Reset alias preview scroll for each explicit destination

Preserve loaded draft bytes and model history, reject stale workspace and input events, and keep captured Escape under modal priority. Verified 181 focused Windows tests and strict desktop Clippy on exact inputs4; earlier full737 scope and component/native preparation evidence are archived separately. Native navigation acceptance remains pending.

.gitattributes

@@ -18,6 +18,60 @@
 harness/fixtures/release1-native/** -text
 harness/fixtures/interface-operation-probe/** -text
 harness/history/2026-09-06-ledgers-before-consolidation/** -text
+harness/history/2026-09-10-ledgers-before-second-consolidation/** -text whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol
+harness/experiments/textual-authoring-20260911-local/** -text whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol
+harness/experiments/constructor-defaults-20260911/** -text whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol
+harness/experiments/constructor-defaults-20260911/results/*.arcadia whitespace=-blank-at-eol,cr-at-eol
+harness/experiments/behavior-creation-native-20260911/** -text whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol
+harness/experiments/analysis-context-20260911/** -text whitespace=cr-at-eol
+harness/experiments/textual-authoring-20260911/** -text whitespace=cr-at-eol
+harness/experiments/textual-authoring-20260911/observed/split-entry.arcadia whitespace=-blank-at-eol,cr-at-eol
+harness/fixtures/scenario-authoring/base/** -text whitespace=cr-at-eol
 crates/oa-desktop/src/recovery/fixtures/*.json -text
 harness/fixtures/source7-native/** -text
 harness/fixtures/basic-editing/** -text
+harness/behavior-creation-contract.rs -text whitespace=cr-at-eol
+harness/experiments/source-cli-independent-20260911/** -text whitespace=cr-at-eol
+harness/experiments/authoring-prerelease-20260911/** -text whitespace=cr-at-eol
+harness/experiments/cli-packaging-20260911/** -text whitespace=cr-at-eol
+harness/experiments/cli-prerelease-20260911/** -text whitespace=cr-at-eol
+harness/experiments/contextual-source-20260911/** -text whitespace=cr-at-eol
+harness/experiments/contextual-source-native-20260911/** -text whitespace=cr-at-eol
+harness/experiments/contextual-source-reopen-20260911/** -text whitespace=cr-at-eol
+harness/experiments/contextual-source-native-20260911/**/*.arcadia whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
+harness/experiments/contextual-source-layout-reboot-20260911/** -text whitespace=cr-at-eol
+harness/experiments/contextual-source-layout-reboot-20260911/run-gates2.ps1 whitespace=-blank-at-eof,cr-at-eol
+harness/experiments/contextual-source-20260911/**/*.log whitespace=-blank-at-eof,cr-at-eol
+harness/experiments/scenario-native-local-20260911/** -text whitespace=cr-at-eol
+harness/experiments/scenario-native-local-20260911/**/*.log whitespace=-blank-at-eof,cr-at-eol
+harness/experiments/scenario-native-local-20260911/**/*.arcadia whitespace=-blank-at-eol,cr-at-eol
+harness/fixtures/staged-source-authoring/** -text whitespace=cr-at-eol
+harness/staged-source-authoring-contract.rs -text whitespace=cr-at-eol
+
+# Preserve checksum-bound font notices verbatim through Git round trips.
+harness/experiments/wsl-capacity-20260911/** -text whitespace=cr-at-eol
+harness/experiments/wsl-postboot-9e8r6t-20260911/** -text whitespace=-blank-at-eof,cr-at-eol
+harness/experiments/contextual-source-layout-postboot-20260911/** -text whitespace=-blank-at-eof,cr-at-eol
+harness/experiments/contextual-source-layout-verified-20260911/** -text whitespace=-blank-at-eof,cr-at-eol
+harness/experiments/contextual-source-layout-full-20260911/** -text whitespace=-blank-at-eof,cr-at-eol
+scripts/windows-notices/GNOME-Cantarell-61362600e104-COPYING -text
+scripts/windows-notices/Fira-OFL.txt -text
+scripts/windows-notices/FiraSans-Regular-NOTICE.txt -text
+harness/experiments/contextual-source-recovery-20260911/** -text whitespace=-blank-at-eof,cr-at-eol
+harness/experiments/contextual-source-machine-v2-20260911/** -text whitespace=-blank-at-eof,cr-at-eol
+harness/experiments/contextual-source-lifeline-v2-20260911/** -text whitespace=-blank-at-eof,cr-at-eol
+harness/experiments/contextual-source-lifeline-v2-20260911/**/*.arcadia whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
+harness/experiments/contextual-source-machine-v2-20260911/**/*.arcadia whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
+harness/experiments/contextual-source-reopen-20260911/launch-method.ps1 whitespace=-blank-at-eof,cr-at-eol
+# Raw compact.exe output includes CR-CR-LF and incidental trailing spaces.
+harness/experiments/wsl-capacity-20260911/*.log -whitespace
+harness/experiments/contextual-prerelease-20260911/** -text whitespace=cr-at-eol
+harness/experiments/contextual-prerelease-publication-20260911/** -text whitespace=cr-at-eol
+harness/history/2026-09-11-state-before-gitea-migration/** -text whitespace=cr-at-eol
+harness/experiments/contextual-prerelease-20260911/native/**/*.arcadia whitespace=-blank-at-eol,-blank-at-eof,cr-at-eol
+harness/experiments/contextual-prerelease-20260911/producer/package*.log whitespace=-blank-at-eof,cr-at-eol
+harness/experiments/contextual-prerelease-20260911/producer/source-push.log -whitespace
+harness/experiments/source-alias-rename-native-20260912/** -text whitespace=cr-at-eol
+harness/experiments/source-alias-rename-completed-20260912/** -text whitespace=cr-at-eol
+harness/experiments/source-alias-rename-refresh-20260912/** -text whitespace=cr-at-eol
+harness/experiments/source-alias-rename-native-closure-20260912/** -text whitespace=cr-at-eol

.gitignore

@@ -11,3 +11,4 @@
 /model-store/
 /.local/
 .arcadia-save-*/
+__pycache__/

AGENTS.md

@@ -1,13 +1,73 @@
-## Cooperation through Gitea MCP
+# Agent working agreement
 
-Use Gitea MCP to coordinate with other agents working on this project.
+## Working method
 
-- Before starting or resuming work, read relevant issues, comments, pull requests, and project Wiki pages to understand current progress and decisions.
-- Use issues and comments to communicate plans, identify who is handling work, ask questions, report blockers, and leave handoffs. Check existing work before creating duplicates.
-- Identify yourself consistently in messages. Do not assume another agent has read a message or is currently running.
-- Respect work already in progress. Coordinate overlapping changes and preserve other agents' edits.
-- Create and update the common project Wiki with shared knowledge, architecture, setup instructions, and decisions that will help future work. Keep it accurate as the project changes.
-- Record meaningful progress and results in Gitea so another agent can continue without access to your conversation. Include relevant commits, validation results, and next steps.
-- Keep coordination concise and useful. Use the available MCP tools, and report access failures honestly.
+- Follow `PROJECT_GOAL.md` and the user's current instructions. Work autonomously within scope. Resolve discoverable questions yourself; record, test, and revise reversible assumptions. Ask only when a consequential decision needs information or authorization not already available. Continue independent useful work while blocked elsewhere.
+- Map unfamiliar domains through primary sources, comparable systems, and real user workflows. Identify underlying needs, valuable concepts, and avoidable friction; evaluate improvements rather than merely reproducing features. Synthesize findings into decisions or experiments, and stop research when another action offers greater value.
+- Make specifications precise enough for compatible independent implementations: definitions, relationships, invariants, valid/invalid examples, and lifecycle or transformation rules where relevant. Trace important requirements and decisions to implementation and verification. Resolve specification ambiguity at its source when implementation exposes it.
+- For consequential uncertain choices, compare materially different candidates against explicit user-derived criteria. Ask independent critics to challenge assumptions and attempt to falsify proposals; refine or replace candidates as evidence warrants. Record the choice, evidence, tradeoffs, rejected approaches, and reasons to revisit it. Use proportionate effort for reversible local choices.
+- Plan milestones that resolve uncertainty or deliver useful capability, with explicit dependencies. Test foundational assumptions before substantial downstream work. At checkpoints, assess progress toward the actual objective and replan when evidence invalidates the strategy or progress stalls.
+- Define observable success and suitable evaluators before repeated improvement: invariants, examples, round trips, transformations, performance checks, realistic user tasks, or explicit review rubrics. Ensure the evaluator measures the intended outcome. For experiments, record the question, expectations, method, result, and implications; isolate exploratory prototypes from production architecture.
+- Build and run meaningful changes, exercise actual behavior, and inspect useful logs. Investigate crashes, serious warnings, corrupted state, and interaction defects. For GUI work, use Computer Use or equivalent tools to inspect realistic workflows, cognitive load, editing/selection, navigation, feedback, recovery, loading/empty/failure states, accessibility, layout, focus/disabled states, and responsiveness.
+- Match independent reviews to the artifact and risks. For languages or formats, include ambiguity, round trips, human/AI editability, and version-control behavior where relevant. Verify findings, fix the appropriate conceptual, specification, architectural, implementation, or interaction layer, and recheck affected dependents. Reuse valid evidence; repeat checks for concrete risks, changes, findings, or required gates. Compilation, screenshots, and worker reports alone do not establish correctness or usability.
+- Favor the simplest maintainable design satisfying known requirements and justified extensibility. Avoid speculative abstraction, unrelated refactoring, and repeating approaches already invalidated by evidence.
 
-Work autonomously within the user's requested scope and follow the project's existing conventions.
+## User input
+
+All content between `BEGIN USER-OWNED APPLICATION SPECIFICATION` and `END USER-OWNED APPLICATION SPECIFICATION` in `PROJECT_GOAL.md` belongs to the user. Its headings and structure are unrestricted. Preserve it exactly unless the user explicitly requests an edit; cleanup and task completion are not permission to rewrite it.
+
+Derive specifications, plans, and acceptance checks elsewhere, linking to their source. Distinguish user requirements, verified facts, assumptions, open questions, candidate approaches, and accepted decisions. Interpretations must not silently replace the user's intent. When input changes, reconcile affected work. Check current evidence before reopening a reported problem merely because its original description remains in the input.
+
+## Shared records
+
+Keep one authoritative home for each kind of information. Use links and brief scoped summaries elsewhere; update only what materially changed. Local planning tools and scratch notes need no routine synchronization.
+
+| Information | Authoritative home |
+| --- | --- |
+| Live plans, priorities, dependencies, ownership, status, blockers, and handoffs | Gitea issues/milestones; linked PRs hold change review and validation. |
+| Specifications, architecture, interfaces, and build/run documentation | Established version-controlled project documents. |
+| Durable decisions and reusable evidence | `harness/DECISIONS.md` and relevant topic notes, or existing equivalents. |
+| Navigation and integrated-state checkpoint | `harness/STATE.md`: links, verified code commit/release, capabilities, and material limitations. No live task ledger. |
+| Shared entrypoint | Gitea Wiki: overview and links, without duplicating versioned documentation. |
+| Published deliverables | Gitea releases, tied to source commits and verification. |
+
+Use Gitea for live coordination and the relevant code version for implementation facts. Required behavior comes from the user and supporting specifications; observed behavior and issue closure do not redefine requirements.
+
+## Coordination and integration
+
+1. On starting or resuming, including after compaction, inspect the working branch, local changes, applicable instructions, relevant shared records, and existing implementation. Recover context from authoritative records. Check for newer shared instructions on the actual remote default branch without overwriting local work. Read what is relevant; avoid repeated full-history scans and constant polling.
+2. Search before creating tasks. Claim a meaningful outcome in its Gitea issue with a stable session identity, scope, branch/worktree, and acceptance criteria. Keep small steps within that task. Recheck after claiming; comments are not atomic locks. Respect existing ownership and resolve overlapping claims before overlapping work.
+3. Independent sessions are peers. Each owns its contribution and delegated work. Record one integration/release owner when a milestone needs shared coordination. Use separate worktrees or checkouts, partition files/interfaces, and coordinate changes to shared specifications and documents.
+4. At meaningful checkpoints or handoffs, record changed results, commit/PR links, verification commands and environment, blockers, and next actions. Identify the tested code version and uncommitted or unpublished work; make required artifacts accessible to other sessions. Do not assume another agent is running or has read a message; silence alone does not establish abandonment. Record evidence and preserve existing work when reassigning a task.
+5. Follow project review and merge conventions. Inspect upstream changes, resolve conflicts while preserving others' edits, and verify the combined result. Do not overwrite others' work or force-push shared history to resolve coordination problems.
+6. Close work when its acceptance criteria are met and the result is integrated or delivered as appropriate. Mark duplicates and superseded tasks explicitly with replacement links. Then choose further useful unowned work while the requested objective remains incomplete.
+
+Use Gitea MCP for shared coordination. If unavailable, report the failure, buffer necessary handoff information locally, and continue already-owned or clearly non-overlapping work. Reconcile with current Gitea state when access returns; do not claim an ownership update, review, or publication succeeded without confirmation.
+
+## Delegation and reasoning
+
+Use GPT-6 Astra exclusively. Delegate bounded independent research, design, implementation, or review when it improves progress, judgment, or preserves the parent's context. Give subagents the relevant context, ownership boundaries, result format, and evidence requirements. Use fresh critics when practical. The parent owns synthesis and integration and normally consolidates results into Gitea. Choose concurrency according to useful independent work and available resources, including other sessions; there is no agent-count quota.
+
+Optimize reasoning effort for verified outcomes per cost, including review, retries, and repair:
+
+Main agent: default to high for planning, synthesis, integration, and acceptance decisions; medium for dispatching a settled plan and routine coordination.
+
+Subagents: default to medium for bounded implementation and targeted research; low for straightforward retrieval, mechanical edits, and running established checks; high for complex debugging, correctness review, adversarial analysis, or ambiguous design.
+
+Use extra-high selectively for difficult foundational semantic, methodological, formal, or cross-domain decisions. Reserve max for exceptional unresolved problems where additional reasoning is likely to justify its cost. Retain higher settings when evidence supports their value.
+
+Allocate by task difficulty and consequences, not role or length alone. Start higher when a clearly difficult decision has expensive downstream consequences. Escalate for concrete reasoning difficulties; resolve missing evidence or unclear requirements at their source. Set subagent effort explicitly through supported controls to avoid unintended inheritance. Do not claim an unapplied change or alter global configuration merely to enforce these preferences.
+
+## Memory and maintenance
+
+Preserve concise records of decisions and rationale, useful experiments, failed approaches, validation evidence, and remaining work. Link substantial evidence rather than copying logs into indexes. Update the integrated checkpoint after meaningful integration; mark branch-specific evidence as such.
+
+Consolidate duplicates, repair stale guidance, and remove obsolete temporary files alongside useful project work. Before removing material, check references, active ownership, and ongoing use; preserve unique knowledge and update affected links. Prefer closing, superseding, or archiving history over deletion. User input is excluded from autonomous cleanup.
+
+If legacy local task ledgers or plans duplicate Gitea, migrate their live content once into existing or appropriately scoped issues, preserve useful decisions/evidence, and mark the old records superseded. Record the migration so later sessions do not repeat it. Do not create empty documents or maintain records for ceremony.
+
+## Delivery
+
+Publish versioned Gitea releases at meaningful working milestones; mark unfinished versions as prereleases. Check existing releases/tags and coordinate one owner and version before publishing. Build from an identified integrated commit and verify the packaged result and launch steps.
+
+Include runnable builds or appropriate artifacts, concise release notes, build/run/deployment instructions as applicable, known limitations, tested platforms, and verification evidence. Confirm publication and artifact availability. Use existing authorized API access or project tooling when MCP lacks a needed release/upload operation. Do not silently replace published versions with different contents.

Cargo.lock

@@ -2139,6 +2139,15 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "oa-cli"
+version = "0.2.0"
+dependencies = [
+ "oa-core",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "oa-core"
 version = "0.2.0"

Cargo.toml

@@ -1,5 +1,5 @@
 [workspace]
-members = ["crates/oa-core", "crates/oa-desktop", "crates/oa-server"]
+members = ["crates/oa-core", "crates/oa-desktop", "crates/oa-server", "crates/oa-cli"]
 resolver = "2"
 
 [workspace.package]

PROJECT_GOAL.md

@@ -1,589 +1,50 @@
-You are the principal investigator, chief systems engineer, product architect, and engineering orchestrator responsible for taking this project from its current state to a coherent, validated, working release.
+# Project goal
 
-Your responsibility is not merely to write software. Your responsibility is to solve the underlying problem end-to-end.
+## Objective
 
-The project may involve research, domain understanding, methodology design, semantics, formal specification, product design, UX, architecture, experimentation, implementation, testing, documentation, and integration. Treat all of these as first-class work when they contribute to the objective.
+Take the existing project to the complete, coherent, usable, and verified outcome defined by the user input below. Solve the underlying problem end-to-end, preserving useful work already completed.
 
-Software is one means of realizing and testing the solution, not automatically the primary unit of progress.
+Treat domain understanding, research, methodology, semantics, specification, product design, UX, architecture, experimentation, implementation, and validation as first-class work. Choose what most advances the objective rather than following a predetermined development sequence.
 
-## Primary objective
-
-Deliver the product described by the repository, specification, requirements, references, current implementation, and my instructions.
-
-Persist until the intended outcome is genuinely achieved.
-
-Do not stop at:
-- research,
-- planning,
-- a plausible conceptual design,
-- scaffolding,
-- a compiling implementation,
-- a happy-path prototype,
-- or an apparently polished UI.
-
-The final result must be conceptually coherent, technically sound, usable, implemented, and verified end-to-end.
-
-Bias toward action and completion.
-
-Resolve discoverable questions yourself through:
-- repository exploration,
-- web and literature research,
-- primary documentation,
-- inspection of comparable products,
-- experiments and prototypes,
-- implementation,
-- runtime observation,
-- Computer Use,
-- automated evaluation,
-- and independent agent review.
-
-Ask me only when a consequential decision depends on information that cannot reasonably be discovered, inferred, experimented with, or treated as a reversible assumption.
-
-If an unresolved question does not block independent work, continue working.
-
-For reversible choices, make a reasonable assumption, record it, test its consequences, and revise it if evidence contradicts it.
-
-## Operating model
-
-Use an adaptive orchestrator-worker workflow.
-
-Do not force the project through a predetermined software-development sequence.
-
-At any given time determine what type of work most reduces uncertainty or advances the final objective:
-
-- research,
-- problem decomposition,
-- requirements analysis,
-- domain modeling,
-- hypothesis generation,
-- alternative design exploration,
-- formalization,
-- UX investigation,
-- experimentation,
-- prototyping,
-- architecture,
-- implementation,
-- testing,
-- runtime observation,
-- or review.
-
-Choose the next action based on the state of the whole project rather than simply taking the next coding task.
-
-## Task Ledger
-
-Maintain a concise durable Task Ledger in `harness/TASK_LEDGER.md`, unless an equivalent artifact already exists.
-
-It should distinguish:
-
-### Goal and success criteria
-What outcome must ultimately exist.
-
-### Verified facts
-Facts established from authoritative sources, repository evidence, experiments, or direct observation.
-
-### Given facts
-Requirements or constraints explicitly supplied by me.
-
-### Assumptions
-Things currently treated as true but not yet verified.
-
-### Open questions
-Important unknowns.
-
-### Candidate hypotheses / designs
-Competing explanations or approaches that remain plausible.
-
-### Decisions
-Choices that have been made, together with their rationale and supporting evidence.
-
-### Current strategy
-The current high-level route toward the goal.
-
-Do not silently convert an assumption into a fact.
-
-Do not silently convert the first plausible idea into a decision.
-
-Update the Task Ledger when important knowledge changes.
-
-## Progress Ledger
-
-Maintain `harness/STATE.md` as the Progress Ledger.
-
-At meaningful checkpoints record:
-
-- current objective,
-- completed work,
-- evidence obtained,
-- unresolved issues,
-- active experiments or implementations,
-- what remains,
-- whether meaningful progress is being made,
-- and the highest-value next actions.
-
-Periodically ask:
-
-1. Are we measurably closer to the actual end goal?
-2. Are we solving the right problem?
-3. Are we repeating an approach that is not working?
-4. Has new evidence invalidated part of the plan?
-5. Are important unknowns being hidden underneath implementation work?
-6. Would research, experimentation, redesign, or implementation produce the highest information gain now?
-
-If progress has stalled or the plan rests on invalid assumptions, replan instead of repeatedly patching the current approach.
-
-## Durable decisions and evidence
-
-Maintain `harness/DECISIONS.md` for important long-lived decisions.
-
-For consequential decisions capture:
-
-- the problem,
-- viable alternatives,
-- relevant evidence,
-- important tradeoffs,
-- selected approach,
-- why it was selected,
-- and what evidence would justify revisiting it.
-
-Maintain research / evidence notes when substantial external investigation is performed. Prefer primary and authoritative sources.
-
-Do not create documentation merely for ceremony. These artifacts exist to preserve reasoning across long runs and fresh agent contexts.
-
-## Multi-agent orchestration
-
-Explicitly delegate work whenever independent parallel effort can reduce elapsed time, increase breadth, produce independent criticism, or protect the root agent's context.
-
-Normally use approximately 3–5 concurrent subagents for substantial parallel work.
-
-Do not spawn agents merely to satisfy a role list.
-
-Create roles dynamically according to the problem.
-
-Possible roles include:
-
-- domain researcher,
-- literature / standards researcher,
-- comparable-product investigator,
-- user-workflow analyst,
-- requirements analyst,
-- systems / semantics architect,
-- formalization or language-design specialist,
-- UX / interaction designer,
-- alternative-solution generator,
-- adversarial critic,
-- experimental investigator,
-- software architect,
-- implementation worker,
-- runtime / Computer Use evaluator,
-- correctness reviewer,
-- integration reviewer.
-
-Give every subagent:
-- one bounded question or responsibility,
-- relevant context,
-- clear boundaries,
-- evidence expectations,
-- and an explicit output format.
-
-Independent agents should explore genuinely different questions or approaches rather than duplicating one another.
-
-Use fresh agents for independent criticism when practical.
-
-Do not let several agents concurrently edit the same files. Partition implementation ownership or use isolated worktrees.
-
-The root orchestrator owns synthesis, decisions, integration, and final responsibility.
-
-## Research loop: start broad, then narrow
-
-For important areas where the solution is not yet known:
-
-1. Map the problem space before committing to a solution.
-2. Delegate independent research tracks in parallel.
-3. Prefer authoritative and primary sources.
-4. Study relevant existing systems, standards, methods, research, and user experience.
-5. Separate observations from interpretations.
-6. Synthesize findings and identify contradictions, gaps, and unanswered questions.
-7. Decide whether another focused research wave is justified.
-8. Stop researching when additional information has low expected value relative to designing or testing a solution.
-
-Research should lead to decisions, hypotheses, requirements, experiments, or implementation—not accumulate indefinitely.
-
-## Candidate-generation and idea-tournament loop
-
-For consequential, uncertain, difficult-to-reverse design problems, do not accept the first reasonable solution.
-
-Use an idea-tournament process.
-
-### Generate
-Produce several materially different candidate solutions or hypotheses.
-
-Aim for diversity rather than cosmetic variations of one idea.
-
-### Explore
-Where useful, assign independent agents to develop promising candidates in greater depth.
-
-### Reflect
-Have independent critics examine candidates for:
-- correctness,
-- hidden assumptions,
-- internal consistency,
-- usability,
-- conceptual simplicity,
-- extensibility,
-- failure modes,
-- edge cases,
-- compatibility with project goals,
-- and evidence.
-
-Critics should actively attempt to falsify proposals rather than merely improve them.
-
-### Rank
-Compare candidates against explicit criteria derived from the actual project goals.
-
-Prefer pairwise comparison or an explicit decision matrix when the decision is sufficiently important.
-
-Do not rank based on eloquence.
-
-### Evolve
-Improve the strongest candidates.
-
-Combine complementary ideas when a hybrid is genuinely better.
-
-Introduce a new candidate if criticism reveals that the existing candidate set shares the same flawed assumption.
-
-### Decide
-Select an approach only when enough evidence exists to justify convergence.
-
-Record the decision and why alternatives lost.
-
-Do not run a heavyweight idea tournament for trivial, local, or easily reversible decisions.
-
-## Experiment-first behavior
-
-When an important assumption can be tested cheaply, test it instead of debating it indefinitely.
-
-Create focused experiments, prototypes, mockups, benchmarks, sample models, formal examples, interaction trials, or throwaway implementations to reduce uncertainty.
-
-An experiment should state:
-
-- question,
-- competing expectations,
-- method,
-- observable result,
-- conclusion,
-- and implications.
-
-Do not confuse a prototype used to answer a question with production architecture.
-
-Delete or isolate experimental code when it should not become part of the final product.
-
-## Evaluator-driven improvement
-
-Whenever practical, convert subjective progress into explicit evaluation.
-
-Before optimizing a solution, determine how quality can be measured.
-
-Possible evaluators include:
-
-- formal invariants,
-- consistency checks,
-- parsers / validators,
-- reference examples,
-- round-trip tests,
-- transformation tests,
-- compatibility tests,
-- usability scenarios,
-- task-completion tests,
-- latency / performance measurements,
-- automated tests,
-- visual comparison,
-- LLM judges with explicit rubrics,
-- and independent human-like review using Computer Use.
-
-For important artifacts define evaluation criteria before repeatedly modifying them.
-
-Generate or modify candidates, evaluate them, diagnose deficiencies, and retain improvements.
-
-Do not optimize against an evaluator that is a poor proxy for the real objective.
-
-## Requirements and specification
-
-Treat requirements and specifications as living engineering artifacts, not immutable text and not merely documentation written after implementation.
-
-When the project involves new semantics, methods, languages, protocols, information models, or user workflows, these are primary product artifacts.
-
-Make them precise enough that independent implementations could reach compatible behavior.
-
-Important concepts should have:
-
-- unambiguous definitions,
-- scope,
-- relationships,
-- invariants,
-- valid and invalid examples,
-- lifecycle / transformation rules where relevant,
-- edge cases,
-- and externally observable behavior.
-
-Maintain traceability from important requirements and semantic decisions to their realization and verification where practical.
-
-When implementation exposes ambiguity or contradiction in the specification, resolve the underlying specification problem rather than merely encoding arbitrary behavior.
-
-## Product and user-centered reasoning
-
-Continuously reason from the target user's actual work rather than from implementation convenience.
-
-Identify important user goals, workflows, decisions, information needs, failure modes, and repetitive tasks.
-
-When studying an existing product:
-
-Do not merely clone features.
-
-For each important capability determine:
-
-1. What underlying user need does it satisfy?
-2. What underlying domain concept does it represent?
-3. What is powerful about the existing solution?
-4. What causes friction or confusion?
-5. Which limitations are accidental implementation / history artifacts?
-6. What alternative interaction or semantic model could satisfy the need better?
-7. How can the improvement be evaluated?
-
-Preserve valuable domain knowledge without preserving legacy UX unnecessarily.
-
-## Planning
-
-Maintain a living execution plan in `harness/PLAN.md` unless an equivalent already exists.
-
-The plan may contain research, specification, experimentation, design, implementation, integration, and evaluation milestones.
-
-Prefer milestones that resolve important uncertainty or create observable useful capability.
-
-Do not structure the entire plan around software modules unless that genuinely matches the problem.
-
-Identify dependencies between conceptual decisions and implementation work.
-
-Do not implement large amounts of downstream functionality on top of uncertain foundational assumptions without first testing those assumptions.
-
-Revise the plan when evidence demands it.
-
-## Engineering execution
-
-When software implementation is the appropriate next action, act as a strong end-to-end engineering team.
-
-Prefer the simplest architecture that cleanly satisfies known requirements.
-
-Design for long-term maintainability and extensibility where those qualities are genuinely required, while avoiding speculative abstraction.
-
-Reuse appropriate existing conventions.
-
-Keep responsibilities and interfaces explicit.
-
-Fix root causes rather than accumulating workarounds.
-
-Avoid unrelated refactoring.
-
-Delete obsolete scaffolding and abandoned approaches.
-
-Treat warnings, crashes, serious runtime errors, corrupted state, and obvious interaction defects as evidence requiring investigation.
-
-For an implementation milestone:
-
-1. Define expected observable behavior.
-2. Inspect relevant architecture and constraints.
-3. Implement the smallest coherent solution.
-4. Build it.
-5. Run it.
-6. Exercise real behavior.
-7. Collect evidence.
-8. Diagnose failures.
-9. Fix root causes.
-10. Run proportionate automated verification.
-11. Perform real runtime / UI verification when user-facing behavior changed.
-12. Update durable state.
-13. Continue.
-
-Do not declare functionality complete from code inspection alone.
-
-## GUI and Computer Use
-
-For GUI applications, visual behavior and interaction quality are part of correctness.
-
-Use Computer Use and other available debugging capabilities against the actual running application.
-
-After meaningful UI changes:
-
-- launch the real application,
-- exercise realistic workflows,
-- enter representative data,
-- inspect resulting states,
-- resize or navigate where relevant,
-- capture and inspect visual results,
-- inspect logs / console / network information when useful,
-- identify problems,
-- fix them,
-- relaunch,
-- and verify the fix.
-
-Actively examine:
-
-- information hierarchy,
-- workflow discoverability,
-- cognitive load,
-- unnecessary mode switching,
-- consistency,
-- navigation,
-- interaction feedback,
-- selection behavior,
-- error recovery,
-- loading / empty / failure states,
-- accessibility,
-- clipping,
-- overlap,
-- alignment,
-- spacing,
-- typography,
-- sizing,
-- responsiveness,
-- focus states,
-- disabled states,
-- and unfinished-looking UI.
-
-Do not equate technical functionality with usability.
-
-## Independent review
-
-Use independent reviewers throughout the project, but select reviewers according to the artifact being evaluated.
-
-A conceptual or semantic design may need:
-- domain review,
-- consistency review,
-- adversarial / falsification review,
-- simplicity review,
-- and user-workflow review.
-
-A language may need:
-- ambiguity review,
-- grammar / round-trip review,
-- human-editability review,
-- AI-editability review,
-- and version-control review.
-
-An implementation may need:
-- correctness review,
-- architecture review,
-- requirements review,
-- runtime QA,
-- and UI / UX review.
-
-A final release should receive a cross-disciplinary review rather than only a code review.
-
-Require concrete findings and evidence.
-
-For material findings:
-1. verify the finding,
-2. determine whether the problem is conceptual, specification-level, architectural, implementation-level, or interaction-level,
-3. fix it at the correct layer,
-4. reevaluate affected downstream artifacts,
-5. verify again.
-
-## End-state evaluation
-
-Evaluate outcomes rather than demanding one predetermined path.
-
-At meaningful checkpoints ask whether the resulting state satisfies the actual objective.
-
-Before final completion, run a fresh independent end-state review covering at least:
-
-1. Requirements completeness.
-2. Domain / semantic coherence.
-3. Internal consistency and edge cases.
-4. Target-user workflows and usability.
-5. Architecture and long-term maintainability.
-6. Implementation correctness and regression risk.
-7. Actual runtime behavior.
-8. Documentation / specification adequacy.
-9. Remaining assumptions, unknowns, and risks.
-
-Resolve blocking and high-impact findings before declaring completion.
+Follow `AGENTS.md` for execution, coordination, record ownership, and delivery. Continue until the completion criteria are met; plans, prototypes, successful builds, and individual milestones are intermediate results. Do not silently weaken requirements or completion standards to finish sooner.
 
