [
+        ("project.arcadia", 4844, 0x450c6ffd8225af32),
+        ("rationale.arcadia", 57, 0xf87e3c2e303f9b62),
+        ("traceability.arcadia", 395, 0xb47992dbdacab344),
+        ("oa/participants.arcadia", 403, 0x1e109eef81968b5f),
+        (
+            "oa/activities/activity_assess_incident.arcadia",
+            376,
+            0x0e67e533db3cff78,
+        ),
+        ("sa/participants.arcadia", 124, 0xcadb35025aea18cc),
+    ];
+    base.bundle.entry == "project.arcadia"
+        && base.bundle.files.len() == pins.len()
+        && pins.iter().all(|(path, length, hash)| {
+            base.bundle
+                .files
+                .get(*path)
+                .is_some_and(|text| text.len() == *length && fnv1a(text.as_bytes()) == *hash)
+        })
+}
+fn baseline(entry: &Path) -> CompiledSourceProject {
+    let base = load(entry);
+    assert!(
+        pinned_baseline(&base),
+        "The six-file baseline differs from the frozen pre-creation input"
+    );
+    let p = &base.decoded.project;
+    assert_eq!(
+        (
+            p.elements.len(),
+            p.relations.len(),
+            p.diagrams.len(),
+            p.traces.len()
+        ),
+        (10, 2, 4, 1)
+    );
+    let context = &p.elements[&Id::from_u128(CAPABILITY)];
+    assert_eq!(
+        (
+            context.name.as_str(),
+            context.kind(),
+            context.layer(),
+            context.parent
+        ),
+        ("Rescue capability", Kind::Capability, Layer::Oa, None)
+    );
+    let owner = &p.elements[&Id::from_u128(OWNER)];
+    assert_eq!(
+        (
+            owner.name.as_str(),
+            owner.kind(),
+            owner.layer(),
+            owner.parent
+        ),
+        ("Rescue team", Kind::SystemActor, Layer::Sa, None)
+    );
+    for name in [PROCESS, SCENARIO, MACHINE] {
+        assert!(
+            !p.elements.values().any(|e| e.name == name),
+            "Baseline already contains requested creation"
+        );
+    }
+    base
+}
+
+struct Roles<'a> {
+    actual: &'a Project,
+    baseline: &'a Project,
+    used: BTreeSet<Id>,
+}
+impl Roles<'_> {
+    fn fresh(&mut self, choices: Vec<Id>, role: &str) -> Id {
+        assert_eq!(
+            choices.len(),
+            1,
+            "Exactly one literal identity role required: {role}"
+        );
+        let id = choices[0];
+        assert_eq!(id.get_version_num(), 4, "{role} must be a fresh UUIDv4");
+        assert!(
+            !self.baseline.contains(id),
+            "{role} reuses a baseline identity"
+        );
+        assert!(self.used.insert(id), "{role} reuses another fresh role");
+        id
+    }
+    fn element(&mut self, kind: Kind, layer: Layer, name: &str) -> Id {
+        self.fresh(
+            self.actual
+                .elements
+                .values()
+                .filter(|e| e.kind() == kind && e.layer() == layer && e.name == name)
+                .map(|e| e.id)
+                .collect(),
+            name,
+        )
+    }
+    fn view(&mut self, machine: Id) -> Id {
+        self.fresh(
+            self.actual
+                .diagrams
+                .values()
+                .filter(|d| {
+                    d.layer == Layer::Sa
+                        && d.name == VIEW
+                        && d.projection == ProjectionKind::StateMachine { machine }
+                })
+                .map(|d| d.id)
+                .collect(),
+            VIEW,
+        )
+    }
+    fn node(&mut self, diagram: Id, machine: Id) -> Id {
+        self.fresh(
+            self.actual.diagrams[&diagram]
+                .nodes
+                .values()
+                .filter(|node| node.element == machine)
+                .map(|node| node.id)
+                .collect(),
+            "new machine's exact view placement",
+        )
+    }
+}
+fn element(p: &Project, id: Id, name: &str, parent: Option<Id>, body: ElementBody) -> Element {
+    Element {
+        id,
+        alias: p.fresh_alias(name, "behavior", id),
+        name: name.into(),
+        description: String::new(),
+        parent,
+        body,
+    }
+}
+fn advance(base: &mut CompiledSourceProject, commands: Vec<Command>) {
+    let project = execute_batch(&base.decoded.project, &[Command::Batch(commands)]).unwrap();
+    *base = update_bundle(base, &project, ProjectLimits::default()).unwrap();
+}
+fn predict(base: &CompiledSourceProject, stage: Stage, carrier: &Project) -> CompiledSourceProject {
+    let mut result = base.clone();
+    let mut roles = Roles {
+        actual: carrier,
+        baseline: &base.decoded.project,
+        used: BTreeSet::new(),
+    };
+    if stage >= Stage::Process {
+        let id = roles.element(Kind::Process, Layer::Oa, PROCESS);
+        let record = element(
+            &result.decoded.project,
+            id,
+            PROCESS,
+            None,
+            ElementBody::Oa(OaBody::Process { steps: vec![] }),
+        );
+        advance(&mut result, vec![Command::CreateElement(record)]);
+    }
+    if stage >= Stage::Scenario {
+        let id = roles.element(Kind::Scenario, Layer::Oa, SCENARIO);
+        let record = element(
+            &result.decoded.project,
+            id,
+            SCENARIO,
+            None,
+            ElementBody::shared_in(
+                Layer::Oa,
+                SharedBody::Scenario {
+                    viewpoint: ScenarioViewpoint::ParticipantInteraction,
+                    context: Some(Id::from_u128(CAPABILITY)),
+                    precondition: String::new(),
+                    postcondition: String::new(),
+                    steps: vec![],
+                },
+            ),
+        );
+        advance(&mut result, vec![Command::CreateElement(record)]);
+    }
+    if stage == Stage::Machine {
+        let machine = roles.element(Kind::StateMachine, Layer::Sa, MACHINE);
+        let diagram = roles.view(machine);
+        let placement = roles.node(diagram, machine);
+        let record = element(
+            &result.decoded.project,
+            machine,
+            MACHINE,
+            Some(Id::from_u128(OWNER)),
+            ElementBody::shared_in(Layer::Sa, SharedBody::StateMachine),
+        );
+        let p = execute_batch(
+            &result.decoded.project,
+            &[Command::CreateElement(record.clone())],
+        )
+        .unwrap();
+        // Published first-view contract, independently constructed: one root,
+        // default options, no routes/regions/states. Shared core Layout owns the
+        // final geometry; no observed geometry or desktop planner is consulted.
+        let view = Diagram {
+            id: diagram,
+            alias: p.fresh_alias(VIEW, "state_view", diagram),
+            name: VIEW.into(),
+            description: String::new(),
+            layer: Layer::Sa,
+            projection: ProjectionKind::StateMachine { machine },
+            routes: vec![],
+            view_options: Default::default(),
+            nodes: BTreeMap::from([(
+                placement,
+                NodePlacement {
+                    id: placement,
+                    alias: p.fresh_alias(&format!("{MACHINE} placement"), "placement", placement),
+                    element: machine,
+                    position: Position { x: 60., y: 60. },
+                    size: Size {
+                        width: 336.,
+                        height: 104.,
+                    },
+                    collapsed: false,
+                    port_anchors: vec![],
+                },
+            )]),
+        };
+        advance(
+            &mut result,
+            vec![
+                Command::CreateElement(record),
+                Command::CreateDiagram(view),
+                Command::Layout(diagram),
+            ],
+        );
+    }
+    let p = &result.decoded.project;
+    assert_eq!(
+        p.elements.len(),
+        base.decoded.project.elements.len() + stage.additions()
+    );
+    assert_eq!(
+        p.diagrams.len(),
+        base.decoded.project.diagrams.len() + usize::from(stage == Stage::Machine)
+    );
+    assert_eq!(p.relations, base.decoded.project.relations);
+    assert_eq!(p.traces, base.decoded.project.traces);
+    result
+}
+fn equal(left: &CompiledSourceProject, right: &CompiledSourceProject) -> bool {
+    left.decoded.project == right.decoded.project && left.bundle == right.bundle
+}
+fn assert_equal(expected: &CompiledSourceProject, actual: &CompiledSourceProject) {
+    assert_eq!(
+        actual.decoded.project, expected.decoded.project,
+        "Complete Project differs from independent prediction"
+    );
+    assert_eq!(
+        actual.bundle, expected.bundle,
+        "Complete SourceBundle differs, including comments and all included bytes"
+    );
+}
+fn test_id(n: u128) -> Id {
+    Id::from_u128(0xc4ea7100000040008000000000000000 + n)
+}
+fn false_carrier(base: &Project) -> Project {
+    let mut p = base.clone();
+    for (n, kind, layer, name) in [
+        (1, Kind::Process, Layer::Oa, PROCESS),
+        (2, Kind::Scenario, Layer::Oa, SCENARIO),
+        (3, Kind::StateMachine, Layer::Sa, MACHINE),
+    ] {
+        p.elements.insert(
+            test_id(n),
+            Element {
+                id: test_id(n),
+                alias: format!("false_alias_{n}"),
+                name: name.into(),
+                description: "Must never be copied".into(),
+                parent: None,
+                body: ElementBody::new(kind, layer).unwrap(),
+            },
+        );
+    }
+    p.diagrams.insert(
+        test_id(4),
+        Diagram {
+            id: test_id(4),
+            alias: "false_view_alias".into(),
+            name: VIEW.into(),
+            description: "False view description".into(),
+            layer: Layer::Sa,
+            projection: ProjectionKind::StateMachine {
+                machine: test_id(3),
+            },
+            routes: vec![],
+            view_options: Default::default(),
+            nodes: BTreeMap::from([(
+                test_id(5),
+                NodePlacement {
+                    id: test_id(5),
+                    alias: "false_node_alias".into(),
+                    element: test_id(3),
+                    position: Position {
+                        x: 9999.,
+                        y: -9999.,
+                    },
+                    size: Size {
+                        width: 1.,
+                        height: 1.,
+                    },
+                    collapsed: true,
+                    port_anchors: vec![],
+                },
+            )]),
+        },
+    );
+    p
+}
+fn self_check(base: &CompiledSourceProject) {
+    let original = base.clone();
+    let carrier = false_carrier(&base.decoded.project);
+    assert_equal(base, &predict(base, Stage::Baseline, &carrier));
+    for stage in [Stage::Process, Stage::Scenario, Stage::Machine] {
+        let expected = predict(base, stage, &carrier);
+        assert_equal(&expected, &predict(base, stage, &expected.decoded.project));
+        let parsed = compile_bundle(&expected.bundle, ProjectLimits::default()).unwrap();
+        assert_equal(&expected, &parsed);
+        let mut altered = expected.clone();
+        altered
+            .decoded
+            .project
+            .elements
+            .get_mut(&test_id(1))
+            .unwrap()
+            .description = "Unrequested metadata".into();
+        assert!(!equal(&expected, &altered));
+        let mut altered = expected.clone();
+        altered
+            .decoded
+            .project
+            .elements
+            .get_mut(&Id::from_u128(CAPABILITY))
+            .unwrap()
+            .name = "Changed unrelated baseline".into();
+        assert!(!equal(&expected, &altered));
+        let mut changed_source = expected.bundle.clone();
+        changed_source
+            .files
+            .get_mut("rationale.arcadia")
+            .unwrap()
+            .push_str("// Extra comment\n");
+        let altered = compile_bundle(&changed_source, ProjectLimits::default()).unwrap();
+        assert_eq!(altered.decoded.project, expected.decoded.project);
+        assert!(
+            !equal(&expected, &altered),
+            "Identical semantics do not excuse changed source bytes"
+        );
+        if stage >= Stage::Scenario {
+            let mut altered = expected.clone();
+            *altered
+                .decoded
+                .project
+                .elements
+                .get_mut(&test_id(2))
+                .unwrap()
+                .shared_mut()
+                .unwrap() = SharedBody::Scenario {
+                viewpoint: ScenarioViewpoint::OperationalActivity,
+                context: None,
+                precondition: String::new(),
+                postcondition: String::new(),
+                steps: vec![],
+            };
+            assert!(!equal(&expected, &altered));
+        }
+        if stage == Stage::Machine {
+            assert_ne!(
+                expected.decoded.project, carrier,
+                "Never adopt role-carrier metadata/geometry"
+            );
+            assert_eq!(
+                expected.decoded.project.elements[&test_id(3)].parent,
+                Some(Id::from_u128(OWNER))
+            );
+            let view = &expected.decoded.project.diagrams[&test_id(4)];
+            assert_eq!(view.nodes.len(), 1);
+            let node = &view.nodes[&test_id(5)];
+            println!(
+                "PREDICT first view: {VIEW}; machine-root position {:?}, size {:?}; {} exact source files",
+                node.position,
+                node.size,
+                expected.bundle.files.len()
+            );
+            let mut altered = expected.clone();
+            altered
+                .decoded
+                .project
+                .diagrams
+                .get_mut(&test_id(4))
+                .unwrap()
+                .nodes
+                .get_mut(&test_id(5))
+                .unwrap()
+                .position
+                .x += 1.;
+            assert!(!equal(&expected, &altered));
+            let mut altered = expected.clone();
+            let extra = element(
+                &altered.decoded.project,
+                test_id(6),
+                "Unrequested region",
+                Some(test_id(3)),
+                ElementBody::shared_in(Layer::Sa, SharedBody::Region),
+            );
+            altered.decoded.project.elements.insert(extra.id, extra);
+            assert!(!equal(&expected, &altered), "Reject extra semantic objects");
+            let mut altered = expected.clone();
+            altered
+                .bundle
+                .files
+                .insert("unrequested.arcadia".into(), "// Extra file\n".into());
+            assert!(!equal(&expected, &altered));
+        }
+        println!(
+            "PASS self-check {stage:?}: full source fixed point; false metadata, unrelated edits and source-only drift rejected"
+        );
+    }
+    let mut altered_base = base.clone();
+    altered_base
+        .bundle
+        .files
+        .get_mut("rationale.arcadia")
+        .unwrap()
+        .push(' ');
+    assert!(
+        !pinned_baseline(&altered_base),
+        "Reject an altered baseline before use"
+    );
+    assert_equal(&original, base);
+    let before = predict(base, Stage::Scenario, &carrier);
+    let created = predict(base, Stage::Machine, &carrier);
+    let origin = predicted_disk(&created.bundle, None);
+    let detached: Vec<_> = created
+        .bundle
+        .files
+        .keys()
+        .filter(|path| !before.bundle.files.contains_key(*path))
+        .cloned()
+        .collect();
+    assert_eq!(
+        detached.len(),
+        1,
+        "A machine creation adds one source module"
+    );
+    // Independently simulate the saver's observable result: restored reachable
+    // bytes plus the one new module left on disk by the prior creation.
+    let mut retained = predicted_disk(&before.bundle, None);
+    retained.insert(
+        detached[0].clone(),
+        created.bundle.files[&detached[0]].as_bytes().to_vec(),
+    );
+    assert_eq!(
+        retained[&detached[0]], origin[&detached[0]],
+        "Retained bytes must come from the exact created checkpoint"
+    );
+    assert_ne!(
+        retained,
+        predicted_disk(&before.bundle, None),
+        "Ordinary comparison must not accept detached history files"
+    );
+    assert_eq!(
+        retained,
+        predicted_disk(&before.bundle, Some(&origin)),
+        "Explicit Undo origin permits only the expected retained bytes"
+    );
+    let mut unknown = retained.clone();
+    unknown.insert("unknown.arcadia".into(), b"// Unclaimed file\n".to_vec());
+    assert_ne!(
+        unknown,
+        predicted_disk(&before.bundle, Some(&origin)),
+        "Reject unknown detached files"
+    );
+    let mut changed = retained.clone();
+    changed.get_mut(&detached[0]).unwrap().push(b' ');
+    assert_ne!(
+        changed,
+        predicted_disk(&before.bundle, Some(&origin)),
+        "Reject changed detached bytes"
+    );
+    let mut missing = retained.clone();
+    missing.remove(&detached[0]);
+    assert_ne!(
+        missing,
+        predicted_disk(&before.bundle, Some(&origin)),
+        "The retained file set is exact, not optional"
+    );
+    let mut reachable_drift = retained.clone();
+    reachable_drift
+        .get_mut("rationale.arcadia")
+        .unwrap()
+        .push(b' ');
+    assert_ne!(
+        reachable_drift,
+        predicted_disk(&before.bundle, Some(&origin)),
+        "An Undo exemption cannot hide reachable-source changes"
+    );
+    println!(
+        "PASS explicit Undo disk contract: known detached retention accepted; unknown, changed, missing and reachable drift rejected"
+    );
+    println!("PASS baseline retained unchanged; no native acceptance claimed");
+}
+fn main() {
+    assert_eq!(SCHEMA_VERSION, 7);
+    let args: Vec<_> = std::env::args().collect();
+    match args.get(1).map(String::as_str) {
+        Some("self-check") => {
+            assert_eq!(args.len(), 3, "self-check BASELINE_ENTRY");
+            self_check(&baseline(Path::new(&args[2])));
+        }
+        Some("check") => {
+            assert_eq!(
+                args.len(),
+                6,
+                "check baseline|process|scenario|machine BASELINE_ENTRY ACTUAL_ENTRY ROLE_ENTRY"
+            );
+            let stage = Stage::parse(&args[2]);
+            let base = baseline(Path::new(&args[3]));
+            let actual = load(Path::new(&args[4]));
+            let carrier = load(Path::new(&args[5]));
+            let expected = predict(&base, stage, &carrier.decoded.project);
+            assert_equal(&expected, &actual);
+            println!(
+                "PASS {stage:?}: complete Project + {} exact source files; only fresh literal-role UUIDs borrowed",
+                actual.bundle.files.len()
+            );
+        }
+        Some("same") => {
+            assert!(
+                matches!(args.len(), 4 | 5),
+                "same EXPECTED_CHECKPOINT ACTUAL_CHECKPOINT [UNDO_FROM_CHECKPOINT]"
+            );
+            let expected = load(Path::new(&args[2]));
+            let (actual, disk) = load_checkpoint(Path::new(&args[3]));
+            assert_equal(&expected, &actual);
+            let origin = args.get(4).map(|entry| {
+                // The first committed checkpoint is itself exact. This keeps
+                // arbitrary pre-existing detached files out of the exception.
+                let committed = load(Path::new(entry));
+                predicted_disk(&committed.bundle, None)
+            });
+            assert_eq!(
+                disk,
+                predicted_disk(&expected.bundle, origin.as_ref()),
+                "Disk source files differ from the exact checkpoint plus explicitly proven retained Undo files"
+            );
+            println!(
+                "PASS exact checkpoint identity/model/{}-file SourceBundle equality; {} exact disk files ({} known retained)",
+                actual.bundle.files.len(),
+                disk.len(),
+                disk.len() - actual.bundle.files.len()
+            );
+        }
+        _ => panic!(
+            "self-check BASE | check STAGE BASE ACTUAL ROLES | same EXPECTED ACTUAL [UNDO_FROM]"
+        ),
+    }
+}
@@ -0,0 +1,156 @@
+//! Native issue4 fixture/oracle. generate DIR | check oa|sa STAGE ENTRY
+//! snapshot ENTRY DIR | compare ENTRY DIR | self-check
+use oa_core::{source_project::*, *};
+use std::{collections::{BTreeMap, BTreeSet}, fs, path::Path};
+fn id(n: u128) -> Id { Id::from_u128(0xc1140000000040008000000000000000 + n) }
+fn work(layer: Layer) -> Kind { if layer == Layer::Oa { Kind::Activity } else { Kind::Function } }
+fn fixture(layer: Layer) -> Project {
+    let mut p = Project::empty();
+    p.id = id(1); p.alias = "child_work_native".into(); p.name = format!("Issue4 {layer:?} child work");
+    for (n, kind, name) in [(10, if layer == Layer::Oa { Kind::Entity } else { Kind::System }, "Performer"), (11, work(layer), "Parent work")] {
+        p.elements.insert(id(n), Element { id: id(n), alias: format!("seed_{n}"), name: name.into(), description: format!("Preserve original {name}"), parent: None, body: ElementBody::new(kind, layer).unwrap() });
+    }
+    p.relations.insert(id(20), Relation { id:id(20), alias:"original_allocation".into(), name:"Original responsibility".into(), description:"Preserve allocation engineering rationale 雨".into(), body:RelationBody::Allocation { source:id(10), target:id(11) } });
+    if layer == Layer::Oa {
+        for n in [12,13] {
+            p.elements.insert(id(n), Element { id:id(n), alias:format!("role_{n}"), name:format!("Responsibility role {n}"), description:"Preserve role".into(), parent:None, body:ElementBody::new(Kind::Role, layer).unwrap() });
+            for (r, kind, source, target) in [(n+10,RelationKind::RoleAssignment,id(n),id(11)),(n+20,RelationKind::RoleRealization,id(10),id(n))] {
+                p.relations.insert(id(r), Relation { id:id(r), alias:format!("responsibility_{r}"), name:format!("Role link {r}"), description:format!("Retain role link metadata {r}"), body:RelationBody::new(kind,source,target) });
+            }
+        }
+    }
+    for (index, owner) in [id(20),id(22),id(23)].into_iter().filter(|owner| p.relations.contains_key(owner)).enumerate() {
+        let key=id(50+index as u128);
+        p.artifact_links.insert(key, ArtifactLink { id:key, alias:format!("evidence_{index}"), name:format!("Responsibility evidence {index}"), description:"Keep owner identity and evidence metadata".into(), owner, relation:ArtifactRelation::References, uri:format!("https://example.invalid/evidence/{index}"), revision:Some("review-7".into()), fragment:Some("assignment".into()) });
+    }
+    p.diagrams.insert(id(2), Diagram { id:id(2), alias:"allocation_view".into(), name:format!("{layer:?} allocated work"), description:"Native child-work fixture".into(), layer, projection:ProjectionKind::Allocation, routes:vec![], view_options:Default::default(), nodes:BTreeMap::new() });
+    for (n,element,x,y,collapsed) in [(40,id(10),60.,60.,false),(41,id(11),84.,124.,true)] {
+        p.diagrams.get_mut(&id(2)).unwrap().nodes.insert(id(n), NodePlacement { id:id(n), alias:format!("seed_view_{n}"), element, position:Position{x,y}, size:Size{width:224.,height:94.}, collapsed, port_anchors:vec![] });
+    }
+    execute_batch(&p,&[]).unwrap()
+}
+fn bundle(p:&Project)->CompiledSourceProject {
+    let source=language::format(p).replacen("{\n","{\n    include \"rationale.arcadia\";\n",1);
+    let raw=SourceBundle { entry:"project.arcadia".into(), files:BTreeMap::from([("project.arcadia".into(),source),("rationale.arcadia".into(),"// Preserve included note bytes: responsibility 雨.\r\n".into())]) };
+    let result=compile_bundle(&raw,ProjectLimits::default()).unwrap();
+    assert_eq!(result.bundle,raw); assert_eq!(&result.decoded.project,p); result
+}
+fn load(entry:&Path)->CompiledSourceProject {
+    let raw=source_files::load_project(entry,ProjectLimits::default()).unwrap().reachable_bundle();
+    let result=compile_bundle(&raw,ProjectLimits::default()).unwrap();
+    assert_eq!(result.bundle,raw,"No source normalization permitted");
+    execute_batch(&result.decoded.project,&[]).unwrap(); result
+}
+fn advance(base:&mut CompiledSourceProject,commands:Vec<Command>) {
+    let expected=execute_batch(&base.decoded.project,&commands).unwrap();
+    *base=update_bundle(base,&expected,ProjectLimits::default()).unwrap();
+}
+#[derive(Clone, Copy)]
+struct Keys { children:[Id;3], nodes:[Id;3], allocation:Id }
+fn expected(layer:Layer,stage:usize,k:Keys)->CompiledSourceProject {
+    assert!(stage<=3);
+    let mut base=bundle(&fixture(layer));
+    for step in 0..stage {
+        let p=&base.decoded.project;
+        let key=k.children[step];
+        let name=format!("New {}",work(layer).label().to_lowercase());
+        let element=Element { id:key, alias:p.fresh_alias(&name,"element",key), name, description:String::new(), parent:Some(if step==2 { k.children[0] } else { id(11) }), body:ElementBody::new(work(layer),layer).unwrap() };
+        let mut commands=vec![Command::CreateElement(element.clone())];
+        if step==1 {
+            commands.push(Command::CreateRelation(Relation { id:k.allocation, alias:p.fresh_alias("Performs","relation",k.allocation), name:"Performs".into(), description:String::new(), body:RelationBody::Allocation { source:id(10),target:key } }));
+        } else {
+            for original in p.relations.values().filter(|r| [id(20),id(22),id(23)].contains(&r.id)) {
+                let mut r=original.clone();
+                match &mut r.body { RelationBody::Allocation{target,..}|RelationBody::RoleAssignment{target,..}=>*target=key,_=>unreachable!() }
+                commands.push(Command::EditRelation(r.id,r));
+            }
+        }
+        if step==0 {
+            let mut node=p.diagrams[&id(2)].nodes[&id(41)].clone(); node.collapsed=false;
+            commands.push(Command::EditNode{diagram:id(2),original:node.id,node});
+        }
+        let mut with_element=p.clone(); with_element.elements.insert(key,element);
+        let (x,y)=[(108.,188.),(108.,298.),(132.,252.)][step];
+        commands.push(Command::CreateNode { diagram:id(2), node:NodePlacement { id:k.nodes[step], alias:with_element.fresh_alias(&format!("view_{}",with_element.named(key)),"node",k.nodes[step]), element:key,position:Position{x,y},size:Size{width:224.,height:94.},collapsed:false,port_anchors:vec![] } });
+        if step==2 {
+            // Grandchild expands first child to bottom370; sibling follows at394
+            // (24px reflow gap), independently predicted for this fixed fixture.