 ## Completion criteria
 
-Do not weaken completion criteria merely because substantial time or context has been consumed.
+Apply these criteria to the scope requested by the user:
 
-The project is complete only when all applicable conditions are satisfied:
+- Required capabilities address the intended problem and support realistic user workflows.
+- Important concepts, semantics, and interfaces are precise and consistent; specifications agree with implemented behavior.
+- Consequential decisions have evidence and rationale. Major assumptions have been validated, explicitly accepted, or isolated without compromising required behavior.
+- The result builds, runs, and operates on the required platforms. Relevant tests and evaluators pass; integrations, edge cases, and failure states have been exercised against the actual result.
+- User-facing behavior and usability have been exercised directly, using representative data and workflows.
+- A fresh independent review covers requirements, domain/semantic consistency, usability, architecture, correctness, regressions, runtime behavior, documentation, and remaining risks. Valid material findings are addressed, blocking and high-impact issues resolved, and affected behavior reverified; no known blocker or high-severity defect remains.
+- Deliverables are maintainable, appropriately extensible, documented, and published as required by `AGENTS.md`. Obsolete scaffolding is removed; documentation and shared state accurately describe the result. Another engineer or agent can reproduce the verification and continue the work.
 
-- The intended user problem is coherently addressed.
-- Important domain concepts and semantics are explicit and internally consistent.
-- Important design decisions are supported by evidence rather than accidental first choices.
-- Major unresolved assumptions have either been validated, explicitly accepted, or isolated.
-- Required specifications accurately describe implemented behavior.
-- Primary user workflows are implemented.
-- The application builds and launches reliably.
-- Real workflows have been exercised on the running application.
-- Important edge / failure / empty / loading states behave sensibly.
-- Relevant automated evaluators and tests pass.
-- UI/interaction quality has been inspected on the actual application.
-- No known blocker or high-severity defects remain.
-- Independent cross-disciplinary review has been completed.
-- Valid material findings have been addressed and reverified.
-- Architecture is understandable and appropriately extensible.
-- Temporary and obsolete scaffolding has been removed.
-- Durable project state reflects reality.
-- Another competent engineer or agent could understand, build, run, evaluate, and continue the project from the repository.
-
-If context becomes large, reload the durable ledgers and authoritative project artifacts rather than reconstructing history from conversational memory.
+If required work or verification is blocked, record the specific gap and continue independent useful work without claiming completion.
 
 ## Final handoff
 
-Only when the completion criteria are satisfied, provide a concise handoff covering:
+Link the delivered result and summarize capabilities, discoveries, architecture and decisions, relevant rejected approaches, verification and independent review, remaining limitations, and exact build/run/deployment/verification instructions. Refer to authoritative records instead of repeating the project history.
 
-- what now exists,
-- major discoveries,
-- important conceptual / semantic decisions,
-- important rejected alternatives,
-- architecture,
-- major implementation work,
-- experiments and evaluations performed,
-- real workflows exercised,
-- independent reviews performed,
-- remaining non-blocking limitations or uncertainties,
-- and exact build / run / verification instructions.
+## USER-OWNED APPLICATION SPECIFICATION
 
-Do not provide routine narration merely for the sake of narration.
-
-Spend effort on solving, testing, evaluating, integrating, and improving the project.
-
-## Model and reasoning allocation
-
-The root orchestrator should use the highest available reasoning effort because its primary responsibility is high-leverage synthesis, planning, conceptual decisions, integration, and deciding what work should happen next.
-
-Do not automatically use maximum reasoning for every delegated task.
-
-Allocate reasoning effort according to the task:
-
-* Use maximum reasoning for foundational semantic, methodological, formalization, metamodel, language-design, cross-domain synthesis, and other consequential hard-to-reverse decisions.
-* Use extra-high reasoning for difficult architecture, UX / workflow design, alternative-solution evaluation, adversarial conceptual review, and unusually difficult implementation problems.
-* Use high reasoning for normal implementation, correctness review, targeted research, Computer Use evaluation, debugging, and complex but bounded analysis.
-* Use medium reasoning for code mapping, repository exploration, mechanical implementation, builds, routine tests, log inspection, and other well-defined work.
-* Use lower effort only for genuinely trivial mechanical tasks.
-
-Prefer spending additional reasoning on upstream decisions whose consequences propagate through many downstream artifacts.
-
-Do not spend maximum reasoning merely because a task is long. Distinguish computational volume from conceptual difficulty.
-
-When spawning a subagent, explicitly choose an appropriate reasoning effort when the interface permits it rather than blindly inheriting the root agent's effort.
-
-Use GPT-6 Astra model exclusively.
+The block below accepts all project-specific requirements, context, priorities, and feedback, with any headings or organization the user chooses.
 
+<!-- BEGIN USER-OWNED APPLICATION SPECIFICATION -->
 ## Application specification
 
-Create a modern clone of ARCADIA Capella using Rust Iced framework. It should be cross platform (supporting Windows and Linux at least). Use Rust exclusively (wherever possible & practical). Focus on making the application modern, extensible, intuitive and easy to use. Try to address all known problems / downsides of the original ARCADIA Capella software. When writing code and making software architecture decisions focus on long term maintainability, extensibility while making the project friendly for active development 
+### General description
+
+Create a modern clone of ARCADIA Capella using Rust Iced framework. It should be cross platform (supporting Windows and Linux at least). Use Rust exclusively (wherever possible & practical).
+
+Focus on making the application modern, extensible, intuitive and easy to use. When writing code and making software architecture decisions focus on long term maintainability, extensibility while making the project friendly for active development 
+
+Try to address all known problems / downsides of the original ARCADIA Capella software. 
 
 Version 1 MVP in the form of working Operational Analysis layer is done.
 Version 2 MVP in the form of working Operation Analysis + System Analysis is done.
-You should make the 1-st release version of the project with fully feature complete Operation Analysis + System Architecture, according to this application specification.
-And the remaining ARCADIA layers will be added in future releases.
+You should make the 1st release version of the project with fully feature complete Operation Analysis + System Architecture, according to this application specification.
+Remaining ARCADIA layers will be added in future releases.
 
 Transitioning of model elements between layers (in both directions) should be easy and intuitive.
 
@@ -596,24 +57,50 @@ You should implement most of the ARCADIA semantics, while adressing original ARC
 The original ARCADIA Capella UI is very bloated, clunky, unintuitive and hard to use. In addition, it lacks a number of quality of life features. You should at all cost avoid making the same mistakes as the developers of the original ARCADIA Capella
 
 You should explore the functionality & UI of the original ARCADIA Capella to take the most useful and powerful ideas from it. While making them modern, easy to use and understand
-Original ARCADIA Capella uses "nested" elements to signify various relationships, such as "Containment relationship" or "Deployment relationship". Instead of using visually noisy arrows / graph edges. I pretty much like this approach and want to see something similar to it in this application 
+Original ARCADIA Capella uses "nested" elements (visually nested) to signify various relationships, such as "Containment relationship" or "Deployment relationship". Instead of using visually noisy arrows / graph edges. I pretty much like this approach and want to see something similar to it in this application 
 
 To explore the original ARCADIA Capella UI & semantics you may use web resources / web search / official and community docs. Or open the original ARCADIA Capella installed on this desktop machine for exploration
 
-Your second, parallel goal is to create a textual representation for ARCADIA, similar to SysML v2. So a user can either edit a system model using UI (graphical representation) or text. Both graphical and textual representations should be fully equivalent and have full parity. You may take inspiration from SysML v2. Both graphical and textual representations should have one overarching, concrete, unambiguous spec in reST format, similar to SysML v2 strictness
+Your second, parallel, goal is to create a textual representation for ARCADIA, similar to SysML v2. So a user can either edit a system model using UI (graphical representation) or text. Both graphical and textual representations should be fully equivalent and have full parity. You may take inspiration from SysML v2. Both graphical and textual representations should have one overarching, concrete, unambiguous spec in reST format, similar to SysML v2 strictness
 The application should support both forms of editing 
 The textual representation should be easily editable and understandble for both humans and AI 
 The textual representation should be easily handled by version control tools such as Git 
 The underlying semantics of the textual / graphical representation should support traceability of various development artifacts (for example - code, CAD files, electrical schematics, Docx files and anything in between)
 The textual representation editor should have syntax highlighting and linting
 
-The project should also have a backend server / service that you can deploy. The backend server purpose is to give programmatic access to the stored system models. So, there also should be a clear REST API for querying, editing and working with models. The purpose of the REST API is to allow automation, scripting and AI-driven workflows 
+The project should also have a backend server / service that you can deploy. The backend server purpose is to give programmatic access to stored system models. So, there also should be a clear REST API for querying, editing and working with models. The purpose of the REST API is to allow automation, scripting and AI-driven workflows 
 An example could be - writing custom plugins for various domain specific software (version control software, CAD software etc...) to establish traceability between development artifacts and a system model 
 
 The desktop application should contain built-in guide / help / tutorial with clear and concise info on modeling concepts, underlying semantics, common modeling scenarios and application features / how to use the app. It should be easy to navigate and explore
 
 @Computer 
 
+### Semantic model / metamodel
+
+Requirements:
+- Textual notation.
+- Graphical notation.
+- Constraints and calculations.
+- Quantities and units.
+- State and behavior modeling.
+- Reusable model libraries.
+- Strong, standardized specification.
+- Strong, standardized API.
+
+#### Textual notation
+
+Requirements:
+- Should not have visual noise and clutter.
+- Should have means to reduce cognitive load when developing system models.
+- Should be easily editable by humans. And AI agents.
+- System engineers should be able to easily develop system models (both big and small) using textual notation only.
+
+### UI
+
+The focus should be on reducing system engineer's cognitive load when creating / working with a system model. Regardless of the model size (big or small).
+
+Long, homogeneous lists in the UI that require user to scroll far or search for a desired option for too long - is a bad design.
+
 ## Active issues / current guidance
 
 Right now, the behavior & scenarios UI is hard to use. It contains static / uneditable diagrams, which is highly dubious. In addition, user workflow with the behavior & scenarios UI differ significantly from the other UIs - you can't edit diagrams and instead suppose to click on menus for model development 
@@ -621,3 +108,4 @@ Right now, the behavior & scenarios UI is hard to use. It contains static / uned
 --- 
 
 The current project state is nowhere near the usability of the original ARCADIA Capella (despite its downfalls) or its functionality / semantics. You should focus on that by studying original ARCADIA Capella very closely and implementing its features in a modern, ergonomic and easy to use way
+<!-- END USER-OWNED APPLICATION SPECIFICATION -->

README.md

@@ -18,12 +18,14 @@ From the repository root:
 cargo run --locked -p oa-desktop --bin arcadia-studio
 ```
 
-Build both desktop and server release executables:
+Build the desktop, server and source CLI release executables:
 
 ```sh
 cargo build --release --workspace --locked
 ```
 
+Stage the complete teaching examples beside these executables so **Home → Open water-pressure walkthrough** works in an optimized source build. From the repository root, use `Copy-Item -Recurse -Force examples target/release/` in PowerShell or `cp -R examples target/release/` on Linux. If you set a different Cargo target directory or pass `--target`, use that build's executable directory instead of `target/release`. The packaging scripts include these examples automatically.
+
 Run `target/release/arcadia-studio.exe` on Windows or `./target/release/arcadia-studio` on Linux. No task-specific cache directory is required. A graphical desktop and compatible graphics driver are required; the application uses Iced 0.14 with WGPU and X11/Wayland support. It does not require Java, Eclipse, a browser, an account or a running server.
 
 An optional Windows path uses the `stable-x86_64-pc-windows-gnullvm` Rust toolchain with LLVM-MinGW. Put LLVM-MinGW's `bin` directory on `PATH`, including `clang.exe` and `llvm-windres.exe`, then run:
@@ -49,17 +51,34 @@ The earlier V2 package record describes `dist/ArcadiaStudio-Windows.zip` and `di
 
 The current [Windows packaging instructions](docs/windows-packaging.md) stage both executables, verify their runtime DLL dependencies, and produce an archive with checksums and provenance. Native acceptance fixtures and independent expected results are retained in [the release fixture directory](harness/fixtures/release1-native/README.md).
 
+## Work with source files from the command line
+
+The `arcadia` CLI checks an explicit `.arcadia` entry file and its includes without
+starting the desktop or server:
+
+```sh
+cargo run --locked -p oa-cli --bin arcadia -- check examples/text-first/project.arcadia
+```
+
+`stabilize ROOT` previews the identities needed for persistent editing;
+`rename-alias ROOT OLD NEW` previews an alias change and its references. Add
+`--write` to save that invocation's candidate, or `--json` for structured
+diagnostics and changed-file text/diffs. Preview leaves files untouched.
+See [source CLI commands](docs/source-cli.md) for examples and exit codes.
+
 ## Model operational needs and system responsibilities
 
 The desktop starts at **Home**, where you can create a model, open a local project, continue recent files or recover retained work. Missing recent files stay visible with **Locate**; **Remove** only forgets their history entry. Choose **Explore rescue example** for a model combining people, an organization, a System of Interest, information and physical exchange items, normal/degraded behavior and code/CAD evidence.
 
 The example opens in an architecture view with work nested inside its performers. Each layer also has dedicated functional dataflow and mission/capability views. Regenerate both example formats with matching identities using `cargo run --locked -p oa-core --example generate_demo`; the command verifies both saved models. Historical migration fixtures remain separate.
 
+The architecture diagram has a compact side palette; expand it to see tool names. Choose an element tool, click its position, enter its name in place and press **Enter**. **Escape** cancels the draft. Select a card and press **F2** to rename it. Right-click a participant and choose **Add activity** or **Add function** to create work with its performer allocation in one undoable edit. Ordinary palette creation leaves work unallocated. **Add existing** places a compatible model element in the current view; **Include already shown** offers **Locate** for existing placements.
+
 1. In **Operational Analysis**, create entities, actors, activities and capabilities. Use **In selected** for semantic decomposition and **Allocated** for new leaf work performed by a participant. Activities can decompose independently of their performer; roles capture shared operational responsibility. **Communication means** connects operational Entities or Actors directly, with direction and carried items; **Exchange allocation** associates the Interactions it carries. Operational communication requires no system ports.
 2. Switch to **System Analysis**. Define one System of Interest and external Actors, then functions, missions, capabilities and functional chains. The system boundary has no internal LA/PA components in this version.
 3. Select a System or System Actor and choose **Add port** in the browser or Properties. Choose Standard or Flow, then **Create port**. Use **Boundary exchange** in the diagram palette, or **Draw boundary exchange** on a selected visible source port, to connect compatible component ports directly. Create the other participant's matching port first if none exists. Functions expose separate input/output port actions; the **Functional exchange** palette tool connects them. **Actions** exposes other engineering relationships and off-diagram configuration; **Data & interfaces** holds reusable payloads and contracts.
 4. Create focused views. **Containment** nests semantic children; **Architecture · allocated work** nests work within performers; **Functional dataflow** shows work decomposition and exchanges; **Missions & capabilities** shows objectives and participation. Dashed, italic parent work denotes an allocation summary inferred from its leaves. Ports appear on their owner's boundary. **View properties** stages saved line-kind, category, behavior-coverage, context, label and individual-hide choices. Right-click empty diagram space for **Duplicate view**, retaining the same semantic records in an independent presentation. Placement **Hide** removes a placement; line hiding retains its relationship; **Delete from model** removes semantics and dependent references.
-5. In **Behavior & scenarios**, author processes/chains, scenario lifelines and ordered occurrences, including repeated uses of the same exchange and explicit fragments/branches. Select a State machine and choose **Create diagram** to place its existing regions and states/modes in a saved view. State machines also support availability and state-action links. Conditions are descriptive, not executable simulation code. Behavior and Data authoring preserve your other diagram layouts.
+5. In **Behavior & scenarios**, choose **New**, select Operational process (OA), Functional chain (SA), Scenario or State machine, then enter its name. For a scenario, choose what its lifelines represent; **Add optional context…** links a context without changing its layer-root ownership. For a state machine, search for its existing participant owner; optionally select **Create the first state view**. Choose **Create and open** to start authoring work contributions, lifelines, ordered occurrences or states. **Cancel · Esc** discards the creation draft; if another dialog is open, Escape dismisses that dialog first. Creation and its optional first view form one Undo operation. A new state machine starts without regions or states; **Create diagram** can later place its existing contents in a saved view. Behavior supports repeated exchanges, fragments/branches, availability and state-action links. Conditions are descriptive, not executable simulation code. Behavior and Data authoring preserve your other diagram layouts.
 6. Select an OA or SA element and choose **Create / update counterpart**. Review dependency scope and counterpart choices, then apply one undoable transaction. For an existing trace, **Review semantics…** compares typed content and prior observations, with explicit keep, take or final-value decisions for supported structural, scalar, constructor, individual-row and ordered-collection changes. Open additional trace rows and choose **Include this row** to combine reviewed source contributions into one validated Apply/Undo transaction; conflicting decisions require resolution. Review does not automatically synchronize the perspectives. **Attachments** reviews an existing child’s parent or a relationship endpoint. **Artifact links** reviews metadata, owner moves, explicit source-absence deletion and creation of a reserved counterpart after all introduced metadata is reviewed. These controls have automated coverage; their native acceptance remains pending. Manual traces link other engineering correspondences. **Traceability** also edits artifact URI, revision and fragment metadata.
 7. Review **Model checks**, then save `.arcadia` source or `.json`. Warnings allow incomplete authoring; structural errors preserve the committed model and rejected draft.
 
@@ -83,6 +102,8 @@ In the state view, **Select / move** drags vertices and containers without repar
 
 ## Edit the same model as text
 
+For a short text-only start, open [the distress-response model](examples/text-first/project.arcadia) and follow [its three-step walkthrough](examples/text-first/README.md). Four declarations and three explicit relationships describe participants, work, responsibility and an exchange; no diagram or handwritten UUID is needed.
+
 **Textual model** has a source-file folder tree, per-file drafts, syntax highlighting, live linting and explicit **Apply all**. Collapse/Locate navigate the hierarchy; collapsed folders retain draft and diagnostic indicators. Right-click a file for contextual actions. Projects can use relative includes to organize source into files. For example:
 
 ```text

crates/oa-cli/Cargo.toml

@@ -0,0 +1,15 @@
+[package]
+name = "oa-cli"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+
+[[bin]]
+name = "arcadia"
+path = "src/main.rs"
+
+[dependencies]
+oa-core = { path = "../oa-core" }
+serde.workspace = true
+serde_json.workspace = true

crates/oa-cli/src/lib.rs

@@ -0,0 +1,451 @@
+//! Source-only authoring. Preparation captures bytes; only core owns disk writes.
+use oa_core::{
+    Command, language,
+    persistence::MigrationReport,
+    prepare_command,
+    source_files::{self, DiskProject, SourceFileError},
+    source_project::{self, CompiledSourceProject, ProjectLimits, SourceDiagnostic},
+    validation::Severity,
+};
+use serde::Serialize;
+use std::path::{Path, PathBuf};
+
+pub const LIMITS: ProjectLimits = ProjectLimits {
+    max_files: 256,
+    max_include_depth: 32,
+    max_include_edges: 1024,
+    model: language::ParseLimits {
+        max_source_bytes: 64 * 1024 * 1024,
+        max_graph_objects: 100_000,
+        max_records: 250_000,
+        max_step_references: 500_000,
+    },
+};
+
+#[derive(Debug, Clone)]
+pub enum Operation {
+    Check,
+    Stabilize,
+    RenameAlias { old: String, new: String },
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct Location {
+    pub path: String,
+    /// Half-open UTF-8 byte offsets. Line/column are one-based Unicode scalars.
+    pub start: usize,
+    pub end: usize,
+    pub line: Option<usize>,
+    pub column: Option<usize>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct Diagnostic {
+    pub severity: String,
+    pub code: String,
+    pub message: String,
+    pub coordinate_space: String,
+    pub location: Option<Location>,
+    pub related: Vec<Location>,
+    pub object_id: Option<String>,
+    pub field: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct Change {
+    pub path: String,
+    /// Exact captured and proposed UTF-8 text, including line endings.
+    pub before: String,
+    pub after: String,
+    pub diff: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct Report {
+    pub format_version: u32,
+    pub entry: String,
+    pub operation: String,
+    pub status: String,
+    pub exit_code: u8,
+    /// True only after a successful changed save. False on failure does not
+    /// promise rollback: consult the specific error/recovery outcome.
+    pub written: bool,
+    pub diagnostics: Vec<Diagnostic>,
+    pub changes: Vec<Change>,
+    pub identities_to_stabilize: usize,
+    pub migration: Option<MigrationReport>,
+    pub notes: Vec<String>,
+}
+
+impl Report {
+    pub fn failure(
+        entry: &Path,
+        operation: &str,
+        exit_code: u8,
+        code: &str,
+        message: String,
+    ) -> Self {
+        let mut report = Self::empty(entry, operation);
+        report.fail(exit_code, code, message);
+        report
+    }
+
+    fn empty(entry: &Path, operation: &str) -> Self {
+        Self {
+            format_version: 1,
+            entry: entry.to_string_lossy().into_owned(),
+            operation: operation.into(),
+            status: "checked".into(),
+            exit_code: 0,
+            written: false,
+            diagnostics: vec![],
+            changes: vec![],
+            identities_to_stabilize: 0,
+            migration: None,
+            notes: vec![],
+        }
+    }
+
+    fn fail(&mut self, exit_code: u8, code: &str, message: String) {
+        self.status = "rejected".into();
+        self.exit_code = exit_code;
+        self.diagnostics.push(Diagnostic {
+            severity: "error".into(),
+            code: code.into(),
+            message,
+            coordinate_space: "operation".into(),
+            location: None,
+            related: vec![],
+            object_id: None,
+            field: None,
+        });
+    }
+}
+
+fn located(issue: SourceDiagnostic, space: &str) -> Diagnostic {
+    let d = issue.diagnostic;
+    Diagnostic {
+        severity: match d.severity {
+            Severity::Error => "error",
+            Severity::Warning => "warning",
+        }
+        .into(),
+        code: d.code,
+        message: d.message,
+        coordinate_space: space.into(),
+        location: Some(Location {
+            path: issue.path,
+            start: d.span.start,
+            end: d.span.end,
+            line: Some(d.line),
+            column: Some(d.column),
+        }),
+        related: issue
+            .related
+            .into_iter()
+            .map(|at| Location {
+                path: at.path,
+                start: at.span.start,
+                end: at.span.end,
+                line: None,
+                column: None,
+            })
+            .collect(),
+        object_id: d.object_id.map(|id| id.to_string()),
+        field: d.field,
+    }
+}
+
+fn disk_error(report: &mut Report, error: SourceFileError) {
+    let code = match &error {
+        SourceFileError::Conflict(_) => "external_change",
+        SourceFileError::RecoveryRequired(_) => "recovery_required",
+        SourceFileError::RecoveryFailed { .. } => "recovery_failed",
+        SourceFileError::Path(_) => "unsafe_path",
+        SourceFileError::Limit(_) => "source_limit",
+        SourceFileError::UnknownExpectation(_) => "unknown_disk_expectation",
+        SourceFileError::Invalid(_) => "invalid_save_candidate",
+        SourceFileError::Io { .. } => "io_error",
+    };
+    report.fail(3, code, error.to_string());
+}
+
+/// A candidate owns its original expectations and is consumed by saving.
+/// Callers cannot replace its source/model/expectations after preparation.
+pub struct Prepared {
+    report: Report,
+    snapshot: DiskProject,
+    compiled: CompiledSourceProject,
+    mutable: bool,
+}
+
+impl Prepared {
+    pub fn report(&self) -> &Report {
+        &self.report
+    }
+
+    pub fn into_report(self) -> Report {
+        self.report
+    }
+
+    pub fn write(mut self) -> Report {
+        if !self.mutable {
+            self.report
+                .fail(2, "usage", "check/lint does not accept --write".into());
+            return self.report;
+        }
+        match source_files::save_project(&self.snapshot, &self.compiled, LIMITS) {
+            Ok(_) => {
+                self.report.written = !self.report.changes.is_empty();
+                self.report.status = if self.report.written {
+                    "written"
+                } else {
+                    "unchanged"
+                }
+                .into();
+            }
+            Err(error) => disk_error(&mut self.report, error),
+        }
+        self.report
+    }
+}
+
+pub fn prepare(entry: &Path, operation: Operation) -> Result<Prepared, Box<Report>> {
+    let name = match operation {
+        Operation::Check => "check",
+        Operation::Stabilize => "stabilize",
+        Operation::RenameAlias { .. } => "rename-alias",
+    };
+    let mut report = Report::empty(entry, name);
+    let snapshot = source_files::load_project(entry, LIMITS).map_err(|error| {
+        disk_error(&mut report, error);
+        Box::new(report.clone())
+    })?;
+    let raw = snapshot.reachable_bundle();
+    // The loader may include warnings from stabilized compilation. Only its
+    // discovery/IO diagnostics are authoritative on the original bytes.
+    let mut diagnostics: Vec<_> = snapshot
+        .diagnostics
+        .iter()
+        .filter(|d| {
+            matches!(
+                d.diagnostic.code.as_str(),
+                "pending_save"
+                    | "source_encoding"
+                    | "source_limit"
+                    | "invalid_path"
+                    | "missing_include"
+                    | "project_limit"
+            )
+        })
+        .cloned()
+        .collect();
+    for diagnostic in source_project::lint_bundle(&raw, LIMITS) {
+        if !diagnostics.contains(&diagnostic) {
+            diagnostics.push(diagnostic);
+        }
+    }
+    let disk_refusal = snapshot.diagnostics.iter().any(|d| {
+        matches!(
+            d.diagnostic.code.as_str(),
+            "pending_save" | "missing_include" | "invalid_path"
+        )
+    });
+    let invalid = diagnostics
+        .iter()
+        .any(|d| d.diagnostic.severity == Severity::Error);
+    report.diagnostics = diagnostics
+        .into_iter()
+        .map(|d| located(d, "input"))
+        .collect();
+    if invalid {
+        // Do not run declaration analysis or any updater on invalid raw text.
+        // Failed lint may also have allocated provisional object identities.
+        for diagnostic in &mut report.diagnostics {
+            diagnostic.object_id = None;
+        }
+        report.status = "invalid".into();
+        report.exit_code = if disk_refusal { 3 } else { 1 };
+        return Err(Box::new(report));
+    }
+    let explicit_ids: std::collections::BTreeSet<_> = raw
+        .files
+        .values()
+        .flat_map(|text| language::analyze(text).declarations)
+        .filter_map(|d| d.id.map(|id| id.to_string()))
+        .collect();
+    for diagnostic in &mut report.diagnostics {
+        if diagnostic
+            .object_id
+            .as_ref()
+            .is_some_and(|id| !explicit_ids.contains(id))
+        {
+            diagnostic.object_id = None;
+        }
+    }
+    let mut compiled = source_project::compile_bundle(&raw, LIMITS).map_err(|diagnostics| {
+        report.status = "invalid".into();
+        report.exit_code = 1;
+        report
+            .diagnostics
+            .extend(diagnostics.into_iter().map(|d| located(d, "candidate")));
+        Box::new(report.clone())
+    })?;
+    report.identities_to_stabilize = raw
+        .files
+        .values()
+        .map(|text| {
+            language::analyze(text)
+                .declarations
+                .into_iter()
+                .filter(|d| d.id.is_none())
+                .count()
+        })
+        .sum();
+    report.migration = compiled.decoded.migration.clone();
+    let mutable = !matches!(operation, Operation::Check);
+    if let Operation::RenameAlias { old, new } = operation {
+        let project = &compiled.decoded.project;
+        let Some((id, _)) = project
+            .identities()
+            .into_iter()
+            .find(|(_, alias)| *alias == old)
+        else {
+            report.fail(
+                1,
+                "unknown_alias",
+                format!("No declaration has alias '{old}'."),
+            );
+            return Err(Box::new(report));
+        };
+        let command = prepare_command(project, &Command::SetAlias(id, new)).map_err(|error| {
+            report.fail(1, "semantic_command_rejected", error.to_string());
+            Box::new(report.clone())
+        })?;
+        compiled = source_project::update_bundle_with_identity_map(
+            &compiled,
+            &command.project,
+            &command.identity_map,
+            LIMITS,
+        )
+        .map_err(|diagnostics| {
+            report.status = "invalid".into();
+            report.exit_code = 1;
+            report
+                .diagnostics
+                .extend(diagnostics.into_iter().map(|d| located(d, "candidate")));
+            Box::new(report.clone())
+        })?;
+    }
+    if mutable {
+        for (path, after) in &compiled.bundle.files {
+            let before = raw.files.get(path).cloned().unwrap_or_default();
+            if &before != after {
+                report.changes.push(Change {
+                    path: path.clone(),
+                    diff: unified_diff(path, &before, after),
+                    before,
+                    after: after.clone(),
+                });
+            }
+        }
+        report.status = "preview".into();
+        report.notes.push("This invocation's complete proposed changed-file texts and diffs are reported. Without --write nothing is saved; a later invocation may allocate different missing UUIDs. This is not a saved plan or a digest of unchanged dependencies.".into());
+    }
+    report.notes.push("Diagnostic object IDs are omitted for declarations without authored IDs; lint's temporary identities are not the candidate's identities.".into());
+    report.notes.push("Disk writes use the core journal/conflict checks. This is not cross-process atomic visibility or a power-loss durability guarantee; pending saves are never implicitly recovered. A failed write may require explicit journal recovery.".into());
+    Ok(Prepared {
+        report,
+        snapshot,
+        compiled,
+        mutable,
+    })
+}
+
+/// One bounded hunk per file: common prefix/suffix plus three context lines.
+/// Linear in input size; no quadratic LCS allocation for large modules.
+fn unified_diff(path: &str, before: &str, after: &str) -> String {
+    let a: Vec<_> = before.split_inclusive('\n').collect();
+    let b: Vec<_> = after.split_inclusive('\n').collect();
+    let prefix = a.iter().zip(&b).take_while(|(a, b)| a == b).count();
+    let suffix = a[prefix..]
+        .iter()
+        .rev()
+        .zip(b[prefix..].iter().rev())
+        .take_while(|(a, b)| a == b)
+        .count();
+    let start = prefix.saturating_sub(3);
+    let a_end = (a.len() - suffix + 3).min(a.len());
+    let b_end = (b.len() - suffix + 3).min(b.len());
+    let a_start = if a_end == start { start } else { start + 1 };
+    let b_start = if b_end == start { start } else { start + 1 };
+    let mut out = format!(
+        "--- a/{path}\n+++ b/{path}\n@@ -{a_start},{} +{b_start},{} @@\n",
+        a_end - start,
+        b_end - start
+    );
+    let mut emit = |prefix: char, line: &str| {
+        out.push(prefix);
+        out.push_str(line);
+        if !line.ends_with('\n') {
+            out.push_str("\n\\ No newline at end of file\n");
+        }
+    };
+    for line in &a[start..prefix] {
+        emit(' ', line);
+    }
+    for line in &a[prefix..a.len() - suffix] {
+        emit('-', line);
+    }
+    for line in &b[prefix..b.len() - suffix] {
+        emit('+', line);
+    }
+    for line in &a[a.len() - suffix..a_end] {
+        emit(' ', line);
+    }
+    out
+}
+
+pub struct Arguments {
+    pub entry: PathBuf,
+    pub operation: Operation,
+    pub write: bool,
+    pub json: bool,
+}
+
+pub const HELP: &str = "arcadia check ROOT [--json]\narcadia lint ROOT [--json]\narcadia stabilize ROOT [--write] [--json]\narcadia rename-alias ROOT OLD NEW [--write] [--json]\n\nROOT is an explicit .arcadia entry file; includes resolve relative to it.\nMutation commands preview by default. --write applies this invocation's candidate.\nMissing UUIDs in a preview are provisional until written. No canonical formatting.\nExit: 0 valid/success (engineering warnings allowed), 1 invalid source or semantic\ncommand rejection, 2 usage, 3 disk/path/conflict/pending-journal/output failure.\nNo implicit journal recovery. Limits: 64 MiB, 256 files, include depth32/edges1024,\n100000 graph objects, 250000 records, 500000 ordered references.\n";
+
+pub fn arguments(args: &[std::ffi::OsString]) -> Result<Arguments, String> {
+    let mut positional = Vec::new();
+    let (mut write, mut json) = (false, false);
+    for arg in args {
+        if arg == "--write" && !write {
+            write = true;
+        } else if arg == "--json" && !json {
+            json = true;
+        } else if arg.to_string_lossy().starts_with('-') {
+            return Err(format!(
+                "Unknown or repeated option: {}",
+                arg.to_string_lossy()
+            ));
+        } else {
+            positional.push(arg);
+        }
+    }
+    let command = positional.first().and_then(|s| s.to_str()).unwrap_or("");
+    let operation = match (command, positional.len()) {
+        ("check" | "lint", 2) if !write => Operation::Check,
+        ("stabilize", 2) => Operation::Stabilize,
+        ("rename-alias", 4) => Operation::RenameAlias {
+            old: positional[2].to_str().ok_or("Alias must be UTF-8")?.into(),
+            new: positional[3].to_str().ok_or("Alias must be UTF-8")?.into(),
+        },
+        _ => return Err(HELP.into()),
+    };
+    Ok(Arguments {
+        entry: PathBuf::from(positional[1]),
+        operation,
+        write,
+        json,
+    })
+}

crates/oa-cli/src/main.rs

@@ -0,0 +1,102 @@
+use oa_cli::{Report, arguments, prepare};
+use std::{
+    io::{self, Write},
+    path::Path,
+    process::ExitCode,
+};
+
+fn human_report(report: &Report, show_diff: bool) -> io::Result<()> {
+    let mut err = io::stderr().lock();
+    for d in &report.diagnostics {
+        let at = d
+            .location
+            .as_ref()
+            .map(|l| {
+                format!(
+                    "{}:{}:{}",
+                    l.path,
+                    l.line.unwrap_or(0),
+                    l.column.unwrap_or(0)
+                )
+            })
+            .unwrap_or_else(|| report.entry.clone());
+        writeln!(
+            err,
+            "{at}: {}[{}] ({}): {}",
+            d.severity, d.code, d.coordinate_space, d.message
+        )?;
+    }
+    writeln!(
+        err,
+        "{}: {} file changes; {} identities to stabilize",
+        report.status,
+        report.changes.len(),
+        report.identities_to_stabilize
+    )?;
+    if let Some(migration) = &report.migration {
+        writeln!(
+            err,
+            "Source migration: schema {} → {} (separate from identity stabilization)",
+            migration.from_schema, migration.to_schema
+        )?;
+    }
+    for note in &report.notes {
+        writeln!(err, "{note}")?;
+    }
+    if show_diff {
+        let mut out = io::stdout().lock();
+        for change in &report.changes {
+            write!(out, "{}", change.diff)?;
+        }
+        out.flush()?;
+    }
+    err.flush()
+}
+
+fn run() -> io::Result<u8> {
+    let args: Vec<_> = std::env::args_os().skip(1).collect();
+    if args.len() == 1 && (args[0] == "--help" || args[0] == "-h") {
+        io::stdout().write_all(oa_cli::HELP.as_bytes())?;
+        return Ok(0);
+    }
+    if args.len() == 1 && args[0] == "--version" {
+        writeln!(io::stdout(), "arcadia {}", env!("CARGO_PKG_VERSION"))?;
+        return Ok(0);
+    }
+    let json = args.iter().any(|a| a == "--json");
+    let mut displayed = false;
+    let report = match arguments(&args) {
+        Err(error) => Report::failure(Path::new(""), "usage", 2, "usage", error),
+        Ok(args) => match prepare(&args.entry, args.operation) {
+            Err(report) => *report,
+            Ok(prepared) => {
+                if args.write {
+                    if !args.json {
+                        human_report(prepared.report(), true)?;
+                        displayed = true;
+                    }
+                    prepared.write()
+                } else {
+                    prepared.into_report()
+                }
+            }
+        },
+    };
+    if json {
+        serde_json::to_writer_pretty(io::stdout().lock(), &report)?;
+        writeln!(io::stdout())?;
+    } else {
+        human_report(&report, !displayed)?;
+    }
+    Ok(report.exit_code)
+}
+
+fn main() -> ExitCode {
+    match run() {
+        Ok(code) => ExitCode::from(code),
+        Err(error) => {
+            let _ = writeln!(io::stderr(), "Output failed: {error}");
+            ExitCode::from(3)
+        }
+    }
+}

crates/oa-cli/tests/source_cli.rs

@@ -0,0 +1,425 @@
+use oa_cli::{LIMITS, Operation, Prepared, prepare};
+use oa_core::{Id, Project, source_files, source_project};
+use serde_json::Value;
+use std::{
+    collections::BTreeMap,
+    fs,
+    path::{Path, PathBuf},
+    process::Command,
+};
+
+struct Fixture(PathBuf);
+impl Fixture {
+    fn new() -> Self {
+        let path = std::env::temp_dir().join(format!("arcadia-cli-test-{}", Id::new_v4()));
+        fs::create_dir(&path).unwrap();
+        Self(path)
+    }
+    fn put(&self, name: &str, text: &str) {
+        let path = self.0.join(name);
+        fs::create_dir_all(path.parent().unwrap()).unwrap();
+        fs::write(path, text).unwrap();
+    }
+    fn entry(&self) -> PathBuf {
+        self.0.join("project.arcadia")
+    }
+    fn read(&self, name: &str) -> String {
+        fs::read_to_string(self.0.join(name)).unwrap()
+    }
+    fn prepare(&self, op: Operation) -> Prepared {
+        prepare(&self.entry(), op).unwrap_or_else(|report| panic!("{report:#?}"))
+    }
+    fn model(&self) -> Project {
+        let disk = source_files::load_project(&self.entry(), LIMITS).unwrap();
+        source_project::compile_bundle(&disk.reachable_bundle(), LIMITS)
+            .unwrap()
+            .decoded
+            .project
+    }
+    fn cli(&self, args: &[&str]) -> (i32, Value) {
+        let mut command = Command::new(env!("CARGO_BIN_EXE_arcadia"));
+        command
+            .arg(args[0])
+            .arg(self.entry())
+            .args(&args[1..])
+            .arg("--json");
+        let output = command.output().unwrap();
+        assert!(
+            output.stderr.is_empty(),
+            "{}",
+            String::from_utf8_lossy(&output.stderr)
+        );
+        (
+            output.status.code().unwrap(),
+            serde_json::from_slice(&output.stdout).unwrap(),
+        )
+    }
+}
+impl Drop for Fixture {
+    fn drop(&mut self) {
+        let _ = fs::remove_dir_all(&self.0);
+    }
+}
+
+const SIMPLE: &str = "// 雨: authored defaults stay omitted\r\narcadia 7;\r\nproject rescue \"Rescue\" {\r\n    oa_entity team \"Team\" {}\r\n}\r\n";
+
+#[test]
+fn complete_alarm_example_preview_then_write_and_fixed_point() {
+    let fixture = Fixture::new();
+    let source = include_str!(
+        "../../../harness/experiments/textual-authoring-20260911/alarm-response.arcadia"
+    );
+    fixture.put("project.arcadia", source);
+    let (code, check) = fixture.cli(&["check"]);
+    assert_eq!(code, 0);
+    assert_eq!(check["diagnostics"], serde_json::json!([]));
+    let (code, preview) = fixture.cli(&["stabilize"]);
+    assert_eq!(code, 0);
+    assert_eq!(preview["identities_to_stabilize"], 40);
+    assert_eq!(preview["status"], "preview");
+    assert_eq!(fixture.read("project.arcadia"), source);
+    assert!(
+        preview["changes"][0]["diff"]
+            .as_str()
+            .unwrap()
+            .contains("+project alarm_response")
+    );
+    let (code, written) = fixture.cli(&["stabilize", "--write"]);
+    assert_eq!(code, 0);
+    let saved = fixture.read("project.arcadia");
+    assert_eq!(written["changes"][0]["after"], saved);
+    let project = fixture.model();
+    assert_eq!(project.identities().len(), 40);
+    let mut stripped = saved.clone();
+    for (id, _) in project.identities() {
+        stripped = stripped.replace(&format!(" id \"{id}\""), "");
+    }
+    assert_eq!(stripped, source, "only identity clauses may be inserted");
+    let (code, again) = fixture.cli(&["stabilize", "--write"]);
+    assert_eq!(code, 0);
+    assert_eq!(again["changes"], serde_json::json!([]));
+    assert_eq!(again["status"], "unchanged");
+    assert_eq!(fixture.model(), project);
+    assert_eq!(fixture.read("project.arcadia"), saved);
+}
+
+#[test]
+fn captured_candidate_exact_write_preserves_crlf_comments_and_noop_metadata() {
+    let fixture = Fixture::new();
+    fixture.put("project.arcadia", SIMPLE);
+    let candidate = fixture.prepare(Operation::Stabilize);
+    let expected = candidate.report().changes[0].after.clone();
+    assert_eq!(candidate.report().identities_to_stabilize, 2);
+    assert_eq!(fixture.read("project.arcadia"), SIMPLE);
+    assert_eq!(candidate.write().exit_code, 0);
+    assert_eq!(fixture.read("project.arcadia"), expected);
+    assert!(expected.contains("// 雨: authored defaults stay omitted\r\n"));
+    assert!(!expected.contains("description"));
+    let metadata = fs::metadata(fixture.entry()).unwrap().modified().unwrap();
+    let report = fixture.prepare(Operation::Stabilize).write();
+    assert_eq!(report.status, "unchanged");
+    assert!(!report.written);
+    assert_eq!(
+        fs::metadata(fixture.entry()).unwrap().modified().unwrap(),
+        metadata
+    );
+    assert_eq!(fs::read_dir(&fixture.0).unwrap().count(), 1);
+}
+
+#[test]
+fn alias_rename_across_modules_changes_only_live_tokens_and_retains_all_identity() {
+    let fixture = Fixture::new();
+    fixture.put("project.arcadia", "arcadia 7; project rescue \"Rescue\" { include \"participants.arcadia\"; include \"work.arcadia\"; }\n");
+    fixture.put(
+        "participants.arcadia",
+        "// @team is quoted documentation\noa_entity team \"Team @team\" {}\n",
+    );
+    fixture.put("work.arcadia", "oa_activity assess \"Assess\" {}\noa_activity report \"Report\" {}\nallocation assigned \"Assigned\" { source @team; target @assess; }\ninteraction transfer \"Transfer\" { source @assess; target @report; }\n");
+    assert_eq!(fixture.prepare(Operation::Stabilize).write().exit_code, 0);
+    let before = fixture.model();
+    let original: BTreeMap<_, _> = ["project.arcadia", "participants.arcadia", "work.arcadia"]
+        .into_iter()
+        .map(|p| (p, fixture.read(p)))
+        .collect();
+    let team = before
+        .identities()
+        .into_iter()
+        .find(|(_, alias)| *alias == "team")
+        .unwrap()
+        .0;
+    let candidate = fixture.prepare(Operation::RenameAlias {
+        old: "team".into(),
+        new: "rescue_team".into(),
+    });
+    assert_eq!(candidate.report().changes.len(), 2);
+    assert_eq!(fixture.model(), before, "preview cannot mutate");
+    assert_eq!(candidate.write().exit_code, 0);
+    let mut expected = before;
+    expected.elements.get_mut(&team).unwrap().alias = "rescue_team".into();
+    assert_eq!(fixture.model(), expected);
+    assert_eq!(fixture.read("project.arcadia"), original["project.arcadia"]);
+    assert_eq!(
+        fixture.read("participants.arcadia"),
+        original["participants.arcadia"].replacen("oa_entity team ", "oa_entity rescue_team ", 1)
+    );
+    assert_eq!(
+        fixture.read("work.arcadia"),
+        original["work.arcadia"].replace("source @team;", "source @rescue_team;")
+    );
+}
+
+#[test]
+fn invalid_unicode_raw_edit_is_located_and_never_stabilized_or_written() {
+    let fixture = Fixture::new();
+    let raw = "arcadia 7; project p \"雨\" {\n oa_activity a \"A\" {}\n allocation alloc \"Alloc\" { source @missing; target @a; }\n}\n";
+    fixture.put("project.arcadia", raw);
+    for command in [
+        vec!["check"],
+        vec!["stabilize", "--write"],
+        vec!["rename-alias", "a", "b", "--write"],
+    ] {
+        let (code, report) = fixture.cli(&command);
+        assert_eq!(code, 1);
+        assert_eq!(fixture.read("project.arcadia"), raw);
+        let diagnostics = report["diagnostics"].as_array().unwrap();
+        assert!(!diagnostics.is_empty());
+        for d in diagnostics {
+            assert_eq!(d["coordinate_space"], "input");
+            let at = &d["location"];
+            let start = at["start"].as_u64().unwrap() as usize;
+            assert!(raw.is_char_boundary(start));
+            assert_eq!(
+                at["line"].as_u64().unwrap() as usize,
+                raw[..start].bytes().filter(|b| *b == b'\n').count() + 1
+            );
+            let line = raw[..start]
+                .rsplit_once('\n')
+                .map_or(&raw[..start], |(_, tail)| tail);
+            assert_eq!(
+                at["column"].as_u64().unwrap() as usize,
+                line.chars().count() + 1
+            );
+        }
+    }
+}
+
+#[test]
+fn missing_id_warning_uses_raw_location_and_never_exposes_ephemeral_lint_id() {
+    let fixture = Fixture::new();
+    let raw = "arcadia 7;\nproject p \"雨\" {\n    oa_activity work \"Work\" {}\n}\n";
+    fixture.put("project.arcadia", raw);
+    let (code, result) = fixture.cli(&["lint"]);
+    assert_eq!(code, 0, "engineering warnings do not reject admission");
+    let warning = result["diagnostics"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .find(|d| d["code"] == "work_without_behavior_context")
+        .unwrap();
+    assert_eq!(warning["severity"], "warning");
+    assert_eq!(
+        warning["location"]["start"],
+        raw.find("oa_activity").unwrap()
+    );
+    assert_eq!(warning["location"]["line"], 3);
+    assert_eq!(warning["location"]["column"], 5);
+    assert!(warning["object_id"].is_null());
+    assert_eq!(fixture.read("project.arcadia"), raw);
+}
+
+#[test]
+fn captured_dependency_change_refuses_all_writes_even_on_noop() {
+    let fixture = Fixture::new();
+    fixture.put("project.arcadia", SIMPLE);
+    let pending = fixture.prepare(Operation::Stabilize);
+    let external = format!("{SIMPLE}// editor changed this\n");
+    fixture.put("project.arcadia", &external);
+    let result = pending.write();
+    assert_eq!(result.exit_code, 3);
+    assert_eq!(result.diagnostics.last().unwrap().code, "external_change");
+    assert_eq!(fixture.read("project.arcadia"), external);
+    assert_eq!(fixture.prepare(Operation::Stabilize).write().exit_code, 0);
+    let noop = fixture.prepare(Operation::Stabilize);
+    assert!(noop.report().changes.is_empty());
+    let latest = format!("{}// another edit\n", fixture.read("project.arcadia"));
+    fixture.put("project.arcadia", &latest);
+    assert_eq!(noop.write().exit_code, 3);
+    assert_eq!(fixture.read("project.arcadia"), latest);
+}
+
+#[test]
+fn pending_journal_refuses_read_preview_and_write_without_recovery() {
+    let fixture = Fixture::new();
+    fixture.put("project.arcadia", SIMPLE);
+    assert_eq!(fixture.prepare(Operation::Stabilize).write().exit_code, 0);
+    let noop = fixture.prepare(Operation::Stabilize);
+    let source = fixture.read("project.arcadia");
+    // An opaque incomplete journal must never be interpreted/recovered by CLI.
+    let journal = fixture.0.join(".arcadia-save-project.arcadia.journal");
+    fs::create_dir(&journal).unwrap();
+    fs::write(journal.join("sentinel"), b"retain").unwrap();
+    for op in [Operation::Check, Operation::Stabilize] {
+        let report = prepare(&fixture.entry(), op).err().unwrap();
+        assert_eq!(report.exit_code, 3);
+        assert!(report.diagnostics.iter().any(|d| d.code == "pending_save"));
+    }
+    assert_eq!(
+        noop.write().exit_code,
+        3,
+        "saver must recheck after preview"
+    );
+    assert_eq!(fixture.read("project.arcadia"), source);
+    assert_eq!(fs::read(journal.join("sentinel")).unwrap(), b"retain");
+}
+
+#[test]
+fn rejected_alias_and_same_alias_preserve_source() {
+    let fixture = Fixture::new();
+    fixture.put("project.arcadia", SIMPLE);
+    assert_eq!(fixture.prepare(Operation::Stabilize).write().exit_code, 0);
+    let source = fixture.read("project.arcadia");
+    for (old, new) in [
+        ("team", "rescue"),
+        ("team", "invalid alias"),
+        ("absent", "valid"),
+    ] {
+        let (code, result) = fixture.cli(&["rename-alias", old, new, "--write"]);
+        assert_eq!(code, 1);
+        assert_eq!(result["status"], "rejected");
+        assert_eq!(fixture.read("project.arcadia"), source);
+    }
+    let (code, result) = fixture.cli(&["rename-alias", "team", "team", "--write"]);
+    assert_eq!(code, 0);
+    assert_eq!(result["status"], "unchanged");
+    assert_eq!(fixture.read("project.arcadia"), source);
+}
+
+#[test]
+fn rename_shows_missing_identity_and_separate_source_migration() {
+    let fixture = Fixture::new();
+    let old = "// retain\narcadia 5; project p \"P\" { oa_entity team \"Team\" {} }\n";
+    fixture.put("project.arcadia", old);
+    let candidate = fixture.prepare(Operation::RenameAlias {
+        old: "team".into(),
+        new: "crew".into(),
+    });
+    let report = candidate.report();
+    assert_eq!(report.identities_to_stabilize, 2);
+    assert_eq!(report.migration.as_ref().unwrap().from_schema, 5);
+    assert_eq!(report.migration.as_ref().unwrap().to_schema, 7);
+    assert!(report.changes[0].diff.contains("-arcadia 5;"));
+    assert!(report.changes[0].diff.contains("+arcadia 7;"));
+    assert!(report.changes[0].after.contains("oa_entity crew"));
+    assert_eq!(fixture.read("project.arcadia"), old);
+    assert_eq!(candidate.write().exit_code, 0);
+}
+
+#[test]
+fn entry_is_explicit_and_machine_readable_usage_errors_do_not_write() {
+    let fixture = Fixture::new();
+    fixture.put("project.arcadia", SIMPLE);
+    let output = Command::new(env!("CARGO_BIN_EXE_arcadia"))
+        .current_dir(&fixture.0)
+        .args(["check", "--json"])
+        .output()
+        .unwrap();
+    assert_eq!(output.status.code(), Some(2));
+    let error: Value = serde_json::from_slice(&output.stdout).unwrap();
+    assert_eq!(error["diagnostics"][0]["code"], "usage");
+    assert_eq!(fixture.read("project.arcadia"), SIMPLE);
+    let (code, _) = fixture.cli(&["check", "--write"]);
+    assert_eq!(code, 2);
+    assert!(Path::new(env!("CARGO_BIN_EXE_arcadia")).is_file());
+}
+
+#[test]
+fn loader_encoding_missing_dependency_and_invalid_old_source_keep_original_bytes() {
+    let fixture = Fixture::new();
+    let entry = "arcadia 7; project p \"P\" { include \"part.arcadia\"; }";
+    fixture.put("project.arcadia", entry);
+    let (code, report) = fixture.cli(&["stabilize", "--write"]);
+    assert_eq!(code, 3, "a disk dependency could not be read");
+    assert!(
+        report["diagnostics"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .any(|d| d["code"] == "missing_include")
+    );
+    fs::write(fixture.0.join("part.arcadia"), [0xff, 0xfe]).unwrap();
+    let (code, report) = fixture.cli(&["stabilize", "--write"]);
+    assert_eq!(code, 1, "invalid encoding is invalid raw source");
+    assert!(
+        report["diagnostics"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .any(|d| d["code"] == "source_encoding")
+    );
+    assert_eq!(fixture.read("project.arcadia"), entry);
+    assert_eq!(
+        fs::read(fixture.0.join("part.arcadia")).unwrap(),
+        [0xff, 0xfe]
+    );
+    for raw in [
+        "arcadia 5; project p \"P\" { oa_entity a \"A\" { ??? } }",
+        "arcadia 2; project p \"P\" {}",
+    ] {
+        fixture.put("project.arcadia", raw);
+        let (code, _) = fixture.cli(&["stabilize", "--write"]);
+        assert_eq!(code, 1);
+        assert_eq!(fixture.read("project.arcadia"), raw);
+    }
+}
+
+#[test]
+fn non_element_alias_detached_file_and_unchanged_dependency_conflict() {
+    let fixture = Fixture::new();
+    fixture.put("project.arcadia", "arcadia 7; project p \"P\" { include \"part.arcadia\"; oa_activity a \"A\" {} allocation responsible \"Responsible\" { source @ // keep edge comment\nteam; target @a; } }");
+    fixture.put("part.arcadia", "oa_entity team \"Team\" {}");
+    fixture.put(
+        "detached.arcadia",
+        "invalid detached draft must stay exact 雨",
+    );
+    assert_eq!(fixture.prepare(Operation::Stabilize).write().exit_code, 0);
+    let before = fixture.model();
+    let relation = before
+        .identities()
+        .into_iter()
+        .find(|(_, alias)| *alias == "responsible")
+        .unwrap()
+        .0;
+    let (code, _) = fixture.cli(&["rename-alias", "responsible", "performs", "--write"]);
+    assert_eq!(code, 0);
+    let mut expected = before;
+    expected.relations.get_mut(&relation).unwrap().alias = "performs".into();
+    assert_eq!(fixture.model(), expected);
+    assert!(
+        fixture
+            .read("project.arcadia")
+            .contains("@ // keep edge comment\nteam")
+    );
+    let captured = fixture.prepare(Operation::RenameAlias {
+        old: "p".into(),
+        new: "rescue".into(),
+    });
+    assert!(
+        captured
+            .report()
+            .changes
+            .iter()
+            .all(|c| c.path != "part.arcadia")
+    );
+    let root_before = fixture.read("project.arcadia");
+    fixture.put("part.arcadia", "// external unchanged-dependency edit\n");
+    assert_eq!(captured.write().exit_code, 3);
+    assert_eq!(fixture.read("project.arcadia"), root_before);
+    assert_eq!(
+        fixture.read("part.arcadia"),
+        "// external unchanged-dependency edit\n"
+    );
+    assert_eq!(
+        fixture.read("detached.arcadia"),
+        "invalid detached draft must stay exact 雨"
+    );
+}

crates/oa-core/src/language.rs

@@ -142,12 +142,87 @@ pub struct Analysis {
     pub declarations: Vec<DeclarationSpan>,
 }
 
+/// Check the decoded spelling required by declaration-header UUID clauses.
+/// This is the shared 36-byte/hyphen shape rule, not a hexadecimal parser:
+/// callers must additionally parse the UUID. Uppercase hex and JSON escapes
+/// that decode to this spelling remain accepted. URN/braced/compact forms do not.
+pub fn has_uuid_header_shape(decoded: &str) -> bool {
+    decoded.len() == 36
+        && [8, 13, 18, 23]
+            .into_iter()
+            .all(|index| decoded.as_bytes()[index] == b'-')
+}
+
+/// Budgets for one original source buffer. Policy is caller-owned; these
+/// limits do not change the grammar or perform model admission.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct OutlineLimits {
+    pub max_source_bytes: usize,
+    pub max_tokens: usize,
+    pub max_declarations: usize,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum OutlineResource {
+    SourceBytes,
+    Tokens,
+    Declarations,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct OutlineLimit {
+    pub resource: OutlineResource,
+    pub limit: usize,
+    pub observed_at_least: usize,
+    /// Original byte offset where admission stopped; never a rewritten offset.
+    pub offset: usize,
+}
+
+/// Roles discovered by the existing tolerant declaration walk. Keeping the
+/// wrapper preserves DeclarationSpan and Analysis as existing public APIs.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct OutlineDeclaration {
+    pub declaration: DeclarationSpan,
+    pub kind_span: Span,
+    pub alias_span: Span,
+    /// Whole quoted header ID token, even if it is not a valid UUID. In that
+    /// case declaration.id is None. Missing/non-string ID values have no span.
+    pub id_literal_span: Option<Span>,
+}
+
+/// A full-file tolerant scan, not a successful parse or validated model. Invalid
+/// text remains available. Lexical errors and unmatched braces are facts only:
+/// their absence does not establish syntactic or semantic validity.
+///
+/// A budget failure returns Err and no partial Outline. Include reachability,
+/// project completeness and editor revision are intentionally not inferred here.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Outline<'a> {
+    pub source: &'a str,
+    pub tokens: Vec<TokenSpan>,
+    pub declarations: Vec<OutlineDeclaration>,
+    pub has_lexical_errors: bool,
+    pub has_unmatched_braces: bool,
+}
+
 /// Tolerant highlighting tokens cover the whole input, including incomplete
 /// strings and unexpected characters. No model is created or modified.
 pub fn tokenize(source: &str) -> Vec<TokenSpan> {
+    tokenize_with_limit(source, usize::MAX).expect("unlimited token scan")
+}
+
+fn tokenize_with_limit(source: &str, max_tokens: usize) -> Result<Vec<TokenSpan>, OutlineLimit> {
     let mut tokens = Vec::new();
     let mut cursor = 0;
     while cursor < source.len() {
+        if tokens.len() == max_tokens {
+            return Err(OutlineLimit {
+                resource: OutlineResource::Tokens,
+                limit: max_tokens,
+                observed_at_least: tokens.len().saturating_add(1),
+                offset: cursor,
+            });
+        }
         let start = cursor;
         let ch = source[cursor..].chars().next().expect("in bounds");
         let class = if matches!(ch, ' ' | '\t' | '\r' | '\n') {
@@ -224,7 +299,7 @@ pub fn tokenize(source: &str) -> Vec<TokenSpan> {
             span: Span { start, end: cursor },
         });
     }
-    tokens
+    Ok(tokens)
 }
 
 pub fn lint(source: &str) -> Vec<Diagnostic> {
@@ -1230,11 +1305,7 @@ impl Parser<'_> {
         self.cursor += 1;
         let offset = self.current().span.start;
         let value = self.quoted()?;
-        if value.len() != 36
-            || ![8, 13, 18, 23]
-                .into_iter()
-                .all(|i| value.as_bytes()[i] == b'-')
-        {
+        if !has_uuid_header_shape(&value) {
             return Err(Error {
                 code: "invalid_source",
                 offset,
@@ -1962,8 +2033,49 @@ fn take_required_id(fields: &mut Map<String, Value>, key: &str) -> Result<Id, St
 