+            let mut sibling=p.diagrams[&id(2)].nodes[&k.nodes[1]].clone(); sibling.position.y=394.;
+            commands.push(Command::EditNode{diagram:id(2),original:sibling.id,node:sibling});
+        }
+        advance(&mut base,commands);
+    }
+    base
+}
+fn only(ids:Vec<Id>,role:&str)->Id { assert_eq!(ids.len(),1,"Exactly one {role}"); ids[0] }
+fn admit(actual:&Project,layer:Layer,stage:usize)->Keys {
+    let mut k=Keys{children:[Id::nil();3],nodes:[Id::nil();3],allocation:Id::nil()};
+    if stage==0 { return k; }
+    let target=actual.relations[&id(20)].target();
+    k.children[0]=if stage==3 { actual.elements[&target].parent.unwrap() } else { target };
+    if stage>=2 {
+        k.children[1]=only(actual.elements.values().filter(|e|e.parent==Some(id(11))&&e.id!=k.children[0]&&e.kind()==work(layer)).map(|e|e.id).collect(),"second child");
+        k.allocation=only(actual.relations.values().filter(|r|r.kind()==RelationKind::Allocation&&r.source()==id(10)&&r.target()==k.children[1]).map(|r|r.id).collect(),"new sibling allocation");
+    }
+    if stage==3 { k.children[2]=target; }
+    for step in 0..stage {
+        let e=&actual.elements[&k.children[step]];
+        assert_eq!(e.kind(),work(layer)); assert_eq!(e.layer(),layer);
+        assert_eq!(e.parent,Some(if step==2{k.children[0]}else{id(11)}));
+        k.nodes[step]=only(actual.diagrams[&id(2)].nodes.values().filter(|n|n.element==e.id).map(|n|n.id).collect(),"child placement");
+    }
+    let seed=fixture(layer); let mut used=BTreeSet::new();
+    for key in k.children[..stage].iter().chain(&k.nodes[..stage]).copied().chain((stage>=2).then_some(k.allocation)) {
+        assert_eq!(key.get_version_num(),4,"Native fresh UUIDv4 required");
+        assert!(!seed.contains(key)&&used.insert(key),"Fresh distinct role identity required");
+    }
+    k
+}
+fn check(actual:&CompiledSourceProject,layer:Layer,stage:usize) {
+    let prediction=expected(layer,stage,admit(&actual.decoded.project,layer,stage));
+    assert_eq!(actual.decoded.project,prediction.decoded.project,"Complete typed model mismatch, including placements and references");
+    assert_eq!(actual.bundle,prediction.bundle,"Exact source mismatch, including included note bytes");
+}
+fn history(actual:&CompiledSourceProject,layer:Layer,stage:usize,first:&CompiledSourceProject,second:Option<&CompiledSourceProject>) {
+    check(first,layer,1);
+    let first_keys=admit(&first.decoded.project,layer,1);
+    let current_keys=admit(&actual.decoded.project,layer,stage);
+    assert_eq!(current_keys.children[0],first_keys.children[0],"First child identity must match original first-commit carrier");
+    assert_eq!(current_keys.nodes[0],first_keys.nodes[0],"First placement identity must match original first-commit carrier");
+    if stage==3 {
+        let second=second.expect("Original second-commit carrier required");
+        check(second,layer,2);
+        history(second,layer,2,first,None);
+        let second_keys=admit(&second.decoded.project,layer,2);
+        assert_eq!(current_keys.children[1],second_keys.children[1],"Sibling identity must persist");
+        assert_eq!(current_keys.nodes[1],second_keys.nodes[1],"Sibling placement identity must persist");
+        assert_eq!(current_keys.allocation,second_keys.allocation,"Sibling allocation identity must persist");
+    }
+}
+fn write_bundle(dir:&Path,raw:&SourceBundle) {
+    assert!(!dir.exists(),"Use a new evidence directory"); fs::create_dir_all(dir).unwrap();
+    for (name,bytes) in &raw.files { let path=dir.join(name); if let Some(parent)=path.parent(){fs::create_dir_all(parent).unwrap();} fs::write(path,bytes).unwrap(); }
+}
+fn main() {
+    assert_eq!(SCHEMA_VERSION,7);
+    let args:Vec<_>=std::env::args().collect();
+    match args.get(1).map(String::as_str) {
+        Some("generate")=>{assert_eq!(args.len(),3);let dir=Path::new(&args[2]);assert!(!dir.exists()); for (name,layer) in [("oa",Layer::Oa),("sa",Layer::Sa)] {write_bundle(&dir.join(name),&bundle(&fixture(layer)).bundle);} println!("PASS deterministic OA/SA native fixtures generated");}
+        Some("check")=>{
+            let layer=match args[2].as_str(){"oa"=>Layer::Oa,"sa"=>Layer::Sa,_=>panic!("oa|sa")};
+            let stage=args[3].parse::<usize>().unwrap();assert!(stage<=3);
+            assert_eq!(args.len(),5+stage.saturating_sub(1),"Stages2/3 require original stage1/stage2 checkpoint directories");
+            let actual=load(Path::new(&args[4]));check(&actual,layer,stage);
+            if stage>=2 {
+                let first=load(&Path::new(&args[5]).join("project.arcadia"));
+                let second=if stage==3 {Some(load(&Path::new(&args[6]).join("project.arcadia")))} else {None};
+                history(&actual,layer,stage,&first,second.as_ref());
+            }
+            println!("PASS complete model, exact source and pinned history stage {stage}");
+        }
+        Some("snapshot")=>{assert_eq!(args.len(),4);let actual=load(Path::new(&args[2]));write_bundle(Path::new(&args[3]),&actual.bundle);println!("PASS immutable source checkpoint");}
+        Some("compare")=>{assert_eq!(args.len(),4);let actual=load(Path::new(&args[2]));let checkpoint=load(&Path::new(&args[3]).join(&actual.bundle.entry));assert_eq!(actual.bundle,checkpoint.bundle,"Saved reachable source bytes changed");assert_eq!(actual.decoded.project,checkpoint.decoded.project);println!("PASS exact checkpoint bytes and model");}
+        Some("self-check")=>{for layer in [Layer::Oa,Layer::Sa]{let keys=Keys{children:std::array::from_fn(|_|Id::new_v4()),nodes:std::array::from_fn(|_|Id::new_v4()),allocation:Id::new_v4()};for stage in 0..=3 {let candidate=expected(layer,stage,keys);check(&candidate,layer,stage);if stage>=2 {history(&candidate,layer,stage,&expected(layer,1,keys),(stage==3).then(||expected(layer,2,keys)).as_ref());}let mut altered=candidate.decoded.project.clone();altered.elements.get_mut(&id(11)).unwrap().description="Unrequested mutation".into();assert_ne!(expected(layer,stage,admit(&altered,layer,stage)).decoded.project,altered);}}println!("PASS oracle fixed points and unrelated-mutation discriminator");}
+        _=>panic!("generate DIR | check oa|sa STAGE ENTRY [STAGE1DIR] [STAGE2DIR] | snapshot ENTRY DIR | compare ENTRY DIR | self-check"),
+    }
+}
@@ -0,0 +1,671 @@
+{
+  "reviewer": "Codex-9e8r6t /root/palette_finish",
+  "started_utc": "2026-09-11T09:18:19.944507+00:00",
+  "finished_utc": "2026-09-11T09:18:23.213965+00:00",
+  "scope": "Frozen checkpoints only; no live work/profile/UI access or compilation.",
+  "artifacts": [
+    {
+      "path": ".local/behavior-creation-oracle-20260911/behavior-creation-contract-v2.exe",
+      "bytes": 20757504,
+      "sha256": "056eefd444924916bf6ac3c4897ab2ff4a8a4bb892e1dbc16adad32e59bf6a36"
+    },
+    {
+      "path": "harness/behavior-creation-contract.rs",
+      "bytes": 23982,
+      "sha256": "51ab2ffa1826dd949b79f3a9690042a2f9e38daf9ed91517cade3861482117ba"
+    },
+    {
+      "path": "harness/experiments/behavior-creation-native-20260911/verify.py",
+      "bytes": 5348,
+      "sha256": "4921c4615071240c3ac3bbe1223c0db3bf472fe5e3eec2ae5dac12f95b1674df"
+    },
+    {
+      "path": ".local/native-qa/behavior-20260911-v4/bin/arcadia-studio.exe",
+      "bytes": 111163904,
+      "sha256": "d4d9c2bd937e301ff1009d7cb93a34ee5aa6dfc837ff7e87d468c85371b20c31"
+    },
+    {
+      "path": ".local/native-qa/behavior-20260911-v4/bin/libunwind.dll",
+      "bytes": 190976,
+      "sha256": "f45604a12e8bcd839fd86f667c1be1cc7c4f9da2b3c69ff381ac708f0e1ae7d4"
+    },
+    {
+      "path": ".local/native-qa/behavior-20260911-v4/bin/manifest.json",
+      "bytes": 41579,
+      "sha256": "e0470afae0ae21941ac6da63fadfb3c70d0ce646317c65fafa5c186e94f18fe2"
+    },
+    {
+      "path": ".local/native-qa/behavior-20260911-v4/baseline-source-manifest.json",
+      "bytes": 927,
+      "sha256": "7b5bcd66739ad9f3ddaa3a50db7a4bba3be144d13d161e1db85d2d43f3038259"
+    },
+    {
+      "path": ".local/native-qa/behavior-20260911-v4/cancel-save-verification.json",
+      "bytes": 1439,
+      "sha256": "5fb79d14a000fa0ecc046fba64bcd2846d3bc2eb8708a88e334db0ede4ce16a1"
+    },
+    {
+      "path": ".local/native-qa/behavior-20260911-v4/scenario-empty-saved.png",
+      "bytes": 90419,
+      "sha256": "b03fb33d3f4cf1e5f95e7ac4198a4dee30ffd9af5e250d481e0d5dc2a2a0f90c"
+    },
+    {
+      "path": ".local/native-qa/behavior-20260911-v4/machine-created-saved.png",
+      "bytes": 98897,
+      "sha256": "1e7af3d6219c430eaafb0de5afd8df4c51b4efeb80de3f642084188633dcb65b"
+    }
+  ],
+  "checkpoints": {
+    "baseline": {
+      "path": ".local/native-qa/palette-20260910-v3/checkpoint-transition-reopen",
+      "files": {
+        "oa/activities/activity_assess_incident.arcadia": {
+          "bytes": 376,
+          "sha256": "ae41d7c20b062b39c2edab7fb890a3d88a9ce18fd8d03018ef2d6f95eeff62e8"
+        },
+        "oa/participants.arcadia": {
+          "bytes": 403,
+          "sha256": "094cab67f34b64902942c10a35bbcd0f760886d862588a0816d6ceb57bacf51b"
+        },
+        "project.arcadia": {
+          "bytes": 4844,
+          "sha256": "b35a3f63f223cc4fe2760d6308e87b016ed1eadfbef0a3a4bd051b52c9080958"
+        },
+        "rationale.arcadia": {
+          "bytes": 57,
+          "sha256": "c01867c9dc0d40726853119fac3c6ad24a40d8d362a93a8b9d20df04ec2e273f"
+        },
+        "sa/participants.arcadia": {
+          "bytes": 124,
+          "sha256": "fb975b83d3ec164c38936bf27fe7d2021cc46805574902a534744b040f7d3ae8"
+        },
+        "traceability.arcadia": {
+          "bytes": 395,
+          "sha256": "f778acaaa85de0940cedcd9514cd803032a11e782d859454203235febb73e5f0"
+        }
+      }
+    },
+    "process": {
+      "path": ".local/native-qa/behavior-20260911-v4/checkpoint-process",
+      "files": {
+        "oa/activities/activity_assess_incident.arcadia": {
+          "bytes": 376,
+          "sha256": "ae41d7c20b062b39c2edab7fb890a3d88a9ce18fd8d03018ef2d6f95eeff62e8"
+        },
+        "oa/behavior/process_coordinate_rescue.arcadia": {
+          "bytes": 149,
+          "sha256": "8f393d1cee5e7eed5e41af14539b1fe7ae1c7300dd9383ca0ef1ee17254b6253"
+        },
+        "oa/participants.arcadia": {
+          "bytes": 403,
+          "sha256": "094cab67f34b64902942c10a35bbcd0f760886d862588a0816d6ceb57bacf51b"
+        },
+        "project.arcadia": {
+          "bytes": 4906,
+          "sha256": "961d99c287dd7728c8ece8b20ca1a7965ac2d0581b3eaedf11a2b243975b0ea8"
+        },
+        "rationale.arcadia": {
+          "bytes": 57,
+          "sha256": "c01867c9dc0d40726853119fac3c6ad24a40d8d362a93a8b9d20df04ec2e273f"
+        },
+        "sa/participants.arcadia": {
+          "bytes": 124,
+          "sha256": "fb975b83d3ec164c38936bf27fe7d2021cc46805574902a534744b040f7d3ae8"
+        },
+        "traceability.arcadia": {
+          "bytes": 395,
+          "sha256": "f778acaaa85de0940cedcd9514cd803032a11e782d859454203235febb73e5f0"
+        }
+      }
+    },
+    "process-undo": {
+      "path": ".local/native-qa/behavior-20260911-v4/checkpoint-process-undo",
+      "files": {
+        "oa/activities/activity_assess_incident.arcadia": {
+          "bytes": 376,
+          "sha256": "ae41d7c20b062b39c2edab7fb890a3d88a9ce18fd8d03018ef2d6f95eeff62e8"
+        },
+        "oa/behavior/process_coordinate_rescue.arcadia": {
+          "bytes": 149,
+          "sha256": "8f393d1cee5e7eed5e41af14539b1fe7ae1c7300dd9383ca0ef1ee17254b6253"
+        },
+        "oa/participants.arcadia": {
+          "bytes": 403,
+          "sha256": "094cab67f34b64902942c10a35bbcd0f760886d862588a0816d6ceb57bacf51b"
+        },
+        "project.arcadia": {
+          "bytes": 4844,
+          "sha256": "b35a3f63f223cc4fe2760d6308e87b016ed1eadfbef0a3a4bd051b52c9080958"
+        },
+        "rationale.arcadia": {
+          "bytes": 57,
+          "sha256": "c01867c9dc0d40726853119fac3c6ad24a40d8d362a93a8b9d20df04ec2e273f"
+        },
+        "sa/participants.arcadia": {
+          "bytes": 124,
+          "sha256": "fb975b83d3ec164c38936bf27fe7d2021cc46805574902a534744b040f7d3ae8"
+        },
+        "traceability.arcadia": {
+          "bytes": 395,
+          "sha256": "f778acaaa85de0940cedcd9514cd803032a11e782d859454203235febb73e5f0"
+        }
+      }
+    },
+    "process-redo": {
+      "path": ".local/native-qa/behavior-20260911-v4/checkpoint-process-redo",
+      "files": {
+        "oa/activities/activity_assess_incident.arcadia": {
+          "bytes": 376,
+          "sha256": "ae41d7c20b062b39c2edab7fb890a3d88a9ce18fd8d03018ef2d6f95eeff62e8"
+        },
+        "oa/behavior/process_coordinate_rescue.arcadia": {
+          "bytes": 149,
+          "sha256": "8f393d1cee5e7eed5e41af14539b1fe7ae1c7300dd9383ca0ef1ee17254b6253"
+        },
+        "oa/participants.arcadia": {
+          "bytes": 403,
+          "sha256": "094cab67f34b64902942c10a35bbcd0f760886d862588a0816d6ceb57bacf51b"
+        },
+        "project.arcadia": {
+          "bytes": 4906,
+          "sha256": "961d99c287dd7728c8ece8b20ca1a7965ac2d0581b3eaedf11a2b243975b0ea8"
+        },
+        "rationale.arcadia": {
+          "bytes": 57,
+          "sha256": "c01867c9dc0d40726853119fac3c6ad24a40d8d362a93a8b9d20df04ec2e273f"
+        },
+        "sa/participants.arcadia": {
+          "bytes": 124,
+          "sha256": "fb975b83d3ec164c38936bf27fe7d2021cc46805574902a534744b040f7d3ae8"
+        },
+        "traceability.arcadia": {
+          "bytes": 395,
+          "sha256": "f778acaaa85de0940cedcd9514cd803032a11e782d859454203235febb73e5f0"
+        }
+      }
+    },
+    "scenario": {
+      "path": ".local/native-qa/behavior-20260911-v4/checkpoint-scenario",
+      "files": {
+        "oa/activities/activity_assess_incident.arcadia": {
+          "bytes": 376,
+          "sha256": "ae41d7c20b062b39c2edab7fb890a3d88a9ce18fd8d03018ef2d6f95eeff62e8"
+        },
+        "oa/behavior/process_coordinate_rescue.arcadia": {
+          "bytes": 149,
+          "sha256": "8f393d1cee5e7eed5e41af14539b1fe7ae1c7300dd9383ca0ef1ee17254b6253"
+        },
+        "oa/behavior/scenario_rescue_coordination_conversation.arcadia": {
+          "bytes": 284,
+          "sha256": "8eed98446dfb4f4dbd5261f550ce8cae1a21d638975d91b32baaf6f309daba98"
+        },
+        "oa/participants.arcadia": {
+          "bytes": 403,
+          "sha256": "094cab67f34b64902942c10a35bbcd0f760886d862588a0816d6ceb57bacf51b"
+        },
+        "project.arcadia": {
+          "bytes": 4984,
+          "sha256": "1fa6dd826fd53ccdf3c93cfdcdd657487e344313d76dabe0c438e08128851ee6"
+        },
+        "rationale.arcadia": {
+          "bytes": 57,
+          "sha256": "c01867c9dc0d40726853119fac3c6ad24a40d8d362a93a8b9d20df04ec2e273f"
+        },
+        "sa/participants.arcadia": {
+          "bytes": 124,
+          "sha256": "fb975b83d3ec164c38936bf27fe7d2021cc46805574902a534744b040f7d3ae8"
+        },
+        "traceability.arcadia": {
+          "bytes": 395,
+          "sha256": "f778acaaa85de0940cedcd9514cd803032a11e782d859454203235febb73e5f0"
+        }
+      }
+    },
+    "scenario-undo": {
+      "path": ".local/native-qa/behavior-20260911-v4/checkpoint-scenario-undo",
+      "files": {
+        "oa/activities/activity_assess_incident.arcadia": {
+          "bytes": 376,
+          "sha256": "ae41d7c20b062b39c2edab7fb890a3d88a9ce18fd8d03018ef2d6f95eeff62e8"
+        },
+        "oa/behavior/process_coordinate_rescue.arcadia": {
+          "bytes": 149,
+          "sha256": "8f393d1cee5e7eed5e41af14539b1fe7ae1c7300dd9383ca0ef1ee17254b6253"
+        },
+        "oa/behavior/scenario_rescue_coordination_conversation.arcadia": {
+          "bytes": 284,
+          "sha256": "8eed98446dfb4f4dbd5261f550ce8cae1a21d638975d91b32baaf6f309daba98"
+        },
+        "oa/participants.arcadia": {
+          "bytes": 403,
+          "sha256": "094cab67f34b64902942c10a35bbcd0f760886d862588a0816d6ceb57bacf51b"
+        },
+        "project.arcadia": {
+          "bytes": 4906,
+          "sha256": "961d99c287dd7728c8ece8b20ca1a7965ac2d0581b3eaedf11a2b243975b0ea8"
+        },
+        "rationale.arcadia": {
+          "bytes": 57,
+          "sha256": "c01867c9dc0d40726853119fac3c6ad24a40d8d362a93a8b9d20df04ec2e273f"
+        },
+        "sa/participants.arcadia": {
+          "bytes": 124,
+          "sha256": "fb975b83d3ec164c38936bf27fe7d2021cc46805574902a534744b040f7d3ae8"
+        },
+        "traceability.arcadia": {
+          "bytes": 395,
+          "sha256": "f778acaaa85de0940cedcd9514cd803032a11e782d859454203235febb73e5f0"
+        }
+      }
+    },
+    "scenario-redo": {
+      "path": ".local/native-qa/behavior-20260911-v4/checkpoint-scenario-redo",
+      "files": {
+        "oa/activities/activity_assess_incident.arcadia": {
+          "bytes": 376,
+          "sha256": "ae41d7c20b062b39c2edab7fb890a3d88a9ce18fd8d03018ef2d6f95eeff62e8"
+        },
+        "oa/behavior/process_coordinate_rescue.arcadia": {
+          "bytes": 149,
+          "sha256": "8f393d1cee5e7eed5e41af14539b1fe7ae1c7300dd9383ca0ef1ee17254b6253"
+        },
+        "oa/behavior/scenario_rescue_coordination_conversation.arcadia": {
+          "bytes": 284,
+          "sha256": "8eed98446dfb4f4dbd5261f550ce8cae1a21d638975d91b32baaf6f309daba98"
+        },
+        "oa/participants.arcadia": {
+          "bytes": 403,
+          "sha256": "094cab67f34b64902942c10a35bbcd0f760886d862588a0816d6ceb57bacf51b"
+        },
+        "project.arcadia": {
+          "bytes": 4984,
+          "sha256": "1fa6dd826fd53ccdf3c93cfdcdd657487e344313d76dabe0c438e08128851ee6"
+        },
+        "rationale.arcadia": {
+          "bytes": 57,
+          "sha256": "c01867c9dc0d40726853119fac3c6ad24a40d8d362a93a8b9d20df04ec2e273f"
+        },
+        "sa/participants.arcadia": {
+          "bytes": 124,
+          "sha256": "fb975b83d3ec164c38936bf27fe7d2021cc46805574902a534744b040f7d3ae8"
+        },
+        "traceability.arcadia": {
+          "bytes": 395,
+          "sha256": "f778acaaa85de0940cedcd9514cd803032a11e782d859454203235febb73e5f0"
+        }
+      }
+    },
+    "machine": {
+      "path": ".local/native-qa/behavior-20260911-v4/checkpoint-machine",
+      "files": {
+        "oa/activities/activity_assess_incident.arcadia": {
+          "bytes": 376,
+          "sha256": "ae41d7c20b062b39c2edab7fb890a3d88a9ce18fd8d03018ef2d6f95eeff62e8"
+        },
+        "oa/behavior/process_coordinate_rescue.arcadia": {
+          "bytes": 149,
+          "sha256": "8f393d1cee5e7eed5e41af14539b1fe7ae1c7300dd9383ca0ef1ee17254b6253"
+        },
+        "oa/behavior/scenario_rescue_coordination_conversation.arcadia": {
+          "bytes": 284,
+          "sha256": "8eed98446dfb4f4dbd5261f550ce8cae1a21d638975d91b32baaf6f309daba98"
+        },
+        "oa/participants.arcadia": {
+          "bytes": 403,
+          "sha256": "094cab67f34b64902942c10a35bbcd0f760886d862588a0816d6ceb57bacf51b"
+        },
+        "project.arcadia": {
+          "bytes": 5057,
+          "sha256": "59b61b321b0cf4817c1ff9276fa59deafc09518765e761a2ebd9e5602afab9cb"
+        },
+        "rationale.arcadia": {
+          "bytes": 57,
+          "sha256": "c01867c9dc0d40726853119fac3c6ad24a40d8d362a93a8b9d20df04ec2e273f"
+        },
+        "sa/participants.arcadia": {
+          "bytes": 285,
+          "sha256": "9b77b88f66e4e80540ae33b83f1af1f3edcd37dafb98c33a861d4c34c66d2559"
+        },
+        "traceability.arcadia": {
+          "bytes": 395,
+          "sha256": "f778acaaa85de0940cedcd9514cd803032a11e782d859454203235febb73e5f0"
+        },
+        "views/diagram_rescue_team_operating_modes_states.arcadia": {
+          "bytes": 842,
+          "sha256": "498eab80da7ac4523883622a0d008b9033a1305e5bb5f168b8e9d4c41dde62de"
+        }
+      }
+    },
+    "machine-undo": {
+      "path": ".local/native-qa/behavior-20260911-v4/checkpoint-machine-undo",
+      "files": {
+        "oa/activities/activity_assess_incident.arcadia": {
+          "bytes": 376,
+          "sha256": "ae41d7c20b062b39c2edab7fb890a3d88a9ce18fd8d03018ef2d6f95eeff62e8"
+        },
+        "oa/behavior/process_coordinate_rescue.arcadia": {
+          "bytes": 149,
+          "sha256": "8f393d1cee5e7eed5e41af14539b1fe7ae1c7300dd9383ca0ef1ee17254b6253"
+        },
+        "oa/behavior/scenario_rescue_coordination_conversation.arcadia": {
+          "bytes": 284,
+          "sha256": "8eed98446dfb4f4dbd5261f550ce8cae1a21d638975d91b32baaf6f309daba98"
+        },
+        "oa/participants.arcadia": {
+          "bytes": 403,
+          "sha256": "094cab67f34b64902942c10a35bbcd0f760886d862588a0816d6ceb57bacf51b"
+        },
+        "project.arcadia": {
+          "bytes": 4984,
+          "sha256": "1fa6dd826fd53ccdf3c93cfdcdd657487e344313d76dabe0c438e08128851ee6"
+        },
+        "rationale.arcadia": {
+          "bytes": 57,
+          "sha256": "c01867c9dc0d40726853119fac3c6ad24a40d8d362a93a8b9d20df04ec2e273f"
+        },
+        "sa/participants.arcadia": {
+          "bytes": 124,
+          "sha256": "fb975b83d3ec164c38936bf27fe7d2021cc46805574902a534744b040f7d3ae8"
+        },
+        "traceability.arcadia": {
+          "bytes": 395,
+          "sha256": "f778acaaa85de0940cedcd9514cd803032a11e782d859454203235febb73e5f0"
+        },
+        "views/diagram_rescue_team_operating_modes_states.arcadia": {
+          "bytes": 842,
+          "sha256": "498eab80da7ac4523883622a0d008b9033a1305e5bb5f168b8e9d4c41dde62de"
+        }
+      }
+    },
+    "machine-redo": {
+      "path": ".local/native-qa/behavior-20260911-v4/checkpoint-machine-redo",
+      "files": {
+        "oa/activities/activity_assess_incident.arcadia": {
+          "bytes": 376,
+          "sha256": "ae41d7c20b062b39c2edab7fb890a3d88a9ce18fd8d03018ef2d6f95eeff62e8"
+        },
+        "oa/behavior/process_coordinate_rescue.arcadia": {
+          "bytes": 149,
+          "sha256": "8f393d1cee5e7eed5e41af14539b1fe7ae1c7300dd9383ca0ef1ee17254b6253"
+        },
+        "oa/behavior/scenario_rescue_coordination_conversation.arcadia": {
+          "bytes": 284,
+          "sha256": "8eed98446dfb4f4dbd5261f550ce8cae1a21d638975d91b32baaf6f309daba98"
+        },
+        "oa/participants.arcadia": {
+          "bytes": 403,
+          "sha256": "094cab67f34b64902942c10a35bbcd0f760886d862588a0816d6ceb57bacf51b"
+        },
+        "project.arcadia": {
+          "bytes": 5057,
+          "sha256": "59b61b321b0cf4817c1ff9276fa59deafc09518765e761a2ebd9e5602afab9cb"
+        },
+        "rationale.arcadia": {
+          "bytes": 57,
+          "sha256": "c01867c9dc0d40726853119fac3c6ad24a40d8d362a93a8b9d20df04ec2e273f"