 /// Analyze an incomplete source buffer without adopting a candidate. Declaration
 /// spans remain available even when a later declaration contains errors.
+/// Invalid compact/braced/URN header IDs retain no authored identity, matching
+/// the declaration parser rather than the UUID crate's broader accepted forms.
 pub fn analyze(source: &str) -> Analysis {
     let tokens = tokenize(source);
+    let (declarations, _) =
+        declaration_outline(source, &tokens, usize::MAX).expect("unlimited declaration walk");
+    Analysis {
+        tokens,
+        diagnostics: lint(source),
+        declarations: declarations.into_iter().map(|d| d.declaration).collect(),
+    }
+}
+
+/// Read exact current text without lint, parsing a model, stabilization or I/O.
+/// Source bytes are admitted before token allocation; token/declaration limits
+/// are checked before lexing the next token or materializing the next record.
+pub fn outline(source: &str, limits: OutlineLimits) -> Result<Outline<'_>, OutlineLimit> {
+    if source.len() > limits.max_source_bytes {
+        return Err(OutlineLimit {
+            resource: OutlineResource::SourceBytes,
+            limit: limits.max_source_bytes,
+            observed_at_least: source.len(),
+            offset: 0,
+        });
+    }
+    let tokens = tokenize_with_limit(source, limits.max_tokens)?;
+    let has_lexical_errors = tokens.iter().any(|token| token.class == TokenClass::Error);
+    let (declarations, has_unmatched_braces) =
+        declaration_outline(source, &tokens, limits.max_declarations)?;
+    Ok(Outline {
+        source,
+        tokens,
+        declarations,
+        has_lexical_errors,
+        has_unmatched_braces,
+    })
+}
+
+fn declaration_outline(
+    source: &str,
+    tokens: &[TokenSpan],
+    max_declarations: usize,
+) -> Result<(Vec<OutlineDeclaration>, bool), OutlineLimit> {
     let significant = tokens
         .iter()
         .filter(|t| !matches!(t.class, TokenClass::Whitespace | TokenClass::Comment))
@@ -1972,17 +2084,21 @@ pub fn analyze(source: &str) -> Analysis {
     // again would make tolerant navigation quadratic on deeply nested drafts.
     let mut body_ends = vec![None; significant.len()];
     let mut bodies = Vec::new();
+    let mut unmatched_close = false;
     for (index, token) in significant.iter().enumerate() {
         match &source[token.span.start..token.span.end] {
             "{" => bodies.push(index),
             "}" => {
                 if let Some(open) = bodies.pop() {
                     body_ends[open] = Some(token.span.end);
+                } else {
+                    unmatched_close = true;
                 }
             }
             _ => {}
         }
     }
+    let has_unmatched_braces = unmatched_close || !bodies.is_empty();
     let mut declarations = Vec::new();
     for (i, t) in significant.iter().enumerate() {
         let word = &source[t.span.start..t.span.end];
@@ -2007,7 +2123,16 @@ pub fn analyze(source: &str) -> Analysis {
             }
             j += 1;
         }
+        if declarations.len() == max_declarations {
+            return Err(OutlineLimit {
+                resource: OutlineResource::Declarations,
+                limit: max_declarations,
+                observed_at_least: declarations.len().saturating_add(1),
+                offset: t.span.start,
+            });
+        }
         let mut id = None;
+        let mut id_literal_span = None;
         if significant
             .get(j)
             .is_some_and(|t| &source[t.span.start..t.span.end] == "id")
@@ -2015,39 +2140,51 @@ pub fn analyze(source: &str) -> Analysis {
             if let Some(value) = significant.get(j + 1)
                 && value.class == TokenClass::String
             {
+                id_literal_span = Some(value.span);
                 let text =
                     serde_json::from_str::<String>(&source[value.span.start..value.span.end])
                         .unwrap();
-                id = Id::parse_str(&text).ok();
+                if has_uuid_header_shape(&text) {
+                    id = Id::parse_str(&text).ok();
+                }
             }
             j += 2;
         }
-        let mut end = significant
-            .get(j)
-            .map_or(alias_token.span.end, |t| t.span.end);
+        // A recognized header ID at EOF must remain inside the whole span.
+        // Keep the old next-token/body behavior; only the EOF fallback changes.
+        let header_end = significant
+            .get(j.saturating_sub(1))
+            .or_else(|| significant.last())
+            .map_or(alias_token.span.end, |token| token.span.end);
+        let mut end = significant.get(j).map_or(header_end, |t| t.span.end);
         if significant
             .get(j)
             .is_some_and(|t| &source[t.span.start..t.span.end] == "{")
         {
             end = body_ends[j].unwrap_or(source.len());
         }
-        declarations.push(DeclarationSpan {
-            alias: alias.into(),
-            id,
-            kind: word.into(),
-            span: Span {
-                start: t.span.start,
-                end,
+        declarations.push(OutlineDeclaration {
+            declaration: DeclarationSpan {
+                alias: alias.into(),
+                id,
+                kind: word.into(),
+                span: Span {
+                    start: t.span.start,
+                    end,
+                },
             },
+            kind_span: t.span,
+            alias_span: alias_token.span,
+            id_literal_span,
         });
     }
-    Analysis {
-        tokens,
-        diagnostics: lint(source),
-        declarations,
-    }
+    Ok((declarations, has_unmatched_braces))
 }
 
+#[cfg(test)]
+#[path = "language_outline_tests.rs"]
+mod outline_tests;
+
 #[cfg(test)]
 #[path = "language_nesting_tests.rs"]
 mod nesting_tests;
@@ -2442,11 +2579,7 @@ pub(crate) mod legacy {
             let value = self.quoted()?;
             // Require the portable 8-4-4-4-12 spelling, not the UUID crate's URN,
             // braces, or compact alternatives. Uppercase hexadecimal is accepted.
-            if value.len() != 36
-                || ![8, 13, 18, 23]
-                    .into_iter()
-                    .all(|index| value.as_bytes()[index] == b'-')
-            {
+            if !super::has_uuid_header_shape(&value) {
                 return Err(Error {
                     code: "invalid_source",
                     offset,

crates/oa-core/src/language_outline_tests.rs

@@ -0,0 +1,386 @@
+//! Prepared outline tests. Explicit compatibility tests additionally exercise
+//! the existing parsers/analyze; the outline entry itself never calls them.
+use super::*;
+
+fn limits() -> OutlineLimits {
+    OutlineLimits {
+        max_source_bytes: 1024 * 1024,
+        max_tokens: 100_000,
+        max_declarations: 1_000,
+    }
+}
+
+fn declaration<'a>(result: &'a Outline<'_>, alias: &str) -> &'a OutlineDeclaration {
+    result
+        .declarations
+        .iter()
+        .find(|d| d.declaration.alias == alias)
+        .unwrap()
+}
+
+fn text(source: &str, span: Span) -> &str {
+    &source[span.start..span.end]
+}
+
+#[test]
+fn outline_roles_preserve_unicode_crlf_and_exact_escaped_uuid_literal() {
+    let source = "// 検査 🚒\r\noa_actor responder \"救助\" id \"\\u00300000000-0000-0000-0000-000000000001\" {}\r\nsource @ // 使用\r\n responder;";
+    let before = source.as_bytes().to_vec();
+    let result = outline(source, limits()).unwrap();
+    assert_eq!(result.source.as_bytes(), before);
+    assert_eq!(result.source.as_ptr(), source.as_ptr());
+    let d = declaration(&result, "responder");
+    assert_eq!(text(source, d.kind_span), "oa_actor");
+    assert_eq!(text(source, d.alias_span), "responder");
+    assert_eq!(
+        text(source, d.id_literal_span.unwrap()),
+        "\"\\u00300000000-0000-0000-0000-000000000001\""
+    );
+    assert_eq!(d.declaration.id, Some(Id::from_u128(1)));
+    assert_eq!(d.declaration.span.start, source.find("oa_actor").unwrap());
+    assert_eq!(d.declaration.span.end, source.find("{}\r\n").unwrap() + 2);
+    let mut end = 0;
+    for token in &result.tokens {
+        assert_eq!(token.span.start, end);
+        assert!(token.span.start < token.span.end);
+        assert!(source.is_char_boundary(token.span.start));
+        assert!(source.is_char_boundary(token.span.end));
+        end = token.span.end;
+    }
+    assert_eq!(end, source.len());
+    assert!(!result.has_lexical_errors);
+    assert!(!result.has_unmatched_braces);
+}
+
+#[test]
+fn closed_id_at_eof_is_inside_the_declaration_extent() {
+    for source in [
+        "oa_actor a \"Actor\" id \"00000000-0000-0000-0000-000000000001\"",
+        "node placed id \"00000000-0000-0000-0000-000000000001\"",
+    ] {
+        let result = outline(source, limits()).unwrap();
+        let d = &result.declarations[0];
+        let literal = d.id_literal_span.unwrap();
+        assert_eq!(d.declaration.id, Some(Id::from_u128(1)));
+        assert_eq!(d.declaration.span.end, source.len());
+        assert!(d.declaration.span.start <= literal.start);
+        assert!(literal.end <= d.declaration.span.end);
+    }
+    for source in ["oa_actor a \"Actor\"", "oa_actor a \"Actor\" id"] {
+        let result = outline(source, limits()).unwrap();
+        let d = &result.declarations[0];
+        assert_eq!(d.declaration.span.end, source.len());
+        assert_eq!(d.declaration.id, None);
+        assert_eq!(d.id_literal_span, None);
+    }
+}
+
+#[test]
+fn missing_bad_and_historical_ids_never_allocate_authored_identity() {
+    let source = "oa_actor missing \"No ID\" {}\noa_actor bad \"Bad ID\" id \"not-a-uuid\" {}\noa_actor historical \"00000000-0000-0000-0000-000000000001\" { history uuid \"00000000-0000-0000-0000-000000000001\"; }";
+    let first = outline(source, limits()).unwrap();
+    let second = outline(source, limits()).unwrap();
+    assert_eq!(first, second);
+    assert!(
+        first
+            .declarations
+            .iter()
+            .all(|d| d.declaration.id.is_none())
+    );
+    assert_eq!(declaration(&first, "missing").id_literal_span, None);
+    assert_eq!(declaration(&first, "historical").id_literal_span, None);
+    assert_eq!(
+        text(source, declaration(&first, "bad").id_literal_span.unwrap()),
+        "\"not-a-uuid\""
+    );
+    // Balanced tokens are not a successful syntax/semantic validation claim.
+    assert!(!first.has_lexical_errors);
+    assert!(!first.has_unmatched_braces);
+}
+
+#[test]
+fn invalid_full_scan_keeps_closed_children_and_reports_lexical_body_facts() {
+    let source = "oa_entity outer \"Outer\" {\n oa_actor ready \"Ready\" { description \"} stays text\"; }\n oa_actor pending \"Pending\" { description \"unfinished 🌊";
+    let result = outline(source, limits()).unwrap();
+    assert_eq!(result.source, source);
+    assert_eq!(result.tokens.last().unwrap().span.end, source.len());
+    assert!(result.has_lexical_errors);
+    assert!(result.has_unmatched_braces);
+    let ready = declaration(&result, "ready");
+    assert_eq!(
+        text(source, ready.declaration.span),
+        "oa_actor ready \"Ready\" { description \"} stays text\"; }"
+    );
+    assert_eq!(
+        declaration(&result, "outer").declaration.span.end,
+        source.len()
+    );
+    assert_eq!(
+        declaration(&result, "pending").declaration.span.end,
+        source.len()
+    );
+    let unmatched_close = outline("}\n// brace in comment {\n", limits()).unwrap();
+    assert!(unmatched_close.has_unmatched_braces);
+    assert!(!unmatched_close.has_lexical_errors);
+}
+
+#[test]
+fn missing_body_syntax_is_unchecked_even_when_known_error_flags_are_clear() {
+    let source = "oa_actor a \"A\" id \"00000000-0000-0000-0000-000000000001\"";
+    let result = outline(source, limits()).unwrap();
+    assert_eq!(result.declarations.len(), 1);
+    assert!(!result.has_lexical_errors);
+    assert!(!result.has_unmatched_braces);
+    // There is deliberately no `valid` flag: the known-complete fact is scanning
+    // these bytes, not the missing body becoming legal or the draft being applied.
+    assert_eq!(result.source, source);
+}
+
+#[test]
+fn keyword_alias_and_collisions_keep_every_source_ordered_header() {
+    let source = "project root_model \"Model\" {\n oa_actor oa_activity \"First\" id \"00000000-0000-0000-0000-000000000001\" {}\n oa_actor oa_activity \"Second\" id \"00000000-0000-0000-0000-000000000001\" {}\n diagram view_one \"View\" {}\n node placement { diagram @view_one; }\n}";
+    let result = outline(source, limits()).unwrap();
+    assert_eq!(result.declarations.len(), 5);
+    let duplicates: Vec<_> = result
+        .declarations
+        .iter()
+        .filter(|d| d.declaration.alias == "oa_activity")
+        .collect();
+    assert_eq!(duplicates.len(), 2);
+    assert!(duplicates[0].alias_span.start < duplicates[1].alias_span.start);
+    assert_eq!(duplicates[0].declaration.id, duplicates[1].declaration.id);
+    assert!(
+        result
+            .tokens
+            .iter()
+            .any(|t| t.span == duplicates[0].alias_span && t.class == TokenClass::Keyword)
+    );
+    assert_eq!(
+        text(source, declaration(&result, "placement").kind_span),
+        "node"
+    );
+    assert_eq!(declaration(&result, "placement").declaration.id, None);
+}
+
+#[test]
+fn bounds_refuse_before_returning_a_partial_outline() {
+    let source = "oa_actor a \"A\" {}\noa_actor b \"B\" {}";
+    let admitted = outline(source, limits()).unwrap();
+    let exact = OutlineLimits {
+        max_source_bytes: source.len(),
+        max_tokens: admitted.tokens.len(),
+        max_declarations: 2,
+    };
+    assert_eq!(outline(source, exact).unwrap(), admitted);
+    for resource in [
+        OutlineResource::SourceBytes,
+        OutlineResource::Tokens,
+        OutlineResource::Declarations,
+    ] {
+        let mut lower = exact;
+        match resource {
+            OutlineResource::SourceBytes => lower.max_source_bytes -= 1,
+            OutlineResource::Tokens => lower.max_tokens -= 1,
+            OutlineResource::Declarations => lower.max_declarations -= 1,
+        }
+        let error = outline(source, lower).unwrap_err();
+        assert_eq!(error.resource, resource);
+        assert!(error.observed_at_least > error.limit);
+        assert!(source.is_char_boundary(error.offset));
+        if resource == OutlineResource::Declarations {
+            assert_eq!(error.offset, source.find("oa_actor b").unwrap());
+        }
+    }
+    let empty = outline(
+        "",
+        OutlineLimits {
+            max_source_bytes: 0,
+            max_tokens: 0,
+            max_declarations: 0,
+        },
+    )
+    .unwrap();
+    assert!(empty.tokens.is_empty() && empty.declarations.is_empty());
+    let unicode = "// 🌊\r\noa_actor a \"A\" {}";
+    let error = outline(
+        unicode,
+        OutlineLimits {
+            max_source_bytes: 4,
+            ..limits()
+        },
+    )
+    .unwrap_err();
+    assert_eq!(error.resource, OutlineResource::SourceBytes);
+    assert_eq!(error.offset, 0);
+    let error = outline(
+        unicode,
+        OutlineLimits {
+            max_tokens: 1,
+            ..limits()
+        },
+    )
+    .unwrap_err();
+    assert_eq!(error.resource, OutlineResource::Tokens);
+    assert_eq!(error.offset, unicode.find('\n').unwrap());
+}
+
+#[test]
+fn outline_ranges_follow_current_bytes_without_identity_stabilization() {
+    let old = "oa_actor a \"A\" {}\nsource @a;";
+    let current = format!("// 航海 🚒\r\n{old}");
+    let old_outline = outline(old, limits()).unwrap();
+    let current_outline = outline(&current, limits()).unwrap();
+    let shift = current.len() - old.len();
+    let old_role = &old_outline.declarations[0];
+    let current_role = &current_outline.declarations[0];
+    assert_eq!(
+        current_role.alias_span.start,
+        old_role.alias_span.start + shift
+    );
+    assert_eq!(
+        current_role.kind_span.start,
+        old_role.kind_span.start + shift
+    );
+    assert_eq!(
+        current_role.declaration.span.end,
+        old_role.declaration.span.end + shift
+    );
+    assert_eq!(current_outline.source, current);
+    assert_eq!(old_outline.source, old);
+    assert_eq!(current_role.declaration.id, None);
+    assert!(!current_outline.source.contains(" id "));
+    // Workspace revision/stale-handle rejection belongs to the query/adapter,
+    // not a claim that an old owned span can be applied to any other string.
+}
+
+#[test]
+fn deeply_nested_bounds_use_the_same_iterative_walk_and_declaration_budget() {
+    let mut source = String::new();
+    for index in 0..600 {
+        source.push_str(&format!("oa_activity work_{index} \"Work\" {{\n"));
+    }
+    source.push_str(&"}\n".repeat(600));
+    let result = outline(&source, limits()).unwrap();
+    assert_eq!(result.declarations.len(), 600);
+    assert!(!result.has_unmatched_braces);
+    assert_eq!(
+        result.declarations[0].declaration.span.end,
+        source.len() - 1
+    );
+    let error = outline(
+        &source,
+        OutlineLimits {
+            max_declarations: 599,
+            ..limits()
+        },
+    )
+    .unwrap_err();
+    assert_eq!(error.resource, OutlineResource::Declarations);
+    assert_eq!(error.observed_at_least, 600);
+    assert_eq!(error.offset, source.find("oa_activity work_599").unwrap());
+}
+
+#[test]
+fn noncanonical_uuid_spellings_have_no_outline_or_analysis_identity() {
+    for raw in [
+        "00000000000000000000000000000001",
+        "{00000000-0000-0000-0000-000000000001}",
+        "urn:uuid:00000000-0000-0000-0000-000000000001",
+    ] {
+        assert!(
+            Id::parse_str(raw).is_ok(),
+            "The UUID crate alone is too permissive"
+        );
+        assert!(!has_uuid_header_shape(raw));
+        let literal = format!("\"{raw}\"");
+        let modern = format!("arcadia 7; project model \"Model\" id {literal} {{}}");
+        let before = modern.clone();
+        let result = outline(&modern, limits()).unwrap();
+        let d = declaration(&result, "model");
+        assert_eq!(d.declaration.id, None);
+        assert_eq!(text(&modern, d.id_literal_span.unwrap()), literal);
+        assert_eq!(modern, before);
+        let errors = parse(&modern).unwrap_err();
+        assert!(
+            errors
+                .iter()
+                .any(|error| error.message.contains("8-4-4-4-12")
+                    && error.span.start == modern.find(&literal).unwrap())
+        );
+        // Intentional compatibility correction: old analyze yielded Some(Id(1))
+        // here despite lint rejecting the header. It now shares outline's None.
+        let analysis = analyze(&modern);
+        assert_eq!(
+            analysis
+                .declarations
+                .iter()
+                .find(|d| d.alias == "model")
+                .unwrap()
+                .id,
+            None
+        );
+        assert!(
+            analysis
+                .diagnostics
+                .iter()
+                .any(|error| error.message.contains("8-4-4-4-12"))
+        );
+        let legacy_source = format!("arcadia 1; project \"Legacy\" id {literal} {{}}");
+        let legacy_errors = legacy::parse(&legacy_source).unwrap_err();
+        assert!(
+            legacy_errors
+                .iter()
+                .any(|error| error.message.contains("8-4-4-4-12"))
+        );
+    }
+}
+
+#[test]
+fn uppercase_and_json_escaped_header_ids_survive_both_parsers_and_outline() {
+    let expected = Id::from_u128(0xabcdef);
+    let canonical = expected.to_string();
+    let uppercase = canonical.to_uppercase();
+    assert_ne!(uppercase, canonical);
+    for raw in [uppercase.clone(), format!("\\u0030{}", &uppercase[1..])] {
+        let literal = format!("\"{raw}\"");
+        let decoded: String = serde_json::from_str(&literal).unwrap();
+        assert!(has_uuid_header_shape(&decoded));
+        let modern = format!("arcadia 7; project model \"Model\" id {literal} {{}}");
+        let result = outline(&modern, limits()).unwrap();
+        let d = declaration(&result, "model");
+        assert_eq!(d.declaration.id, Some(expected));
+        assert_eq!(text(&modern, d.id_literal_span.unwrap()), literal);
+        assert_eq!(result.source.as_bytes(), modern.as_bytes());
+        assert_eq!(parse(&modern).unwrap().id, expected);
+        let analysis = analyze(&modern);
+        assert_eq!(analysis.declarations[0].id, Some(expected));
+        assert!(
+            !analysis
+                .diagnostics
+                .iter()
+                .any(|error| error.severity == crate::validation::Severity::Error)
+        );
+        let legacy_source = format!("arcadia 1; project \"Legacy\" id {literal} {{}}");
+        assert_eq!(legacy::parse(&legacy_source).unwrap().id, expected);
+    }
+}
+
+#[test]
+fn header_shape_still_requires_valid_hexadecimal_uuid_data() {
+    let raw = "00000000-0000-0000-0000-00000000000Z";
+    assert!(has_uuid_header_shape(raw));
+    assert!(Id::parse_str(raw).is_err());
+    let literal = format!("\"{raw}\"");
+    let source = format!("arcadia 7; project model \"Model\" id {literal} {{}}");
+    let result = outline(&source, limits()).unwrap();
+    let d = declaration(&result, "model");
+    assert_eq!(d.declaration.id, None);
+    assert_eq!(text(&source, d.id_literal_span.unwrap()), literal);
+    assert!(
+        parse(&source)
+            .unwrap_err()
+            .iter()
+            .any(|error| error.message == "Invalid UUID identity.")
+    );
+    assert_eq!(analyze(&source).declarations[0].id, None);
+}