+        },
+        "sa/participants.arcadia": {
+          "bytes": 285,
+          "sha256": "9b77b88f66e4e80540ae33b83f1af1f3edcd37dafb98c33a861d4c34c66d2559"
+        },
+        "traceability.arcadia": {
+          "bytes": 395,
+          "sha256": "f778acaaa85de0940cedcd9514cd803032a11e782d859454203235febb73e5f0"
+        },
+        "views/diagram_rescue_team_operating_modes_states.arcadia": {
+          "bytes": 842,
+          "sha256": "498eab80da7ac4523883622a0d008b9033a1305e5bb5f168b8e9d4c41dde62de"
+        }
+      }
+    },
+    "creation-reopen": {
+      "path": ".local/native-qa/behavior-20260911-v4/checkpoint-creation-reopen",
+      "files": {
+        "oa/activities/activity_assess_incident.arcadia": {
+          "bytes": 376,
+          "sha256": "ae41d7c20b062b39c2edab7fb890a3d88a9ce18fd8d03018ef2d6f95eeff62e8"
+        },
+        "oa/behavior/process_coordinate_rescue.arcadia": {
+          "bytes": 149,
+          "sha256": "8f393d1cee5e7eed5e41af14539b1fe7ae1c7300dd9383ca0ef1ee17254b6253"
+        },
+        "oa/behavior/scenario_rescue_coordination_conversation.arcadia": {
+          "bytes": 284,
+          "sha256": "8eed98446dfb4f4dbd5261f550ce8cae1a21d638975d91b32baaf6f309daba98"
+        },
+        "oa/participants.arcadia": {
+          "bytes": 403,
+          "sha256": "094cab67f34b64902942c10a35bbcd0f760886d862588a0816d6ceb57bacf51b"
+        },
+        "project.arcadia": {
+          "bytes": 5057,
+          "sha256": "59b61b321b0cf4817c1ff9276fa59deafc09518765e761a2ebd9e5602afab9cb"
+        },
+        "rationale.arcadia": {
+          "bytes": 57,
+          "sha256": "c01867c9dc0d40726853119fac3c6ad24a40d8d362a93a8b9d20df04ec2e273f"
+        },
+        "sa/participants.arcadia": {
+          "bytes": 285,
+          "sha256": "9b77b88f66e4e80540ae33b83f1af1f3edcd37dafb98c33a861d4c34c66d2559"
+        },
+        "traceability.arcadia": {
+          "bytes": 395,
+          "sha256": "f778acaaa85de0940cedcd9514cd803032a11e782d859454203235febb73e5f0"
+        },
+        "views/diagram_rescue_team_operating_modes_states.arcadia": {
+          "bytes": 842,
+          "sha256": "498eab80da7ac4523883622a0d008b9033a1305e5bb5f168b8e9d4c41dde62de"
+        }
+      }
+    }
+  },
+  "commands": [
+    {
+      "label": "self-check",
+      "command_argv": [
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\behavior-creation-oracle-20260911\\behavior-creation-contract-v2.exe",
+        "self-check",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\palette-20260910-v3\\checkpoint-transition-reopen\\project.arcadia"
+      ],
+      "exit_code": 0,
+      "elapsed_seconds": 0.967588,
+      "stdout": "PASS self-check Process: full source fixed point; false metadata, unrelated edits and source-only drift rejected\nPASS self-check Scenario: full source fixed point; false metadata, unrelated edits and source-only drift rejected\nPREDICT first view: Rescue team operating modes \u00b7 states; machine-root position Position { x: 60.0, y: 60.0 }, size Size { width: 336.0, height: 104.0 }; 9 exact source files\nPASS self-check Machine: full source fixed point; false metadata, unrelated edits and source-only drift rejected\nPASS explicit Undo disk contract: known detached retention accepted; unknown, changed, missing and reachable drift rejected\nPASS baseline retained unchanged; no native acceptance claimed\n",
+      "stderr": ""
+    },
+    {
+      "label": "baseline",
+      "command_argv": [
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\behavior-creation-oracle-20260911\\behavior-creation-contract-v2.exe",
+        "check",
+        "baseline",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\palette-20260910-v3\\checkpoint-transition-reopen\\project.arcadia",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\palette-20260910-v3\\checkpoint-transition-reopen\\project.arcadia",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\palette-20260910-v3\\checkpoint-transition-reopen\\project.arcadia"
+      ],
+      "exit_code": 0,
+      "elapsed_seconds": 0.119426,
+      "stdout": "PASS Baseline: complete Project + 6 exact source files; only fresh literal-role UUIDs borrowed\n",
+      "stderr": ""
+    },
+    {
+      "label": "process",
+      "command_argv": [
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\behavior-creation-oracle-20260911\\behavior-creation-contract-v2.exe",
+        "check",
+        "process",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\palette-20260910-v3\\checkpoint-transition-reopen\\project.arcadia",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-process\\project.arcadia",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-process\\project.arcadia"
+      ],
+      "exit_code": 0,
+      "elapsed_seconds": 0.163785,
+      "stdout": "PASS Process: complete Project + 7 exact source files; only fresh literal-role UUIDs borrowed\n",
+      "stderr": ""
+    },
+    {
+      "label": "process-undo",
+      "command_argv": [
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\behavior-creation-oracle-20260911\\behavior-creation-contract-v2.exe",
+        "same",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\palette-20260910-v3\\checkpoint-transition-reopen\\project.arcadia",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-process-undo\\project.arcadia",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-process\\project.arcadia"
+      ],
+      "exit_code": 0,
+      "elapsed_seconds": 0.155607,
+      "stdout": "PASS exact checkpoint identity/model/6-file SourceBundle equality; 7 exact disk files (1 known retained)\n",
+      "stderr": ""
+    },
+    {
+      "label": "process-redo",
+      "command_argv": [
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\behavior-creation-oracle-20260911\\behavior-creation-contract-v2.exe",
+        "check",
+        "process",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\palette-20260910-v3\\checkpoint-transition-reopen\\project.arcadia",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-process-redo\\project.arcadia",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-process\\project.arcadia"
+      ],
+      "exit_code": 0,
+      "elapsed_seconds": 0.187937,
+      "stdout": "PASS Process: complete Project + 7 exact source files; only fresh literal-role UUIDs borrowed\n",
+      "stderr": ""
+    },
+    {
+      "label": "scenario",
+      "command_argv": [
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\behavior-creation-oracle-20260911\\behavior-creation-contract-v2.exe",
+        "check",
+        "scenario",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\palette-20260910-v3\\checkpoint-transition-reopen\\project.arcadia",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-scenario\\project.arcadia",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-scenario\\project.arcadia"
+      ],
+      "exit_code": 0,
+      "elapsed_seconds": 0.253057,
+      "stdout": "PASS Scenario: complete Project + 8 exact source files; only fresh literal-role UUIDs borrowed\n",
+      "stderr": ""
+    },
+    {
+      "label": "scenario-undo",
+      "command_argv": [
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\behavior-creation-oracle-20260911\\behavior-creation-contract-v2.exe",
+        "same",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-process\\project.arcadia",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-scenario-undo\\project.arcadia",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-scenario\\project.arcadia"
+      ],
+      "exit_code": 0,
+      "elapsed_seconds": 0.160712,
+      "stdout": "PASS exact checkpoint identity/model/7-file SourceBundle equality; 8 exact disk files (1 known retained)\n",
+      "stderr": ""
+    },
+    {
+      "label": "scenario-redo",
+      "command_argv": [
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\behavior-creation-oracle-20260911\\behavior-creation-contract-v2.exe",
+        "check",
+        "scenario",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\palette-20260910-v3\\checkpoint-transition-reopen\\project.arcadia",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-scenario-redo\\project.arcadia",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-scenario\\project.arcadia"
+      ],
+      "exit_code": 0,
+      "elapsed_seconds": 0.222,
+      "stdout": "PASS Scenario: complete Project + 8 exact source files; only fresh literal-role UUIDs borrowed\n",
+      "stderr": ""
+    },
+    {
+      "label": "machine",
+      "command_argv": [
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\behavior-creation-oracle-20260911\\behavior-creation-contract-v2.exe",
+        "check",
+        "machine",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\palette-20260910-v3\\checkpoint-transition-reopen\\project.arcadia",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-machine\\project.arcadia",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-machine\\project.arcadia"
+      ],
+      "exit_code": 0,
+      "elapsed_seconds": 0.266748,
+      "stdout": "PASS Machine: complete Project + 9 exact source files; only fresh literal-role UUIDs borrowed\n",
+      "stderr": ""
+    },
+    {
+      "label": "machine-undo",
+      "command_argv": [
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\behavior-creation-oracle-20260911\\behavior-creation-contract-v2.exe",
+        "same",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-scenario\\project.arcadia",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-machine-undo\\project.arcadia",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-machine\\project.arcadia"
+      ],
+      "exit_code": 0,
+      "elapsed_seconds": 0.122982,
+      "stdout": "PASS exact checkpoint identity/model/8-file SourceBundle equality; 9 exact disk files (1 known retained)\n",
+      "stderr": ""
+    },
+    {
+      "label": "machine-redo",
+      "command_argv": [
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\behavior-creation-oracle-20260911\\behavior-creation-contract-v2.exe",
+        "check",
+        "machine",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\palette-20260910-v3\\checkpoint-transition-reopen\\project.arcadia",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-machine-redo\\project.arcadia",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-machine\\project.arcadia"
+      ],
+      "exit_code": 0,
+      "elapsed_seconds": 0.229706,
+      "stdout": "PASS Machine: complete Project + 9 exact source files; only fresh literal-role UUIDs borrowed\n",
+      "stderr": ""
+    },
+    {
+      "label": "reopen-contract",
+      "command_argv": [
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\behavior-creation-oracle-20260911\\behavior-creation-contract-v2.exe",
+        "check",
+        "machine",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\palette-20260910-v3\\checkpoint-transition-reopen\\project.arcadia",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-creation-reopen\\project.arcadia",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-machine\\project.arcadia"
+      ],
+      "exit_code": 0,
+      "elapsed_seconds": 0.192465,
+      "stdout": "PASS Machine: complete Project + 9 exact source files; only fresh literal-role UUIDs borrowed\n",
+      "stderr": ""
+    },
+    {
+      "label": "reopen-exact-redo",
+      "command_argv": [
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\behavior-creation-oracle-20260911\\behavior-creation-contract-v2.exe",
+        "same",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-machine-redo\\project.arcadia",
+        "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-creation-reopen\\project.arcadia"
+      ],
+      "exit_code": 0,
+      "elapsed_seconds": 0.131742,
+      "stdout": "PASS exact checkpoint identity/model/9-file SourceBundle equality; 9 exact disk files (0 known retained)\n",
+      "stderr": ""
+    }
+  ],
+  "all_checkpoint_files_unchanged": true,
+  "machine_redo_reopen_inventory_equal": true,
+  "machine_redo_reopen_direct_byte_comparisons": {
+    "oa/activities/activity_assess_incident.arcadia": true,
+    "oa/behavior/process_coordinate_rescue.arcadia": true,
+    "oa/behavior/scenario_rescue_coordination_conversation.arcadia": true,
+    "oa/participants.arcadia": true,
+    "project.arcadia": true,
+    "rationale.arcadia": true,
+    "sa/participants.arcadia": true,
+    "traceability.arcadia": true,
+    "views/diagram_rescue_team_operating_modes_states.arcadia": true
+  },
+  "log": {
+    "path": "harness/experiments/behavior-creation-native-20260911/commands-results.log",
+    "bytes": 9392,
+    "sha256": "f5bfbee185f7064419b1bd9fe33ec6a48526b5bbe3f818c006feb74eddf8e189"
+  },
+  "pass": true
+}
@@ -0,0 +1,200 @@
+{
+  "reviewer": "Codex-9e8r6t /root/palette_finish",
+  "started_utc": "2026-09-11T09:22:33.387447+00:00",
+  "finished_utc": "2026-09-11T09:22:34.502189+00:00",
+  "scope": "Immutable evidence only; native observations supplied separately by root. No live work/profile/UI/Cargo access; no persisted Undo claim.",
+  "artifacts": [
+    {
+      "path": "harness/experiments/behavior-creation-native-20260911/verify-recovery.py",
+      "bytes": 5560,
+      "sha256": "3546b4fe68d3e1a2474015be1b652a665af238e5fcf63e04bac3f25df3d35e90"
+    },
+    {
+      "path": "harness/experiments/behavior-creation-native-20260911/manifest.json",
+      "bytes": 30406,
+      "sha256": "356dfbb27dec04764a4b3f2372602f39953b472baac0a3de3e72acd9c1d76b8a"
+    },
+    {
+      "path": ".local/behavior-creation-oracle-20260911/behavior-creation-contract-v2.exe",
+      "bytes": 20757504,
+      "sha256": "056eefd444924916bf6ac3c4897ab2ff4a8a4bb892e1dbc16adad32e59bf6a36"
+    },
+    {
+      "path": ".local/native-qa/behavior-20260911-v4/recovery-evidence/before-interruption.json",
+      "bytes": 27382,
+      "sha256": "0c355aa3c7b9be623d767ff35c4b85cf7b2907eb9bc3be39d619aa610c989692"
+    },
+    {
+      "path": ".local/native-qa/behavior-20260911-v4/recovery-evidence/after-recovery-and-typing.json",
+      "bytes": 27263,
+      "sha256": "fafa7a884275bac09afab365f8ab0063f998ca56c5ffc70be596db6f78a10103"
+    },
+    {
+      "path": ".local/native-qa/behavior-20260911-v4/recovery-evidence/restored-draft.png",
+      "bytes": 113820,
+      "sha256": "8ae0fe8957d5a935b6e2605a6ffb68934bd0e8840f3594c43e63865ab89d03c9"
+    },
+    {
+      "path": ".local/native-qa/behavior-20260911-v4/recovery-launch.json",
+      "bytes": 812,
+      "sha256": "641ff05ea50d551a51e642f728650cf254dbf131cfb2f585865db436a8877396"
+    },
+    {
+      "path": ".local/native-qa/behavior-20260911-v4/bin/arcadia-studio.exe",
+      "bytes": 111163904,
+      "sha256": "d4d9c2bd937e301ff1009d7cb93a34ee5aa6dfc837ff7e87d468c85371b20c31"
+    }
+  ],
+  "input_file_inventories": {
+    ".local\\native-qa\\behavior-20260911-v4\\checkpoint-creation-reopen": {
+      "oa/activities/activity_assess_incident.arcadia": {
+        "path": ".local/native-qa/behavior-20260911-v4/checkpoint-creation-reopen/oa/activities/activity_assess_incident.arcadia",
+        "bytes": 376,
+        "sha256": "ae41d7c20b062b39c2edab7fb890a3d88a9ce18fd8d03018ef2d6f95eeff62e8"
+      },
+      "oa/behavior/process_coordinate_rescue.arcadia": {
+        "path": ".local/native-qa/behavior-20260911-v4/checkpoint-creation-reopen/oa/behavior/process_coordinate_rescue.arcadia",
+        "bytes": 149,
+        "sha256": "8f393d1cee5e7eed5e41af14539b1fe7ae1c7300dd9383ca0ef1ee17254b6253"
+      },
+      "oa/behavior/scenario_rescue_coordination_conversation.arcadia": {
+        "path": ".local/native-qa/behavior-20260911-v4/checkpoint-creation-reopen/oa/behavior/scenario_rescue_coordination_conversation.arcadia",
+        "bytes": 284,
+        "sha256": "8eed98446dfb4f4dbd5261f550ce8cae1a21d638975d91b32baaf6f309daba98"
+      },
+      "oa/participants.arcadia": {
+        "path": ".local/native-qa/behavior-20260911-v4/checkpoint-creation-reopen/oa/participants.arcadia",
+        "bytes": 403,
+        "sha256": "094cab67f34b64902942c10a35bbcd0f760886d862588a0816d6ceb57bacf51b"
+      },
+      "project.arcadia": {
+        "path": ".local/native-qa/behavior-20260911-v4/checkpoint-creation-reopen/project.arcadia",
+        "bytes": 5057,
+        "sha256": "59b61b321b0cf4817c1ff9276fa59deafc09518765e761a2ebd9e5602afab9cb"
+      },
+      "rationale.arcadia": {
+        "path": ".local/native-qa/behavior-20260911-v4/checkpoint-creation-reopen/rationale.arcadia",
+        "bytes": 57,
+        "sha256": "c01867c9dc0d40726853119fac3c6ad24a40d8d362a93a8b9d20df04ec2e273f"
+      },
+      "sa/participants.arcadia": {
+        "path": ".local/native-qa/behavior-20260911-v4/checkpoint-creation-reopen/sa/participants.arcadia",
+        "bytes": 285,
+        "sha256": "9b77b88f66e4e80540ae33b83f1af1f3edcd37dafb98c33a861d4c34c66d2559"
+      },
+      "traceability.arcadia": {
+        "path": ".local/native-qa/behavior-20260911-v4/checkpoint-creation-reopen/traceability.arcadia",
+        "bytes": 395,
+        "sha256": "f778acaaa85de0940cedcd9514cd803032a11e782d859454203235febb73e5f0"
+      },
+      "views/diagram_rescue_team_operating_modes_states.arcadia": {
+        "path": ".local/native-qa/behavior-20260911-v4/checkpoint-creation-reopen/views/diagram_rescue_team_operating_modes_states.arcadia",
+        "bytes": 842,
+        "sha256": "498eab80da7ac4523883622a0d008b9033a1305e5bb5f168b8e9d4c41dde62de"
+      }
+    },
+    ".local\\native-qa\\behavior-20260911-v4\\checkpoint-recovery-cancel": {
+      "oa/activities/activity_assess_incident.arcadia": {
+        "path": ".local/native-qa/behavior-20260911-v4/checkpoint-recovery-cancel/oa/activities/activity_assess_incident.arcadia",
+        "bytes": 376,
+        "sha256": "ae41d7c20b062b39c2edab7fb890a3d88a9ce18fd8d03018ef2d6f95eeff62e8"
+      },
+      "oa/behavior/process_coordinate_rescue.arcadia": {
+        "path": ".local/native-qa/behavior-20260911-v4/checkpoint-recovery-cancel/oa/behavior/process_coordinate_rescue.arcadia",
+        "bytes": 149,
+        "sha256": "8f393d1cee5e7eed5e41af14539b1fe7ae1c7300dd9383ca0ef1ee17254b6253"
+      },
+      "oa/behavior/scenario_rescue_coordination_conversation.arcadia": {
+        "path": ".local/native-qa/behavior-20260911-v4/checkpoint-recovery-cancel/oa/behavior/scenario_rescue_coordination_conversation.arcadia",
+        "bytes": 284,
+        "sha256": "8eed98446dfb4f4dbd5261f550ce8cae1a21d638975d91b32baaf6f309daba98"
+      },
+      "oa/participants.arcadia": {
+        "path": ".local/native-qa/behavior-20260911-v4/checkpoint-recovery-cancel/oa/participants.arcadia",
+        "bytes": 403,
+        "sha256": "094cab67f34b64902942c10a35bbcd0f760886d862588a0816d6ceb57bacf51b"
+      },
+      "project.arcadia": {
+        "path": ".local/native-qa/behavior-20260911-v4/checkpoint-recovery-cancel/project.arcadia",
+        "bytes": 5057,
+        "sha256": "59b61b321b0cf4817c1ff9276fa59deafc09518765e761a2ebd9e5602afab9cb"
+      },
+      "rationale.arcadia": {
+        "path": ".local/native-qa/behavior-20260911-v4/checkpoint-recovery-cancel/rationale.arcadia",
+        "bytes": 57,
+        "sha256": "c01867c9dc0d40726853119fac3c6ad24a40d8d362a93a8b9d20df04ec2e273f"
+      },
+      "sa/participants.arcadia": {
+        "path": ".local/native-qa/behavior-20260911-v4/checkpoint-recovery-cancel/sa/participants.arcadia",
+        "bytes": 285,
+        "sha256": "9b77b88f66e4e80540ae33b83f1af1f3edcd37dafb98c33a861d4c34c66d2559"
+      },
+      "traceability.arcadia": {
+        "path": ".local/native-qa/behavior-20260911-v4/checkpoint-recovery-cancel/traceability.arcadia",
+        "bytes": 395,
+        "sha256": "f778acaaa85de0940cedcd9514cd803032a11e782d859454203235febb73e5f0"
+      },
+      "views/diagram_rescue_team_operating_modes_states.arcadia": {
+        "path": ".local/native-qa/behavior-20260911-v4/checkpoint-recovery-cancel/views/diagram_rescue_team_operating_modes_states.arcadia",
+        "bytes": 842,
+        "sha256": "498eab80da7ac4523883622a0d008b9033a1305e5bb5f168b8e9d4c41dde62de"
+      }
+    }
+  },
+  "checks": {
+    "literal_name_before": true,
+    "literal_name_after": true,
+    "sa_machine": true,
+    "selected_exact_system_actor": true,
+    "first_view_selected": true,
+    "complete_behavior_equal_except_deliberate_suffix": true,
+    "accepted_exact_json_equality": true,
+    "workspace_exact_json_equality": true,
+    "property_exact_json_equality": true,
+    "workflow_exact_json_equality": true,
+    "selected_exact_json_equality": true,
+    "reserved_ids_unchanged": true,
+    "complete_file_inventory_equal": true,
+    "complete_file_bytes_equal": true,
+    "accepted_snapshot_exactly_matches_saved_checkpoint": true,
+    "reserved_objects_not_committed": true,
+    "oracle_same_pass": true,
+    "input_files_unchanged": true,
+    "evidence_and_prior_manifest_unchanged": true
+  },
+  "reserved_ids": {
+    "element": "c6f559f5-401e-4e0d-af93-91faee68d3f5",
+    "diagram": "11ad8f0a-73aa-416a-bbeb-9b886bf39854",
+    "placement": "171f7d7e-3a8f-4200-86f6-a9e2efd87610"
+  },
+  "reopen_recovery_cancel_direct_byte_comparisons": {
+    "views/diagram_rescue_team_operating_modes_states.arcadia": true,
+    "traceability.arcadia": true,
+    "oa/activities/activity_assess_incident.arcadia": true,
+    "sa/participants.arcadia": true,
+    "rationale.arcadia": true,
+    "oa/behavior/process_coordinate_rescue.arcadia": true,
+    "project.arcadia": true,
+    "oa/participants.arcadia": true,
+    "oa/behavior/scenario_rescue_coordination_conversation.arcadia": true
+  },
+  "comparison_origin": "checkpoint-creation-reopen",
+  "command": {
+    "command_argv": [
+      "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\behavior-creation-oracle-20260911\\behavior-creation-contract-v2.exe",
+      "same",
+      "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-creation-reopen\\project.arcadia",
+      "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-qa\\behavior-20260911-v4\\checkpoint-recovery-cancel\\project.arcadia"
+    ],
+    "exit_code": 0,
+    "elapsed_seconds": 0.147209,
+    "stdout": "PASS exact checkpoint identity/model/9-file SourceBundle equality; 9 exact disk files (0 known retained)\n",
+    "stderr": ""
+  },
+  "log": {
+    "path": "harness/experiments/behavior-creation-native-20260911/recovery-commands-results.log",
+    "bytes": 641,
+    "sha256": "1dc3e89aa46660bfad796e7b6bf821bebd7e5bc5a7902a826021d461a3e74c68"
+  },
+  "pass": true
+}
@@ -0,0 +1,89 @@
+"""Verify immutable recovery evidence; never access live profile/work or UI."""
+from pathlib import Path
+import copy
+import datetime
+import hashlib
+import json
+import os
+import subprocess
+import time
+
+ROOT = Path(__file__).resolve().parents[3]
+OUT = Path(__file__).resolve().parent
+STAGE = ROOT / '.local/native-qa/behavior-20260911-v4'
+EVIDENCE = STAGE / 'recovery-evidence'
+EXPECTED = STAGE / 'checkpoint-creation-reopen'
+ACTUAL = STAGE / 'checkpoint-recovery-cancel'
+EXE = ROOT / '.local/behavior-creation-oracle-20260911/behavior-creation-contract-v2.exe'
+
+
+def record(path):
+    data = path.read_bytes()
+    return {'path': path.relative_to(ROOT).as_posix(), 'bytes': len(data),
+            'sha256': hashlib.sha256(data).hexdigest()}
+
+
+def inventory(directory):
+    return {p.relative_to(directory).as_posix(): record(p)
+            for p in sorted(directory.rglob('*')) if p.is_file()}
+
+
+artifacts = [record(p) for p in (Path(__file__), OUT / 'manifest.json', EXE,
+    EVIDENCE / 'before-interruption.json', EVIDENCE / 'after-recovery-and-typing.json',
+    EVIDENCE / 'restored-draft.png', STAGE / 'recovery-launch.json', STAGE / 'bin/arcadia-studio.exe')]
+assert artifacts[1]['sha256'] == '356dfbb27dec04764a4b3f2372602f39953b472baac0a3de3e72acd9c1d76b8a'
+assert artifacts[2]['sha256'] == '056eefd444924916bf6ac3c4897ab2ff4a8a4bb892e1dbc16adad32e59bf6a36'
+before = json.loads((EVIDENCE / 'before-interruption.json').read_text(encoding='utf-8-sig'))
+after = json.loads((EVIDENCE / 'after-recovery-and-typing.json').read_text(encoding='utf-8-sig'))
+draft = before['behavior']['draft']
+expected_name = 'Recovery — secours Δ «operating modes»'
+checks = {'literal_name_before': draft['name'] == expected_name,
+          'literal_name_after': after['behavior']['draft']['name'] == expected_name + ' · resumed',
+          'sa_machine': draft['layer'] == 'Sa' and draft['family'] == 'Machine',
+          'selected_exact_system_actor': draft['owner'] == 'c0629449-1209-4b50-afac-f558a9a0fc7f',
+          'first_view_selected': draft['first_view'] is True}
+normalized = copy.deepcopy(after['behavior'])
+if checks['literal_name_after']:
+    normalized['draft']['name'] = expected_name
+checks['complete_behavior_equal_except_deliberate_suffix'] = normalized == before['behavior']
+for field in ('accepted', 'workspace', 'property', 'workflow', 'selected'):
+    checks[field + '_exact_json_equality'] = before[field] == after[field]
+reserved = {field: draft[field] for field in ('element', 'diagram', 'placement')}
+checks['reserved_ids_unchanged'] = all(after['behavior']['draft'][k] == v for k, v in reserved.items())
+inputs = {str(p.relative_to(ROOT)): inventory(p) for p in (EXPECTED, ACTUAL)}
+expected_names = set(inputs[str(EXPECTED.relative_to(ROOT))])
+actual_names = set(inputs[str(ACTUAL.relative_to(ROOT))])
+checks['complete_file_inventory_equal'] = expected_names == actual_names
+byte_results = {name: (EXPECTED / name).read_bytes() == (ACTUAL / name).read_bytes()
+                for name in expected_names if name in actual_names}
+checks['complete_file_bytes_equal'] = all(byte_results.values()) and len(byte_results) == len(expected_names)
+checks['accepted_snapshot_exactly_matches_saved_checkpoint'] = (
+    set(before['accepted']['files']) == expected_names and
+    all(text.encode('utf-8') == (EXPECTED / name).read_bytes()
+        for name, text in before['accepted']['files'].items()))
+checks['reserved_objects_not_committed'] = all(
+    all(value.encode('utf-8') not in (ACTUAL / name).read_bytes() for value in reserved.values())
+    for name in actual_names)
+command = [str(EXE), 'same', str(EXPECTED / 'project.arcadia'), str(ACTUAL / 'project.arcadia')]
+env = os.environ.copy()
+env['PATH'] = str(STAGE / 'bin') + os.pathsep + env.get('PATH', '')
+started = datetime.datetime.now(datetime.timezone.utc).isoformat()
+tick = time.perf_counter()
+run = subprocess.run(command, cwd=ROOT, env=env, capture_output=True, text=True, encoding='utf-8', errors='replace', timeout=60)
+elapsed = time.perf_counter() - tick
+checks['oracle_same_pass'] = run.returncode == 0
+checks['input_files_unchanged'] = inputs == {str(p.relative_to(ROOT)): inventory(p) for p in (EXPECTED, ACTUAL)}
+checks['evidence_and_prior_manifest_unchanged'] = artifacts == [record(ROOT / item['path']) for item in artifacts]
+result = {'command_argv': command, 'exit_code': run.returncode,
+          'elapsed_seconds': round(elapsed, 6), 'stdout': run.stdout, 'stderr': run.stderr}
+(OUT / 'recovery-commands-results.log').write_text(json.dumps(result, indent=2) + '\n', encoding='utf-8', newline='\n')
+manifest = {'reviewer': 'Codex-9e8r6t /root/palette_finish', 'started_utc': started,
+            'finished_utc': datetime.datetime.now(datetime.timezone.utc).isoformat(),
+            'scope': 'Immutable evidence only; native observations supplied separately by root. No live work/profile/UI/Cargo access; no persisted Undo claim.',
+            'artifacts': artifacts, 'input_file_inventories': inputs, 'checks': checks,
+            'reserved_ids': reserved, 'reopen_recovery_cancel_direct_byte_comparisons': byte_results,
+            'comparison_origin': 'checkpoint-creation-reopen', 'command': result,
+            'log': record(OUT / 'recovery-commands-results.log'), 'pass': all(checks.values())}
+(OUT / 'recovery-manifest.json').write_text(json.dumps(manifest, indent=2) + '\n', encoding='utf-8', newline='\n')
+print(json.dumps({'pass': manifest['pass'], 'checks': checks, 'manifest': record(OUT / 'recovery-manifest.json')}))
+raise SystemExit(0 if manifest['pass'] else 1)
@@ -0,0 +1,93 @@
+"""Read only frozen checkpoints; run the existing v2 oracle without compiling."""
+from pathlib import Path
+import datetime
+import hashlib
+import json
+import os
+import subprocess
+import time
+
+ROOT = Path(__file__).resolve().parents[3]
+OUT = Path(__file__).resolve().parent
+STAGE = ROOT / '.local/native-qa/behavior-20260911-v4'
+BASE = ROOT / '.local/native-qa/palette-20260910-v3/checkpoint-transition-reopen'
+EXE = ROOT / '.local/behavior-creation-oracle-20260911/behavior-creation-contract-v2.exe'
+
+
+def record(path):
+    data = path.read_bytes()
+    return {'path': path.relative_to(ROOT).as_posix(), 'bytes': len(data),
+            'sha256': hashlib.sha256(data).hexdigest()}
+
+
+def inventory(directory):
+    return {p.relative_to(directory).as_posix(): {
+        'bytes': p.stat().st_size, 'sha256': hashlib.sha256(p.read_bytes()).hexdigest()
+    } for p in sorted(directory.rglob('*')) if p.is_file()}
+
+
+def entry(directory):
+    return str(directory / 'project.arcadia')
+
+
+checkpoints = {'baseline': BASE}
+for family in ('process', 'scenario', 'machine'):
+    for suffix in ('', '-undo', '-redo'):
+        checkpoints[family + suffix] = STAGE / ('checkpoint-' + family + suffix)
+checkpoints['creation-reopen'] = STAGE / 'checkpoint-creation-reopen'
+before = {name: inventory(path) for name, path in checkpoints.items()}
+artifacts = [record(p) for p in (
+    EXE, ROOT / 'harness/behavior-creation-contract.rs', Path(__file__),
+    STAGE / 'bin/arcadia-studio.exe', STAGE / 'bin/libunwind.dll',
+    STAGE / 'bin/manifest.json', STAGE / 'baseline-source-manifest.json',
+    STAGE / 'cancel-save-verification.json', STAGE / 'scenario-empty-saved.png',
+    STAGE / 'machine-created-saved.png')]
+assert artifacts[0]['sha256'] == '056eefd444924916bf6ac3c4897ab2ff4a8a4bb892e1dbc16adad32e59bf6a36'
+assert artifacts[1]['sha256'] == '51ab2ffa1826dd949b79f3a9690042a2f9e38daf9ed91517cade3861482117ba'
+commands = [('self-check', ['self-check', entry(BASE)]),
+            ('baseline', ['check', 'baseline', entry(BASE), entry(BASE), entry(BASE)])]
+previous = BASE
+for family in ('process', 'scenario', 'machine'):
+    first = checkpoints[family]
+    commands.extend([
+        (family, ['check', family, entry(BASE), entry(first), entry(first)]),
+        (family + '-undo', ['same', entry(previous), entry(checkpoints[family + '-undo']), entry(first)]),
+        (family + '-redo', ['check', family, entry(BASE), entry(checkpoints[family + '-redo']), entry(first)])])
+    previous = first
+commands.extend([
+    ('reopen-contract', ['check', 'machine', entry(BASE), entry(checkpoints['creation-reopen']), entry(checkpoints['machine'])]),
+    ('reopen-exact-redo', ['same', entry(checkpoints['machine-redo']), entry(checkpoints['creation-reopen'])])])
+env = os.environ.copy()
+env['PATH'] = str(STAGE / 'bin') + os.pathsep + env.get('PATH', '')
+started = datetime.datetime.now(datetime.timezone.utc).isoformat()
+results = []
+for label, args in commands:
+    t = time.perf_counter()
+    command = [str(EXE), *args]
+    run = subprocess.run(command, cwd=ROOT, env=env, capture_output=True, text=True, encoding='utf-8', errors='replace', timeout=60)
+    results.append({'label': label, 'command_argv': command, 'exit_code': run.returncode,
+                    'elapsed_seconds': round(time.perf_counter() - t, 6),
+                    'stdout': run.stdout, 'stderr': run.stderr})
+after = {name: inventory(path) for name, path in checkpoints.items()}
+redo_files = checkpoints['machine-redo']
+reopen_files = checkpoints['creation-reopen']
+same_names = set(before['machine-redo']) == set(before['creation-reopen'])
+byte_results = {name: (redo_files / name).read_bytes() == (reopen_files / name).read_bytes()
+                for name in before['machine-redo'] if (reopen_files / name).is_file()}
+success = (all(r['exit_code'] == 0 for r in results) and before == after
+           and same_names and all(byte_results.values()))
+log = '\n\n'.join(f"[{r['label']}] argv={json.dumps(r['command_argv'])}\nexit={r['exit_code']} elapsed={r['elapsed_seconds']}s\nstdout:\n{r['stdout']}stderr:\n{r['stderr']}" for r in results)
+(OUT / 'commands-results.log').write_text(log + '\n', encoding='utf-8', newline='\n')
+manifest = {'reviewer': 'Codex-9e8r6t /root/palette_finish', 'started_utc': started,
+            'finished_utc': datetime.datetime.now(datetime.timezone.utc).isoformat(),
+            'scope': 'Frozen checkpoints only; no live work/profile/UI access or compilation.',
+            'artifacts': artifacts, 'checkpoints': {name: {'path': path.relative_to(ROOT).as_posix(), 'files': before[name]} for name, path in checkpoints.items()},
+            'commands': results, 'all_checkpoint_files_unchanged': before == after,
+            'machine_redo_reopen_inventory_equal': same_names,
+            'machine_redo_reopen_direct_byte_comparisons': byte_results,
+            'log': record(OUT / 'commands-results.log'), 'pass': success}
+(OUT / 'manifest.json').write_text(json.dumps(manifest, indent=2) + '\n', encoding='utf-8', newline='\n')
+print(json.dumps({'pass': success, 'commands_passed': sum(r['exit_code'] == 0 for r in results),
+                  'commands_total': len(results), 'unchanged_checkpoints': before == after,
+                  'reopen_exact_files': len(byte_results), 'manifest': record(OUT / 'manifest.json')}))
+raise SystemExit(0 if success else 1)
@@ -0,0 +1,15 @@
+# Bounded a57 camera and minimum-window native checks
+
+Root exercised source `a57c334b302eb13352b4bb65df1c75d94d002348`, unoptimized GUI SHA256 `69DBB90FA299B3B3D90140C7934891F79166025893AF9B35B2B8D754A37A0D40`, in a fresh isolated session on 2026-09-12. Launch and close bind PID 5004 and unchanged GUI/runtime hashes. This is the pre-grapheme a57 executable: no clusters, native combined-source, all-zoom, package or full-product acceptance follows.
+
+The archiver independently viewed all 18 original JPEGs and checked the closed receipts; no new UI, oracle, compiler or application action was performed. Image 01 shows the wide source project opened. Images 02–06 show OA wide-W lifecycle at 100%, Create selected as `life_oa_110`, zoom 125%, Delete selected as `life_oa_112`, and Fit restoring 100%. Header text and Create text remain within the visible card/capsule or viewport; at 125% the headers are partly above the viewport, with no visible spill into the toolbar.
+
+Images 07–08 document native resizing from 1442×932 to 1102×932 and then 1102×732 captured frame; root reports the final client as 1100×700. At 100% the narrow viewport cuts the right side of the receiver card/capsule at its boundary. Images 09–12 show Fit 66%, OA Create selection, content shifted 60 pixels left after root's Right pan, and Delete selected at its new position with alias `life_oa_112`. The left header is then partly outside the viewport and clipped there. Images 13–17 show the SA CJK receiver: switching layer restores 100%; Fit gives 66%; Create selects `life_sa_110`; content moves 60 pixels up after root's Down pan, leaving headers above the viewport; selecting the moved Delete shows `life_sa_112`. No visible header bleed into the toolbar is present. Exact keyboard inputs and camera values (-60,0)/(0,-60) are root's action account, while the images independently support the resulting displacement, zoom labels and selection identities.
+
+At 66% labels are visibly small. These screenshots do not establish general readability, accessibility, focus/keyboard completeness, every clipping edge or every zoom. The visible 19 model checks are not zero diagnostics; the fixture intentionally contains sparse lifecycle cases. No model editing is inferred from selection or camera navigation.
+
+Image 18 records **All source files saved**. The closed lifecycle `same` invocation compares the original `baseline-wide/project.arcadia` with `checkpoints/wide-passive/project.arcadia`, exiting 0 at 2026-09-12T11:02:28.993557Z with `PASS same: all identities, fields, reachable source and physical bytes`. A fresh archival all-file comparison also confirms both directories contain exactly the same two files, 20,214 bytes total. The checker source, historical compilation/self-check/admission and binary/input provenance are included; no fresh checker execution or compilation is claimed by this archive.
+
+Root reports two temporary 1×16 captures during Windows sizing, recovered by fresh window selection and full capture before coordinate input. Those tiny captures are not among the 18 saved JPEGs and are not independently reconstructed here. Root then reports one Alt+F4 and fresh inventory without Studio. The waiting logger independently records exit 0 at 2026-09-12T11:02:56.0410831Z; closed stdout/stderr are empty. Launch's pending acceptance text is historical. This fresh successful bounded run is separate from the [earlier camera picker failure and close](../canvas-native-close-a57c334-20260911/README.md).
+
+`manifest.json` binds exact original/copy bytes. `readback.json` independently rereads original payloads, archived payloads and final metadata inventory. Preparation and provenance may mention clusters, other oracles, ZIPs, working files or prior gates; these are historical references, not acceptance of those cases. Executables, DLLs, ZIPs, profiles and live working directories are excluded. Source-only archival/preparation/launch scripts are records, not instructions to rerun. Root owns integration and publication.