crates/oa-desktop/src/app.rs

@@ -7,12 +7,15 @@ mod diagram_selection_tests;
 mod hosted;
 #[cfg(test)]
 mod review_navigation_tests;
+pub(crate) mod source_rename;
+mod source_symbols;
 #[cfg(test)]
 mod transition_context_tests;
 #[cfg(test)]
 mod view_copy_tests;
 use crate::forms::Draft;
 use crate::{
+    behavior,
     document::Document,
     source_workspace::{self, LIMITS, Workspace},
 };
@@ -414,9 +417,17 @@ pub enum Message {
     Linted(u64, Result<Vec<SourceDiagnostic>, String>),
     SourceDiagnostic(usize),
     SourceRelated(SourceLocation),
-    SourceViewport,
+    SourceViewport(Option<Id>),
+    SourceSymbols(
+        crate::source_navigation::SymbolContext,
+        crate::source_navigation::SymbolEvent,
+    ),
+    SourceSymbolsReady(crate::source_navigation::Completion),
+    SourceRename(source_rename::Event),
+    SourceRenameReady(source_rename::Completion),
     SourceForSelection,
     SourceNavigation(crate::source_navigation::Event),
+    SourceFindClose(crate::source_navigation::SymbolContext, Id),
     Save(bool),
     SavePath(Option<PathBuf>),
     Saved(Result<Option<FileSnapshot>, SaveFailure>),
@@ -490,6 +501,9 @@ pub struct App {
     pub source_jump: Option<text_editor::Cursor>,
     source_select_line: bool,
     pub source_navigation: crate::source_navigation::State,
+    source_find_instance: Id,
+    pub source_symbols: crate::source_navigation::SymbolState,
+    pub source_rename: source_rename::State,
     pub model_issues: Vec<validation::Issue>,
     pub migration: Option<persistence::MigrationReport>,
     source_version: u64,
@@ -595,6 +609,9 @@ impl App {
             source_jump: None,
             source_select_line: false,
             source_navigation: crate::source_navigation::State::default(),
+            source_find_instance: Id::new_v4(),
+            source_symbols: crate::source_navigation::SymbolState::default(),
+            source_rename: source_rename::State::default(),
             model_issues,
             migration: None,
             source_version: 0,
@@ -641,18 +658,37 @@ impl App {
             || self.behavior.has_pending()
     }
     fn sync_source(&mut self) {
+        self.sync_source_with_alias_editor(None);
+    }
+    fn sync_source_with_alias_editor(&mut self, hint: Option<source_rename::EditorRefresh<'_>>) {
         self.source_workspace.accept(self.document.bundle());
-        self.show_source_file(false);
+        self.show_source_file_with_alias_editor(false, hint);
         self.source_diagnostics = self.document.compiled().diagnostics.clone();
         self.source_version += 1;
         self.lint_requested = None;
     }
     fn show_source_file(&mut self, restore_cursor: bool) {
+        self.show_source_file_with_alias_editor(restore_cursor, None);
+    }
+    fn show_source_file_with_alias_editor(
+        &mut self,
+        restore_cursor: bool,
+        hint: Option<source_rename::EditorRefresh<'_>>,
+    ) {
+        self.source_symbols.reveal = None;
         self.source_tree.reveal(&self.source_workspace.active);
         self.source_select_line = false;
         let source = self.source_workspace.text().to_owned();
         self.source_navigation.refresh(&source);
-        self.source_editor = text_editor::Content::with_text(&source);
+        if !hint.is_some_and(|hint| {
+            hint.apply(
+                &mut self.source_editor,
+                &self.source_workspace.active,
+                &source,
+            )
+        }) {
+            self.source_editor = text_editor::Content::with_text(&source);
+        }
         self.source_snapshot = Arc::from(source);
         self.source_jump = restore_cursor
             .then(|| {
@@ -662,6 +698,9 @@ impl App {
                     .map(|b| b.cursor)
             })
             .flatten();
+        if let Some(cursor) = self.source_jump {
+            self.queue_source_reveal(cursor, false);
+        }
     }
     fn selected_architecture_placement(&self) -> Option<Id> {
         self.active_diagram
@@ -694,6 +733,9 @@ impl App {
         }
     }
     fn sync(&mut self) {
+        self.sync_with_alias_editor(None);
+    }
+    fn sync_with_alias_editor(&mut self, hint: Option<source_rename::EditorRefresh<'_>>) {
         self.explorer_index = crate::explorer::Index::new(self.project(), self.layer);
         self.model_issues = validate(self.project());
         self.normalize_creation();
@@ -723,7 +765,7 @@ impl App {
                 .map(|d| d.id);
         }
         self.refresh_draft();
-        self.sync_source();
+        self.sync_source_with_alias_editor(hint);
     }
     fn normalize_creation(&mut self) {
         if !self.create_kind.supports(self.layer) {
@@ -849,14 +891,28 @@ impl App {
     }
     fn execute(&mut self, command: Command) -> bool {
         let command = crate::port_edit::repair_owner_change(self.project(), command);
+        let created = self.behavior.creation.created_by(self.project(), &command);
         let scenario_selection = self
             .behavior
             .scenario
-            .created_selection(&command)
-            .or_else(|| self.behavior.topology.created_selection(&command));
+            .created_selection(self.project(), &command)
+            .or_else(|| {
+                self.behavior
+                    .topology
+                    .created_selection(self.project(), &command)
+            });
         match self.document.execute(command) {
             Ok(selected) => {
-                if let Some(id) = scenario_selection.or(selected) {
+                if let Some(created) = created {
+                    self.layer = created.layer;
+                    self.selected = created.behavior;
+                    self.selected_node = None;
+                    self.behavior.active_owner = Some(created.behavior);
+                    self.behavior.diagram = behavior::state_view::State::default();
+                    self.behavior.diagram.diagram = created.diagram;
+                    self.page = Page::Behavior;
+                    self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
+                } else if let Some(id) = scenario_selection.or(selected) {
                     self.selected = id;
                 }
                 self.sync();
@@ -901,6 +957,8 @@ impl App {
         let canvas_size = self.canvas_size;
         let source_version = self.source_version + 1;
         let lint_running = self.lint_running;
+        let navigation_in_flight = self.source_symbols.in_flight;
+        let rename_in_flight = self.source_rename.in_flight;
         let guide = std::mem::take(&mut self.guide);
         let mut hosted = std::mem::take(&mut self.hosted);
         hosted.leave_document();
@@ -912,6 +970,8 @@ impl App {
         self.canvas_size = canvas_size;
         self.source_version = source_version;
         self.lint_running = lint_running;
+        self.source_symbols.in_flight = navigation_in_flight;
+        self.source_rename.in_flight = rename_in_flight;
         self.guide = guide;
         self.path = path;
         self.status = "Project ready".into();
@@ -1012,13 +1072,29 @@ impl App {
             crate::model_menu::popup(self),
         )
         .into();
-        crate::hosted::view::overlay(self, base)
+        crate::source_navigation::interaction::observe(
+            crate::hosted::view::overlay(self, base),
+            self.source_symbols.raw_interaction.clone(),
+        )
     }
     pub fn subscription(&self) -> Subscription<Message> {
         Subscription::batch([
             iced::time::every(std::time::Duration::from_secs(10)).map(|_| Message::CheckpointTick),
             window::close_requests().map(|id| Message::Request(Pending::Close(id))),
             window::resize_events().map(|(_, size)| Message::WindowResized(size)),
+            architecture_authoring::subscription(self),
+            // Use one captured-Escape bridge: a focused Find input consumes
+            // Escape, while modal priority remains in the ordinary handler.
+            behavior::creation::subscription(
+                self.behavior.creation.has_pending()
+                    || self.behavior.source_active()
+                    || (self.page == Page::Text
+                        && (self.source_symbols.open
+                            || self.source_navigation.open
+                            || self.source_rename.open())
+                        && self.architecture.is_none()),
+            )
+            .map(|()| Message::Escape),
             iced::event::listen_with(|event, status, _| {
                 let iced::Event::Keyboard(keyboard::Event::KeyPressed {
                     key,
@@ -1063,6 +1139,55 @@ impl App {
         ])
     }
     pub fn update(&mut self, message: Message) -> Task<Message> {
+        if let Message::SourceRename(event) = &message
+            && !self.source_rename_envelope(event)
+        {
+            return Task::none();
+        }
+        let message = match message {
+            Message::SourceFindClose(context, instance) => {
+                if context != self.source_symbol_context()
+                    || instance != self.source_find_instance
+                    || !self.source_navigation.open
+                    || !self.source_navigation_available()
+                {
+                    return Task::none();
+                }
+                // Only the checked envelope may enter the legacy Close handler.
+                Message::SourceNavigation(crate::source_navigation::Event::Close)
+            }
+            Message::SourceNavigation(crate::source_navigation::Event::Close) => {
+                return Task::none();
+            }
+            message => message,
+        };
+        if let Message::SourceSymbols(context, _) = &message
+            && (context.session != self.source_workspace.session()
+                || context.path != self.source_workspace.active)
+        {
+            return Task::none();
+        }
+        // Internal results and geometry do not constitute a new user intent.
+        // Process query completion even behind a modal to release its worker slot;
+        // its handler independently refuses navigation outside the live editor.
+        if let Message::SourceSymbolsReady(completion) = message {
+            return self.source_symbols_ready(completion);
+        }
+        if let Message::SourceRenameReady(completion) = message {
+            return self.source_rename_ready(completion);
+        }
+        if !matches!(
+            &message,
+            Message::CheckpointTick
+                | Message::CheckpointWritten(..)
+                | Message::Lint(_)
+                | Message::Linted(..)
+                | Message::SourceViewport(_)
+                | Message::WindowResized(_)
+                | Message::CanvasResized(_)
+        ) {
+            self.source_interaction();
+        }
         if matches!(&message, Message::Connection(_))
             && self
                 .architecture
@@ -1076,9 +1201,7 @@ impl App {
         // navigation and close retain raw input until explicit completion/cancel.
         if self.architecture.is_some() {
             if matches!(message, Message::Escape) {
-                self.architecture = None;
-                self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
-                return Task::none();
+                return self.architecture_event(architecture_authoring::Event::Cancel);
             }
             let placing = self.architecture.as_ref().is_some_and(|s| s.saved.placing);
             if !matches!(
@@ -1104,6 +1227,7 @@ impl App {
             Message::ScenarioCanvas(
                 crate::behavior::scenario::CanvasEvent::Scrolled(..)
                     | crate::behavior::scenario::CanvasEvent::Restored(..)
+                    | crate::behavior::scenario::CanvasEvent::Viewport(..)
             ) | Message::TopologyCanvas(
                 crate::behavior::topology::CanvasEvent::Scrolled(..)
                     | crate::behavior::topology::CanvasEvent::Viewport(..)
@@ -1128,7 +1252,7 @@ impl App {
                     | Message::CanvasResized(_)
                     | Message::Lint(_)
                     | Message::Linted(_, _)
-                    | Message::SourceViewport
+                    | Message::SourceViewport(_)
                     | Message::Request(Pending::Close(_))
             )
         {
@@ -1174,7 +1298,7 @@ impl App {
                     | Message::Exported(_)
                     | Message::WindowResized(_)
                     | Message::CanvasResized(_)
-                    | Message::SourceViewport
+                    | Message::SourceViewport(_)
             )
         {
             return Task::none();
@@ -1212,7 +1336,7 @@ impl App {
                 | Message::CheckpointLoaded(..)
                 | Message::WindowResized(_)
                 | Message::CanvasResized(_)
-                | Message::SourceViewport
+                | Message::SourceViewport(_)
                 | Message::Lint(_)
                 | Message::Linted(_, _)
                 | Message::Saved(_)
@@ -1242,6 +1366,18 @@ impl App {
         {
             return Task::none();
         }
+        if self.source_rename.open() {
+            if matches!(
+                message,
+                Message::Escape | Message::Request(Pending::Close(_))
+            ) {
+                self.close_source_rename();
+                return Task::none();
+            }
+            if !modal_event && !matches!(message, Message::SourceRename(_)) {
+                return Task::none();
+            }
+        }
         if matches!(
             message,
             Message::Page(_) | Message::Layer(_) | Message::Diagram(_)
@@ -1286,6 +1422,7 @@ impl App {
             self.last_workspace_page = self.page;
         }
         let mut task = self.handle(message);
+        self.refresh_source_rename_context();
         self.route_state_diagram_workspace();
         if self.page != Page::Home {
             self.last_workspace_page = self.page;
@@ -1295,6 +1432,11 @@ impl App {
                 .topology
                 .enter(context.document, context.owner);
         }
+        if let Some(context) = self.scenario_context() {
+            self.behavior
+                .scenario
+                .enter(context.document, context.scenario);
+        }
         if self.connection.as_ref().is_some_and(|session| {
             Some(session.context) != self.route_context()
                 || self.page != Page::Diagram
@@ -1365,6 +1507,17 @@ impl App {
             Message::ScenarioCanvas(event) => {
                 use crate::behavior::scenario::{self, CanvasEvent};
                 let context = event.context();
+                if let CanvasEvent::Viewport(_, size) = event {
+                    if self.scenario_context().is_some_and(|current| {
+                        current.document == context.document
+                            && current.scenario == context.scenario
+                            && current.revision == context.revision
+                    }) && self.behavior.scenario.viewport(size)
+                    {
+                        self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
+                    }
+                    return Task::none();
+                }
                 if let CanvasEvent::Restored(_, token, area, offset) = event {
                     if self.scenario_context().is_some_and(|current| {
                         current.document == context.document && current.scenario == context.scenario
@@ -1378,7 +1531,7 @@ impl App {
                     return Task::none();
                 }
                 if let CanvasEvent::Scrolled(_, area, offset) = event {
-                    // Inner and outer scroll notifications may come from the
+                    // Canvas and outline notifications may come from the
                     // same frame. Accept both across the first epoch bump,
                     // while still rejecting another owner/document/revision.
                     if self.scenario_context().is_some_and(|current| {
@@ -1395,6 +1548,19 @@ impl App {
                     return Task::none();
                 }
                 match event {
+                    CanvasEvent::Focus(_) => {
+                        self.behavior.scenario.toggle_focus();
+                        self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
+                    }
+                    CanvasEvent::Shelf(_, shelf) => {
+                        self.behavior.scenario.toggle_shelf(shelf);
+                        self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
+                    }
+                    CanvasEvent::Zoom(_, scale) => {
+                        if self.behavior.scenario.zoom(scale) {
+                            self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
+                        }
+                    }
                     CanvasEvent::OpenUse(_, occurrence) => {
                         if self.behavior.has_pending() || self.draft_dirty() || self.source_dirty()
                         {
@@ -1406,6 +1572,9 @@ impl App {
                         self.behavior.scenario = state;
                         match target {
                             Ok(target) => {
+                                // A command can preselect this target while the
+                                // caller remains visible, bypassing select below.
+                                self.behavior.active_owner = Some(target);
                                 self.select(target);
                                 self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
                             }
@@ -1424,12 +1593,23 @@ impl App {
                         let caller = state.back(self.project(), context);
                         self.behavior.scenario = state;
                         if let Some(caller) = caller {
+                            // A command may already have selected this UUID while
+                            // leaving the referenced definition open. select's
+                            // same-UUID fast path must not keep that old owner.
+                            self.behavior.active_owner = Some(caller.owner);
                             self.select(caller.occurrence);
                             self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
                             if let Some(context) = self.scenario_context() {
                                 self.behavior.scenario.restore_caller(context, caller);
                             }
                         } else {
+                            // An edit can select a retargeted caller outside the
+                            // definition that remains visible after rejected Back.
+                            if crate::behavior::selected_behavior(self.project(), self.selected)
+                                != Some(context.scenario)
+                            {
+                                self.select(context.scenario);
+                            }
                             self.status =
                                 "The calling scenario reference is no longer available.".into();
                         }
@@ -1444,7 +1624,11 @@ impl App {
                         }
                     }
                     CanvasEvent::Choose(_, tool) => {
-                        if self.behavior.has_pending() || !self.apply() {
+                        if self.behavior.has_pending() || self.draft_dirty() || self.source_dirty()
+                        {
+                            self.status =
+                                "Apply or cancel pending edits before choosing a scenario tool."
+                                    .into();
                             return Task::none();
                         }
                         self.behavior.scenario.choose_tool(context.scenario, tool);
@@ -1459,6 +1643,37 @@ impl App {
                             return Task::none();
                         }
                         match mutation {
+                            CanvasEvent::First(_, tool) => {
+                                let empty = match tool {
+                                    scenario::Tool::Lifeline => !self
+                                        .project()
+                                        .children(context.scenario)
+                                        .any(|e| e.kind() == Kind::Lifeline),
+                                    scenario::Tool::Message | scenario::Tool::Action => {
+                                        self.project()
+                                            .children(context.scenario)
+                                            .any(|e| e.kind() == Kind::Lifeline)
+                                            && !self
+                                                .project()
+                                                .children(context.scenario)
+                                                .any(|e| e.kind() == Kind::Occurrence)
+                                    }
+                                    _ => false,
+                                };
+                                if !empty {
+                                    self.status="This scenario already has content. Use its current authoring tools.".into();
+                                    return Task::none();
+                                }
+                                let mut state = std::mem::take(&mut self.behavior.scenario);
+                                let result = state.update(
+                                    self.project(),
+                                    scenario::Event::Start(context.scenario, tool),
+                                );
+                                self.behavior.scenario = state;
+                                if let Err(error) = result {
+                                    self.status = error;
+                                }
+                            }
                             CanvasEvent::BeginOccurrence {
                                 tool,
                                 slot,
@@ -1694,10 +1909,30 @@ impl App {
                 return self.update(Message::Add(child));
             }
             Message::Escape => {
+                let restore_source_focus = self.source_navigation_available()
+                    && (self.source_navigation.open || self.source_symbols.open);
+                if self.behavior.source_back() {
+                    self.status =
+                        "Returned to the unchanged parent form; no source was created.".into();
+                    return Task::none();
+                }
+                if self.behavior.source_active() {
+                    self.behavior.acknowledge_commit();
+                    self.status = "Behavior form cancelled; no staged source was created.".into();
+                } else if self.behavior.creation.has_pending() {
+                    self.behavior.creation.acknowledge_commit();
+                    self.status = "Behavior creation cancelled".into();
+                }
                 if self.connection.take().is_some() {
                     self.status = "Drawing cancelled · Select / move is active".into();
                 }
                 self.source_navigation.open = false;
+                self.source_symbols.open = false;
+                self.source_symbols.results = None;
+                self.source_symbols.notice = None;
+                if restore_source_focus {
+                    self.restore_source_editor_focus();
+                }
                 self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
                 self.selected_bend = None;
             }
@@ -2237,9 +2472,33 @@ impl App {
             }
             Message::InspectorTab(tab) => self.inspector_tab = tab,
             Message::Behavior(event) => {
-                if event.starts_form() && !self.behavior.has_pending() && !self.apply() {
+                if matches!(&event, behavior::Event::Creation(behavior::creation::Event::Open(layer)) if *layer != self.layer)
+                {
+                    self.status =
+                        "The active layer changed. Choose New in the current layer.".into();
                     return Task::none();
                 }
+                let creating = matches!(
+                    &event,
+                    behavior::Event::Creation(behavior::creation::Event::Open(..))
+                );
+                let focus_name = matches!(
+                    &event,
+                    behavior::Event::Creation(behavior::creation::Event::Choose(..))
+                );
+                if creating
+                    && (self.behavior.has_pending() || self.source_dirty() || self.draft_dirty())
+                {
+                    self.status = "Apply or cancel the current draft before starting a new behavior. Your inputs are retained.".into();
+                    return Task::none();
+                }
+                if (event.starts_form() || (event.is_source() && !event.is_source_back()))
+                    && (self.source_dirty() || self.draft_dirty())
+                {
+                    self.status="Apply or cancel the other editors before starting this form. Your inputs are retained.".into();
+                    return Task::none();
+                }
+                let source_was_open = self.behavior.source_open();
                 if event.is_submit() && (self.source_dirty() || self.draft_dirty()) {
                     self.status = "Revert the other drafts before applying the behavior form. Your inputs are retained.".into();
                     return Task::none();
@@ -2256,7 +2515,16 @@ impl App {
                             }
                         }
                     }
-                    Ok(None) => {}
+                    Ok(None) => {
+                        if !source_was_open && self.behavior.source_open() {
+                            return iced::widget::operation::focus(
+                                behavior::source_draft::NAME_INPUT,
+                            );
+                        }
+                        if focus_name {
+                            return iced::widget::operation::focus(behavior::creation::NAME_INPUT);
+                        }
+                    }
                     Err(error) => self.status = error,
                 }
             }
@@ -2448,13 +2716,19 @@ impl App {
             Message::Undo | Message::Redo => {
                 let redo = matches!(message, Message::Redo);
                 if self.apply() {
-                    if redo {
-                        self.document.redo();
+                    let changed = if redo {
+                        self.document.redo()
                     } else {
-                        self.document.undo();
+                        self.document.undo()
+                    };
+                    if changed {
+                        self.sync();
                     }
-                    self.sync();
-                    self.status = if redo {
+                    self.status = if !changed && redo {
+                        "Nothing to redo"
+                    } else if !changed {
+                        "Nothing to undo"
+                    } else if redo {
                         "Model change redone"
                     } else {
                         "Model change undone"
@@ -2694,6 +2968,7 @@ impl App {
                         if self.pending_recovery.as_ref() != Some(&receipt.target) {
                             return Task::none();
                         }
+                        self.invalidate_source_rename("Disk recovery changed this source context. Your replacement is retained; close and invoke Rename again.");
                         self.pending_recovery = None;
                         self.source_diagnostics
                             .retain(|issue| issue.diagnostic.code != "pending_save");
@@ -2707,12 +2982,21 @@ impl App {
                                 if self.path.is_none()
                                     || self.path.as_ref() == Some(&receipt.target)
                                 {
+                                    if self.path.as_ref() != Some(&receipt.target) {
+                                        self.source_workspace.reset_navigation_session();
+                                    }
                                     self.path = Some(receipt.target);
+                                    self.document.bind_repair_baseline(disk.reachable_bundle());
                                     self.disk_project = Some(disk);
                                 }
                                 self.status = "Interrupted disk save recovered. Current model and drafts are retained; Save all can be retried.".into();
                             }
                             Err(error) => {
+                                if self.path.is_none()
+                                    || self.path.as_ref() == Some(&receipt.target)
+                                {
+                                    self.document.invalidate_saved_baseline();
+                                }
                                 self.status = format!(
                                     "Disk recovery completed; files could not be reloaded: {error}"
                                 )
@@ -2769,14 +3053,13 @@ impl App {
                 }
             }
             Message::SourceRelated(location) => self.jump_to_source(location),
-            Message::SourceViewport => {
-                if let Some(cursor) = self.source_jump.take() {
-                    self.source_editor.move_to(cursor);
-                    if self.source_select_line && cursor.selection.is_none() {
-                        self.source_editor.perform(text_editor::Action::SelectLine);
-                    }
-                    return iced::widget::operation::focus("source-editor");
-                }
+            Message::SourceViewport(ticket) => return self.source_viewport(ticket),
+            Message::SourceFindClose(..) => return Task::none(), // update checks and unwraps it
+            Message::SourceSymbols(_, event) => return self.source_symbol_event(event),
+            Message::SourceRename(event) => return self.source_rename_event(event),
+            Message::SourceRenameReady(completion) => return self.source_rename_ready(completion),
+            Message::SourceSymbolsReady(completion) => {
+                return self.source_symbols_ready(completion);
             }
             Message::ApplySource => {
                 self.apply_source();
@@ -2822,6 +3105,7 @@ impl App {
                             return Task::none();
                         }
                         self.page = Page::Text;
+                        self.source_find_instance = Id::new_v4();
                         self.source_navigation.open = true;
                         self.source_navigation.refresh(&self.source_editor.text());
                         return iced::widget::operation::focus(if go_to_line {
@@ -2830,13 +3114,22 @@ impl App {
                             "source-find"
                         });
                     }
-                    Event::Close => self.source_navigation.open = false,
+                    Event::Close => {
+                        let was_open = self.source_navigation.open;
+                        self.source_navigation.open = false;
+                        if was_open {
+                            self.restore_source_editor_focus();
+                        }
+                    }
                     Event::Query(query) => {
                         self.source_navigation.query = query;
                         self.source_navigation.refresh(&self.source_editor.text());
                     }
                     Event::Next(backwards) if self.page == Page::Text => {
                         self.source_jump = self.source_navigation.next(backwards);
+                        if let Some(cursor) = self.source_jump {
+                            self.queue_source_reveal(cursor, false);
+                        }
                         if self.source_jump.is_none() {
                             self.status = "No matching source text.".into();
                         }
@@ -2847,8 +3140,7 @@ impl App {
                         .destination(self.source_editor.line_count())
                     {
                         Ok(cursor) => {
-                            self.source_jump = Some(cursor);
-                            self.source_select_line = true;
+                            self.queue_source_reveal(cursor, true);
                         }
                         Err(error) => self.status = error,
                     },
@@ -2931,6 +3223,9 @@ impl App {
                                 }
                                 self.sync_source();
                             }
+                            if self.path.as_ref() != Some(&receipt.path) {
+                                self.source_workspace.reset_navigation_session();
+                            }
                             self.disk_project = Some(disk);
                             self.path = Some(receipt.path);
                             self.hosted.session = None;
@@ -3489,8 +3784,9 @@ impl App {
                 self.canvas_document = Id::new_v4();
                 self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
                 self.path = Some(path);
+                self.document.bind_repair_baseline(disk.reachable_bundle());
                 self.source_workspace = Workspace::new(&disk.bundle, false);
-                self.source_workspace.reachable = disk.reachable.clone();
+                self.source_workspace.set_reachable(disk.reachable.clone());
                 self.show_source_file(false);
                 self.source_diagnostics = error.diagnostics().to_vec();
                 self.source_version += 1;
@@ -3542,11 +3838,13 @@ impl App {
         let column = prefix
             .rfind('\n')
             .map_or(offset, |start| offset - start - 1);
-        self.source_jump = Some(text_editor::Cursor {
-            position: text_editor::Position { line, column },
-            selection: None,
-        });
-        self.source_select_line = true;
+        self.queue_source_reveal(
+            text_editor::Cursor {
+                position: text_editor::Position { line, column },
+                selection: None,
+            },
+            true,
+        );
     }
 
     fn create_source_file(&mut self) -> Result<(), String> {
@@ -4156,6 +4454,10 @@ fn read_snapshot(path: PathBuf) -> Result<LoadedSnapshot, String> {
 #[path = "app/save_as_tests.rs"]
 mod save_as_tests;
 
+#[cfg(test)]
+#[path = "app/repair_save_state_tests.rs"]
+mod repair_save_state_tests;
+
 #[cfg(test)]
 mod source_project_tests {
     use super::*;

crates/oa-desktop/src/app/architecture_authoring.rs

@@ -3,6 +3,8 @@ use super::*;
 use iced::widget::{button, column, pick_list, row, scrollable, text, text_input};
 use serde::{Deserialize, Serialize};
 mod palette;
+#[cfg(test)]
+mod tests;
 pub use palette::view as palette;
 
 #[derive(Debug, Clone)]
@@ -21,9 +23,35 @@ pub enum Event {
     Filter(Filter),
     ShowPlaced(bool),
     Page(usize),
-    Edit,
+    CapturedEscape,
     Cancel,
 }
+
+pub fn subscription(app: &App) -> Subscription<Message> {
+    if app.architecture.as_ref().is_some_and(State::inline) {
+        iced::event::listen_with(captured_escape)
+    } else {
+        Subscription::none()
+    }
+}
+
+fn captured_escape(
+    event: iced::Event,
+    status: iced::event::Status,
+    _: iced::window::Id,
+) -> Option<Message> {
+    // A focused Iced text input captures Escape while dropping its focus. Only
+    // inline architecture naming opts into also cancelling that same keypress.
+    (status == iced::event::Status::Captured
+        && matches!(
+            event,
+            iced::Event::Keyboard(iced::keyboard::Event::KeyPressed {
+                key: iced::keyboard::Key::Named(iced::keyboard::key::Named::Escape),
+                ..
+            })
+        ))
+    .then_some(Message::Architecture(Event::CapturedEscape))
+}
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub enum Filter {
@@ -336,9 +364,15 @@ impl App {
                 }
                 return iced::widget::operation::focus("architecture-name");
             }
+            Event::CapturedEscape => {
+                if self.architecture.as_ref().is_some_and(State::inline) {
+                    return self.architecture_event(Event::Cancel);
+                }
+            }
             Event::Cancel => {
                 self.architecture = None;
                 self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
+                self.status = "Cancelled · Select / move".into();
             }
             Event::Name(value) => {
                 if value.len() <= 16384
@@ -375,13 +409,6 @@ impl App {
                     s.saved.page = page.min(1_000_000);
                 }
             }
-            Event::Edit => {
-                self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
-                if let Some(s) = &mut self.architecture {
-                    s.saved.placing = false;
-                }
-                return iced::widget::operation::focus("architecture-name");
-            }
             Event::Pick(id) => {
                 if !candidates(self)
                     .iter()
@@ -560,9 +587,10 @@ pub fn inline_editor(app: &App) -> Option<Element<'_, Message>> {
             row![
                 iced::widget::Space::new().width(x),
                 iced::widget::opaque(
-                    iced::widget::container(name_editor(app))
+                    iced::widget::container(scrollable(name_editor(app)))
                         .padding(10)
                         .width(width)
+                        .max_height((size.height - y - 8.).max(0.))
                         .style(crate::style::card)
                 )
             ]

crates/oa-desktop/src/app/architecture_authoring/palette.rs

@@ -4,7 +4,7 @@ use iced::{
     Point, Rectangle, Size, Theme, mouse,
     widget::{
         canvas::{self, Frame, Geometry, Path, Stroke},
-        column, container, tooltip,
+        container, tooltip,
     },
 };
 
@@ -165,7 +165,7 @@ fn tool<'a>(
     .into()
 }
 pub fn view(app: &App) -> Element<'_, Message> {
-    let mut content = column![tool(
+    let mut content = iced::widget::column![tool(
         app,
         Icon::Collapse(app.architecture_palette_expanded),
         if app.architecture_palette_expanded {