@@ -0,0 +1,29 @@
+$ErrorActionPreference = 'Stop'
+$originRoot = 'C:\Users\User\Documents\Git\ARCADIA-Studio\.local\native-a57c334-camera'
+$destinationRoot = $PSScriptRoot
+$paths = @('launch-script-syntax.json','launch.json','normal-close.json','preparation-manifest.json','prepare-inputs.py','second-readback.json','wide-passive-status.json')
+foreach ($directory in @('baseline-wide','checkpoints/wide-passive','logs','provenance','screenshots')) {
+    $paths += Get-ChildItem -LiteralPath (Join-Path $originRoot $directory) -Recurse -File | ForEach-Object { $_.FullName.Substring($originRoot.Length + 1).Replace('\','/') }
+}
+$entries = @()
+foreach ($relative in ($paths | Sort-Object)) {
+    $original = Join-Path $originRoot $relative
+    $copy = Join-Path $destinationRoot $relative
+    if (Test-Path -LiteralPath $copy) { throw "Refusing to overwrite $copy" }
+    $before = (Get-FileHash -LiteralPath $original -Algorithm SHA256).Hash
+    New-Item -ItemType Directory -Path (Split-Path $copy) -Force | Out-Null
+    Copy-Item -LiteralPath $original -Destination $copy
+    $after = (Get-FileHash -LiteralPath $copy -Algorithm SHA256).Hash
+    if ($before -ne $after) { throw "Copy mismatch $relative" }
+    $entries += [ordered]@{path=$relative;original=$original;bytes=(Get-Item -LiteralPath $copy).Length;original_sha256=$before;copy_sha256=$after}
+}
+$original = 'C:\Users\User\Documents\Git\ARCADIA-Studio\.local\launch-native-a57c334-camera.ps1'
+$copy = Join-Path $destinationRoot 'launch-native-a57c334-camera.ps1'
+if (Test-Path -LiteralPath $copy) { throw "Refusing to overwrite $copy" }
+$before = (Get-FileHash -LiteralPath $original).Hash
+Copy-Item -LiteralPath $original -Destination $copy
+$after = (Get-FileHash -LiteralPath $copy).Hash
+if ($before -ne $after) { throw 'Launch script mismatch' }
+$entries += [ordered]@{path='launch-native-a57c334-camera.ps1';original=$original;bytes=(Get-Item -LiteralPath $copy).Length;original_sha256=$before;copy_sha256=$after}
+$manifest = [ordered]@{created_utc=[DateTime]::UtcNow.ToString('o');scope='Closed a57 camera evidence only; copying does not execute gates or UI';payload_count=$entries.Count;payload_bytes=($entries|ForEach-Object { $_.bytes }|Measure-Object -Sum).Sum;files=$entries;excluded=@('bin','oracles executables/DLL','baseline-clusters','working-wide','working-clusters','profile','unrelated-cwd','ZIP archives')}
+[IO.File]::WriteAllText((Join-Path $destinationRoot 'manifest.json'),($manifest|ConvertTo-Json -Depth 6)+"`n",[Text.UTF8Encoding]::new($false))
@@ -0,0 +1,692 @@
+arcadia 7;
+project lifecycle_native "Lifecycle native contract" id "5ceab400-0000-4000-8000-000000000001" {
+    include "rationale.arcadia";
+    description "Fixed semantic inputs; lifecycle geometry is derived and never authored.";
+
+    oa_activity life_oa_10 "OA Controller work" id "5ceab400-0000-4000-8000-0000000003f2" {
+        description "";
+        parent none;
+    }
+
+    oa_activity life_oa_11 "OA Receiver work" id "5ceab400-0000-4000-8000-0000000003f3" {
+        description "";
+        parent none;
+    }
+
+    oa_scenario life_oa_100 "OA 01 Root create action delete" id "5ceab400-0000-4000-8000-00000000044c" {
+        context none;
+        description "";
+        parent none;
+        postcondition "";
+        precondition "";
+        steps [@life_oa_110, @life_oa_111, @life_oa_112];
+        viewpoint OperationalActivity;
+    }
+
+    oa_lifeline life_oa_101 "OA Controller lane" id "5ceab400-0000-4000-8000-00000000044d" {
+        description "";
+        parent @life_oa_100;
+        represented @life_oa_10;
+    }
+
+    oa_lifeline life_oa_102 "WWWWWWWWWWWWWWWWWW" id "5ceab400-0000-4000-8000-00000000044e" {
+        description "";
+        parent @life_oa_100;
+        represented @life_oa_11;
+    }
+
+    oa_occurrence life_oa_110 "OA Create receiver" id "5ceab400-0000-4000-8000-000000000456" {
+        body {
+            Exchange {
+                exchange @life_oa_service;
+                message_kind Create;
+                receiver @life_oa_102;
+                reply_to none;
+                sender @life_oa_101;
+                values [];
+            };
+        };
+        description "";
+        parent @life_oa_100;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_occurrence life_oa_111 "OA Receiver action" id "5ceab400-0000-4000-8000-000000000457" {
+        body {
+            Action {
+                action @life_oa_11;
+                lifeline @life_oa_102;
+            };
+        };
+        description "";
+        parent @life_oa_100;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_occurrence life_oa_112 "OA Delete receiver" id "5ceab400-0000-4000-8000-000000000458" {
+        body {
+            Exchange {
+                exchange @life_oa_service;
+                message_kind Delete;
+                receiver @life_oa_102;
+                reply_to none;
+                sender @life_oa_101;
+                values [];
+            };
+        };
+        description "";
+        parent @life_oa_100;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_scenario life_oa_200 "OA 02 Preexisting empty" id "5ceab400-0000-4000-8000-0000000004b0" {
+        context none;
+        description "";
+        parent none;
+        postcondition "";
+        precondition "";
+        steps [];
+        viewpoint OperationalActivity;
+    }
+
+    oa_lifeline life_oa_201 "OA Controller lane" id "5ceab400-0000-4000-8000-0000000004b1" {
+        description "";
+        parent @life_oa_200;
+        represented @life_oa_10;
+    }
+
+    oa_lifeline life_oa_202 "OA Receiver lane" id "5ceab400-0000-4000-8000-0000000004b2" {
+        description "";
+        parent @life_oa_200;
+        represented @life_oa_11;
+    }
+
+    oa_scenario life_oa_300 "OA 03 Create only" id "5ceab400-0000-4000-8000-000000000514" {
+        context none;
+        description "";
+        parent none;
+        postcondition "";
+        precondition "";
+        steps [@life_oa_310];
+        viewpoint OperationalActivity;
+    }
+
+    oa_lifeline life_oa_301 "OA Controller lane" id "5ceab400-0000-4000-8000-000000000515" {
+        description "";
+        parent @life_oa_300;
+        represented @life_oa_10;
+    }
+
+    oa_lifeline life_oa_302 "OA Receiver lane" id "5ceab400-0000-4000-8000-000000000516" {
+        description "";
+        parent @life_oa_300;
+        represented @life_oa_11;
+    }
+
+    oa_occurrence life_oa_310 "OA Create only receiver" id "5ceab400-0000-4000-8000-00000000051e" {
+        body {
+            Exchange {
+                exchange @life_oa_service;
+                message_kind Create;
+                receiver @life_oa_302;
+                reply_to none;
+                sender @life_oa_301;
+                values [];
+            };
+        };
+        description "";
+        parent @life_oa_300;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_scenario life_oa_400 "OA 04 Conditional delete" id "5ceab400-0000-4000-8000-000000000578" {
+        context none;
+        description "";
+        parent none;
+        postcondition "";
+        precondition "";
+        steps [@life_oa_410, @life_oa_411];
+        viewpoint OperationalActivity;
+    }
+
+    oa_lifeline life_oa_401 "OA Controller lane" id "5ceab400-0000-4000-8000-000000000579" {
+        description "";
+        parent @life_oa_400;
+        represented @life_oa_10;
+    }
+
+    oa_lifeline life_oa_402 "OA Receiver lane" id "5ceab400-0000-4000-8000-00000000057a" {
+        description "";
+        parent @life_oa_400;
+        represented @life_oa_11;
+    }
+
+    oa_occurrence life_oa_410 "OA Open call" id "5ceab400-0000-4000-8000-000000000582" {
+        body {
+            Exchange {
+                exchange @life_oa_service;
+                message_kind Call;
+                receiver @life_oa_402;
+                reply_to none;
+                sender @life_oa_401;
+                values [];
+            };
+        };
+        description "";
+        parent @life_oa_400;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_occurrence life_oa_411 "OA ALT delete or keep" id "5ceab400-0000-4000-8000-000000000583" {
+        body {
+            Fragment {
+                branches [@life_oa_412, @life_oa_413];
+                operator Alternative;
+            };
+        };
+        description "";
+        parent @life_oa_400;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_occurrence life_oa_412 "OA Left delete operand" id "5ceab400-0000-4000-8000-000000000584" {
+        body {
+            Branch {
+                guard "stop_requested";
+                occurrences [@life_oa_414];
+            };
+        };
+        description "";
+        parent @life_oa_411;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_occurrence life_oa_413 "OA Right empty operand" id "5ceab400-0000-4000-8000-000000000585" {
+        body {
+            Branch {
+                guard "else";
+                occurrences [];
+            };
+        };
+        description "";
+        parent @life_oa_411;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_occurrence life_oa_414 "OA Conditional delete receiver" id "5ceab400-0000-4000-8000-000000000586" {
+        body {
+            Exchange {
+                exchange @life_oa_service;
+                message_kind Delete;
+                receiver @life_oa_402;
+                reply_to none;
+                sender @life_oa_401;
+                values [];
+            };
+        };
+        description "";
+        parent @life_oa_412;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_scenario life_oa_500 "OA 05 Unassigned receiver" id "5ceab400-0000-4000-8000-0000000005dc" {
+        context none;
+        description "";
+        parent none;
+        postcondition "";
+        precondition "";
+        steps [@life_oa_510, @life_oa_511];
+        viewpoint OperationalActivity;
+    }
+
+    oa_lifeline life_oa_501 "OA Controller lane" id "5ceab400-0000-4000-8000-0000000005dd" {
+        description "";
+        parent @life_oa_500;
+        represented @life_oa_10;
+    }
+
+    oa_lifeline life_oa_502 "OA Unassigned receiver lane" id "5ceab400-0000-4000-8000-0000000005de" {
+        description "";
+        parent @life_oa_500;
+        represented none;
+    }
+
+    oa_occurrence life_oa_510 "OA Create unassigned receiver" id "5ceab400-0000-4000-8000-0000000005e6" {
+        body {
+            Exchange {
+                exchange none;
+                message_kind Create;
+                receiver @life_oa_502;
+                reply_to none;
+                sender @life_oa_501;
+                values [];
+            };
+        };
+        description "";
+        parent @life_oa_500;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_occurrence life_oa_511 "OA Delete unassigned receiver" id "5ceab400-0000-4000-8000-0000000005e7" {
+        body {
+            Exchange {
+                exchange none;
+                message_kind Delete;
+                receiver @life_oa_502;
+                reply_to none;
+                sender @life_oa_501;
+                values [];
+            };
+        };
+        description "";
+        parent @life_oa_500;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_scenario life_oa_600 "OA 06 Self delete" id "5ceab400-0000-4000-8000-000000000640" {
+        context none;
+        description "";
+        parent none;
+        postcondition "";
+        precondition "";
+        steps [@life_oa_610];
+        viewpoint OperationalActivity;
+    }
+
+    oa_lifeline life_oa_601 "OA Controller lane" id "5ceab400-0000-4000-8000-000000000641" {
+        description "";
+        parent @life_oa_600;
+        represented @life_oa_10;
+    }
+
+    oa_occurrence life_oa_610 "OA Self delete controller" id "5ceab400-0000-4000-8000-00000000064a" {
+        body {
+            Exchange {
+                exchange none;
+                message_kind Delete;
+                receiver @life_oa_601;
+                reply_to none;
+                sender @life_oa_601;
+                values [];
+            };
+        };
+        description "";
+        parent @life_oa_600;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_function life_sa_10 "SA Controller work" id "5ceab400-0000-4000-8000-0000000007da" {
+        description "";
+        parent none;
+    }
+
+    sa_function life_sa_11 "SA Receiver work" id "5ceab400-0000-4000-8000-0000000007db" {
+        description "";
+        parent none;
+    }
+
+    sa_scenario life_sa_100 "SA 01 Root create action delete" id "5ceab400-0000-4000-8000-000000000834" {
+        context none;
+        description "";
+        parent none;
+        postcondition "";
+        precondition "";
+        steps [@life_sa_110, @life_sa_111, @life_sa_112];
+        viewpoint Functional;
+    }
+
+    sa_lifeline life_sa_101 "SA Controller lane" id "5ceab400-0000-4000-8000-000000000835" {
+        description "";
+        parent @life_sa_100;
+        represented @life_sa_10;
+    }
+
+    sa_lifeline life_sa_102 "界界界界界界界界界界界界界界界界界界" id "5ceab400-0000-4000-8000-000000000836" {
+        description "";
+        parent @life_sa_100;
+        represented @life_sa_11;
+    }
+
+    sa_occurrence life_sa_110 "SA Create receiver" id "5ceab400-0000-4000-8000-00000000083e" {
+        body {
+            Exchange {
+                exchange @life_sa_service;
+                message_kind Create;
+                receiver @life_sa_102;
+                reply_to none;
+                sender @life_sa_101;
+                values [];
+            };
+        };
+        description "";
+        parent @life_sa_100;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_occurrence life_sa_111 "SA Receiver action" id "5ceab400-0000-4000-8000-00000000083f" {
+        body {
+            Action {
+                action @life_sa_11;
+                lifeline @life_sa_102;
+            };
+        };
+        description "";
+        parent @life_sa_100;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_occurrence life_sa_112 "SA Delete receiver" id "5ceab400-0000-4000-8000-000000000840" {
+        body {
+            Exchange {
+                exchange @life_sa_service;
+                message_kind Delete;
+                receiver @life_sa_102;
+                reply_to none;
+                sender @life_sa_101;
+                values [];
+            };
+        };
+        description "";
+        parent @life_sa_100;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_scenario life_sa_200 "SA 02 Preexisting empty" id "5ceab400-0000-4000-8000-000000000898" {
+        context none;
+        description "";
+        parent none;
+        postcondition "";
+        precondition "";
+        steps [];
+        viewpoint Functional;
+    }
+
+    sa_lifeline life_sa_201 "SA Controller lane" id "5ceab400-0000-4000-8000-000000000899" {
+        description "";
+        parent @life_sa_200;
+        represented @life_sa_10;
+    }
+
+    sa_lifeline life_sa_202 "SA Receiver lane" id "5ceab400-0000-4000-8000-00000000089a" {
+        description "";
+        parent @life_sa_200;
+        represented @life_sa_11;
+    }
+
+    sa_scenario life_sa_300 "SA 03 Create only" id "5ceab400-0000-4000-8000-0000000008fc" {
+        context none;
+        description "";
+        parent none;
+        postcondition "";
+        precondition "";
+        steps [@life_sa_310];
+        viewpoint Functional;
+    }
+
+    sa_lifeline life_sa_301 "SA Controller lane" id "5ceab400-0000-4000-8000-0000000008fd" {
+        description "";
+        parent @life_sa_300;
+        represented @life_sa_10;
+    }
+
+    sa_lifeline life_sa_302 "SA Receiver lane" id "5ceab400-0000-4000-8000-0000000008fe" {
+        description "";
+        parent @life_sa_300;
+        represented @life_sa_11;
+    }
+
+    sa_occurrence life_sa_310 "SA Create only receiver" id "5ceab400-0000-4000-8000-000000000906" {
+        body {
+            Exchange {
+                exchange @life_sa_service;
+                message_kind Create;
+                receiver @life_sa_302;
+                reply_to none;
+                sender @life_sa_301;
+                values [];
+            };
+        };
+        description "";
+        parent @life_sa_300;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_scenario life_sa_400 "SA 04 Conditional delete" id "5ceab400-0000-4000-8000-000000000960" {
+        context none;
+        description "";
+        parent none;
+        postcondition "";
+        precondition "";
+        steps [@life_sa_410, @life_sa_411];
+        viewpoint Functional;
+    }
+
+    sa_lifeline life_sa_401 "SA Controller lane" id "5ceab400-0000-4000-8000-000000000961" {
+        description "";
+        parent @life_sa_400;
+        represented @life_sa_10;
+    }
+
+    sa_lifeline life_sa_402 "SA Receiver lane" id "5ceab400-0000-4000-8000-000000000962" {
+        description "";
+        parent @life_sa_400;
+        represented @life_sa_11;
+    }
+
+    sa_occurrence life_sa_410 "SA Open call" id "5ceab400-0000-4000-8000-00000000096a" {
+        body {
+            Exchange {
+                exchange @life_sa_service;
+                message_kind Call;
+                receiver @life_sa_402;
+                reply_to none;
+                sender @life_sa_401;
+                values [];
+            };
+        };
+        description "";
+        parent @life_sa_400;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_occurrence life_sa_411 "SA ALT delete or keep" id "5ceab400-0000-4000-8000-00000000096b" {
+        body {
+            Fragment {
+                branches [@life_sa_412, @life_sa_413];
+                operator Alternative;
+            };
+        };
+        description "";
+        parent @life_sa_400;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_occurrence life_sa_412 "SA Left delete operand" id "5ceab400-0000-4000-8000-00000000096c" {
+        body {
+            Branch {
+                guard "stop_requested";
+                occurrences [@life_sa_414];
+            };
+        };
+        description "";
+        parent @life_sa_411;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_occurrence life_sa_413 "SA Right empty operand" id "5ceab400-0000-4000-8000-00000000096d" {
+        body {
+            Branch {
+                guard "else";
+                occurrences [];
+            };
+        };
+        description "";
+        parent @life_sa_411;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_occurrence life_sa_414 "SA Conditional delete receiver" id "5ceab400-0000-4000-8000-00000000096e" {
+        body {
+            Exchange {
+                exchange @life_sa_service;
+                message_kind Delete;
+                receiver @life_sa_402;
+                reply_to none;
+                sender @life_sa_401;
+                values [];
+            };
+        };
+        description "";
+        parent @life_sa_412;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_scenario life_sa_500 "SA 05 Unassigned receiver" id "5ceab400-0000-4000-8000-0000000009c4" {
+        context none;
+        description "";
+        parent none;
+        postcondition "";
+        precondition "";
+        steps [@life_sa_510, @life_sa_511];
+        viewpoint Functional;
+    }
+
+    sa_lifeline life_sa_501 "SA Controller lane" id "5ceab400-0000-4000-8000-0000000009c5" {
+        description "";
+        parent @life_sa_500;
+        represented @life_sa_10;
+    }
+
+    sa_lifeline life_sa_502 "SA Unassigned receiver lane" id "5ceab400-0000-4000-8000-0000000009c6" {
+        description "";
+        parent @life_sa_500;
+        represented none;
+    }
+
+    sa_occurrence life_sa_510 "SA Create unassigned receiver" id "5ceab400-0000-4000-8000-0000000009ce" {
+        body {
+            Exchange {
+                exchange none;
+                message_kind Create;
+                receiver @life_sa_502;
+                reply_to none;
+                sender @life_sa_501;
+                values [];
+            };
+        };
+        description "";
+        parent @life_sa_500;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_occurrence life_sa_511 "SA Delete unassigned receiver" id "5ceab400-0000-4000-8000-0000000009cf" {
+        body {
+            Exchange {
+                exchange none;
+                message_kind Delete;
+                receiver @life_sa_502;
+                reply_to none;
+                sender @life_sa_501;
+                values [];
+            };
+        };
+        description "";
+        parent @life_sa_500;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_scenario life_sa_600 "SA 06 Self delete" id "5ceab400-0000-4000-8000-000000000a28" {
+        context none;
+        description "";
+        parent none;
+        postcondition "";
+        precondition "";
+        steps [@life_sa_610];
+        viewpoint Functional;
+    }
+
+    sa_lifeline life_sa_601 "SA Controller lane" id "5ceab400-0000-4000-8000-000000000a29" {
+        description "";
+        parent @life_sa_600;
+        represented @life_sa_10;
+    }
+
+    sa_occurrence life_sa_610 "SA Self delete controller" id "5ceab400-0000-4000-8000-000000000a32" {
+        body {
+            Exchange {
+                exchange none;
+                message_kind Delete;
+                receiver @life_sa_601;
+                reply_to none;
+                sender @life_sa_601;
+                values [];
+            };
+        };
+        description "";
+        parent @life_sa_600;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_port sa_lifecycle_service_input "SA Lifecycle service input" id "a4a6ecc0-3e12-51a5-b08b-199ad743525c" {
+        contract {
+            FunctionInput {
+                incoming_items [];
+            };
+        };
+        description "";
+        legacy none;
+        parent @life_sa_11;
+    }
+
+    sa_port sa_lifecycle_service_output "SA Lifecycle service output" id "b1aa66c4-0e8e-5091-beda-2b8d2005b688" {
+        contract {
+            FunctionOutput {
+                outgoing_items [];
+            };
+        };
+        description "";
+        legacy none;
+        parent @life_sa_10;
+    }
+
+    interaction life_oa_service "OA Lifecycle service" id "5ceab400-0000-4000-8000-0000000003f4" {
+        description "";
+        items [];
+        source @life_oa_10;
+        target @life_oa_11;
+    }
+
+    functional_exchange life_sa_service "SA Lifecycle service" id "5ceab400-0000-4000-8000-0000000007dc" {
+        description "";
+        items [];
+        source @life_sa_10;
+        source_port @sa_lifecycle_service_output;
+        target @life_sa_11;
+        target_port @sa_lifecycle_service_input;
+    }
+
+}
@@ -0,0 +1,2 @@
+// Preserve lifecycle note: 雨 · receiver.
+// Geometry never changes these bytes.
@@ -0,0 +1,692 @@
+arcadia 7;
+project lifecycle_native "Lifecycle native contract" id "5ceab400-0000-4000-8000-000000000001" {
+    include "rationale.arcadia";
+    description "Fixed semantic inputs; lifecycle geometry is derived and never authored.";
+
+    oa_activity life_oa_10 "OA Controller work" id "5ceab400-0000-4000-8000-0000000003f2" {
+        description "";
+        parent none;
+    }
+
+    oa_activity life_oa_11 "OA Receiver work" id "5ceab400-0000-4000-8000-0000000003f3" {
+        description "";
+        parent none;
+    }
+
+    oa_scenario life_oa_100 "OA 01 Root create action delete" id "5ceab400-0000-4000-8000-00000000044c" {
+        context none;
+        description "";
+        parent none;
+        postcondition "";
+        precondition "";
+        steps [@life_oa_110, @life_oa_111, @life_oa_112];
+        viewpoint OperationalActivity;
+    }
+
+    oa_lifeline life_oa_101 "OA Controller lane" id "5ceab400-0000-4000-8000-00000000044d" {
+        description "";
+        parent @life_oa_100;
+        represented @life_oa_10;
+    }
+
+    oa_lifeline life_oa_102 "WWWWWWWWWWWWWWWWWW" id "5ceab400-0000-4000-8000-00000000044e" {
+        description "";
+        parent @life_oa_100;
+        represented @life_oa_11;
+    }
+
+    oa_occurrence life_oa_110 "OA Create receiver" id "5ceab400-0000-4000-8000-000000000456" {
+        body {
+            Exchange {
+                exchange @life_oa_service;
+                message_kind Create;
+                receiver @life_oa_102;
+                reply_to none;
+                sender @life_oa_101;
+                values [];
+            };
+        };
+        description "";
+        parent @life_oa_100;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_occurrence life_oa_111 "OA Receiver action" id "5ceab400-0000-4000-8000-000000000457" {
+        body {
+            Action {
+                action @life_oa_11;
+                lifeline @life_oa_102;
+            };
+        };
+        description "";
+        parent @life_oa_100;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_occurrence life_oa_112 "OA Delete receiver" id "5ceab400-0000-4000-8000-000000000458" {
+        body {
+            Exchange {
+                exchange @life_oa_service;
+                message_kind Delete;
+                receiver @life_oa_102;
+                reply_to none;
+                sender @life_oa_101;
+                values [];
+            };
+        };
+        description "";
+        parent @life_oa_100;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_scenario life_oa_200 "OA 02 Preexisting empty" id "5ceab400-0000-4000-8000-0000000004b0" {
+        context none;
+        description "";
+        parent none;
+        postcondition "";
+        precondition "";
+        steps [];
+        viewpoint OperationalActivity;
+    }
+
+    oa_lifeline life_oa_201 "OA Controller lane" id "5ceab400-0000-4000-8000-0000000004b1" {
+        description "";
+        parent @life_oa_200;
+        represented @life_oa_10;
+    }
+
+    oa_lifeline life_oa_202 "OA Receiver lane" id "5ceab400-0000-4000-8000-0000000004b2" {
+        description "";
+        parent @life_oa_200;
+        represented @life_oa_11;
+    }
+
+    oa_scenario life_oa_300 "OA 03 Create only" id "5ceab400-0000-4000-8000-000000000514" {
+        context none;
+        description "";
+        parent none;
+        postcondition "";
+        precondition "";
+        steps [@life_oa_310];
+        viewpoint OperationalActivity;
+    }
+
+    oa_lifeline life_oa_301 "OA Controller lane" id "5ceab400-0000-4000-8000-000000000515" {
+        description "";
+        parent @life_oa_300;
+        represented @life_oa_10;
+    }
+
+    oa_lifeline life_oa_302 "OA Receiver lane" id "5ceab400-0000-4000-8000-000000000516" {
+        description "";
+        parent @life_oa_300;
+        represented @life_oa_11;
+    }
+
+    oa_occurrence life_oa_310 "OA Create only receiver" id "5ceab400-0000-4000-8000-00000000051e" {
+        body {
+            Exchange {
+                exchange @life_oa_service;
+                message_kind Create;
+                receiver @life_oa_302;
+                reply_to none;
+                sender @life_oa_301;
+                values [];
+            };
+        };
+        description "";
+        parent @life_oa_300;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_scenario life_oa_400 "OA 04 Conditional delete" id "5ceab400-0000-4000-8000-000000000578" {
+        context none;
+        description "";
+        parent none;
+        postcondition "";
+        precondition "";
+        steps [@life_oa_410, @life_oa_411];
+        viewpoint OperationalActivity;
+    }
+
+    oa_lifeline life_oa_401 "OA Controller lane" id "5ceab400-0000-4000-8000-000000000579" {
+        description "";
+        parent @life_oa_400;
+        represented @life_oa_10;
+    }
+
+    oa_lifeline life_oa_402 "OA Receiver lane" id "5ceab400-0000-4000-8000-00000000057a" {
+        description "";
+        parent @life_oa_400;
+        represented @life_oa_11;
+    }
+
+    oa_occurrence life_oa_410 "OA Open call" id "5ceab400-0000-4000-8000-000000000582" {
+        body {
+            Exchange {
+                exchange @life_oa_service;
+                message_kind Call;
+                receiver @life_oa_402;
+                reply_to none;
+                sender @life_oa_401;
+                values [];
+            };
+        };
+        description "";
+        parent @life_oa_400;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_occurrence life_oa_411 "OA ALT delete or keep" id "5ceab400-0000-4000-8000-000000000583" {
+        body {
+            Fragment {
+                branches [@life_oa_412, @life_oa_413];
+                operator Alternative;
+            };
+        };
+        description "";
+        parent @life_oa_400;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_occurrence life_oa_412 "OA Left delete operand" id "5ceab400-0000-4000-8000-000000000584" {
+        body {
+            Branch {
+                guard "stop_requested";
+                occurrences [@life_oa_414];
+            };
+        };
+        description "";
+        parent @life_oa_411;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_occurrence life_oa_413 "OA Right empty operand" id "5ceab400-0000-4000-8000-000000000585" {
+        body {
+            Branch {
+                guard "else";
+                occurrences [];
+            };
+        };
+        description "";
+        parent @life_oa_411;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_occurrence life_oa_414 "OA Conditional delete receiver" id "5ceab400-0000-4000-8000-000000000586" {
+        body {
+            Exchange {
+                exchange @life_oa_service;
+                message_kind Delete;
+                receiver @life_oa_402;
+                reply_to none;
+                sender @life_oa_401;
+                values [];
+            };
+        };
+        description "";
+        parent @life_oa_412;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_scenario life_oa_500 "OA 05 Unassigned receiver" id "5ceab400-0000-4000-8000-0000000005dc" {
+        context none;
+        description "";
+        parent none;
+        postcondition "";
+        precondition "";
+        steps [@life_oa_510, @life_oa_511];
+        viewpoint OperationalActivity;
+    }
+
+    oa_lifeline life_oa_501 "OA Controller lane" id "5ceab400-0000-4000-8000-0000000005dd" {
+        description "";
+        parent @life_oa_500;
+        represented @life_oa_10;
+    }
+
+    oa_lifeline life_oa_502 "OA Unassigned receiver lane" id "5ceab400-0000-4000-8000-0000000005de" {
+        description "";
+        parent @life_oa_500;
+        represented none;
+    }
+
+    oa_occurrence life_oa_510 "OA Create unassigned receiver" id "5ceab400-0000-4000-8000-0000000005e6" {
+        body {
+            Exchange {
+                exchange none;
+                message_kind Create;
+                receiver @life_oa_502;
+                reply_to none;
+                sender @life_oa_501;
+                values [];
+            };
+        };
+        description "";
+        parent @life_oa_500;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_occurrence life_oa_511 "OA Delete unassigned receiver" id "5ceab400-0000-4000-8000-0000000005e7" {
+        body {
+            Exchange {
+                exchange none;
+                message_kind Delete;
+                receiver @life_oa_502;
+                reply_to none;
+                sender @life_oa_501;
+                values [];
+            };
+        };
+        description "";
+        parent @life_oa_500;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_scenario life_oa_600 "OA 06 Self delete" id "5ceab400-0000-4000-8000-000000000640" {
+        context none;
+        description "";
+        parent none;
+        postcondition "";
+        precondition "";
+        steps [@life_oa_610];
+        viewpoint OperationalActivity;
+    }
+
+    oa_lifeline life_oa_601 "OA Controller lane" id "5ceab400-0000-4000-8000-000000000641" {
+        description "";
+        parent @life_oa_600;
+        represented @life_oa_10;
+    }
+
+    oa_occurrence life_oa_610 "OA Self delete controller" id "5ceab400-0000-4000-8000-00000000064a" {
+        body {
+            Exchange {
+                exchange none;
+                message_kind Delete;
+                receiver @life_oa_601;
+                reply_to none;
+                sender @life_oa_601;
+                values [];
+            };
+        };
+        description "";
+        parent @life_oa_600;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_function life_sa_10 "SA Controller work" id "5ceab400-0000-4000-8000-0000000007da" {
+        description "";
+        parent none;
+    }
+
+    sa_function life_sa_11 "SA Receiver work" id "5ceab400-0000-4000-8000-0000000007db" {
+        description "";
+        parent none;
+    }
+
+    sa_scenario life_sa_100 "SA 01 Root create action delete" id "5ceab400-0000-4000-8000-000000000834" {
+        context none;
+        description "";
+        parent none;
+        postcondition "";
+        precondition "";
+        steps [@life_sa_110, @life_sa_111, @life_sa_112];
+        viewpoint Functional;
+    }
+
+    sa_lifeline life_sa_101 "SA Controller lane" id "5ceab400-0000-4000-8000-000000000835" {
+        description "";
+        parent @life_sa_100;
+        represented @life_sa_10;
+    }
+
+    sa_lifeline life_sa_102 "界界界界界界界界界界界界界界界界界界" id "5ceab400-0000-4000-8000-000000000836" {
+        description "";
+        parent @life_sa_100;
+        represented @life_sa_11;
+    }
+
+    sa_occurrence life_sa_110 "SA Create receiver" id "5ceab400-0000-4000-8000-00000000083e" {
+        body {
+            Exchange {
+                exchange @life_sa_service;
+                message_kind Create;
+                receiver @life_sa_102;
+                reply_to none;
+                sender @life_sa_101;
+                values [];
+            };
+        };
+        description "";
+        parent @life_sa_100;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_occurrence life_sa_111 "SA Receiver action" id "5ceab400-0000-4000-8000-00000000083f" {
+        body {
+            Action {
+                action @life_sa_11;
+                lifeline @life_sa_102;
+            };
+        };
+        description "";
+        parent @life_sa_100;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_occurrence life_sa_112 "SA Delete receiver" id "5ceab400-0000-4000-8000-000000000840" {
+        body {
+            Exchange {
+                exchange @life_sa_service;
+                message_kind Delete;
+                receiver @life_sa_102;
+                reply_to none;
+                sender @life_sa_101;
+                values [];
+            };
+        };
+        description "";
+        parent @life_sa_100;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_scenario life_sa_200 "SA 02 Preexisting empty" id "5ceab400-0000-4000-8000-000000000898" {
+        context none;
+        description "";
+        parent none;
+        postcondition "";
+        precondition "";
+        steps [];
+        viewpoint Functional;
+    }
+
+    sa_lifeline life_sa_201 "SA Controller lane" id "5ceab400-0000-4000-8000-000000000899" {
+        description "";
+        parent @life_sa_200;
+        represented @life_sa_10;
+    }
+
+    sa_lifeline life_sa_202 "SA Receiver lane" id "5ceab400-0000-4000-8000-00000000089a" {
+        description "";
+        parent @life_sa_200;
+        represented @life_sa_11;
+    }
+
+    sa_scenario life_sa_300 "SA 03 Create only" id "5ceab400-0000-4000-8000-0000000008fc" {
+        context none;
+        description "";
+        parent none;
+        postcondition "";
+        precondition "";
+        steps [@life_sa_310];
+        viewpoint Functional;
+    }
+
+    sa_lifeline life_sa_301 "SA Controller lane" id "5ceab400-0000-4000-8000-0000000008fd" {
+        description "";
+        parent @life_sa_300;
+        represented @life_sa_10;
+    }
+
+    sa_lifeline life_sa_302 "SA Receiver lane" id "5ceab400-0000-4000-8000-0000000008fe" {
+        description "";
+        parent @life_sa_300;
+        represented @life_sa_11;
+    }
+
+    sa_occurrence life_sa_310 "SA Create only receiver" id "5ceab400-0000-4000-8000-000000000906" {
+        body {
+            Exchange {
+                exchange @life_sa_service;
+                message_kind Create;
+                receiver @life_sa_302;
+                reply_to none;
+                sender @life_sa_301;
+                values [];
+            };
+        };
+        description "";
+        parent @life_sa_300;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_scenario life_sa_400 "SA 04 Conditional delete" id "5ceab400-0000-4000-8000-000000000960" {
+        context none;
+        description "";
+        parent none;
+        postcondition "";
+        precondition "";
+        steps [@life_sa_410, @life_sa_411];
+        viewpoint Functional;
+    }
+
+    sa_lifeline life_sa_401 "SA Controller lane" id "5ceab400-0000-4000-8000-000000000961" {
+        description "";
+        parent @life_sa_400;
+        represented @life_sa_10;
+    }
+
+    sa_lifeline life_sa_402 "SA Receiver lane" id "5ceab400-0000-4000-8000-000000000962" {
+        description "";
+        parent @life_sa_400;
+        represented @life_sa_11;
+    }
+
+    sa_occurrence life_sa_410 "SA Open call" id "5ceab400-0000-4000-8000-00000000096a" {
+        body {
+            Exchange {
+                exchange @life_sa_service;
+                message_kind Call;
+                receiver @life_sa_402;
+                reply_to none;
+                sender @life_sa_401;
+                values [];
+            };
+        };
+        description "";
+        parent @life_sa_400;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_occurrence life_sa_411 "SA ALT delete or keep" id "5ceab400-0000-4000-8000-00000000096b" {
+        body {
+            Fragment {
+                branches [@life_sa_412, @life_sa_413];
+                operator Alternative;
+            };
+        };
+        description "";
+        parent @life_sa_400;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_occurrence life_sa_412 "SA Left delete operand" id "5ceab400-0000-4000-8000-00000000096c" {
+        body {
+            Branch {
+                guard "stop_requested";
+                occurrences [@life_sa_414];
+            };
+        };
+        description "";
+        parent @life_sa_411;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_occurrence life_sa_413 "SA Right empty operand" id "5ceab400-0000-4000-8000-00000000096d" {
+        body {
+            Branch {
+                guard "else";
+                occurrences [];
+            };
+        };
+        description "";
+        parent @life_sa_411;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_occurrence life_sa_414 "SA Conditional delete receiver" id "5ceab400-0000-4000-8000-00000000096e" {
+        body {
+            Exchange {
+                exchange @life_sa_service;
+                message_kind Delete;
+                receiver @life_sa_402;
+                reply_to none;
+                sender @life_sa_401;
+                values [];
+            };
+        };
+        description "";
+        parent @life_sa_412;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_scenario life_sa_500 "SA 05 Unassigned receiver" id "5ceab400-0000-4000-8000-0000000009c4" {
+        context none;
+        description "";
+        parent none;
+        postcondition "";
+        precondition "";
+        steps [@life_sa_510, @life_sa_511];
+        viewpoint Functional;
+    }
+
+    sa_lifeline life_sa_501 "SA Controller lane" id "5ceab400-0000-4000-8000-0000000009c5" {
+        description "";
+        parent @life_sa_500;
+        represented @life_sa_10;
+    }
+
+    sa_lifeline life_sa_502 "SA Unassigned receiver lane" id "5ceab400-0000-4000-8000-0000000009c6" {
+        description "";
+        parent @life_sa_500;
+        represented none;
+    }
+
+    sa_occurrence life_sa_510 "SA Create unassigned receiver" id "5ceab400-0000-4000-8000-0000000009ce" {
+        body {
+            Exchange {
+                exchange none;
+                message_kind Create;
+                receiver @life_sa_502;
+                reply_to none;
+                sender @life_sa_501;
+                values [];
+            };
+        };
+        description "";
+        parent @life_sa_500;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_occurrence life_sa_511 "SA Delete unassigned receiver" id "5ceab400-0000-4000-8000-0000000009cf" {
+        body {
+            Exchange {
+                exchange none;
+                message_kind Delete;
+                receiver @life_sa_502;
+                reply_to none;
+                sender @life_sa_501;
+                values [];
+            };
+        };
+        description "";
+        parent @life_sa_500;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_scenario life_sa_600 "SA 06 Self delete" id "5ceab400-0000-4000-8000-000000000a28" {
+        context none;
+        description "";
+        parent none;
+        postcondition "";
+        precondition "";
+        steps [@life_sa_610];
+        viewpoint Functional;
+    }
+
+    sa_lifeline life_sa_601 "SA Controller lane" id "5ceab400-0000-4000-8000-000000000a29" {
+        description "";
+        parent @life_sa_600;
+        represented @life_sa_10;
+    }
+
+    sa_occurrence life_sa_610 "SA Self delete controller" id "5ceab400-0000-4000-8000-000000000a32" {
+        body {
+            Exchange {
+                exchange none;
+                message_kind Delete;
+                receiver @life_sa_601;
+                reply_to none;
+                sender @life_sa_601;
+                values [];
+            };
+        };
+        description "";
+        parent @life_sa_600;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_port sa_lifecycle_service_input "SA Lifecycle service input" id "a4a6ecc0-3e12-51a5-b08b-199ad743525c" {
+        contract {
+            FunctionInput {
+                incoming_items [];
+            };
+        };
+        description "";
+        legacy none;
+        parent @life_sa_11;
+    }
+
+    sa_port sa_lifecycle_service_output "SA Lifecycle service output" id "b1aa66c4-0e8e-5091-beda-2b8d2005b688" {
+        contract {
+            FunctionOutput {
+                outgoing_items [];
+            };
+        };
+        description "";
+        legacy none;
+        parent @life_sa_10;
+    }
+
+    interaction life_oa_service "OA Lifecycle service" id "5ceab400-0000-4000-8000-0000000003f4" {
+        description "";
+        items [];
+        source @life_oa_10;
+        target @life_oa_11;
+    }
+
+    functional_exchange life_sa_service "SA Lifecycle service" id "5ceab400-0000-4000-8000-0000000007dc" {
+        description "";
+        items [];
+        source @life_sa_10;
+        source_port @sa_lifecycle_service_output;
+        target @life_sa_11;
+        target_port @sa_lifecycle_service_input;
+    }
+
+}
@@ -0,0 +1,2 @@
+// Preserve lifecycle note: 雨 · receiver.
+// Geometry never changes these bytes.
@@ -0,0 +1,183 @@
+#Requires -Version 7.0
+# PREPARED ONLY. Root decides when to invoke. Keep this logger alive until normal GUI close.
+[CmdletBinding()]
+param()
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+$nativeRoot = Join-Path $PSScriptRoot 'native-a57c334-camera'
+$nativeFreeze = 'a57c334b302eb13352b4bb65df1c75d94d002348'
+$nativeManifestHash = '293892C2F430D6EADB58C6678F3C1B346742B3AA4D2FE5CE3729F896EAD2C2DB'
+$nativeInputHash = '47FEC9CADC0E7FAE99D789376C111C02EEAAB7FAC3740DE48174A06F61FE16B3'
+$nativeGuiHash = '69DBB90FA299B3B3D90140C7934891F79166025893AF9B35B2B8D754A37A0D40'
+$nativeDllHash = 'AA282FA47BB2C4E210CEA5E470CDBDCA58568F0BE0BC73E404D86AB9CD95EF6A'
+$nativeBin = Join-Path $nativeRoot 'bin'
+$nativeProfile = Join-Path $nativeRoot 'profile'
+$nativeCwd = Join-Path $nativeRoot 'unrelated-cwd'
+$nativePath = 'C:\Windows\System32;C:\Windows;' + $nativeBin
+$nativeReceipt = Join-Path $nativeRoot 'launch.json'
+$nativeTerminal = Join-Path $nativeRoot 'normal-close.json'
+$nativeStdout = Join-Path $nativeRoot 'logs/studio.stdout.log'
+$nativeStderr = Join-Path $nativeRoot 'logs/studio.stderr.log'
+$nativeUtf8 = [Text.UTF8Encoding]::new($false)
+
+function Read-NativeItem([string]$Path) {
+    $item = Get-Item -LiteralPath $Path -Force
+    $ancestor = $item
+    while ($null -ne $ancestor) {
+        if (($ancestor.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) {
+            throw "Reparse path requires separate review: $($ancestor.FullName)"
+        }
+        $ancestor = if ($ancestor -is [IO.FileInfo]) { $ancestor.Directory } else { $ancestor.Parent }
+    }
+    return $item
+}
+function Read-NativeFile([string]$Path) {
+    $item = Read-NativeItem $Path
+    if ($item.PSIsContainer) { throw "Expected file: $Path" }
+    return [ordered]@{ path = $item.FullName; bytes = $item.Length; sha256 = (Get-FileHash -LiteralPath $item.FullName -Algorithm SHA256).Hash }
+}
+function Write-NativeRecord($Record, [IO.FileStream]$Stream) {
+    $bytes = $nativeUtf8.GetBytes(($Record | ConvertTo-Json -Depth 12) + "`n")
+    $Stream.Position = 0
+    $Stream.SetLength(0)
+    $Stream.Write($bytes, 0, $bytes.Length)
+    $Stream.Flush($true)
+}
+function Open-NativeOutput([string]$Path) {
+    return [IO.File]::Open($Path, [IO.FileMode]::CreateNew, [IO.FileAccess]::ReadWrite, [IO.FileShare]::Read)
+}
+
+# Source provenance is the closed a57 gate, never current dirty sources or target/debug.
+$nativeManifestFile = Read-NativeFile (Join-Path $nativeRoot 'preparation-manifest.json')
+if ($nativeManifestFile.sha256 -ne $nativeManifestHash) { throw 'Preparation manifest changed.' }
+$nativeManifest = Get-Content -LiteralPath $nativeManifestFile.path -Raw | ConvertFrom-Json
+if ($nativeManifest.source_commit -ne $nativeFreeze -or $nativeManifest.input_manifest_sha256 -ne $nativeInputHash -or $nativeManifest.frozen_input_count -ne 529) { throw 'Unexpected frozen input identity.' }
+foreach ($file in $nativeManifest.files) {
+    $path = [IO.Path]::GetFullPath((Join-Path $nativeRoot $file.target))
+    if (-not $path.StartsWith($nativeRoot + [IO.Path]::DirectorySeparatorChar, [StringComparison]::OrdinalIgnoreCase)) { throw 'Manifest path escapes private root.' }
+    $actual = Read-NativeFile $path
+    if ($actual.sha256 -ne $file.sha256 -or $actual.bytes -ne $file.bytes) { throw "Prepared input changed: $($file.target)" }
+}
+$nativeInputs = Read-NativeFile (Join-Path $nativeRoot 'provenance/inputs.json')
+if ($nativeInputs.sha256 -ne $nativeInputHash) { throw 'Frozen input manifest changed.' }
+$nativeBuildFile = Read-NativeFile (Join-Path $nativeRoot 'provenance/studio-build-status.json')
+$nativeBuild = Get-Content -LiteralPath $nativeBuildFile.path -Raw | ConvertFrom-Json
+if ($nativeBuild.exit -ne 0 -or $nativeBuild.name -ne 'canvas-union-windows-20260911/studio-build' -or [string]::IsNullOrWhiteSpace($nativeBuild.completed_utc)) { throw 'Matching completed build required.' }
+$nativeGui = Read-NativeFile (Join-Path $nativeBin 'arcadia-studio.exe')
+$nativeDll = Read-NativeFile (Join-Path $nativeBin 'libunwind.dll')
+if ($nativeGui.sha256 -ne $nativeGuiHash -or $nativeGui.bytes -ne 113028608 -or $nativeDll.sha256 -ne $nativeDllHash -or $nativeDll.bytes -ne 190464) { throw 'Immutable GUI/runtime mismatch.' }
+if (-not [string]::Equals($env:SystemRoot, 'C:\Windows', [StringComparison]::OrdinalIgnoreCase)) { throw 'This recorded launch requires SystemRoot C:\Windows.' }
+foreach ($directory in @($nativeProfile, $nativeCwd, (Join-Path $nativeRoot 'logs'), 'C:\Windows\System32')) {
+    if (-not (Read-NativeItem $directory).PSIsContainer) { throw "Required directory missing: $directory" }
+}
+foreach ($empty in @($nativeProfile, $nativeCwd)) {
+    if (@(Get-ChildItem -LiteralPath $empty -Force).Count -ne 0) { throw "Fresh empty directory required: $empty" }
+}
+foreach ($output in @($nativeReceipt, $nativeTerminal, $nativeStdout, $nativeStderr)) {
+    if (Test-Path -LiteralPath $output) { throw "Never overwrite prior launch evidence: $output" }
+}
+
+$nativeState = [ordered]@{
+    source_commit = $nativeFreeze
+    scope = 'Independent pre-grapheme a57 camera/clipping/zoom/hit session; no package or new combined Unicode acceptance implied.'
+    preparation_manifest = $nativeManifestFile
+    build_inputs_manifest = $nativeInputs
+    build_status_file = $nativeBuildFile
+    build_status = $nativeBuild
+    studio = $nativeGui
+    runtime = $nativeDll
+    launch_script = (Read-NativeFile $PSCommandPath)
+    process_path = $nativePath
+    isolated_localappdata = $nativeProfile
+    working_directory = $nativeCwd
+    arguments = @()
+    environment_scope = 'Child ProcessStartInfo only; other normal inherited environment retained.'
+    window_style = 'Hidden'
+    use_shell_execute = $false
+    create_no_window = $true
+    stdout = $nativeStdout
+    stderr = $nativeStderr
+    pid = $null
+    launch_requested_utc = $null
+    process_started_utc = $null
+    state = 'preflight_passed'
+    acceptance = 'Pending root observation and independent source/model checks.'
+}
+$nativeReceiptStream = $null
+$nativeOutStream = $null
+$nativeErrStream = $null
+$nativeProcess = $null
+$nativeStarted = $false
+try {
+    # Exclusive receipt reservation also serializes accidental concurrent invocations.
+    $nativeReceiptStream = Open-NativeOutput $nativeReceipt
+    Write-NativeRecord $nativeState $nativeReceiptStream
+    $nativeOutStream = Open-NativeOutput $nativeStdout
+    $nativeErrStream = Open-NativeOutput $nativeStderr
+    $nativeInfo = [Diagnostics.ProcessStartInfo]::new()
+    $nativeInfo.FileName = $nativeGui.path
+    $nativeInfo.WorkingDirectory = $nativeCwd
+    $nativeInfo.UseShellExecute = $false
+    $nativeInfo.CreateNoWindow = $true
+    $nativeInfo.WindowStyle = [Diagnostics.ProcessWindowStyle]::Hidden
+    $nativeInfo.RedirectStandardOutput = $true
+    $nativeInfo.RedirectStandardError = $true
+    $nativeInfo.Environment['PATH'] = $nativePath
+    $nativeInfo.Environment['LOCALAPPDATA'] = $nativeProfile
+    foreach ($file in @($nativeGui, $nativeDll, $nativeManifestFile, $nativeInputs, $nativeBuildFile)) {
+        if ((Read-NativeFile $file.path).sha256 -ne $file.sha256) { throw "Launch-critical input changed: $($file.path)" }
+    }
+    $nativeProcess = [Diagnostics.Process]::new()
+    $nativeProcess.StartInfo = $nativeInfo
+    $nativeState.launch_requested_utc = [DateTime]::UtcNow.ToString('o')
+    if (-not $nativeProcess.Start()) { throw 'Process.Start returned false.' }
+    $nativeStarted = $true
+    $nativeState.pid = $nativeProcess.Id
+    # Pump both raw streams concurrently; no line decoding/newline normalization.
+    $nativeOutCopy = $nativeProcess.StandardOutput.BaseStream.CopyToAsync($nativeOutStream)
+    $nativeErrCopy = $nativeProcess.StandardError.BaseStream.CopyToAsync($nativeErrStream)
+    $nativeState.process_started_utc = $nativeProcess.StartTime.ToUniversalTime().ToString('o')
+    $nativeState.state = 'launched'
+    Write-NativeRecord $nativeState $nativeReceiptStream
+    $nativeReceiptStream.Dispose()
+    $nativeReceiptStream = $null
+    $nativeState | ConvertTo-Json -Depth 12 | Write-Output
+    # Deliberately stays attached as a logger. Root uses a running shell session and closes GUI normally.