crates/oa-desktop/src/app/architecture_authoring/tests.rs

@@ -0,0 +1,378 @@
+use super::*;
+
+fn setup(layer: Layer) -> App {
+    let mut app = App::with_project(Project::empty());
+    app.layer = layer;
+    app.active_diagram = None;
+    let _ = app.update(Message::AddDiagram);
+    app.zoom = 0.75;
+    app.pan = iced::Vector::new(37., -19.);
+    app
+}
+fn send(app: &mut App, event: Event) {
+    let _ = app.update(Message::Architecture(event));
+}
+fn create(app: &mut App, kind: Kind, name: &str) -> Id {
+    send(app, Event::Start(kind, Some(Position { x: 120., y: 160. })));
+    send(app, Event::Name(name.into()));
+    send(app, Event::Submit);
+    assert!(app.architecture.is_none(), "{}", app.status);
+    app.selected
+}
+
+#[test]
+fn architecture_allocated_work_is_root_owned_and_one_exact_history_change() {
+    for (layer, participant, work) in [
+        (Layer::Oa, Kind::Entity, Kind::Activity),
+        (Layer::Sa, Kind::System, Kind::Function),
+    ] {
+        let mut app = setup(layer);
+        let performer = create(&mut app, participant, "Control team");
+        let before = app.document.bundle().clone();
+        let camera = (app.zoom, app.pan);
+        let point = Position { x: 151., y: 221. };
+        send(&mut app, Event::Allocate(work, performer, Some(point)));
+        send(&mut app, Event::Name("  Report 雨  ".into()));
+        assert_eq!(app.document.bundle(), &before);
+        send(&mut app, Event::Submit);
+        assert!(app.architecture.is_none(), "{}", app.status);
+        let created = app.selected;
+        let element = &app.project().elements[&created];
+        assert_eq!(element.kind(), work);
+        assert_eq!(element.name, "  Report 雨  ");
+        assert_eq!(element.parent, None);
+        assert!(app.project().relations.values().any(|r| {
+            r.kind() == RelationKind::Allocation && r.source() == performer && r.target() == created
+        }));
+        let d = &app.project().diagrams[&app.active_diagram.unwrap()];
+        assert_eq!(d.nodes[&app.selected_node.unwrap()].position, point);
+        assert_eq!((app.zoom, app.pan), camera);
+        let accepted = app.document.bundle().clone();
+        let _ = app.update(Message::Undo);
+        assert_eq!(app.document.bundle(), &before);
+        let _ = app.update(Message::Redo);
+        assert_eq!(app.document.bundle(), &accepted);
+    }
+}
+
+#[test]
+fn architecture_f2_routes_selected_node_to_inline_rename_and_exact_undo() {
+    use iced::widget::canvas::{Event as CanvasEvent, Program};
+    use iced::{keyboard, mouse};
+    let mut app = setup(Layer::Oa);
+    let element = create(&mut app, Kind::Entity, "Original team");
+    let before = app.document.bundle().clone();
+    let diagrams = app.project().diagrams.clone();
+    let camera = (app.zoom, app.pan);
+    let bounds = iced::Rectangle::new(iced::Point::ORIGIN, iced::Size::new(600., 380.));
+    let canvas = crate::diagram::DiagramCanvas {
+        project: app.project(),
+        view_index: None,
+        diagram: app.active_diagram.unwrap(),
+        selected: element,
+        zoom: app.zoom,
+        pan: app.pan,
+        context: app.route_context().unwrap(),
+        selected_bend: None,
+        editable: true,
+        placing: false,
+        connection: None,
+    };
+    let mut state = crate::diagram::State::default();
+    let key = CanvasEvent::Keyboard(keyboard::Event::KeyPressed {
+        key: keyboard::Key::Named(keyboard::key::Named::F2),
+        modified_key: keyboard::Key::Named(keyboard::key::Named::F2),
+        physical_key: keyboard::key::Physical::Code(keyboard::key::Code::F2),
+        location: keyboard::Location::Standard,
+        modifiers: keyboard::Modifiers::empty(),
+        text: None,
+        repeat: false,
+    });
+    assert!(
+        canvas
+            .update(&mut state, &key, bounds, mouse::Cursor::Unavailable)
+            .is_none()
+    );
+    let _ = canvas.update(
+        &mut state,
+        &CanvasEvent::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
+        bounds,
+        mouse::Cursor::Available(iced::Point::new(150., 120.)),
+    );
+    let action = canvas
+        .update(&mut state, &key, bounds, mouse::Cursor::Unavailable)
+        .unwrap();
+    let message = action.into_inner().0.unwrap();
+    let _ = app.update(message);
+    assert!(app.architecture.as_ref().unwrap().inline());
+    assert!(matches!(&app.architecture.as_ref().unwrap().saved.intent,
+        Intent::Rename { element: id, name } if *id == element && name == "Original team"));
+    send(&mut app, Event::Name("  Renamed team 雨  ".into()));
+    assert_eq!(app.document.bundle(), &before);
+    send(&mut app, Event::Submit);
+    assert!(app.architecture.is_none(), "{}", app.status);
+    assert_eq!(app.project().elements[&element].name, "  Renamed team 雨  ");
+    assert_eq!(app.project().diagrams, diagrams);
+    assert_eq!((app.zoom, app.pan), camera);
+    let accepted = app.document.bundle().clone();
+    let _ = app.update(Message::Undo);
+    assert_eq!(app.document.bundle(), &before);
+    let _ = app.update(Message::Redo);
+    assert_eq!(app.document.bundle(), &accepted);
+}
+
+#[test]
+fn architecture_blank_names_and_escape_never_accept_placeholder_or_rename() {
+    let mut app = setup(Layer::Oa);
+    let element = create(&mut app, Kind::Actor, "Dispatcher");
+    let before = app.document.bundle().clone();
+    let context = app.route_context().unwrap();
+    for event in [
+        Event::Start(Kind::Activity, Some(Position { x: 220., y: 330. })),
+        Event::Rename(context, element, Position { x: 150., y: 200. }),
+    ] {
+        // Every cancel changes the gesture context; use the current context for F2.
+        let event = match event {
+            Event::Rename(_, element, point) => {
+                Event::Rename(app.route_context().unwrap(), element, point)
+            }
+            event => event,
+        };
+        send(&mut app, event);
+        send(&mut app, Event::Name(" \t ".into()));
+        send(&mut app, Event::Submit);
+        assert!(app.architecture.as_ref().unwrap().inline());
+        assert!(app.architecture.as_ref().unwrap().error.is_some());
+        assert_eq!(app.document.bundle(), &before);
+        let _ = app.update(Message::Escape);
+        assert!(app.architecture.is_none());
+        assert_eq!(app.document.bundle(), &before);
+    }
+}
+
+#[test]
+fn architecture_invalid_click_cannot_poison_inline_or_checkpoint_geometry() {
+    let mut app = setup(Layer::Oa);
+    send(&mut app, Event::Start(Kind::Entity, None));
+    let before = app.document.bundle().clone();
+    let context = app.route_context().unwrap();
+    for point in [
+        Position { x: f32::NAN, y: 0. },
+        Position {
+            x: 0.,
+            y: f32::INFINITY,
+        },
+    ] {
+        send(&mut app, Event::Click(context, point));
+        let draft = app.architecture.as_ref().unwrap();
+        assert!(draft.unnamed_tool());
+        assert!(validate_saved(app.project(), &draft.saved).is_ok());
+        assert_eq!(app.document.bundle(), &before);
+    }
+    send(&mut app, Event::Click(context, Position { x: 25., y: 30. }));
+    assert!(app.architecture.as_ref().unwrap().inline());
+}
+
+#[test]
+fn architecture_stale_submit_keeps_create_and_rename_visible_and_exact() {
+    for rename in [false, true] {
+        for stale_document in [false, true] {
+            let mut app = setup(Layer::Oa);
+            let element = create(&mut app, Kind::Entity, "Accepted team");
+            let point = Position {
+                x: 151.5,
+                y: 227.25,
+            };
+            let event = if rename {
+                Event::Rename(app.route_context().unwrap(), element, point)
+            } else {
+                Event::Start(Kind::Activity, Some(point))
+            };
+            send(&mut app, event);
+            send(
+                &mut app,
+                Event::Name("  Retained engineering name 雨  ".into()),
+            );
+            // Change only the binding. The accepted model/source must not be
+            // rewritten or a rejected draft silently rebound to the new context.
+            if stale_document {
+                app.architecture.as_mut().unwrap().document = Id::new_v4();
+            } else {
+                app.architecture.as_mut().unwrap().revision = app.document.revision() + 1;
+            }
+            let draft = app.architecture.as_ref().unwrap();
+            let saved = serde_json::to_value(&draft.saved).unwrap();
+            let binding = (draft.document, draft.revision);
+            let model = app.project().clone();
+            let source = app.document.bundle().clone();
+            let revision = app.document.revision();
+            let camera = (app.zoom, app.pan);
+
+            for _ in 0..2 {
+                send(&mut app, Event::Submit);
+                let draft = app.architecture.as_ref().unwrap();
+                assert!(
+                    draft.inline(),
+                    "rename={rename}, stale_document={stale_document}"
+                );
+                assert!(inline_editor(&app).is_some());
+                assert_eq!(draft.error.as_deref(), Some(app.status.as_str()));
+                assert!(app.status.contains("cancel and restart"));
+                assert_eq!(serde_json::to_value(&draft.saved).unwrap(), saved);
+                assert_eq!((draft.document, draft.revision), binding);
+                assert_eq!(app.project(), &model);
+                assert_eq!(app.document.bundle(), &source);
+                assert_eq!(app.document.revision(), revision);
+                assert_eq!((app.zoom, app.pan), camera);
+            }
+            let _ = app.update(Message::Escape);
+            assert!(app.architecture.is_none());
+            assert_eq!(app.project(), &model);
+            assert_eq!(app.document.bundle(), &source);
+            let fresh = create(&mut app, Kind::Actor, "Fresh context");
+            assert_eq!(app.project().elements[&fresh].name, "Fresh context");
+            let _ = app.update(Message::Undo);
+            assert_eq!(app.project(), &model);
+            assert_eq!(app.document.bundle(), &source);
+        }
+    }
+}
+
+fn key_event(named: iced::keyboard::key::Named) -> iced::Event {
+    use iced::keyboard;
+    iced::Event::Keyboard(keyboard::Event::KeyPressed {
+        key: keyboard::Key::Named(named),
+        modified_key: keyboard::Key::Named(named),
+        physical_key: keyboard::key::Physical::Code(keyboard::key::Code::Escape),
+        location: keyboard::Location::Standard,
+        modifiers: keyboard::Modifiers::empty(),
+        text: None,
+        repeat: false,
+    })
+}
+
+fn focused_text_input_escape(name: &str) -> Message {
+    use iced::advanced::{Layout, Shell, layout, widget};
+    let mut field: iced::Element<'_, (), iced::Theme, ()> = text_input("Engineering name", name)
+        .id("architecture-name")
+        .on_input(|_| ())
+        .into();
+    let mut tree = widget::Tree::new(field.as_widget());
+    let size = iced::Size::new(300., 40.);
+    let node =
+        field
+            .as_widget_mut()
+            .layout(&mut tree, &(), &layout::Limits::new(iced::Size::ZERO, size));
+    tree.state
+        .downcast_mut::<iced::widget::text_input::State<()>>()
+        .focus();
+    let escape = key_event(iced::keyboard::key::Named::Escape);
+    let mut messages = Vec::new();
+    let mut shell = Shell::new(&mut messages);
+    field.as_widget_mut().update(
+        &mut tree,
+        &escape,
+        Layout::new(&node),
+        iced::mouse::Cursor::Unavailable,
+        &(),
+        &mut iced::advanced::clipboard::Null,
+        &mut shell,
+        &iced::Rectangle::new(iced::Point::ORIGIN, size),
+    );
+    assert!(
+        shell.is_event_captured(),
+        "Iced consumes focused-input Escape"
+    );
+    assert!(
+        !tree
+            .state
+            .downcast_ref::<iced::widget::text_input::State<()>>()
+            .is_focused()
+    );
+    captured_escape(
+        escape,
+        iced::event::Status::Captured,
+        iced::window::Id::unique(),
+    )
+    .unwrap()
+}
+
+#[test]
+fn architecture_first_focused_input_escape_cancels_create_and_rename() {
+    for rename in [false, true] {
+        let mut app = setup(Layer::Oa);
+        let element = create(&mut app, Kind::Actor, "Accepted dispatcher");
+        let model = app.project().clone();
+        let source = app.document.bundle().clone();
+        let revision = app.document.revision();
+        let camera = (app.zoom, app.pan);
+        let point = Position { x: 439., y: 328.2 };
+        let event = if rename {
+            Event::Rename(app.route_context().unwrap(), element, point)
+        } else {
+            Event::Start(Kind::Actor, Some(point))
+        };
+        send(&mut app, event);
+        let name = "  Unaccepted long engineering name 雨  ";
+        send(&mut app, Event::Name(name.into()));
+        assert!(app.architecture.as_ref().unwrap().inline());
+        let message = focused_text_input_escape(name);
+        let _ = app.update(message);
+        assert!(app.architecture.is_none());
+        assert!(inline_editor(&app).is_none());
+        assert_eq!(app.status, "Cancelled · Select / move");
+        assert_eq!(app.project(), &model);
+        assert_eq!(app.document.bundle(), &source);
+        assert_eq!(app.document.revision(), revision);
+        assert_eq!((app.zoom, app.pan), camera);
+    }
+}
+
+#[test]
+fn architecture_captured_escape_does_not_cancel_other_controls_or_placement() {
+    let mut app = setup(Layer::Oa);
+    for event in [
+        None,
+        Some(Event::Start(Kind::Entity, None)),
+        Some(Event::Existing(None)),
+    ] {
+        send(&mut app, Event::Cancel);
+        if let Some(event) = event {
+            send(&mut app, event);
+        }
+        let saved = app
+            .architecture
+            .as_ref()
+            .map(|s| serde_json::to_value(&s.saved).unwrap());
+        let before = app.document.bundle().clone();
+        let status = app.status.clone();
+        let epoch = app.canvas_epoch;
+        let message = focused_text_input_escape("Other field or existing-element search");
+        let _ = app.update(message);
+        assert_eq!(
+            app.architecture
+                .as_ref()
+                .map(|s| serde_json::to_value(&s.saved).unwrap()),
+            saved
+        );
+        assert_eq!(app.document.bundle(), &before);
+        assert_eq!(app.status, status);
+        assert_eq!(app.canvas_epoch, epoch);
+    }
+    assert!(
+        captured_escape(
+            key_event(iced::keyboard::key::Named::Escape),
+            iced::event::Status::Ignored,
+            iced::window::Id::unique(),
+        )
+        .is_none()
+    );
+    assert!(
+        captured_escape(
+            key_event(iced::keyboard::key::Named::Enter),
+            iced::event::Status::Captured,
+            iced::window::Id::unique(),
+        )
+        .is_none()
+    );
+}

crates/oa-desktop/src/app/checkpoints.rs

@@ -173,7 +173,12 @@ impl App {
         self.behavior = restored.behavior;
         self.workflow = restored.workflow;
         let focus = self.behavior.pending_owner().unwrap_or(self.selected);
-        if let Some(layer) = self.project().layer_of(focus) {
+        if let Some(layer) = self
+            .behavior
+            .creation
+            .pending_layer()
+            .or_else(|| self.project().layer_of(focus))
+        {
             self.layer = layer;
             self.explorer_index = crate::explorer::Index::new(self.project(), layer);
             self.active_diagram = self.diagram_for(layer, focus);
@@ -202,7 +207,26 @@ impl App {
         } else {
             "Recovered an unsaved local copy. Choose Save as to save it; the original file and hosted model are unchanged.".into()
         };
-        self.request_lint()
+        let lint = self.request_lint();
+        if self
+            .architecture
+            .as_ref()
+            .is_some_and(architecture_authoring::State::inline)
+        {
+            Task::batch([lint, iced::widget::operation::focus("architecture-name")])
+        } else if self.page == Page::Behavior && self.behavior.source_open() {
+            Task::batch([
+                lint,
+                iced::widget::operation::focus(behavior::source_draft::NAME_INPUT),
+            ])
+        } else if self.page == Page::Behavior && self.behavior.creation.created().is_some() {
+            Task::batch([
+                lint,
+                iced::widget::operation::focus(behavior::creation::NAME_INPUT),
+            ])
+        } else {
+            lint
+        }
     }
 }
 
@@ -331,6 +355,177 @@ mod tests {
         .unwrap()
     }
 
+    async fn run_recovery_tasks(app: &mut App, task: Task<Message>) -> (usize, bool, bool) {
+        use iced::advanced::{Layout, layout, widget};
+        use iced::futures::StreamExt;
+        // Mount real inputs, with focus initially in another control. This
+        // verifies the returned operation targets the naming field by its ID.
+        let mut fields: iced::Element<'_, (), iced::Theme, ()> = iced::widget::column![
+            iced::widget::text_input("Engineering name", "Retained name")
+                .id("architecture-name")
+                .on_input(|_| ()),
+            iced::widget::text_input("Other control", "Other value")
+                .id("unrelated-field")
+                .on_input(|_| ())
+        ]
+        .into();
+        let mut tree = widget::Tree::new(fields.as_widget());
+        let node = fields.as_widget_mut().layout(
+            &mut tree,
+            &(),
+            &layout::Limits::new(iced::Size::ZERO, iced::Size::new(320., 100.)),
+        );
+        tree.children[1]
+            .state
+            .downcast_mut::<iced::widget::text_input::State<()>>()
+            .focus();
+        let mut operations = 0;
+        let mut lint_completions = 0;
+        let mut stream = iced_runtime::task::into_stream(task).expect("Recovery must still lint");
+        while let Some(action) = stream.next().await {
+            match action {
+                iced_runtime::Action::Widget(mut operation) => {
+                    operations += 1;
+                    fields.as_widget_mut().operate(
+                        &mut tree,
+                        Layout::new(&node),
+                        &(),
+                        operation.as_mut(),
+                    );
+                }
+                iced_runtime::Action::Output(message @ Message::Linted(_, _)) => {
+                    lint_completions += 1;
+                    let _ = app.update(message);
+                }
+                _ => panic!("Unexpected recovery task action"),
+            }
+        }
+        assert_eq!(
+            lint_completions, 1,
+            "Autofocus must not replace request_lint"
+        );
+        assert!(app.lint_running.is_none());
+        let focused = |index: usize| {
+            tree.children[index]
+                .state
+                .downcast_ref::<iced::widget::text_input::State<()>>()
+                .is_focused()
+        };
+        (operations, focused(0), focused(1))
+    }
+
+    fn architecture_recovery_app() -> App {
+        let mut app = App::with_project(Project::empty());
+        let _ = app.update(Message::AddDiagram);
+        let _ = app.update(Message::Architecture(architecture_authoring::Event::Start(
+            Kind::Entity,
+            Some(Position { x: 80., y: 90. }),
+        )));
+        let _ = app.update(Message::Architecture(architecture_authoring::Event::Name(
+            "Accepted team".into(),
+        )));
+        let _ = app.update(Message::Architecture(architecture_authoring::Event::Submit));
+        assert!(app.architecture.is_none());
+        app
+    }
+
+    #[tokio::test]
+    async fn checkpoint_inline_create_and_rename_restore_focus_without_changing_drafts_or_history()
+    {
+        use architecture_authoring::Event;
+        for rename in [false, true] {
+            let mut app = architecture_recovery_app();
+            let point = Position { x: 439., y: 328.2 };
+            let event = if rename {
+                Event::Rename(app.route_context().unwrap(), app.selected, point)
+            } else {
+                Event::Start(Kind::Actor, Some(point))
+            };
+            let _ = app.update(Message::Architecture(event));
+            let _ = app.update(Message::Architecture(Event::Name(
+                "  Recovered engineering name 雨  ".into(),
+            )));
+            let saved = serde_json::to_value(&app.architecture.as_ref().unwrap().saved).unwrap();
+            let snapshot = retained_snapshot(&app).with_architecture(app.architecture.as_ref());
+            let expected = snapshot.clone().restore().unwrap();
+            let checkpoint = snapshot.id;
+            let mut recovered = App::with_project(Project::empty());
+            let task = recovered.checkpoint_loaded(Ok(Arc::new(snapshot)));
+            assert_eq!(
+                run_recovery_tasks(&mut recovered, task).await,
+                (1, true, false)
+            );
+            assert_eq!(recovered.page, Page::Diagram);
+            assert!(recovered.architecture.as_ref().unwrap().inline());
+            assert_eq!(
+                serde_json::to_value(&recovered.architecture.as_ref().unwrap().saved).unwrap(),
+                saved
+            );
+            assert_eq!(recovered.project(), expected.document.project());
+            assert_eq!(recovered.document.bundle(), expected.document.bundle());
+            assert_eq!(recovered.document.revision(), expected.document.revision());
+            assert_eq!(recovered.document.can_undo(), expected.document.can_undo());
+            assert_eq!(recovered.document.can_redo(), expected.document.can_redo());
+            assert_eq!(
+                recovered.source_workspace.bundle(),
+                expected.workspace.bundle()
+            );
+            assert_eq!(recovered.recovery.restored, Some(checkpoint));
+            assert!(recovered.path.is_none());
+        }
+    }
+
+    #[tokio::test]
+    async fn checkpoint_noninline_contexts_keep_other_focus_and_still_lint() {
+        use architecture_authoring::Event;
+        for context in ["accepted", "armed", "picker", "property", "source"] {
+            let mut app = architecture_recovery_app();
+            match context {
+                "armed" => {
+                    let _ = app.update(Message::Architecture(Event::Start(Kind::Actor, None)));
+                }
+                "picker" => {
+                    let _ = app.update(Message::Architecture(Event::Existing(None)));
+                }
+                "property" => {
+                    app.draft
+                        .as_mut()
+                        .unwrap()
+                        .input("/name", "Unapplied property".into());
+                    assert!(app.draft_dirty());
+                }
+                "source" => {
+                    app.source_workspace
+                        .edit("incomplete source 雨".into(), app.source_editor.cursor());
+                    assert!(app.source_dirty());
+                }
+                _ => {}
+            }
+            let snapshot = retained_snapshot(&app).with_architecture(app.architecture.as_ref());
+            let expected = snapshot.clone().restore().unwrap();
+            let mut recovered = App::with_project(Project::empty());
+            let task = recovered.checkpoint_loaded(Ok(Arc::new(snapshot)));
+            assert_eq!(
+                run_recovery_tasks(&mut recovered, task).await,
+                (0, false, true),
+                "{context}"
+            );
+            assert!(
+                !recovered
+                    .architecture
+                    .as_ref()
+                    .is_some_and(architecture_authoring::State::inline)
+            );
+            assert_eq!(recovered.project(), expected.document.project());
+            assert_eq!(recovered.document.bundle(), expected.document.bundle());
+            assert_eq!(recovered.document.revision(), expected.document.revision());
+            assert_eq!(
+                recovered.source_workspace.bundle(),
+                expected.workspace.bundle()
+            );
+        }
+    }
+
     #[test]
     fn saving_an_older_snapshot_keeps_recovery_for_newer_unsaved_work() {
         let directory = tempfile::tempdir().unwrap();

crates/oa-desktop/src/app/hosted.rs

@@ -213,6 +213,14 @@ impl App {
             self.pending = None;
             return Task::none();
         }
+        if self.path.is_some()
+            || self.hosted.session.as_ref().is_none_or(|session| {
+                session.resource_id != remote.resource_id
+                    || session.connection.base() != request.connection.base()
+            })
+        {
+            self.source_workspace.reset_navigation_session();
+        }
         self.hosted.session = Some(Session {
             connection: request.connection.clone(),
             resource_id: remote.resource_id,
@@ -345,6 +353,14 @@ impl App {
                         match self.document.apply_compiled((*remote.compiled).clone()) {
                             Ok(_) => {
                                 self.document.mark_saved(remote.compiled.clone());
+                                if self.path.is_some()
+                                    || self.hosted.session.as_ref().is_none_or(|session| {
+                                        session.resource_id != remote.resource_id
+                                            || session.connection.base() != connection.base()
+                                    })
+                                {
+                                    self.source_workspace.reset_navigation_session();
+                                }
                                 self.hosted.session = Some(Session {
                                     connection,
                                     resource_id: remote.resource_id,

crates/oa-desktop/src/app/repair_save_state_tests.rs

@@ -0,0 +1,263 @@
+use super::*;
+
+const VALID: &str = concat!(
+    "arcadia 7;\r\n",
+    "project repair \"Repair 救援\" id \"9e8f0000-0000-4000-8000-000000000001\" {\r\n",
+    "    oa_activity assess \"Assess\" id \"9e8f0000-0000-4000-8000-000000000002\" {}\r\n",
+    "}\r\n",
+);
+
+fn open(app: &mut App, path: &std::path::Path) {
+    let _ = app.update(Message::Loaded(Ok(Some(
+        read_snapshot(path.to_owned()).unwrap(),
+    ))));
+}
+
+fn edit(app: &mut App, text: &str) {
+    let _ = app.update(Message::SourceEdit(text_editor::Action::SelectAll));
+    let _ = app.update(Message::SourceEdit(text_editor::Action::Edit(
+        text_editor::Edit::Paste(Arc::new(text.into())),
+    )));
+}
+
+fn save(app: &mut App, path: &std::path::Path) {
+    let receipt = write_snapshot(
+        app.canvas_document,
+        app.document.revision(),
+        app.document.snapshot(),
+        path.to_owned(),
+        app.disk_project.clone(),
+    )
+    .unwrap();
+    let _ = app.update(Message::Saved(Ok(Some(receipt))));
+}
+
+#[test]
+fn repair_to_previous_saved_bytes_requires_save_at_new_destination_and_guards_close() {
+    for extra in [
+        "    include \"missing.arcadia\";\r\n",
+        "    oa_activity assess \"Duplicate\" id \"9e8f0000-0000-4000-8000-000000000003\" {}\r\n",
+    ] {
+        let first = tempfile::tempdir().unwrap();
+        let second = tempfile::tempdir().unwrap();
+        let first_path = first.path().canonicalize().unwrap().join("project.arcadia");
+        let second_path = second
+            .path()
+            .canonicalize()
+            .unwrap()
+            .join("project.arcadia");
+        let invalid = VALID.strip_suffix("}\r\n").unwrap().to_owned() + extra + "}\r\n";
+        std::fs::write(&first_path, VALID).unwrap();
+        std::fs::write(&second_path, &invalid).unwrap();
+        let mut app = App::with_project(Project::empty());
+        open(&mut app, &first_path);
+        assert!(!app.dirty());
+        let before = app.document.snapshot();
+        let revision = app.document.revision();
+        open(&mut app, &second_path);
+        assert!(!app.source_workspace.applied);
+        assert!(Arc::ptr_eq(&before, &app.document.snapshot()));
+        edit(&mut app, VALID);
+        assert!(app.apply_source(), "{}", app.status);
+        assert!(app.source_workspace.applied);
+        assert!(!app.source_dirty());
+        assert_eq!(app.document.bundle(), &before.bundle);
+        assert_eq!(app.project(), &before.decoded.project);
+        assert_eq!(app.document.revision(), revision);
+        assert!(
+            !app.document.can_undo(),
+            "Equal content creates no history step"
+        );
+        assert!(app.document.dirty());
+        assert_eq!(app.hosted_label(), "Unsaved changes");
+        assert_eq!(std::fs::read(&second_path).unwrap(), invalid.as_bytes());
+        assert_eq!(std::fs::read(&first_path).unwrap(), VALID.as_bytes());
+        let close = window::Id::unique();
+        let task = app.update(Message::Request(Pending::Close(close)));
+        assert!(iced_runtime::task::into_stream(task).is_none());
+        assert!(matches!(app.pending, Some(Pending::Close(id)) if id == close));
+        let _ = app.update(Message::Cancel);
+        save(&mut app, &second_path);
+        assert!(!app.dirty());
+        assert_eq!(app.hosted_label(), "All changes saved");
+        assert_eq!(std::fs::read(&second_path).unwrap(), VALID.as_bytes());
+        assert_eq!(std::fs::read(&first_path).unwrap(), VALID.as_bytes());
+    }
+}
+
+#[test]
+fn repair_history_compares_to_new_disk_baseline_and_then_successful_save() {
+    let directory = tempfile::tempdir().unwrap();
+    let path = directory
+        .path()
+        .canonicalize()
+        .unwrap()
+        .join("project.arcadia");
+    std::fs::write(&path, VALID).unwrap();
+    let mut app = App::with_project(Project::empty());
+    open(&mut app, &path);
+    let before = app.document.snapshot();
+    let invalid = format!("{VALID} unfinished {{");
+    std::fs::write(&path, &invalid).unwrap();
+    open(&mut app, &path);
+    let repaired = format!("{VALID}// Repaired rationale\r\n");
+    edit(&mut app, &repaired);
+    assert!(app.apply_source());
+    assert!(app.dirty());
+    let _ = app.update(Message::Undo);
+    assert_eq!(app.document.bundle(), &before.bundle);
+    assert!(
+        app.dirty(),
+        "Old saved bytes are not saved at the repair destination"
+    );
+    let _ = app.update(Message::Redo);
+    assert!(app.dirty());
+    assert_eq!(std::fs::read(&path).unwrap(), invalid.as_bytes());
+
+    std::fs::write(&path, "external edit").unwrap();
+    let failed = write_snapshot(
+        app.canvas_document,
+        app.document.revision(),
+        app.document.snapshot(),
+        path.clone(),
+        app.disk_project.clone(),
+    )
+    .unwrap_err();
+    let _ = app.update(Message::Saved(Err(failed)));
+    assert!(app.dirty());
+    assert_eq!(std::fs::read(&path).unwrap(), b"external edit");
+    std::fs::write(&path, &invalid).unwrap();
+    save(&mut app, &path);
+    assert!(!app.dirty());
+    let _ = app.update(Message::Undo);
+    assert!(app.dirty());
+    assert_eq!(app.document.bundle(), &before.bundle);
+    let _ = app.update(Message::Redo);
+    assert!(!app.dirty(), "Redo to the new saved snapshot is clean");
+    assert_eq!(std::fs::read(&path).unwrap(), repaired.as_bytes());
+}
+
+#[test]
+fn valid_equal_content_at_distinct_destinations_stays_clean() {
+    let first = tempfile::tempdir().unwrap();
+    let second = tempfile::tempdir().unwrap();
+    let first_path = first.path().canonicalize().unwrap().join("project.arcadia");
+    let second_path = second
+        .path()
+        .canonicalize()
+        .unwrap()
+        .join("project.arcadia");
+    std::fs::write(&first_path, VALID).unwrap();
+    std::fs::write(&second_path, VALID).unwrap();
+    let mut app = App::with_project(Project::empty());
+    open(&mut app, &first_path);
+    let before = app.document.bundle().clone();
+    open(&mut app, &second_path);
+    assert_eq!(app.document.bundle(), &before);
+    assert_eq!(app.path.as_ref(), Some(&second_path));
+    assert!(!app.dirty());
+    assert_eq!(app.hosted_label(), "All changes saved");
+}
+
+#[test]
+fn recovering_applied_repair_rebinds_rolled_back_disk_bytes_without_changing_model() {
+    let first = tempfile::tempdir().unwrap();
+    let second = tempfile::tempdir().unwrap();
+    let first_path = first.path().canonicalize().unwrap().join("project.arcadia");
+    let root = second.path().canonicalize().unwrap();
+    let path = root.join("project.arcadia");
+    let before = VALID.replace("Repair 救援", "Before 救援");
+    std::fs::write(&first_path, VALID).unwrap();
+    std::fs::write(&path, VALID).unwrap();
+    let journal = root.join(".arcadia-save-project.arcadia.journal");
+    std::fs::create_dir(&journal).unwrap();
+    std::fs::write(
+        journal.join("journal.json"),
+        br#"{"version":1,"entry":"project.arcadia","files":[{"path":"project.arcadia","before":true,"write":true}]}"#,
+    )
+    .unwrap();
+    std::fs::write(journal.join("0.before"), &before).unwrap();
+    std::fs::write(journal.join("0.after"), VALID).unwrap();
+    let mut app = App::with_project(Project::empty());
+    open(&mut app, &first_path);
+    let accepted = app.document.snapshot();
+    open(&mut app, &path);
+    assert_eq!(app.pending_recovery.as_ref(), Some(&path));
+    assert!(!app.source_workspace.applied);
+    assert!(app.apply_source());
+    assert!(
+        !app.dirty(),
+        "Current bytes still match disk before rollback"
+    );
+    let _ = app.update(Message::SourceRecovered(recover_snapshot(path.clone())));
+    assert!(app.pending_recovery.is_none());
+    assert!(!journal.exists());
+    assert_eq!(std::fs::read(&path).unwrap(), before.as_bytes());
+    assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+    assert!(!app.source_dirty());
+    assert!(app.dirty(), "Recovery changed disk, not the accepted model");
+    assert_eq!(app.hosted_label(), "Unsaved changes");
+    save(&mut app, &path);
+    assert!(!app.dirty());
+    assert_eq!(std::fs::read(&path).unwrap(), VALID.as_bytes());
+}
+
+#[test]
+fn recovery_missing_entry_or_failed_reload_preserves_current_destination_save_authority() {
+    for (current_destination, failed_reload) in
+        [(true, false), (false, false), (true, true), (false, true)]
+    {
+        let directory = tempfile::tempdir().unwrap();
+        let root = directory.path().canonicalize().unwrap();
+        let path = root.join("project.arcadia");
+        std::fs::write(&path, VALID).unwrap();
+        let mut app = App::with_project(Project::empty());
+        open(&mut app, &path);
+        let accepted = app.document.snapshot();
+        let journal = root.join(".arcadia-save-project.arcadia.journal");
+        std::fs::create_dir(&journal).unwrap();
+        std::fs::write(
+            journal.join("journal.json"),
+            br#"{"version":1,"entry":"project.arcadia","files":[{"path":"project.arcadia","before":false,"write":true}]}"#,
+        )
+        .unwrap();
+        std::fs::write(journal.join("0.after"), VALID).unwrap();
+        open(&mut app, &path);
+        assert!(app.apply_source());
+        assert!(!app.dirty());
+        let destination = tempfile::tempdir().unwrap();
+        let saved_elsewhere = destination
+            .path()
+            .canonicalize()
+            .unwrap()
+            .join("project.arcadia");
+        if !current_destination {
+            save(&mut app, &saved_elsewhere);
+            assert_eq!(app.path.as_ref(), Some(&saved_elsewhere));
+            assert_eq!(app.pending_recovery.as_ref(), Some(&path));
+        }
+        let mut receipt = recover_snapshot(path.clone()).unwrap();
+        assert!(
+            receipt.disk.as_ref().unwrap().bundle.files.is_empty(),
+            "Missing entry reloads as an empty repair workspace"
+        );
+        if failed_reload {
+            // Separately exercise the adapter's successful-recovery/failed-read
+            // boundary; first-save rollback itself does not cause a read error.
+            receipt.disk = Err("Injected post-recovery reload failure".into());
+        }
+        let _ = app.update(Message::SourceRecovered(Ok(receipt)));
+        assert!(!path.exists());
+        assert!(!journal.exists());
+        assert!(app.pending_recovery.is_none());
+        assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+        assert_eq!(app.dirty(), current_destination);
+        if current_destination {
+            let _ = app.update(Message::Request(Pending::New));
+            assert!(matches!(app.pending, Some(Pending::New)));
+        } else {
+            assert_eq!(app.path.as_ref(), Some(&saved_elsewhere));
+            assert_eq!(std::fs::read(&saved_elsewhere).unwrap(), VALID.as_bytes());
+        }
+    }
+}

crates/oa-desktop/src/app/source_rename/alias_input.rs

@@ -0,0 +1,219 @@
+//! Keep Iced's single-line input from silently filtering pasted control bytes.
+//! Only the alias field uses this adapter. The child retains editing and focus.
+use iced::advanced::{
+    Clipboard, Layout, Shell, Widget, clipboard, layout, overlay, renderer, text, widget,
+};
+use iced::{Element, Event, Length, Rectangle, Size, Vector, keyboard, mouse};
+
+pub(super) fn guard<'a, Message: Clone + 'a, Theme: 'a, R: text::Renderer + 'a>(
+    input: Element<'a, Message, Theme, R>,
+    rejected: Option<Message>,
+) -> Element<'a, Message, Theme, R> {
+    Element::new(AliasInput { input, rejected })
+}
+
+struct AliasInput<'a, Message, Theme, R> {
+    input: Element<'a, Message, Theme, R>,
+    rejected: Option<Message>,
+}
+
+#[derive(Default)]
+struct State {
+    modifiers: keyboard::Modifiers,
+}
+
+// Each fresh child clipboard read uses the checked snapshot. Iced may reuse its
+// previously admitted paste while V is held, until KeyReleased clears that cache.
+struct CapturedClipboard<'a> {
+    content: Option<String>,
+    original: &'a mut dyn Clipboard,
+}
+impl Clipboard for CapturedClipboard<'_> {
+    fn read(&self, kind: clipboard::Kind) -> Option<String> {
+        if kind == clipboard::Kind::Standard {
+            self.content.clone()
+        } else {
+            self.original.read(kind)
+        }
+    }
+    fn write(&mut self, kind: clipboard::Kind, contents: String) {
+        self.original.write(kind, contents);
+    }
+}
+
+impl<Message: Clone, Theme, R: text::Renderer> Widget<Message, Theme, R>
+    for AliasInput<'_, Message, Theme, R>
+{
+    fn size(&self) -> Size<Length> {
+        self.input.as_widget().size()
+    }
+    fn size_hint(&self) -> Size<Length> {
+        self.input.as_widget().size_hint()
+    }
+    fn tag(&self) -> widget::tree::Tag {
+        widget::tree::Tag::of::<State>()
+    }
+    fn state(&self) -> widget::tree::State {
+        widget::tree::State::new(State::default())
+    }
+    fn children(&self) -> Vec<widget::Tree> {
+        vec![widget::Tree::new(self.input.as_widget())]
+    }
+    fn diff(&self, tree: &mut widget::Tree) {
+        tree.diff_children(std::slice::from_ref(&self.input));
+    }
+    fn layout(
+        &mut self,
+        tree: &mut widget::Tree,
+        renderer: &R,
+        limits: &layout::Limits,
+    ) -> layout::Node {
+        self.input
+            .as_widget_mut()
+            .layout(&mut tree.children[0], renderer, limits)
+    }
+    fn draw(
+        &self,
+        tree: &widget::Tree,
+        renderer: &mut R,
+        theme: &Theme,
+        style: &renderer::Style,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        viewport: &Rectangle,
+    ) {
+        self.input.as_widget().draw(
+            &tree.children[0],
+            renderer,
+            theme,
+            style,
+            layout,
+            cursor,
+            viewport,
+        );
+    }
+    fn operate(
+        &mut self,
+        tree: &mut widget::Tree,
+        layout: Layout<'_>,
+        renderer: &R,
+        operation: &mut dyn widget::Operation,
+    ) {
+        self.input
+            .as_widget_mut()
+            .operate(&mut tree.children[0], layout, renderer, operation);
+    }
+    fn update(
+        &mut self,
+        tree: &mut widget::Tree,
+        event: &Event,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        renderer: &R,
+        clipboard: &mut dyn Clipboard,
+        shell: &mut Shell<'_, Message>,
+        viewport: &Rectangle,
+    ) {
+        let focused = tree.children[0]
+            .state
+            .downcast_ref::<iced::widget::text_input::State<R::Paragraph>>()
+            .is_focused();
+        let state = tree.state.downcast_mut::<State>();
+        // Iced 0.14.2 uses stored ModifiersChanged state, not KeyPressed.modifiers.
+        // Mirror its Escape reset and its Latin/physical-key paste shortcut.
+        if let Event::Keyboard(keyboard::Event::ModifiersChanged(modifiers)) = event {
+            state.modifiers = *modifiers;
+        }
+        let paste = matches!(event,
+            Event::Keyboard(keyboard::Event::KeyPressed { key, physical_key, .. })
+                if key.to_latin(*physical_key) == Some('v')
+                    && state.modifiers.command() && !state.modifiers.alt());
+        if focused
+            && paste
+            && let Some(rejected) = &self.rejected
+        {
+            let content = clipboard.read(clipboard::Kind::Standard);
+            if content
+                .as_ref()
+                .is_some_and(|value| value.chars().any(char::is_control))
+            {
+                // Do not invoke the child: even an empty replacement would erase
+                // its selection. Approval invalidation is an explicit App event.
+                shell.publish(rejected.clone());
+                shell.capture_event();
+                return;
+            }
+            self.input.as_widget_mut().update(
+                &mut tree.children[0],
+                event,
+                layout,
+                cursor,
+                renderer,
+                &mut CapturedClipboard {
+                    content,
+                    original: clipboard,
+                },
+                shell,
+                viewport,
+            );
+            return;
+        }
+        self.input.as_widget_mut().update(
+            &mut tree.children[0],
+            event,
+            layout,
+            cursor,
+            renderer,
+            clipboard,
+            shell,
+            viewport,
+        );
+        // In Iced 0.14.2 the only KeyPressed branch that removes focus is its
+        // Escape branch, which also resets stored modifiers. Observe that branch
+        // after its text/shortcut early returns and effective-key conversion.
+        if focused
+            && matches!(event, Event::Keyboard(keyboard::Event::KeyPressed { .. }))
+            && !tree.children[0]
+                .state
+                .downcast_ref::<iced::widget::text_input::State<R::Paragraph>>()
+                .is_focused()
+        {
+            tree.state.downcast_mut::<State>().modifiers = keyboard::Modifiers::default();
+        }
+    }
+    fn mouse_interaction(
+        &self,
+        tree: &widget::Tree,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        viewport: &Rectangle,
+        renderer: &R,
+    ) -> mouse::Interaction {
+        self.input.as_widget().mouse_interaction(
+            &tree.children[0],
+            layout,
+            cursor,
+            viewport,
+            renderer,
+        )
+    }
+    fn overlay<'a>(
+        &'a mut self,
+        tree: &'a mut widget::Tree,
+        layout: Layout<'a>,
+        renderer: &R,
+        viewport: &Rectangle,
+        translation: Vector,
+    ) -> Option<overlay::Element<'a, Message, Theme, R>> {
+        self.input.as_widget_mut().overlay(
+            &mut tree.children[0],
+            layout,
+            renderer,
+            viewport,
+            translation,
+        )
+    }
+}
+
+#[cfg(all(test, debug_assertions))]
+mod tests;

crates/oa-desktop/src/app/source_rename/alias_input/tests.rs

@@ -0,0 +1,220 @@
+use super::*;
+use crate::views::source_tests::FontLayout;
+use iced::keyboard::{
+    Key, Modifiers,
+    key::{Code, Named, Physical},
+};
+use std::cell::Cell;
+
+#[derive(Debug, Clone, PartialEq)]
+enum Signal {
+    Input(String),
+    Rejected,
+}
+
+struct ClipboardText {
+    text: String,
+    reads: Cell<usize>,
+}
+impl Clipboard for ClipboardText {
+    fn read(&self, _: clipboard::Kind) -> Option<String> {
+        self.reads.set(self.reads.get() + 1);
+        Some(self.text.clone())
+    }
+    fn write(&mut self, _: clipboard::Kind, _: String) {}
+}
+type InputState = iced::widget::text_input::State<<FontLayout as text::Renderer>::Paragraph>;
+
+struct Mounted {
+    input: Element<'static, Signal, iced::Theme, FontLayout>,
+    tree: widget::Tree,
+    node: layout::Node,
+    clipboard: ClipboardText,
+    messages: Vec<Signal>,
+}
+impl Mounted {
+    fn new(focused: bool, enabled: bool, modifiers: Modifiers) -> Self {
+        let mut child = iced::widget::text_input("Alias", "send_water");
+        if enabled {
+            child = child.on_input(Signal::Input);
+        }
+        let mut input = guard(child.into(), enabled.then_some(Signal::Rejected));
+        let mut tree = widget::Tree::new(input.as_widget());
+        let node = input.as_widget_mut().layout(
+            &mut tree,
+            &FontLayout,
+            &layout::Limits::new(Size::ZERO, Size::new(500., 40.)),
+        );
+        if focused {
+            let state = tree.children[0].state.downcast_mut::<InputState>();
+            state.focus();
+            state.select_range(0, 10);
+        }
+        let mut mounted = Self {
+            input,
+            tree,
+            node,
+            clipboard: ClipboardText {
+                text: "foo\nbar".into(),
+                reads: Cell::new(0),
+            },
+            messages: vec![],
+        };
+        mounted.event(Event::Keyboard(keyboard::Event::ModifiersChanged(
+            modifiers,
+        )));
+        mounted
+    }
+    fn state(&self) -> &InputState {
+        self.tree.children[0].state.downcast_ref::<InputState>()
+    }
+    fn event(&mut self, event: Event) -> bool {
+        let mut shell = Shell::new(&mut self.messages);
+        self.input.as_widget_mut().update(
+            &mut self.tree,
+            &event,
+            Layout::new(&self.node),
+            mouse::Cursor::Unavailable,
+            &FontLayout,
+            &mut self.clipboard,
+            &mut shell,
+            &Rectangle::new(iced::Point::ORIGIN, Size::new(500., 40.)),
+        );
+        shell.is_event_captured()
+    }
+}
+fn key(key: Key, modified_key: Key, code: Code) -> Event {
+    Event::Keyboard(keyboard::Event::KeyPressed {
+        key,
+        modified_key,
+        physical_key: Physical::Code(code),
+        location: keyboard::Location::Standard,
+        modifiers: Modifiers::empty(),
+        text: None,
+        repeat: false,
+    })
+}
+fn paste() -> Event {
+    key(
+        Key::Character("v".into()),
+        Key::Character("v".into()),
+        Code::KeyV,
+    )
+}
+
+#[test]
+fn paste_refusal_matches_child_focus_enabled_and_stored_modifier_protocol() {
+    for focused in [false, true] {
+        for enabled in [false, true] {
+            for modifiers in [
+                Modifiers::empty(),
+                Modifiers::SHIFT,
+                Modifiers::COMMAND,
+                Modifiers::COMMAND | Modifiers::ALT,
+                Modifiers::COMMAND | Modifiers::SHIFT,
+            ] {
+                let mut mounted = Mounted::new(focused, enabled, modifiers);
+                let before = mounted.state().cursor();
+                let expected = focused && enabled && modifiers.command() && !modifiers.alt();
+                let captured = mounted.event(paste());
+                assert_eq!(
+                    mounted.messages,
+                    if expected {
+                        vec![Signal::Rejected]
+                    } else {
+                        vec![]
+                    }
+                );
+                assert_eq!(mounted.clipboard.reads.get(), usize::from(expected));
+                assert_eq!(mounted.state().cursor(), before);
+                if expected {
+                    assert!(captured);
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn effective_escape_reset_follows_child_after_early_returns() {
+    // Raw Escape mapped to Home must not clear only the guard's Command state.
+    let mut mounted = Mounted::new(true, true, Modifiers::COMMAND);
+    mounted.event(key(
+        Key::Named(Named::Escape),
+        Key::Named(Named::Home),
+        Code::Escape,
+    ));
+    assert!(mounted.state().is_focused());
+    assert!(mounted.event(paste()));
+    assert_eq!(mounted.messages, vec![Signal::Rejected]);
+
+    // Effective Escape clears both states; a later focus operation does not
+    // invent a new ModifiersChanged event or revive the previous Command state.
+    let mut mounted = Mounted::new(true, true, Modifiers::COMMAND);
+    mounted.event(key(
+        Key::Named(Named::Home),
+        Key::Named(Named::Escape),
+        Code::Home,
+    ));
+    assert!(!mounted.state().is_focused());
+    mounted.tree.children[0]
+        .state
+        .downcast_mut::<InputState>()
+        .focus();
+    mounted.event(paste());
+    assert!(mounted.messages.is_empty());
+    assert_eq!(mounted.clipboard.reads.get(), 0);
+
+    // Printable text returns before effective Escape and leaves modifiers live.
+    let mut mounted = Mounted::new(true, true, Modifiers::COMMAND);
+    let mut event = key(
+        Key::Named(Named::Home),
+        Key::Named(Named::Escape),
+        Code::Home,
+    );
+    if let Event::Keyboard(keyboard::Event::KeyPressed { text, .. }) = &mut event {
+        *text = Some("x".into());
+    }
+    mounted.event(event);
+    assert!(mounted.state().is_focused());
+    assert_eq!(mounted.messages, vec![Signal::Input("x".into())]);
+    mounted.messages.clear();
+    mounted.event(paste());
+    assert_eq!(mounted.messages, vec![Signal::Rejected]);
+}
+
+#[test]
+fn held_paste_cache_contains_only_previously_admitted_text() {
+    let mut mounted = Mounted::new(true, true, Modifiers::COMMAND);
+    mounted.clipboard.text = "water".into();
+    mounted.event(paste());
+    assert_eq!(mounted.messages, vec![Signal::Input("water".into())]);
+    mounted.messages.clear();
+    mounted.clipboard.text = "other".into();
+    mounted.event(paste());
+    assert_eq!(
+        mounted.messages,
+        vec![Signal::Input("waterwater".into())],
+        "Iced reuses its first admitted paste while the key is held"
+    );
+    mounted.messages.clear();
+    let before = mounted.state().cursor();
+    mounted.clipboard.text = "bad\tvalue".into();
+    mounted.event(paste());
+    assert_eq!(mounted.messages, vec![Signal::Rejected]);
+    assert_eq!(mounted.state().cursor(), before);
+    mounted.messages.clear();
+    mounted.event(Event::Keyboard(keyboard::Event::KeyReleased {
+        key: Key::Character("v".into()),
+        modified_key: Key::Character("v".into()),
+        physical_key: Physical::Code(Code::KeyV),
+        location: keyboard::Location::Standard,
+        modifiers: Modifiers::empty(),
+    }));
+    mounted.clipboard.text = "later".into();
+    mounted.event(paste());
+    assert_eq!(
+        mounted.messages,
+        vec![Signal::Input("waterwaterlater".into())]
+    );
+}

crates/oa-desktop/src/app/source_rename/editor_patch.rs

@@ -0,0 +1,303 @@
+//! Display-only reuse after a guarded alias rename. This is not model authority.
+use iced::{advanced::text::Renderer, widget::text_editor};
+use std::sync::Arc;
+
+/// Replace exact, unchanged-line-count source in an existing editor.
+///
+/// The caller must first authorize/commit the model change and must reconstruct
+/// from accepted source on false. Preflight failures do not mutate the editor;
+/// a failed final readback can leave it changed. On changing success the cursor
+/// is at 0:0 without selection; the caller restores its approved origin/reveal.
+/// Direct Content actions deliberately bypass App draft edits and Undo history.
+pub(super) fn replace<R: Renderer>(
+    editor: &mut text_editor::Content<R>,
+    before: &str,
+    after: &str,
+) -> bool {
+    if editor.text() != before {
+        return false;
+    }
+    let Some(old_lines) = lines(before) else {
+        return false;
+    };
+    let Some(new_lines) = lines(after) else {
+        return false;
+    };
+    if old_lines.len() != new_lines.len() || old_lines.len() != editor.line_count() {
+        return false;
+    }
+    let mut patches = Vec::new();
+    for (line, ((old, old_ending), (new, new_ending))) in
+        old_lines.into_iter().zip(new_lines).enumerate()
+    {
+        let Some(actual) = editor.line(line) else {
+            return false;
+        };
+        // Cosmic also recognizes bare CR and LFCR. Comparing the actual lines
+        // catches its greedy LFCR interpretation of e.g. "x\n\r\ny" too.
+        if old_ending != new_ending || actual.text != old || actual.ending != old_ending {
+            return false;
+        }
+        if old == new {
+            continue;
+        }
+        let mut start = old
+            .bytes()
+            .zip(new.bytes())
+            .take_while(|(a, b)| a == b)
+            .count();
+        while !old.is_char_boundary(start) || !new.is_char_boundary(start) {
+            start -= 1;
+        }
+        let mut suffix = old[start..]
+            .bytes()
+            .rev()
+            .zip(new[start..].bytes().rev())
+            .take_while(|(a, b)| a == b)
+            .count();
+        while !old.is_char_boundary(old.len() - suffix) || !new.is_char_boundary(new.len() - suffix)
+        {
+            suffix -= 1;
+        }
+        // All positions and owned payloads are prepared before the first edit.
+        patches.push((
+            line,
+            start,
+            old.len() - suffix,
+            Arc::new(new[start..new.len() - suffix].to_owned()),
+        ));
+    }
+    if patches.is_empty() {
+        return true;
+    }
+    let empty = Arc::new(String::new());
+    for (line, start, end, replacement) in patches.into_iter().rev() {
+        select(editor, line, start, end);
+        editor.perform(text_editor::Action::Edit(text_editor::Edit::Paste(
+            replacement,
+        )));
+    }
+    // Iced overwrites its earliest-change marker on each Edit. An explicit
+    // zero-width selection + empty Paste changes no bytes, but marks line zero.
+    // This also refreshes previously unhighlighted lines before the first patch.
+    // It resets only line zero's text cache; other unchanged lines retain theirs.
+    select(editor, 0, 0, 0);
+    editor.perform(text_editor::Action::Edit(text_editor::Edit::Paste(empty)));
+    editor.text() == after
+}
+
+fn select<R: Renderer>(
+    editor: &mut text_editor::Content<R>,
+    line: usize,
+    start: usize,
+    end: usize,
+) {
+    editor.move_to(text_editor::Cursor {
+        position: text_editor::Position {
+            line,
+            column: start,
+        },
+        // move_to(None) does not clear a previous selection in this Iced version.
+        selection: Some(text_editor::Position { line, column: end }),
+    });
+}
+
+fn lines(source: &str) -> Option<Vec<(&str, text_editor::LineEnding)>> {
+    use text_editor::LineEnding;
+    let mut result = Vec::new();
+    let mut parts = source.split('\n').peekable();
+    while let Some(part) = parts.next() {
+        let (text, ending) = if parts.peek().is_none() {
+            (part, LineEnding::None)
+        } else if let Some(text) = part.strip_suffix('\r') {
+            (text, LineEnding::CrLf)
+        } else {
+            (part, LineEnding::Lf)
+        };
+        if text.contains('\r')
+            || (text.is_empty()
+                && ending == LineEnding::CrLf
+                && result
+                    .last()
+                    .is_some_and(|(_, previous)| *previous == LineEnding::Lf))
+        {
+            return None;
+        }
+        result.push((text, ending));
+    }
+    Some(result)
+}
+
+#[cfg(all(test, debug_assertions))]
+mod tests {
+    use super::*;
+    use crate::views::source_tests::FontLayout;
+    use iced::advanced::{layout, text::Highlighter, widget::Tree};
+    use iced::{Element, Font, Length, Size};
+    use std::{cell::RefCell, ops::Range};
+
+    #[test]
+    fn exact_text_matrix_and_reverse_preserve_endings() {
+        for (before, after) in [
+            ("", ""),
+            ("", "alias"),
+            ("alias", ""),
+            ("same", "same"),
+            ("a\n", "alias\n"),
+            ("a\r\n", "alias\r\n"),
+            ("\r\na\r\n\r\n", "\r\nlong_alias\r\n\r\n"),
+            ("\na\n\n", "\nlong_alias\n\n"),
+            ("a\r\nb\nc", "long_a\r\nlong_b\nlong_c"),
+            (
+                "雨🙂 e\u{301} @a @a // a",
+                "雨🙂 e\u{301} @a_long @a_long // a",
+            ),
+            ("@abc", "@abcdef"),
+            ("@abcdef", "@abc"),
+            ("@abc_suffix", "@def_suffix"),
+            ("@none", "@identifier"),
+            // Shared prefix/suffix bytes inside distinct UTF-8 codepoints must
+            // not be used as String split positions, even outside alias scope.
+            ("雨xé", "雪xê"),
+            ("é", "©"),
+            (
+                "unchanged\n@a\nunchanged\n@a\n",
+                "unchanged\n@long\nunchanged\n@long\n",
+            ),
+        ] {
+            let mut editor = text_editor::Content::<FontLayout>::with_text(before);
+            assert!(
+                replace(&mut editor, before, after),
+                "{before:?} -> {after:?}"
+            );
+            assert_eq!(editor.text(), after);
+            let expected = text_editor::Content::<FontLayout>::with_text(after);
+            assert_eq!(editor.line_count(), expected.line_count());
+            for (actual, expected) in editor.lines().zip(expected.lines()) {
+                assert_eq!(actual.text, expected.text);
+                assert_eq!(actual.ending, expected.ending);
+            }
+            if before != after {
+                assert_eq!(
+                    editor.cursor().position,
+                    text_editor::Position { line: 0, column: 0 }
+                );
+                assert_eq!(editor.cursor().selection, None);
+            }
+            assert!(replace(&mut editor, after, before));
+            assert_eq!(editor.text(), before);
+        }
+    }
+
+    #[test]
+    fn all_preflight_refusals_leave_text_cursor_and_selection_unchanged() {
+        for (actual, before, after) in [
+            ("live", "stale", "changed"),
+            ("a\nb", "a\nb", "long\nb\nc"),
+            ("a\nb", "a\nb", "long\r\nb"),
+            // Refusal on a later line must not apply the earlier planned edit.
+            ("a\nb\r\n", "a\nb\r\n", "long\nb\n"),
+            ("a\rb", "a\rb", "long\rb"),
+            ("a\n\rb", "a\n\rb", "long\n\rb"),
+            ("a\n\r\nb", "a\n\r\nb", "long\n\r\nb"),
+            // The replacement must not introduce a greedy LFCR boundary either.
+            ("a\nx\r\n", "a\nx\r\n", "a\n\r\n"),
+            ("a", "a", "long\r"),
+        ] {
+            let mut editor = text_editor::Content::<FontLayout>::with_text(actual);
+            select(&mut editor, 0, 0, 1);
+            let cursor = editor.cursor();
+            let selection = editor.selection();
+            assert!(
+                !replace(&mut editor, before, after),
+                "{before:?} -> {after:?}"
+            );
+            assert_eq!(editor.text(), actual);
+            assert_eq!(editor.cursor(), cursor);
+            assert_eq!(editor.selection(), selection);
+        }
+    }
+
+    #[test]
+    fn unchanged_content_preserves_selection_and_next_direct_edit_works() {
+        let mut editor = text_editor::Content::<FontLayout>::with_text("@a");
+        select(&mut editor, 0, 1, 2);
+        let cursor = editor.cursor();
+        assert!(replace(&mut editor, "@a", "@a"));
+        assert_eq!(editor.cursor(), cursor);
+        assert!(replace(&mut editor, "@a", "@long"));
+        editor.move_to(text_editor::Cursor {
+            position: text_editor::Position { line: 0, column: 5 },
+            selection: None,
+        });
+        editor.perform(text_editor::Action::Edit(text_editor::Edit::Insert('!')));
+        assert_eq!(editor.text(), "@long!");
+    }
+
+    thread_local! {
+        static CHANGES: RefCell<Vec<usize>> = const { RefCell::new(Vec::new()) };
+    }
+
+    struct Tracked(crate::highlight::ArcadiaHighlighter);
+    impl Highlighter for Tracked {
+        type Settings = Arc<str>;
+        type Highlight = oa_core::language::TokenClass;
+        type Iterator<'a> = std::vec::IntoIter<(Range<usize>, Self::Highlight)>;
+        fn new(settings: &Self::Settings) -> Self {
+            Self(crate::highlight::ArcadiaHighlighter::new(settings))
+        }
+        fn update(&mut self, settings: &Self::Settings) {
+            self.0.update(settings);
+        }
+        fn change_line(&mut self, line: usize) {
+            CHANGES.with(|changes| changes.borrow_mut().push(line));
+            self.0.change_line(line);
+        }
+        fn highlight_line(&mut self, line: &str) -> Self::Iterator<'_> {
+            self.0.highlight_line(line)
+        }
+        fn current_line(&self) -> usize {
+            self.0.current_line()
+        }
+    }
+
+    fn view(
+        editor: &text_editor::Content<FontLayout>,
+        source: Arc<str>,
+    ) -> Element<'_, (), iced::Theme, FontLayout> {
+        text_editor(editor)
+            .font(Font::MONOSPACE)
+            .size(14)
+            .height(Length::Fill)
+            .highlight_with::<Tracked>(source, crate::highlight::format)
+            .into()
+    }
+
+    #[test]
+    fn already_laid_out_editor_notifies_highlighter_from_zero_after_later_line_patch() {
+        let before = "// earlier\n// unmodified\n@a";
+        let after = "// earlier\n// unmodified\n@none";
+        let mut editor = text_editor::Content::<FontLayout>::with_text(before);
+        let limits = layout::Limits::new(Size::ZERO, Size::new(400., 60.));
+        let mut tree = {
+            let mut widget = view(&editor, Arc::from(before));
+            let mut tree = Tree::new(widget.as_widget());
+            let _ = widget
+                .as_widget_mut()
+                .layout(&mut tree, &FontLayout, &limits);
+            tree
+        };
+        CHANGES.with(|changes| changes.borrow_mut().clear());
+        assert!(replace(&mut editor, before, after));
+        {
+            let mut widget = view(&editor, Arc::from(after));
+            let _ = widget
+                .as_widget_mut()
+                .layout(&mut tree, &FontLayout, &limits);
+        }
+        // Font/metrics/bounds are already stable. This notification must come
+        // from the helper's empty edit, not a fresh renderer initialization.
+        CHANGES.with(|changes| assert_eq!(*changes.borrow(), [0]));
+        assert_eq!(editor.text(), after);
+    }
+}