+    $nativeProcess.WaitForExit()
+    [Threading.Tasks.Task]::WaitAll([Threading.Tasks.Task[]]@($nativeOutCopy, $nativeErrCopy))
+    $nativeOutStream.Flush($true)
+    $nativeErrStream.Flush($true)
+    $nativeOutStream.Dispose()
+    $nativeOutStream = $null
+    $nativeErrStream.Dispose()
+    $nativeErrStream = $null
+    $nativeClosed = [ordered]@{
+        source_commit = $nativeFreeze
+        pid = $nativeState.pid
+        process_started_utc = $nativeState.process_started_utc
+        observed_exit_utc = [DateTime]::UtcNow.ToString('o')
+        exit_code = $nativeProcess.ExitCode
+        scope = 'Process termination and closed raw logs only; UI acceptance and reason for close require root observation.'
+        stdout = (Read-NativeFile $nativeStdout)
+        stderr = (Read-NativeFile $nativeStderr)
+        studio_readback = (Read-NativeFile $nativeGui.path)
+        runtime_readback = (Read-NativeFile $nativeDll.path)
+    }
+    $nativeCloseStream = Open-NativeOutput $nativeTerminal
+    try { Write-NativeRecord $nativeClosed $nativeCloseStream } finally { $nativeCloseStream.Dispose() }
+    $nativeClosed | ConvertTo-Json -Depth 12 | Write-Output
+} catch {
+    if ($null -ne $nativeReceiptStream) {
+        $nativeState.state = if ($nativeStarted) { 'launched_record_error' } else { 'launch_failed' }
+        $nativeState['error'] = $_.Exception.Message
+        Write-NativeRecord $nativeState $nativeReceiptStream
+    }
+    throw
+} finally {
+    if ($null -ne $nativeReceiptStream) { $nativeReceiptStream.Dispose() }
+    if ($null -ne $nativeOutStream) { $nativeOutStream.Dispose() }
+    if ($null -ne $nativeErrStream) { $nativeErrStream.Dispose() }
+    if ($null -ne $nativeProcess) { $nativeProcess.Dispose() }
+    # Never kill an application here. Root owns every native interaction and any recovery.
+}
@@ -0,0 +1,5 @@
+{
+  "scope": "Parser only; no launch",
+  "errors": [],
+  "pass": true
+}
@@ -0,0 +1,67 @@
+{
+  "source_commit": "a57c334b302eb13352b4bb65df1c75d94d002348",
+  "scope": "Independent pre-grapheme a57 camera/clipping/zoom/hit session; no package or new combined Unicode acceptance implied.",
+  "preparation_manifest": {
+    "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\preparation-manifest.json",
+    "bytes": 9149,
+    "sha256": "293892C2F430D6EADB58C6678F3C1B346742B3AA4D2FE5CE3729F896EAD2C2DB"
+  },
+  "build_inputs_manifest": {
+    "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\provenance\\inputs.json",
+    "bytes": 101859,
+    "sha256": "47FEC9CADC0E7FAE99D789376C111C02EEAAB7FAC3740DE48174A06F61FE16B3"
+  },
+  "build_status_file": {
+    "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\provenance\\studio-build-status.json",
+    "bytes": 474,
+    "sha256": "AB1E04807F32F8DADA0A572D69F632BD6FD242150DF211C18E35D82EA8BE91EC"
+  },
+  "build_status": {
+    "seconds": 385.1131455,
+    "log": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\canvas-union-windows-20260911\\studio-build.log",
+    "started_utc": "2026-09-11T20:14:23.6348444Z",
+    "exit": 0,
+    "command": [
+      "cargo",
+      "build",
+      "-p",
+      "oa-desktop",
+      "--bin",
+      "arcadia-studio",
+      "--offline",
+      "--locked"
+    ],
+    "name": "canvas-union-windows-20260911/studio-build",
+    "completed_utc": "2026-09-11T20:20:48.7677661Z"
+  },
+  "studio": {
+    "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\bin\\arcadia-studio.exe",
+    "bytes": 113028608,
+    "sha256": "69DBB90FA299B3B3D90140C7934891F79166025893AF9B35B2B8D754A37A0D40"
+  },
+  "runtime": {
+    "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\bin\\libunwind.dll",
+    "bytes": 190464,
+    "sha256": "AA282FA47BB2C4E210CEA5E470CDBDCA58568F0BE0BC73E404D86AB9CD95EF6A"
+  },
+  "launch_script": {
+    "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\launch-native-a57c334-camera.ps1",
+    "bytes": 10001,
+    "sha256": "BE80A4B5B407BCEA3DBECC547DA5E5888F3C6DC06F5F7AF87F546C388963B4DE"
+  },
+  "process_path": "C:\\Windows\\System32;C:\\Windows;C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\bin",
+  "isolated_localappdata": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\profile",
+  "working_directory": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\unrelated-cwd",
+  "arguments": [],
+  "environment_scope": "Child ProcessStartInfo only; other normal inherited environment retained.",
+  "window_style": "Hidden",
+  "use_shell_execute": false,
+  "create_no_window": true,
+  "stdout": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\logs\\studio.stdout.log",
+  "stderr": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\logs\\studio.stderr.log",
+  "pid": 5004,
+  "launch_requested_utc": "2026-09-12T10:52:56.9766659Z",
+  "process_started_utc": "2026-09-12T10:52:57.0962185Z",
+  "state": "launched",
+  "acceptance": "Pending root observation and independent source/model checks."
+}
@@ -0,0 +1 @@
+PASS same: all identities, fields, reachable source and physical bytes
@@ -0,0 +1,347 @@
+{
+  "created_utc": "2026-09-12T11:07:20.1744786Z",
+  "scope": "Closed a57 camera evidence only; copying does not execute gates or UI",
+  "payload_count": 47,
+  "payload_bytes": 2184242.0,
+  "files": [
+    {
+      "path": "baseline-wide/project.arcadia",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\baseline-wide\\project.arcadia",
+      "bytes": 20128,
+      "original_sha256": "6A18EE1F246321BDF8AB0E7E8E5D4EBA134CE486ED5224C4FFD61C7342C3A7D3",
+      "copy_sha256": "6A18EE1F246321BDF8AB0E7E8E5D4EBA134CE486ED5224C4FFD61C7342C3A7D3"
+    },
+    {
+      "path": "baseline-wide/rationale.arcadia",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\baseline-wide\\rationale.arcadia",
+      "bytes": 86,
+      "original_sha256": "8509F8D8A136D808CF98A1BB0FE50348B8A24409F30DEE4EE65B62BF5CB9E6BF",
+      "copy_sha256": "8509F8D8A136D808CF98A1BB0FE50348B8A24409F30DEE4EE65B62BF5CB9E6BF"
+    },
+    {
+      "path": "checkpoints/wide-passive/project.arcadia",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\checkpoints\\wide-passive\\project.arcadia",
+      "bytes": 20128,
+      "original_sha256": "6A18EE1F246321BDF8AB0E7E8E5D4EBA134CE486ED5224C4FFD61C7342C3A7D3",
+      "copy_sha256": "6A18EE1F246321BDF8AB0E7E8E5D4EBA134CE486ED5224C4FFD61C7342C3A7D3"
+    },
+    {
+      "path": "checkpoints/wide-passive/rationale.arcadia",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\checkpoints\\wide-passive\\rationale.arcadia",
+      "bytes": 86,
+      "original_sha256": "8509F8D8A136D808CF98A1BB0FE50348B8A24409F30DEE4EE65B62BF5CB9E6BF",
+      "copy_sha256": "8509F8D8A136D808CF98A1BB0FE50348B8A24409F30DEE4EE65B62BF5CB9E6BF"
+    },
+    {
+      "path": "launch-script-syntax.json",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\launch-script-syntax.json",
+      "bytes": 77,
+      "original_sha256": "9FE1369737B8A02EE9DDB83318CE800F200AFABF5486C9DD6F52DBEC9F87502C",
+      "copy_sha256": "9FE1369737B8A02EE9DDB83318CE800F200AFABF5486C9DD6F52DBEC9F87502C"
+    },
+    {
+      "path": "launch.json",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\launch.json",
+      "bytes": 3308,
+      "original_sha256": "7BCF09DFB689DB4E686BBACD0F1805B013597FB4159D5477D5DE56F52D79D147",
+      "copy_sha256": "7BCF09DFB689DB4E686BBACD0F1805B013597FB4159D5477D5DE56F52D79D147"
+    },
+    {
+      "path": "logs/studio.stderr.log",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\logs\\studio.stderr.log",
+      "bytes": 0,
+      "original_sha256": "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855",
+      "copy_sha256": "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855"
+    },
+    {
+      "path": "logs/studio.stdout.log",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\logs\\studio.stdout.log",
+      "bytes": 0,
+      "original_sha256": "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855",
+      "copy_sha256": "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855"
+    },
+    {
+      "path": "logs/wide-passive.stderr.log",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\logs\\wide-passive.stderr.log",
+      "bytes": 0,
+      "original_sha256": "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855",
+      "copy_sha256": "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855"
+    },
+    {
+      "path": "logs/wide-passive.stdout.log",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\logs\\wide-passive.stdout.log",
+      "bytes": 71,
+      "original_sha256": "72F1D2214D32F2C77CEB6666FFA91EB54795BC94E77DAF63589B00ABFEAAC477",
+      "copy_sha256": "72F1D2214D32F2C77CEB6666FFA91EB54795BC94E77DAF63589B00ABFEAAC477"
+    },
+    {
+      "path": "normal-close.json",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\normal-close.json",
+      "bytes": 1326,
+      "original_sha256": "21CE20643ED69CA1247B261A44A71A562850D0BCF8339761E60F11B7A19A7AF1",
+      "copy_sha256": "21CE20643ED69CA1247B261A44A71A562850D0BCF8339761E60F11B7A19A7AF1"
+    },
+    {
+      "path": "preparation-manifest.json",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\preparation-manifest.json",
+      "bytes": 9149,
+      "original_sha256": "293892C2F430D6EADB58C6678F3C1B346742B3AA4D2FE5CE3729F896EAD2C2DB",
+      "copy_sha256": "293892C2F430D6EADB58C6678F3C1B346742B3AA4D2FE5CE3729F896EAD2C2DB"
+    },
+    {
+      "path": "prepare-inputs.py",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\prepare-inputs.py",
+      "bytes": 5563,
+      "original_sha256": "661D6686AD0B59FBD28CB4FE42CFD4955DB5922B9CE3B5EF3F378A4CF1982884",
+      "copy_sha256": "661D6686AD0B59FBD28CB4FE42CFD4955DB5922B9CE3B5EF3F378A4CF1982884"
+    },
+    {
+      "path": "provenance/after-build-verify-head.json",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\provenance\\after-build-verify-head.json",
+      "bytes": 199,
+      "original_sha256": "FF0F533653B601F1456C726106A97D94346C3C18288912C620748112119AFF08",
+      "copy_sha256": "FF0F533653B601F1456C726106A97D94346C3C18288912C620748112119AFF08"
+    },
+    {
+      "path": "provenance/binary-manifest.json",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\provenance\\binary-manifest.json",
+      "bytes": 2828,
+      "original_sha256": "F8F8A97B2BA516685A0690E98DF90269A7C83F371A5A3257E80B865E15D3EDFA",
+      "copy_sha256": "F8F8A97B2BA516685A0690E98DF90269A7C83F371A5A3257E80B865E15D3EDFA"
+    },
+    {
+      "path": "provenance/desktop-all-targets-status.json",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\provenance\\desktop-all-targets-status.json",
+      "bytes": 472,
+      "original_sha256": "2C23196BEA849E77C49F2CF64FD31311A01998520460E92F91B935C5A7880BC0",
+      "copy_sha256": "2C23196BEA849E77C49F2CF64FD31311A01998520460E92F91B935C5A7880BC0"
+    },
+    {
+      "path": "provenance/desktop-clippy-status.json",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\provenance\\desktop-clippy-status.json",
+      "bytes": 503,
+      "original_sha256": "BA5F6D17354D194C1102EA75EE4E7B893EF04EEDD21518D591726A912E3E6A4C",
+      "copy_sha256": "BA5F6D17354D194C1102EA75EE4E7B893EF04EEDD21518D591726A912E3E6A4C"
+    },
+    {
+      "path": "provenance/focused-lifecycle-status.json",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\provenance\\focused-lifecycle-status.json",
+      "bytes": 509,
+      "original_sha256": "FA6618F15C4B41BDD691A613CF0992C83CE984A1AA0FAFFCD2DC4FB96CDEBCE3",
+      "copy_sha256": "FA6618F15C4B41BDD691A613CF0992C83CE984A1AA0FAFFCD2DC4FB96CDEBCE3"
+    },
+    {
+      "path": "provenance/inputs.json",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\provenance\\inputs.json",
+      "bytes": 101859,
+      "original_sha256": "47FEC9CADC0E7FAE99D789376C111C02EEAAB7FAC3740DE48174A06F61FE16B3",
+      "copy_sha256": "47FEC9CADC0E7FAE99D789376C111C02EEAAB7FAC3740DE48174A06F61FE16B3"
+    },
+    {
+      "path": "provenance/lifecycle-fixture-README.md",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\provenance\\lifecycle-fixture-README.md",
+      "bytes": 12199,
+      "original_sha256": "B441C562459B2AE000055D73529FB608C9CC015F64293206B9FB7D8C7CBC8B78",
+      "copy_sha256": "B441C562459B2AE000055D73529FB608C9CC015F64293206B9FB7D8C7CBC8B78"
+    },
+    {
+      "path": "provenance/lifecycle-native-contract.rs",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\provenance\\lifecycle-native-contract.rs",
+      "bytes": 19135,
+      "original_sha256": "FC5E71F9870D7B98E0F52EAF20C831EBFFBE9F7A9B8960269DC9BE3D9BF0D9E4",
+      "copy_sha256": "FC5E71F9870D7B98E0F52EAF20C831EBFFBE9F7A9B8960269DC9BE3D9BF0D9E4"
+    },
+    {
+      "path": "provenance/lifecycle-oracle-status.json",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\provenance\\lifecycle-oracle-status.json",
+      "bytes": 1272,
+      "original_sha256": "68452154CF96EC4FD245D89A11D1FC1C08CB471419A5F8D94039ECCBF2EFCF7C",
+      "copy_sha256": "68452154CF96EC4FD245D89A11D1FC1C08CB471419A5F8D94039ECCBF2EFCF7C"
+    },
+    {
+      "path": "provenance/oracles-865-copy-manifest.json",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\provenance\\oracles-865-copy-manifest.json",
+      "bytes": 1015,
+      "original_sha256": "5DC8D7A3C721E03A0A249E5B8D30BC41539B39D39EC7157D9DBF5C99044B1C4C",
+      "copy_sha256": "5DC8D7A3C721E03A0A249E5B8D30BC41539B39D39EC7157D9DBF5C99044B1C4C"
+    },
+    {
+      "path": "provenance/studio-build-status.json",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\provenance\\studio-build-status.json",
+      "bytes": 474,
+      "original_sha256": "AB1E04807F32F8DADA0A572D69F632BD6FD242150DF211C18E35D82EA8BE91EC",
+      "copy_sha256": "AB1E04807F32F8DADA0A572D69F632BD6FD242150DF211C18E35D82EA8BE91EC"
+    },
+    {
+      "path": "provenance/typography-admission.json",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\provenance\\typography-admission.json",
+      "bytes": 553,
+      "original_sha256": "B06FD83F554982B407E1B28A79DFADCB61717B4F076EB3062EC314C742A2CCD8",
+      "copy_sha256": "B06FD83F554982B407E1B28A79DFADCB61717B4F076EB3062EC314C742A2CCD8"
+    },
+    {
+      "path": "provenance/typography-predictions.json",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\provenance\\typography-predictions.json",
+      "bytes": 2490,
+      "original_sha256": "6951FF7C96C0A7A14D72781B416FC64CAB9F4AF5861F5C0EF4C327D843483243",
+      "copy_sha256": "6951FF7C96C0A7A14D72781B416FC64CAB9F4AF5861F5C0EF4C327D843483243"
+    },
+    {
+      "path": "screenshots/01-wide-opened.jpg",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\screenshots\\01-wide-opened.jpg",
+      "bytes": 102087,
+      "original_sha256": "76B5ABF72AAA2B40DB91FCF182E3B464BEE29CC9ABDCCC4005EC9567554C7E18",
+      "copy_sha256": "76B5ABF72AAA2B40DB91FCF182E3B464BEE29CC9ABDCCC4005EC9567554C7E18"
+    },
+    {
+      "path": "screenshots/02-behavior-open.jpg",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\screenshots\\02-behavior-open.jpg",
+      "bytes": 118609,
+      "original_sha256": "92D75BCF44D78221D99C393C039E6ED395AF70973477643EEF437CD0B5EFF1A2",
+      "copy_sha256": "92D75BCF44D78221D99C393C039E6ED395AF70973477643EEF437CD0B5EFF1A2"
+    },
+    {
+      "path": "screenshots/03-oa-create-selected-100.jpg",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\screenshots\\03-oa-create-selected-100.jpg",
+      "bytes": 134137,
+      "original_sha256": "0028B918C56C5686890C18D730D3394CC07A8D0714DBD5175B06A336C2BD937C",
+      "copy_sha256": "0028B918C56C5686890C18D730D3394CC07A8D0714DBD5175B06A336C2BD937C"
+    },
+    {
+      "path": "screenshots/04-oa-create-zoom125.jpg",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\screenshots\\04-oa-create-zoom125.jpg",
+      "bytes": 131774,
+      "original_sha256": "9B6627543E8A79E8D217029861407A89C884F36A3024BE44F5B8205AD2B557ED",
+      "copy_sha256": "9B6627543E8A79E8D217029861407A89C884F36A3024BE44F5B8205AD2B557ED"
+    },
+    {
+      "path": "screenshots/05-oa-delete-selected-125.jpg",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\screenshots\\05-oa-delete-selected-125.jpg",
+      "bytes": 132774,
+      "original_sha256": "1BC820418F12B18EBC97F52D2B2B85B8B9BDD57F9485BE040946FC9CC2F37FAA",
+      "copy_sha256": "1BC820418F12B18EBC97F52D2B2B85B8B9BDD57F9485BE040946FC9CC2F37FAA"
+    },
+    {
+      "path": "screenshots/06-oa-fit.jpg",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\screenshots\\06-oa-fit.jpg",
+      "bytes": 133100,
+      "original_sha256": "585063787D8E0299A7C2173BB8EC0264CDF51D5EDD8CBC3FCC953EF1917E1116",
+      "copy_sha256": "585063787D8E0299A7C2173BB8EC0264CDF51D5EDD8CBC3FCC953EF1917E1116"
+    },
+    {
+      "path": "screenshots/07-minimum-width.jpg",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\screenshots\\07-minimum-width.jpg",
+      "bytes": 123533,
+      "original_sha256": "9D798D0B087C7F05FAFDC23237BD934B069B69E1A08D8C33EAF74D4E85264582",
+      "copy_sha256": "9D798D0B087C7F05FAFDC23237BD934B069B69E1A08D8C33EAF74D4E85264582"
+    },
+    {
+      "path": "screenshots/08-minimum-window.jpg",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\screenshots\\08-minimum-window.jpg",
+      "bytes": 105379,
+      "original_sha256": "DFBAFFA375445BCD36565BDC8873DBF457E0A528A827E882F069B95D90529944",
+      "copy_sha256": "DFBAFFA375445BCD36565BDC8873DBF457E0A528A827E882F069B95D90529944"
+    },
+    {
+      "path": "screenshots/09-oa-minimum-fit.jpg",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\screenshots\\09-oa-minimum-fit.jpg",
+      "bytes": 99033,
+      "original_sha256": "FD2FEE1D602488243876B6FAEAFCBBCFE7065DDCFA2C28AD743A0FD19673C4B9",
+      "copy_sha256": "FD2FEE1D602488243876B6FAEAFCBBCFE7065DDCFA2C28AD743A0FD19673C4B9"
+    },
+    {
+      "path": "screenshots/10-oa-minimum-create-hit.jpg",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\screenshots\\10-oa-minimum-create-hit.jpg",
+      "bytes": 99898,
+      "original_sha256": "7975C21C9E41D32A8684E3420DEF616D7AC1E43F5EF291E94380FA63DA37241F",
+      "copy_sha256": "7975C21C9E41D32A8684E3420DEF616D7AC1E43F5EF291E94380FA63DA37241F"
+    },
+    {
+      "path": "screenshots/11-oa-minimum-pan-right.jpg",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\screenshots\\11-oa-minimum-pan-right.jpg",
+      "bytes": 99456,
+      "original_sha256": "61BD5C917B738E1C3B2267D623A41193A8C5F84F5A1F7B51DAFA1B147DB13A51",
+      "copy_sha256": "61BD5C917B738E1C3B2267D623A41193A8C5F84F5A1F7B51DAFA1B147DB13A51"
+    },
+    {
+      "path": "screenshots/12-oa-panned-delete-hit.jpg",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\screenshots\\12-oa-panned-delete-hit.jpg",
+      "bytes": 98952,
+      "original_sha256": "1B9C0E408BC9445AE0E6BDC2F86EA341AA385EB26D42693C76309963D9D4064C",
+      "copy_sha256": "1B9C0E408BC9445AE0E6BDC2F86EA341AA385EB26D42693C76309963D9D4064C"
+    },
+    {
+      "path": "screenshots/13-system-layer.jpg",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\screenshots\\13-system-layer.jpg",
+      "bytes": 101904,
+      "original_sha256": "02992B658775E55F0CBAF974050BBFEA0C1F608799C5D9BE9A05AA6789C9F1F4",
+      "copy_sha256": "02992B658775E55F0CBAF974050BBFEA0C1F608799C5D9BE9A05AA6789C9F1F4"
+    },
+    {
+      "path": "screenshots/14-sa-minimum-fit.jpg",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\screenshots\\14-sa-minimum-fit.jpg",
+      "bytes": 95469,
+      "original_sha256": "E4A274CA8DA7ECD2255EF519C8FC81D8310DB55C9DB9009FC8731751A25202CB",
+      "copy_sha256": "E4A274CA8DA7ECD2255EF519C8FC81D8310DB55C9DB9009FC8731751A25202CB"
+    },
+    {
+      "path": "screenshots/15-sa-minimum-create-hit.jpg",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\screenshots\\15-sa-minimum-create-hit.jpg",
+      "bytes": 99837,
+      "original_sha256": "4ED02839A417EE567CD8F23750DFFB535AF8C32063B535F8C0B4BE8ACB082542",
+      "copy_sha256": "4ED02839A417EE567CD8F23750DFFB535AF8C32063B535F8C0B4BE8ACB082542"
+    },
+    {
+      "path": "screenshots/16-sa-pan-up.jpg",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\screenshots\\16-sa-pan-up.jpg",
+      "bytes": 96836,
+      "original_sha256": "26048071F3B2A09ED054D18834C128093CC1FB9B1C4A7518B09E0F9E9EC8291A",
+      "copy_sha256": "26048071F3B2A09ED054D18834C128093CC1FB9B1C4A7518B09E0F9E9EC8291A"
+    },
+    {
+      "path": "screenshots/17-sa-panned-delete-hit.jpg",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\screenshots\\17-sa-panned-delete-hit.jpg",
+      "bytes": 96499,
+      "original_sha256": "31EA2A24959B4A5014C9FCD0E43BD918847C6FB58EB0B8B1577C56074E266BC0",
+      "copy_sha256": "31EA2A24959B4A5014C9FCD0E43BD918847C6FB58EB0B8B1577C56074E266BC0"
+    },
+    {
+      "path": "screenshots/18-passive-navigation-saved.jpg",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\screenshots\\18-passive-navigation-saved.jpg",
+      "bytes": 94345,
+      "original_sha256": "280942F9B9806884D4EE34A5FB740428A420D7603EDDDF21D6E4979BEE041B2D",
+      "copy_sha256": "280942F9B9806884D4EE34A5FB740428A420D7603EDDDF21D6E4979BEE041B2D"
+    },
+    {
+      "path": "second-readback.json",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\second-readback.json",
+      "bytes": 6332,
+      "original_sha256": "BB8063AAC3FFF3A7B8FC19BA81F9EBBC13068871F6924651A14B08D58CE525BB",
+      "copy_sha256": "BB8063AAC3FFF3A7B8FC19BA81F9EBBC13068871F6924651A14B08D58CE525BB"
+    },
+    {
+      "path": "wide-passive-status.json",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\wide-passive-status.json",
+      "bytes": 857,
+      "original_sha256": "A358FA3C26A11DEACFC9457EC96F27F43EBD9020575329E701F0F026759850BF",
+      "copy_sha256": "A358FA3C26A11DEACFC9457EC96F27F43EBD9020575329E701F0F026759850BF"
+    },
+    {
+      "path": "launch-native-a57c334-camera.ps1",
+      "original": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\launch-native-a57c334-camera.ps1",
+      "bytes": 10001,
+      "original_sha256": "BE80A4B5B407BCEA3DBECC547DA5E5888F3C6DC06F5F7AF87F546C388963B4DE",
+      "copy_sha256": "BE80A4B5B407BCEA3DBECC547DA5E5888F3C6DC06F5F7AF87F546C388963B4DE"
+    }
+  ],
+  "excluded": [
+    "bin",
+    "oracles executables/DLL",
+    "baseline-clusters",
+    "working-wide",
+    "working-clusters",
+    "profile",
+    "unrelated-cwd",
+    "ZIP archives"
+  ]
+}
@@ -0,0 +1,28 @@
+{
+  "source_commit": "a57c334b302eb13352b4bb65df1c75d94d002348",
+  "pid": 5004,
+  "process_started_utc": "2026-09-12T10:52:57.0962185Z",
+  "observed_exit_utc": "2026-09-12T11:02:56.0410831Z",
+  "exit_code": 0,
+  "scope": "Process termination and closed raw logs only; UI acceptance and reason for close require root observation.",
+  "stdout": {
+    "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\logs\\studio.stdout.log",
+    "bytes": 0,
+    "sha256": "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855"
+  },
+  "stderr": {
+    "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\logs\\studio.stderr.log",
+    "bytes": 0,
+    "sha256": "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855"
+  },
+  "studio_readback": {
+    "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\bin\\arcadia-studio.exe",
+    "bytes": 113028608,
+    "sha256": "69DBB90FA299B3B3D90140C7934891F79166025893AF9B35B2B8D754A37A0D40"
+  },
+  "runtime_readback": {
+    "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\bin\\libunwind.dll",
+    "bytes": 190464,
+    "sha256": "AA282FA47BB2C4E210CEA5E470CDBDCA58568F0BE0BC73E404D86AB9CD95EF6A"
+  }
+}
@@ -0,0 +1,166 @@
+{
+  "prepared_utc": "2026-09-11T21:32:45.779806+00:00",
+  "source_commit": "a57c334b302eb13352b4bb65df1c75d94d002348",
+  "scope": "Preparation only for independent OA/SA camera, clipping, minimum-size, zoom and hit checks with passive Save equality. Pre-grapheme a57; no package or new combined Unicode acceptance.",
+  "archive": {
+    "path": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\canvas-union-windows-20260911\\exact-inputs.zip",
+    "sha256": "E2C8BB3CC8EB2BFD6ABB0A2C5769756148D594CE0CDC90449A894AB0CB026927"
+  },
+  "input_manifest_sha256": "47FEC9CADC0E7FAE99D789376C111C02EEAAB7FAC3740DE48174A06F61FE16B3",
+  "frozen_input_count": 529,
+  "files": [
+    {
+      "origin": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\canvas-union-windows-20260911\\exact-inputs.zip::harness/fixtures/scenario-lifecycle-native/typography-wide/rationale.arcadia",
+      "target": "baseline-wide/rationale.arcadia",
+      "bytes": 86,
+      "sha256": "8509F8D8A136D808CF98A1BB0FE50348B8A24409F30DEE4EE65B62BF5CB9E6BF"
+    },
+    {
+      "origin": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\canvas-union-windows-20260911\\exact-inputs.zip::harness/fixtures/scenario-lifecycle-native/typography-wide/rationale.arcadia",
+      "target": "working-wide/rationale.arcadia",
+      "bytes": 86,
+      "sha256": "8509F8D8A136D808CF98A1BB0FE50348B8A24409F30DEE4EE65B62BF5CB9E6BF"
+    },
+    {
+      "origin": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\canvas-union-windows-20260911\\exact-inputs.zip::harness/fixtures/scenario-lifecycle-native/typography-wide/project.arcadia",
+      "target": "baseline-wide/project.arcadia",
+      "bytes": 20128,
+      "sha256": "6A18EE1F246321BDF8AB0E7E8E5D4EBA134CE486ED5224C4FFD61C7342C3A7D3"
+    },
+    {
+      "origin": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\canvas-union-windows-20260911\\exact-inputs.zip::harness/fixtures/scenario-lifecycle-native/typography-wide/project.arcadia",
+      "target": "working-wide/project.arcadia",
+      "bytes": 20128,
+      "sha256": "6A18EE1F246321BDF8AB0E7E8E5D4EBA134CE486ED5224C4FFD61C7342C3A7D3"
+    },
+    {
+      "origin": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\canvas-union-windows-20260911\\exact-inputs.zip::harness/fixtures/scenario-lifecycle-native/typography-clusters/project.arcadia",
+      "target": "baseline-clusters/project.arcadia",
+      "bytes": 20110,
+      "sha256": "EECDDFC4A4514E995633EA58B89FE154DC6DC43509B1F53EE05B76F8E6B993C8"
+    },
+    {
+      "origin": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\canvas-union-windows-20260911\\exact-inputs.zip::harness/fixtures/scenario-lifecycle-native/typography-clusters/project.arcadia",
+      "target": "working-clusters/project.arcadia",
+      "bytes": 20110,
+      "sha256": "EECDDFC4A4514E995633EA58B89FE154DC6DC43509B1F53EE05B76F8E6B993C8"
+    },
+    {
+      "origin": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\canvas-union-windows-20260911\\exact-inputs.zip::harness/fixtures/scenario-lifecycle-native/typography-clusters/rationale.arcadia",
+      "target": "baseline-clusters/rationale.arcadia",
+      "bytes": 86,
+      "sha256": "8509F8D8A136D808CF98A1BB0FE50348B8A24409F30DEE4EE65B62BF5CB9E6BF"
+    },
+    {
+      "origin": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\canvas-union-windows-20260911\\exact-inputs.zip::harness/fixtures/scenario-lifecycle-native/typography-clusters/rationale.arcadia",
+      "target": "working-clusters/rationale.arcadia",
+      "bytes": 86,
+      "sha256": "8509F8D8A136D808CF98A1BB0FE50348B8A24409F30DEE4EE65B62BF5CB9E6BF"
+    },
+    {
+      "origin": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\canvas-union-windows-20260911\\exact-inputs.zip::harness/fixtures/scenario-lifecycle-native/README.md",
+      "target": "provenance/lifecycle-fixture-README.md",
+      "bytes": 12199,
+      "sha256": "B441C562459B2AE000055D73529FB608C9CC015F64293206B9FB7D8C7CBC8B78"
+    },
+    {
+      "origin": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\canvas-union-windows-20260911\\bin\\arcadia-studio.exe",
+      "target": "bin/arcadia-studio.exe",
+      "bytes": 113028608,
+      "sha256": "69DBB90FA299B3B3D90140C7934891F79166025893AF9B35B2B8D754A37A0D40"
+    },
+    {
+      "origin": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\canvas-union-windows-20260911\\bin\\libunwind.dll",
+      "target": "bin/libunwind.dll",
+      "bytes": 190464,
+      "sha256": "AA282FA47BB2C4E210CEA5E470CDBDCA58568F0BE0BC73E404D86AB9CD95EF6A"
+    },
+    {
+      "origin": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\canvas-union-windows-20260911\\inputs.json",
+      "target": "provenance/inputs.json",
+      "bytes": 101859,
+      "sha256": "47FEC9CADC0E7FAE99D789376C111C02EEAAB7FAC3740DE48174A06F61FE16B3"
+    },
+    {
+      "origin": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\canvas-union-windows-20260911\\binary-manifest.json",
+      "target": "provenance/binary-manifest.json",
+      "bytes": 2828,
+      "sha256": "F8F8A97B2BA516685A0690E98DF90269A7C83F371A5A3257E80B865E15D3EDFA"
+    },
+    {
+      "origin": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\canvas-union-windows-20260911\\after-build-verify-head.json",
+      "target": "provenance/after-build-verify-head.json",
+      "bytes": 199,
+      "sha256": "FF0F533653B601F1456C726106A97D94346C3C18288912C620748112119AFF08"
+    },
+    {
+      "origin": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\canvas-union-windows-20260911\\studio-build-status.json",
+      "target": "provenance/studio-build-status.json",
+      "bytes": 474,
+      "sha256": "AB1E04807F32F8DADA0A572D69F632BD6FD242150DF211C18E35D82EA8BE91EC"
+    },
+    {
+      "origin": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\canvas-union-windows-20260911\\desktop-clippy-status.json",
+      "target": "provenance/desktop-clippy-status.json",
+      "bytes": 503,
+      "sha256": "BA5F6D17354D194C1102EA75EE4E7B893EF04EEDD21518D591726A912E3E6A4C"
+    },
+    {
+      "origin": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\canvas-union-windows-20260911\\desktop-all-targets-status.json",
+      "target": "provenance/desktop-all-targets-status.json",
+      "bytes": 472,
+      "sha256": "2C23196BEA849E77C49F2CF64FD31311A01998520460E92F91B935C5A7880BC0"
+    },
+    {
+      "origin": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\canvas-union-windows-20260911\\focused-lifecycle-status.json",
+      "target": "provenance/focused-lifecycle-status.json",
+      "bytes": 509,
+      "sha256": "FA6618F15C4B41BDD691A613CF0992C83CE984A1AA0FAFFCD2DC4FB96CDEBCE3"
+    },
+    {
+      "origin": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-865483b\\oracles\\lifecycle.exe",
+      "target": "oracles/lifecycle.exe",
+      "bytes": 20700160,
+      "sha256": "798D7A1907B894C13549BAD35511B21D6BC7F3D67D63674042B7DF71184C7524"
+    },
+    {
+      "origin": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-865483b\\oracles\\libunwind.dll",
+      "target": "oracles/libunwind.dll",
+      "bytes": 190464,
+      "sha256": "AA282FA47BB2C4E210CEA5E470CDBDCA58568F0BE0BC73E404D86AB9CD95EF6A"
+    },
+    {
+      "origin": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\harness\\lifecycle-native-contract.rs",
+      "target": "provenance/lifecycle-native-contract.rs",
+      "bytes": 19135,
+      "sha256": "FC5E71F9870D7B98E0F52EAF20C831EBFFBE9F7A9B8960269DC9BE3D9BF0D9E4"
+    },
+    {
+      "origin": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-865483b\\oracles\\manifest.json",
+      "target": "provenance/oracles-865-copy-manifest.json",
+      "bytes": 1015,
+      "sha256": "5DC8D7A3C721E03A0A249E5B8D30BC41539B39D39EC7157D9DBF5C99044B1C4C"
+    },
+    {
+      "origin": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\lifecycle-native-ytr83r-20260911\\status.json",
+      "target": "provenance/lifecycle-oracle-status.json",
+      "bytes": 1272,
+      "sha256": "68452154CF96EC4FD245D89A11D1FC1C08CB471419A5F8D94039ECCBF2EFCF7C"
+    },
+    {
+      "origin": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\harness\\experiments\\lifecycle-native-ytr83r-20260911\\typography-admission.json",
+      "target": "provenance/typography-admission.json",
+      "bytes": 553,
+      "sha256": "B06FD83F554982B407E1B28A79DFADCB61717B4F076EB3062EC314C742A2CCD8"
+    },
+    {
+      "origin": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\harness\\experiments\\lifecycle-native-ytr83r-20260911\\typography-predictions.json",
+      "target": "provenance/typography-predictions.json",
+      "bytes": 2490,
+      "sha256": "6951FF7C96C0A7A14D72781B416FC64CAB9F4AF5861F5C0EF4C327D843483243"
+    }
+  ],
+  "empty_profile": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\profile",
+  "unrelated_cwd": "C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\unrelated-cwd",
+  "restricted_path": "C:\\Windows\\System32;C:\\Windows;C:\\Users\\User\\Documents\\Git\\ARCADIA-Studio\\.local\\native-a57c334-camera\\bin"
+}
@@ -0,0 +1,88 @@
+"""Preparation only: copy and hash frozen inputs; never execute model/oracle/GUI code."""
+import hashlib
+import json
+import shutil
+import zipfile
+from datetime import datetime, timezone
+from pathlib import Path
+
+root = Path(__file__).resolve().parent
+repo = root.parent.parent
+gates = repo / '.local/canvas-union-windows-20260911'
+freeze = 'a57c334b302eb13352b4bb65df1c75d94d002348'
+
+def digest(data):
+    return hashlib.sha256(data).hexdigest().upper()
+
+def write_new(path, data):
+    path.parent.mkdir(parents=True, exist_ok=True)
+    with path.open('xb') as out:
+        out.write(data)
+
+records = []
+def copy_exact(source, target, expected=None):
+    source = Path(source)
+    data = source.read_bytes()
+    sha = digest(data)
+    if expected:
+        assert sha == expected.upper(), (source, sha, expected)
+    destination = root / target
+    write_new(destination, data)
+    assert destination.read_bytes() == data == source.read_bytes()
+    records.append(dict(origin=str(source), target=target, bytes=len(data), sha256=sha))
+
+assert not (root / 'preparation-manifest.json').exists(), 'Never overwrite a prior preparation'
+manifest_bytes = (gates / 'inputs.json').read_bytes()
+assert digest(manifest_bytes) == '47FEC9CADC0E7FAE99D789376C111C02EEAAB7FAC3740DE48174A06F61FE16B3'
+inputs = json.loads(manifest_bytes)
+indexed = {item['path']: item for item in inputs['files']}
+assert len(indexed) == 529
+archive = gates / 'exact-inputs.zip'
+archive_sha = digest(archive.read_bytes())
+with zipfile.ZipFile(archive) as frozen:
+    selected = {
+        'harness/fixtures/scenario-lifecycle-native/typography-wide/rationale.arcadia': ('baseline-wide/rationale.arcadia', 'working-wide/rationale.arcadia'),
+        'harness/fixtures/scenario-lifecycle-native/typography-wide/project.arcadia': ('baseline-wide/project.arcadia', 'working-wide/project.arcadia'),
+        'harness/fixtures/scenario-lifecycle-native/typography-clusters/project.arcadia': ('baseline-clusters/project.arcadia', 'working-clusters/project.arcadia'),
+        'harness/fixtures/scenario-lifecycle-native/typography-clusters/rationale.arcadia': ('baseline-clusters/rationale.arcadia', 'working-clusters/rationale.arcadia'),
+        'harness/fixtures/scenario-lifecycle-native/README.md': ('provenance/lifecycle-fixture-README.md',),
+    }
+    for name, destinations in selected.items():
+        data = frozen.read(name)
+        record = indexed[name]
+        assert len(data) == record['bytes'] and digest(data) == record['sha256'].upper(), name
+        for destination in destinations:
+            write_new(root / destination, data)
+            records.append(dict(origin=str(archive) + '::' + name, target=destination, bytes=len(data), sha256=digest(data)))
+
+copy_exact(gates / 'bin/arcadia-studio.exe', 'bin/arcadia-studio.exe', '69DBB90FA299B3B3D90140C7934891F79166025893AF9B35B2B8D754A37A0D40')
+copy_exact(gates / 'bin/libunwind.dll', 'bin/libunwind.dll', 'AA282FA47BB2C4E210CEA5E470CDBDCA58568F0BE0BC73E404D86AB9CD95EF6A')
+for name in ('inputs.json', 'binary-manifest.json', 'after-build-verify-head.json', 'studio-build-status.json', 'desktop-clippy-status.json', 'desktop-all-targets-status.json', 'focused-lifecycle-status.json'):
+    copy_exact(gates / name, 'provenance/' + name)
+for source, target, expected in (
+    ('.local/native-865483b/oracles/lifecycle.exe', 'oracles/lifecycle.exe', '798D7A1907B894C13549BAD35511B21D6BC7F3D67D63674042B7DF71184C7524'),
+    ('.local/native-865483b/oracles/libunwind.dll', 'oracles/libunwind.dll', 'AA282FA47BB2C4E210CEA5E470CDBDCA58568F0BE0BC73E404D86AB9CD95EF6A'),
+    ('harness/lifecycle-native-contract.rs', 'provenance/lifecycle-native-contract.rs', 'FC5E71F9870D7B98E0F52EAF20C831EBFFBE9F7A9B8960269DC9BE3D9BF0D9E4'),
+):
+    copy_exact(repo / source, target, expected)
+for source, target in (
+    ('.local/native-865483b/oracles/manifest.json', 'provenance/oracles-865-copy-manifest.json'),
+    ('.local/lifecycle-native-ytr83r-20260911/status.json', 'provenance/lifecycle-oracle-status.json'),
+    ('harness/experiments/lifecycle-native-ytr83r-20260911/typography-admission.json', 'provenance/typography-admission.json'),
+    ('harness/experiments/lifecycle-native-ytr83r-20260911/typography-predictions.json', 'provenance/typography-predictions.json'),
+):
+    copy_exact(repo / source, target)
+
+for directory in ('profile', 'unrelated-cwd', 'logs', 'screenshots', 'checkpoints'):
+    (root / directory).mkdir(exist_ok=False)
+for record in records:
+    if record['target'].startswith(('baseline-', 'bin/', 'oracles/', 'provenance/')):
+        (root / record['target']).chmod(0o444)
+result = dict(prepared_utc=datetime.now(timezone.utc).isoformat(), source_commit=freeze,
+              scope='Preparation only for independent OA/SA camera, clipping, minimum-size, zoom and hit checks with passive Save equality. Pre-grapheme a57; no package or new combined Unicode acceptance.',
+              archive=dict(path=str(archive), sha256=archive_sha), input_manifest_sha256=digest(manifest_bytes),
+              frozen_input_count=529, files=records,
+              empty_profile=str(root / 'profile'), unrelated_cwd=str(root / 'unrelated-cwd'),
+              restricted_path='C:\\Windows\\System32;C:\\Windows;' + str(root / 'bin'))
+write_new(root / 'preparation-manifest.json', (json.dumps(result, indent=2) + '\n').encode())
+print(json.dumps(dict(files=len(records), copied_bytes=sum(r['bytes'] for r in records), archive_sha256=archive_sha), indent=2))
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
sorokin.oleg.edu	48620b527b	Sync agent instructions from main	2026-09-13 11:38:55 +03:00
Codex-ytr83r	7aa007b077	Publish verified canvas and repair Windows prerelease checkpoint	2026-09-12 05:06:18 -07:00
Codex-ytr83r	0c53c21030	Record verified Windows canvas and repair package acceptance	2026-09-12 04:59:48 -07:00
Codex-ytr83r	4dd0f60c75	Record complete combined Windows gates and bounded native camera checks	2026-09-12 04:26:03 -07:00
Codex-ytr83r	60f714853f	Merge commit '51846f5a2b44ae31f8e8f1127fc803f2f430fbe7' into codex/canvas-union-ytr83r-20260911	2026-09-12 04:06:16 -07:00
Codex-ytr83r	5511755a5e	Preserve closed native and Unicode verification with repair integration review	2026-09-12 04:02:45 -07:00
Codex-ytr83r	33e30c1cd7	Keep repaired destinations unsaved until their accepted source is written	2026-09-12 03:55:42 -07:00
sorokin.oleg.edu	51846f5a2b	Sync agent instructions from main	2026-09-12 13:43:20 +03:00
sorokin.oleg.edu	436ea4b29a	Sync agent instructions from main	2026-09-12 13:40:03 +03:00
sorokin.oleg.edu	46c8783c72	Sync agent instructions from main	2026-09-12 13:15:35 +03:00
Codex-ytr83r	0d39d58ebd	Record reviewed grapheme fix and closed packaged GUI evidence	2026-09-11 14:09:38 -07:00
Codex-ytr83r	cb91525cfd	Preserve grapheme clusters when shortening desktop labels	2026-09-11 13:48:21 -07:00
Codex-ytr83r	108b1dd208	Record combined Windows gates and native child-work evidence	2026-09-11 13:34:47 -07:00
Codex-ytr83r	a57c334b30	Integrate persistent canvas controls with scenario lifetime rendering	2026-09-11 12:44:06 -07:00
Codex-ytr83r	32334c6631	Record Windows gates and partial native child-work checks	2026-09-11 12:13:33 -07:00
Codex-ytr83r	09da0d90aa	Add reproducible native child-work verification fixtures	2026-09-11 11:32:15 -07:00
Codex-ytr83r	865483b4c6	Preserve responsibility assignments when creating child work	2026-09-11 11:04:12 -07:00
Codex-ytr83r	f796a27277	Record integrated Windows tests and HTTP persistence checks	2026-09-11 11:04:09 -07:00
Codex-ytr83r	321897fd55	Integrate contextual source creation with lifecycle rendering	2026-09-11 10:38:05 -07:00
Codex-ytr83r	4da92ab481	Clip behavior card labels to their bounds	2026-09-11 10:23:36 -07:00
Codex-ytr83r	7831abeed5	Record native lifecycle checks and centralize live planning	2026-09-11 10:22:50 -07:00
sorokin.oleg.edu	fe8364e7eb	Sync agent instructions from main	2026-09-11 19:52:27 +03:00
Codex-ytr83r	3ade397008	Record Windows desktop validation and user-paused Linux setup	2026-09-11 08:40:05 -07:00
Codex-ytr83r	29084050a7	Prepare Linux delivery and correct lifecycle rendering build types	2026-09-11 07:53:42 -07:00
Codex-ytr83r	cb611a71df	Bound Create labels within lifeline capsules and preserve Unicode test inputs	2026-09-11 06:56:17 -07:00
Codex-ytr83r	fb77b857d2	Save reboot checkpoint with interrupted build and restart instructions	2026-09-11 06:38:54 -07:00
Codex-ytr83r	a9a5768144	Record bounded Linux trial and contextual source integration review	2026-09-11 06:35:30 -07:00
Codex-ytr83r	d041212d17	Merge owner instruction sync while preserving exact supplied goal	2026-09-11 06:33:51 -07:00
Codex-ytr83r	b96286ea37	Record current core and lifecycle evidence and refresh project entrypoints	2026-09-11 06:30:59 -07:00
sorokin.oleg.edu	dd42d0ab01	Sync agent instructions from main	2026-09-11 15:55:52 +03:00
sorokin.oleg.edu	023e3a8f09	Add source-first CLI with guarded writes and reviewed evidence	2026-09-11 05:45:32 -07:00
Codex-ytr83r	52f6e176cd	Render explicit scenario lifetimes and preserve marker selection	2026-09-11 05:25:04 -07:00
Codex-ytr83r	b853a1eca3	Import corrected creation oracle and verified external evidence	2026-09-11 05:01:57 -07:00
sorokin.oleg.edu	e207b04114	Add named behavior creation and verified textual authoring examples	2026-09-11 04:37:07 -07:00
Codex-ytr83r	c81e285573	Integrate published behavior work and preserve current release goal	2026-09-11 04:27:09 -07:00
sorokin.oleg.edu	ff615d0ee0	Update the project goal Rust checks / check (windows-latest) (push) Canceled after 0s Rust checks / check (ubuntu-latest) (push) Canceled after 0s	2026-09-10 21:32:22 +03:00
				`@@ -0,0 +1 @@`
				`PASS same: all identities, fields, reachable source and physical bytes`