crates/oa-desktop/src/app/source_rename/preview_glyph_tests.rs

@@ -0,0 +1,449 @@
+//! Real paragraph advances and clipping through the actual preview dialog.
+//! Native screenshots additionally check raster ink and the platform renderer.
+use super::*;
+use crate::views::source_tests::FontLayout;
+use iced::advanced::{Layout, layout, renderer, text as shaped, widget};
+use iced::{Background, Color, Font, Pixels, Point, Rectangle, Size, Transformation, Vector};
+use std::collections::{BTreeMap, BTreeSet};
+
+struct Glyph {
+    text: String,
+    paragraph_y: u32,
+    line: usize,
+    bytes: std::ops::Range<usize>,
+    bounds: Rectangle,
+    clip: Rectangle,
+}
+
+struct GlyphRecorder {
+    wanted: BTreeSet<String>,
+    transforms: Vec<Transformation>,
+    clips: Vec<Rectangle>,
+    glyphs: Vec<Glyph>,
+    quads: Vec<Rectangle>,
+}
+impl GlyphRecorder {
+    fn new(wanted: BTreeSet<String>, viewport: Rectangle) -> Self {
+        Self {
+            wanted,
+            transforms: vec![Transformation::IDENTITY],
+            clips: vec![viewport],
+            glyphs: vec![],
+            quads: vec![],
+        }
+    }
+    fn transform(&self) -> Transformation {
+        *self.transforms.last().unwrap()
+    }
+    fn clip(&self, bounds: Rectangle) -> Rectangle {
+        self.clips
+            .last()
+            .unwrap()
+            .intersection(&(bounds * self.transform()))
+            .unwrap_or(Rectangle::with_size(Size::ZERO))
+    }
+}
+impl renderer::Renderer for GlyphRecorder {
+    fn start_layer(&mut self, bounds: Rectangle) {
+        self.clips.push(self.clip(bounds));
+    }
+    fn end_layer(&mut self) {
+        self.clips.pop().unwrap();
+    }
+    fn start_transformation(&mut self, transform: Transformation) {
+        self.transforms.push(self.transform() * transform);
+    }
+    fn end_transformation(&mut self) {
+        self.transforms.pop().unwrap();
+    }
+    fn reset(&mut self, bounds: Rectangle) {
+        self.transforms = vec![Transformation::IDENTITY];
+        self.clips = vec![bounds];
+        self.glyphs.clear();
+        self.quads.clear();
+    }
+    fn fill_quad(&mut self, quad: renderer::Quad, _: impl Into<Background>) {
+        self.quads.push(quad.bounds * self.transform());
+    }
+    fn allocate_image(
+        &mut self,
+        handle: &iced::advanced::image::Handle,
+        callback: impl FnOnce(Result<iced::advanced::image::Allocation, iced::advanced::image::Error>)
+        + Send
+        + 'static,
+    ) {
+        renderer::Renderer::allocate_image(&mut FontLayout, handle, callback);
+    }
+}
+impl shaped::Renderer for GlyphRecorder {
+    type Font = Font;
+    type Paragraph = <FontLayout as shaped::Renderer>::Paragraph;
+    type Editor = <FontLayout as shaped::Renderer>::Editor;
+    const ICON_FONT: Font = <FontLayout as shaped::Renderer>::ICON_FONT;
+    const CHECKMARK_ICON: char = <FontLayout as shaped::Renderer>::CHECKMARK_ICON;
+    const ARROW_DOWN_ICON: char = <FontLayout as shaped::Renderer>::ARROW_DOWN_ICON;
+    const SCROLL_UP_ICON: char = <FontLayout as shaped::Renderer>::SCROLL_UP_ICON;
+    const SCROLL_DOWN_ICON: char = <FontLayout as shaped::Renderer>::SCROLL_DOWN_ICON;
+    const SCROLL_LEFT_ICON: char = <FontLayout as shaped::Renderer>::SCROLL_LEFT_ICON;
+    const SCROLL_RIGHT_ICON: char = <FontLayout as shaped::Renderer>::SCROLL_RIGHT_ICON;
+    const ICED_LOGO: char = <FontLayout as shaped::Renderer>::ICED_LOGO;
+    fn default_font(&self) -> Font {
+        shaped::Renderer::default_font(&FontLayout)
+    }
+    fn default_size(&self) -> Pixels {
+        shaped::Renderer::default_size(&FontLayout)
+    }
+    fn fill_paragraph(
+        &mut self,
+        paragraph: &Self::Paragraph,
+        position: Point,
+        _: Color,
+        clip: Rectangle,
+    ) {
+        let buffer = paragraph.buffer();
+        let text = buffer
+            .lines
+            .iter()
+            .map(|line| line.text())
+            .collect::<Vec<_>>()
+            .join("\n");
+        if !self.wanted.contains(&text) {
+            return;
+        }
+        let clip = self.clip(clip);
+        for run in buffer.layout_runs() {
+            for glyph in run.glyphs {
+                if run.text[glyph.start..glyph.end]
+                    .chars()
+                    .all(char::is_whitespace)
+                {
+                    continue;
+                }
+                let bounds = Rectangle {
+                    x: position.x + glyph.x + glyph.x_offset * glyph.font_size,
+                    y: position.y + run.line_top,
+                    width: glyph.w,
+                    height: run.line_height,
+                } * self.transform();
+                self.glyphs.push(Glyph {
+                    text: text.clone(),
+                    paragraph_y: position.y.to_bits(),
+                    line: run.line_i,
+                    bytes: glyph.start..glyph.end,
+                    bounds,
+                    clip,
+                });
+            }
+        }
+    }
+    fn fill_editor(
+        &mut self,
+        editor: &Self::Editor,
+        position: Point,
+        color: Color,
+        clip: Rectangle,
+    ) {
+        shaped::Renderer::fill_editor(&mut FontLayout, editor, position, color, clip);
+    }
+    fn fill_text(&mut self, text: shaped::Text, position: Point, color: Color, clip: Rectangle) {
+        shaped::Renderer::fill_text(&mut FontLayout, text, position, color, clip);
+    }
+}
+
+#[derive(Default)]
+struct ScrollGeometry {
+    id: Option<widget::Id>,
+    bounds: Option<Rectangle>,
+    content: Option<Rectangle>,
+    offset: Vector,
+}
+impl widget::Operation for ScrollGeometry {
+    fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn widget::Operation)) {
+        visit(self);
+    }
+    fn scrollable(
+        &mut self,
+        id: Option<&widget::Id>,
+        bounds: Rectangle,
+        content: Rectangle,
+        offset: Vector,
+        _: &mut dyn widget::operation::Scrollable,
+    ) {
+        if id == self.id.as_ref() {
+            self.bounds = Some(bounds);
+            self.content = Some(content);
+            self.offset = offset;
+        }
+    }
+}
+fn normalized(text: &str) -> String {
+    text.replace("\r\n", "\n").replace('\r', "\n")
+}
+fn required_chars(text: &str) -> BTreeSet<(usize, usize)> {
+    text.split('\n')
+        .enumerate()
+        .flat_map(|(line, text)| {
+            text.char_indices()
+                .filter(|(_, ch)| !ch.is_whitespace())
+                .map(move |(byte, _)| (line, byte))
+        })
+        .collect()
+}
+
+fn declarations(long: bool) -> App {
+    let name = if long {
+        format!("Assess {} request", "界🚀".repeat(90))
+    } else {
+        "Assess 救援 request".into()
+    };
+    let source = SourceBundle { entry: "project.arcadia".into(), files: BTreeMap::from([
+        ("project.arcadia".into(), "arcadia 7;\r\nproject navigation_trial \"Navigation — 救援\" id \"9e8f0000-0000-4000-8000-000000000001\" {\r\n include \"救援/assess.arcadia\";\r\n}\r\n".into()),
+        ("救援/assess.arcadia".into(), format!("// Comment @assess must not be a lexical use.\r\noa_activity assess \"{name}\" id \"9e8f0000-0000-4000-8000-000000000002\" {{\r\n    description \"Keep @assess as prose, not a use.\";\r\n}}\r\n")),
+    ]) };
+    let mut app = fixture();
+    app.document = Document::from_bundle(source, LIMITS).unwrap();
+    app.source_workspace = Workspace::new(app.document.bundle(), true);
+    app.source_workspace.active = "救援/assess.arcadia".into();
+    app.selected = app.project().id;
+    app.refresh_draft();
+    app.show_source_file(false);
+    let start = app
+        .source_workspace
+        .text()
+        .find("oa_activity assess")
+        .unwrap()
+        + "oa_activity ".len();
+    app.source_editor.move_to(cursor(
+        app.source_workspace.text(),
+        start,
+        start + "assess".len(),
+    ));
+    begin(&mut app);
+    let replacement = if long {
+        "a".repeat(255)
+    } else {
+        "assess_damage".into()
+    };
+    input(&mut app, &replacement);
+    let _ = preview(&mut app);
+    app
+}
+
+fn assert_page_glyphs_visible(app: &App, host: Size) {
+    let form = app.source_rename.form.as_ref().unwrap();
+    let ready = form.approval.as_ref().unwrap();
+    let file = &ready.preview.files()[form.file];
+    let mut expected = BTreeMap::<String, usize>::new();
+    for line in file.hunks()[form.hunk]
+        .lines()
+        .iter()
+        .skip(form.line)
+        .take(LINES_PER_PAGE)
+    {
+        for source in [
+            line.before_text(&ready.prepared.before().bundle.files[file.path()])
+                .unwrap(),
+            line.after_text(&ready.prepared.after().bundle.files[file.path()])
+                .unwrap(),
+        ] {
+            if let Some(fragment) = preview::text_segment(source, form.segment) {
+                let text = normalized(fragment);
+                if !required_chars(&text).is_empty() {
+                    *expected.entry(text).or_default() += 1;
+                }
+            }
+        }
+    }
+    assert!(!expected.is_empty());
+    let viewport = Rectangle::new(Point::ORIGIN, host);
+    let mut renderer = GlyphRecorder::new(expected.keys().cloned().collect(), viewport);
+    let editor = text_editor::Content::<GlyphRecorder>::new();
+    let mut view = dialog_content(app, &editor);
+    let mut tree = widget::Tree::new(view.as_widget());
+    let node =
+        view.as_widget_mut()
+            .layout(&mut tree, &renderer, &layout::Limits::new(Size::ZERO, host));
+    let mut geometry = ScrollGeometry {
+        id: Some(preview_scroll_id(form, ready.id)),
+        ..ScrollGeometry::default()
+    };
+    view.as_widget_mut()
+        .operate(&mut tree, Layout::new(&node), &renderer, &mut geometry);
+    let bounds = geometry.bounds.unwrap();
+    let content = geometry.content.unwrap();
+    assert!(bounds.height >= 40.);
+    let maximum = (content.height - bounds.height).max(0.);
+    let steps = (maximum / (bounds.height * 0.5)).ceil() as usize;
+    let mut visible = BTreeMap::<(String, u32), BTreeSet<(usize, usize)>>::new();
+    let mut reserved_bar_gap = true;
+    for step in 0..=steps {
+        let offset = (step as f32 * bounds.height * 0.5).min(maximum);
+        view.as_widget_mut().operate(
+            &mut tree,
+            Layout::new(&node),
+            &renderer,
+            &mut widget::operation::scrollable::scroll_to(
+                preview_scroll_id(form, ready.id),
+                widget::operation::scrollable::AbsoluteOffset {
+                    x: None,
+                    y: Some(offset),
+                },
+            ),
+        );
+        view.as_widget_mut()
+            .operate(&mut tree, Layout::new(&node), &renderer, &mut geometry);
+        assert!(
+            (geometry.offset.y - offset).abs() <= 0.5,
+            "actual scroll operation reaches the requested source offset"
+        );
+        renderer::Renderer::reset(&mut renderer, viewport);
+        view.as_widget().draw(
+            &tree,
+            &mut renderer,
+            &iced::Theme::Light,
+            &renderer::Style::default(),
+            Layout::new(&node),
+            iced::mouse::Cursor::Unavailable,
+            &viewport,
+        );
+        // The vertical scrollbar's actual painted thumb fixes its excluded x
+        // region; the outer scroll clip alone cannot detect overpainting.
+        let scrollbar_left = renderer
+            .quads
+            .iter()
+            .filter(|quad| {
+                quad.width > 0.
+                    && quad.width <= 16.
+                    && quad.height > 0.
+                    && quad.x >= bounds.x + bounds.width - 18.
+                    && quad.x + quad.width <= bounds.x + bounds.width + 0.5
+                    && quad.y >= bounds.y - 0.5
+                    && quad.y + quad.height <= bounds.y + bounds.height + 0.5
+            })
+            .map(|quad| quad.x)
+            .min_by(f32::total_cmp);
+        if maximum > 0. {
+            let left = scrollbar_left.expect("overflowing actual preview must paint its scrollbar");
+            reserved_bar_gap &= content.x + content.width <= left - 7.5;
+        }
+        for glyph in &renderer.glyphs {
+            let right = glyph.bounds.x + glyph.bounds.width;
+            if let Some(left) = scrollbar_left {
+                assert!(
+                    right <= left - 0.5,
+                    "source glyph under scrollbar: text={:?} cluster={:?} glyph={:?} bar x={left}",
+                    glyph.text,
+                    glyph.bytes,
+                    glyph.bounds
+                );
+            }
+            assert!(
+                glyph.bounds.x >= content.x - 0.5 && right <= content.x + content.width + 0.5,
+                "source glyph escaped reserved width: {:?} {:?}",
+                glyph.text,
+                glyph.bounds
+            );
+            assert!(
+                glyph.bounds.x >= glyph.clip.x - 0.5
+                    && right <= glyph.clip.x + glyph.clip.width + 0.5,
+                "source glyph horizontally clipped: {:?} {:?} {:?}",
+                glyph.text,
+                glyph.bounds,
+                glyph.clip
+            );
+            if glyph.bounds.y >= glyph.clip.y - 0.5
+                && glyph.bounds.y + glyph.bounds.height <= glyph.clip.y + glyph.clip.height + 0.5
+            {
+                let logical_line = glyph.text.split('\n').nth(glyph.line).unwrap();
+                let chars = logical_line
+                    .char_indices()
+                    .filter(|(byte, ch)| glyph.bytes.contains(byte) && !ch.is_whitespace())
+                    .map(|(byte, _)| (glyph.line, byte));
+                visible
+                    .entry((glyph.text.clone(), glyph.paragraph_y))
+                    .or_default()
+                    .extend(chars);
+            }
+        }
+    }
+    assert!(
+        reserved_bar_gap,
+        "source content must reserve actual scrollbar width plus gap"
+    );
+    assert!(
+        bounds.width >= host.width - 30.,
+        "preview must use available dialog width: {bounds:?} / {host:?}"
+    );
+    for (text, count) in expected {
+        let required = required_chars(&text);
+        let instances: Vec<_> = visible
+            .iter()
+            .filter(|((value, _), _)| value == &text)
+            .collect();
+        assert_eq!(
+            instances.len(),
+            count,
+            "all before/after occurrences must be seen: {text:?}"
+        );
+        for (_, seen) in instances {
+            assert_eq!(
+                seen, &required,
+                "every non-whitespace source cluster must be fully visible at some vertical offset: {text:?}"
+            );
+        }
+    }
+}
+
+#[test]
+fn actual_preview_source_glyphs_clear_scrollbar_and_all_long_fragments_are_reachable() {
+    for long in [false, true] {
+        let mut app = declarations(long);
+        let ready = app
+            .source_rename
+            .form
+            .as_ref()
+            .unwrap()
+            .approval
+            .as_ref()
+            .unwrap()
+            .clone();
+        let invocation = app.source_rename.form.as_ref().unwrap().invocation;
+        let before = evidence(&app);
+        for (width, height) in [(1100., 700.), (580., 700.)] {
+            app.window_size = Size::new(width, height);
+            let host = Size::new((width - 84.).min(708.), height - 120.);
+            let total = segment_total(app.source_rename.form.as_ref().unwrap());
+            if long {
+                assert!(
+                    total >= 3,
+                    "include unbroken ASCII and wide Unicode across segments"
+                );
+            }
+            for segment in 0..total {
+                assert_page_glyphs_visible(&app, host);
+                if segment + 1 < total {
+                    event(&mut app, Event::Segment(invocation, ready.id, true));
+                }
+            }
+            for _ in 1..total {
+                event(&mut app, Event::Segment(invocation, ready.id, false));
+            }
+        }
+        assert_eq!(
+            evidence(&app),
+            before,
+            "preview geometry/paging cannot alter transaction inputs"
+        );
+        assert_eq!(
+            app.source_rename
+                .form
+                .as_ref()
+                .unwrap()
+                .approval
+                .as_ref()
+                .unwrap()
+                .id,
+            ready.id
+        );
+    }
+}

crates/oa-desktop/src/app/source_rename/preview_scroll_tests.rs

@@ -0,0 +1,310 @@
+//! Execute the controller's scroll operations on a retained, scrolled dialog.
+use super::*;
+use crate::views::source_tests::FontLayout;
+use iced::advanced::{Layout, layout, widget};
+use iced::futures::StreamExt;
+use iced::{Rectangle, Size, Vector};
+
+const HOST: Size = Size::new(720., 660.);
+
+fn paged_fixture() -> App {
+    let mut source = bundle();
+    let name = "Long engineering name 雨 ".repeat(18);
+    source.files.get_mut("defs.arcadia").unwrap().replace_range(
+        ..,
+        &format!(
+            "oa_activity pump \"{name}\" id \"00000000-0000-0000-0000-000000000002\" {{}}\r\n\
+            oa_activity backup \"Backup\" id \"00000000-0000-0000-0000-000000000004\" {{}}\r\n"
+        ),
+    );
+    let mut uses = String::new();
+    for index in 0..16 {
+        if index == 12 {
+            uses.push_str(&"// unchanged gap\r\n".repeat(10));
+        }
+        uses.push_str(&format!(
+            "interaction use_{index} \"{name}\" id \"00000000-0000-0000-0001-{index:012}\" {{ source @pump; target @backup; }}\r\n"
+        ));
+    }
+    source.files.insert("uses.arcadia".into(), uses);
+    let mut app = fixture();
+    app.window_size = HOST;
+    app.document = Document::from_bundle(source, LIMITS).unwrap();
+    app.source_workspace = Workspace::new(app.document.bundle(), true);
+    app.source_workspace.active = "uses.arcadia".into();
+    app.show_source_file(false);
+    let start = app.source_workspace.text().find("source @pump").unwrap() + "source @".len();
+    app.source_editor
+        .move_to(cursor(app.source_workspace.text(), start, start + 4));
+    begin(&mut app);
+    input(&mut app, "pump_long");
+    let _ = preview(&mut app);
+    app
+}
+
+fn scroll_id(app: &App) -> widget::Id {
+    let form = app.source_rename.form.as_ref().unwrap();
+    preview_scroll_id(form, form.approval.as_ref().unwrap().id)
+}
+
+struct Geometry {
+    id: widget::Id,
+    offset: Option<Vector>,
+}
+impl widget::Operation for Geometry {
+    fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn widget::Operation)) {
+        visit(self);
+    }
+    fn scrollable(
+        &mut self,
+        id: Option<&widget::Id>,
+        _: Rectangle,
+        _: Rectangle,
+        offset: Vector,
+        _: &mut dyn widget::operation::Scrollable,
+    ) {
+        if id == Some(&self.id) {
+            self.offset = Some(offset);
+        }
+    }
+}
+
+struct Mounted {
+    editor: text_editor::Content<FontLayout>,
+    tree: widget::Tree,
+}
+impl Mounted {
+    fn new(app: &App) -> Self {
+        let editor = text_editor::Content::<FontLayout>::new();
+        let tree = widget::Tree::new(dialog_content(app, &editor).as_widget());
+        Self { editor, tree }
+    }
+    fn operate(&mut self, app: &App, operation: &mut dyn widget::Operation) {
+        let mut view = dialog_content(app, &self.editor);
+        // Preserve the actual scroll state across the new page's view diff.
+        self.tree.diff(view.as_widget());
+        let node = view.as_widget_mut().layout(
+            &mut self.tree,
+            &FontLayout,
+            &layout::Limits::new(Size::ZERO, HOST),
+        );
+        view.as_widget_mut()
+            .operate(&mut self.tree, Layout::new(&node), &FontLayout, operation);
+    }
+    fn offset(&mut self, app: &App) -> f32 {
+        let mut geometry = Geometry {
+            id: scroll_id(app),
+            offset: None,
+        };
+        self.operate(app, &mut geometry);
+        geometry.offset.expect("mounted preview scrollable").y
+    }
+    fn scroll_down(&mut self, app: &App) -> f32 {
+        self.operate(
+            app,
+            &mut widget::operation::scrollable::scroll_to(
+                scroll_id(app),
+                widget::operation::scrollable::AbsoluteOffset {
+                    x: None,
+                    y: Some(10_000.),
+                },
+            ),
+        );
+        let offset = self.offset(app);
+        assert!(offset > 10., "fixture must really be scrolled");
+        offset
+    }
+    async fn execute(&mut self, app: &App, task: Task<Message>) -> usize {
+        let mut count = 0;
+        if let Some(mut actions) = iced_runtime::task::into_stream(task) {
+            while let Some(action) = actions.next().await {
+                let iced_runtime::Action::Widget(mut operation) = action else {
+                    panic!("preview paging must only schedule a widget operation");
+                };
+                self.operate(app, operation.as_mut());
+                count += 1;
+            }
+        }
+        count
+    }
+}
+
+#[tokio::test]
+async fn explicit_navigation_resets_retained_scroll_but_id_change_alone_does_not() {
+    let mut app = paged_fixture();
+    let before = evidence(&app);
+    let form = app.source_rename.form.as_ref().unwrap();
+    let invocation = form.invocation;
+    let approval = form.approval.as_ref().unwrap().id;
+    let mut mounted = Mounted::new(&app);
+    mounted.scroll_down(&app);
+    let old_id = scroll_id(&app);
+    let task = app.update(Message::SourceRename(Event::File(
+        invocation, approval, true,
+    )));
+    assert_ne!(old_id, scroll_id(&app));
+    // Negative control: even after diff/layout with the new id and new file,
+    // Iced retains the previous offset until the returned operation executes.
+    assert!(mounted.offset(&app) > 10.);
+    assert_eq!(mounted.execute(&app, task).await, 1);
+    assert_eq!(mounted.offset(&app), 0.);
+
+    for navigation in [
+        Event::Line(invocation, approval, true),
+        Event::Segment(invocation, approval, true),
+        Event::Hunk(invocation, approval, true),
+        Event::File(invocation, approval, false),
+        Event::Search(invocation, "uses".into()),
+        Event::Search(invocation, "no-path-match".into()),
+        Event::Search(invocation, String::new()),
+    ] {
+        mounted.scroll_down(&app);
+        let task = app.update(Message::SourceRename(navigation));
+        assert_eq!(mounted.execute(&app, task).await, 1);
+        assert_eq!(mounted.offset(&app), 0.);
+        assert_eq!(evidence(&app), before);
+    }
+    // Passive redraw and unchanged filter input preserve deliberate scrolling.
+    let offset = mounted.scroll_down(&app);
+    assert_eq!(mounted.offset(&app), offset);
+    let task = app.update(Message::SourceRename(Event::Search(
+        invocation,
+        String::new(),
+    )));
+    assert_eq!(mounted.execute(&app, task).await, 0);
+    assert_eq!(mounted.offset(&app), offset);
+    let task = app.update(Message::SourceRename(Event::Input(
+        invocation,
+        "pump_long".into(),
+    )));
+    assert_eq!(mounted.execute(&app, task).await, 0);
+    assert_eq!(mounted.offset(&app), offset);
+    let task = app.update(Message::SourceRename(Event::File(
+        invocation, approval, false,
+    )));
+    assert_eq!(
+        mounted.execute(&app, task).await,
+        0,
+        "clamped first-page request is a no-op"
+    );
+    assert_eq!(mounted.offset(&app), offset);
+    assert_eq!(evidence(&app), before);
+}
+
+#[tokio::test]
+async fn delayed_page_and_approval_operations_cannot_reset_a_new_destination() {
+    let mut app = paged_fixture();
+    let before = evidence(&app);
+    let form = app.source_rename.form.as_ref().unwrap();
+    let invocation = form.invocation;
+    let old_approval = form.approval.as_ref().unwrap().id;
+    let mut mounted = Mounted::new(&app);
+    let old_page_task = app.update(Message::SourceRename(Event::File(
+        invocation,
+        old_approval,
+        true,
+    )));
+    let next_page_task = app.update(Message::SourceRename(Event::Line(
+        invocation,
+        old_approval,
+        true,
+    )));
+    assert_eq!(mounted.execute(&app, next_page_task).await, 1);
+    let offset = mounted.scroll_down(&app);
+    assert_eq!(mounted.execute(&app, old_page_task).await, 1);
+    assert_eq!(mounted.offset(&app), offset, "old page target is absent");
+
+    let old_approval_task = app.update(Message::SourceRename(Event::Search(
+        invocation,
+        "defs".into(),
+    )));
+    input(&mut app, "pump_new");
+    let _ = preview(&mut app); // Real new approval in the same invocation/page.
+    assert_ne!(
+        app.source_rename
+            .form
+            .as_ref()
+            .unwrap()
+            .approval
+            .as_ref()
+            .unwrap()
+            .id,
+        old_approval
+    );
+    let offset = mounted.scroll_down(&app);
+    assert_eq!(mounted.execute(&app, old_approval_task).await, 1);
+    assert_eq!(
+        mounted.offset(&app),
+        offset,
+        "old approval target is absent"
+    );
+    let task = app.update(Message::SourceRename(Event::File(
+        invocation,
+        old_approval,
+        true,
+    )));
+    assert_eq!(
+        mounted.execute(&app, task).await,
+        0,
+        "stale envelope is rejected before scheduling"
+    );
+    assert_eq!(mounted.offset(&app), offset);
+    assert_eq!(evidence(&app), before);
+}
+
+#[tokio::test]
+async fn repeated_page_visits_filters_and_fast_preview_completion_have_distinct_destinations() {
+    let mut app = paged_fixture();
+    let before = evidence(&app);
+    let form = app.source_rename.form.as_ref().unwrap();
+    let invocation = form.invocation;
+    let approval = form.approval.as_ref().unwrap().id;
+    let mut mounted = Mounted::new(&app);
+
+    let first_visit = app.update(Message::SourceRename(Event::File(
+        invocation, approval, true,
+    )));
+    let next_page = app.update(Message::SourceRename(Event::Line(
+        invocation, approval, true,
+    )));
+    assert_eq!(mounted.execute(&app, next_page).await, 1);
+    let return_visit = app.update(Message::SourceRename(Event::Line(
+        invocation, approval, false,
+    )));
+    assert_eq!(mounted.execute(&app, return_visit).await, 1);
+    let offset = mounted.scroll_down(&app);
+    assert_eq!(mounted.execute(&app, first_visit).await, 1);
+    assert_eq!(
+        mounted.offset(&app),
+        offset,
+        "old visit to the identical page is stale"
+    );
+
+    let old_filter = app.update(Message::SourceRename(Event::Search(
+        invocation,
+        "uses".into(),
+    )));
+    let new_filter = app.update(Message::SourceRename(Event::Search(
+        invocation,
+        "us".into(),
+    )));
+    assert_eq!(mounted.execute(&app, new_filter).await, 1);
+    let offset = mounted.scroll_down(&app);
+    assert_eq!(mounted.execute(&app, old_filter).await, 1);
+    assert_eq!(
+        mounted.offset(&app),
+        offset,
+        "old filter on the same page is stale"
+    );
+
+    input(&mut app, "pump_new");
+    let job = start_preview(&mut app);
+    let completion = preview_completion(&app, job);
+    // No intermediate frame mounts the temporary no-approval view. The old
+    // Scrollable survives even though the new approval has a different id.
+    let ready = app.update(Message::SourceRenameReady(completion));
+    assert!(mounted.offset(&app) > 10.);
+    assert_eq!(mounted.execute(&app, ready).await, 1);
+    assert_eq!(mounted.offset(&app), 0.);
+    assert_eq!(evidence(&app), before);
+}

crates/oa-desktop/src/app/source_rename_layout_timing_tests.rs

@@ -0,0 +1,313 @@
+//! Manual replacement + next-layout/highlight evaluator; no GPU or native paint.
+//! Child of source_rename_timing_tests, preserving the separate real App test.
+use super::*;
+use crate::{highlight, views::source_tests::FontLayout};
+use iced::advanced::widget::operation::Focusable;
+use iced::advanced::{Layout, graphics, layout, renderer, text as shaped, widget::Tree};
+use iced::{
+    Background, Color, Element, Font, Length, Pixels, Point, Rectangle, Size, Transformation,
+};
+
+// The same real Paragraph and Editor as FontLayout. During draw, retain only a
+// Weak and fixed geometry; inspect glyphs after timing, never in fill_editor.
+#[derive(Default)]
+struct ObservedFontLayout {
+    drawn: Option<(graphics::text::editor::Weak, Point, Rectangle)>,
+}
+impl renderer::Renderer for ObservedFontLayout {
+    fn start_layer(&mut self, _: Rectangle) {}
+    fn end_layer(&mut self) {}
+    fn start_transformation(&mut self, _: Transformation) {}
+    fn end_transformation(&mut self) {}
+    fn reset(&mut self, _: Rectangle) {
+        self.drawn = None;
+    }
+    fn fill_quad(&mut self, _: renderer::Quad, _: impl Into<Background>) {}
+    fn allocate_image(
+        &mut self,
+        handle: &iced::advanced::image::Handle,
+        callback: impl FnOnce(Result<iced::advanced::image::Allocation, iced::advanced::image::Error>)
+        + Send
+        + 'static,
+    ) {
+        renderer::Renderer::allocate_image(&mut FontLayout, handle, callback);
+    }
+}
+impl shaped::Renderer for ObservedFontLayout {
+    type Font = Font;
+    type Paragraph = <FontLayout as shaped::Renderer>::Paragraph;
+    type Editor = <FontLayout as shaped::Renderer>::Editor;
+    const ICON_FONT: Font = <FontLayout as shaped::Renderer>::ICON_FONT;
+    const CHECKMARK_ICON: char = <FontLayout as shaped::Renderer>::CHECKMARK_ICON;
+    const ARROW_DOWN_ICON: char = <FontLayout as shaped::Renderer>::ARROW_DOWN_ICON;
+    const SCROLL_UP_ICON: char = <FontLayout as shaped::Renderer>::SCROLL_UP_ICON;
+    const SCROLL_DOWN_ICON: char = <FontLayout as shaped::Renderer>::SCROLL_DOWN_ICON;
+    const SCROLL_LEFT_ICON: char = <FontLayout as shaped::Renderer>::SCROLL_LEFT_ICON;
+    const SCROLL_RIGHT_ICON: char = <FontLayout as shaped::Renderer>::SCROLL_RIGHT_ICON;
+    const ICED_LOGO: char = <FontLayout as shaped::Renderer>::ICED_LOGO;
+    fn default_font(&self) -> Font {
+        shaped::Renderer::default_font(&FontLayout)
+    }
+    fn default_size(&self) -> Pixels {
+        shaped::Renderer::default_size(&FontLayout)
+    }
+    fn fill_paragraph(&mut self, _: &Self::Paragraph, _: Point, _: Color, _: Rectangle) {}
+    fn fill_editor(&mut self, editor: &Self::Editor, position: Point, _: Color, clip: Rectangle) {
+        self.drawn = Some((editor.downgrade(), position, clip));
+    }
+    fn fill_text(&mut self, _: shaped::Text, _: Point, _: Color, _: Rectangle) {}
+}
+
+type Content = text_editor::Content<ObservedFontLayout>;
+const HOST: Size = Size::new(640., 350.);
+
+fn view(editor: &Content, source: Arc<str>) -> Element<'_, (), iced::Theme, ObservedFontLayout> {
+    text_editor(editor)
+        .on_action(|_| ())
+        .font(Font::MONOSPACE)
+        .size(14)
+        .padding(16)
+        .height(Length::Fill)
+        .highlight_with::<highlight::ArcadiaHighlighter>(source, highlight::format)
+        .into()
+}
+
+fn check_text(editor: &Content, expected: &str, cursor: text_editor::Cursor) {
+    assert_eq!(editor.text(), expected);
+    assert_eq!(editor.cursor(), cursor);
+    let lines: Vec<_> = expected.split('\n').collect();
+    assert_eq!(editor.line_count(), lines.len());
+    for (index, part) in lines.iter().enumerate() {
+        let (text, ending) = if index + 1 == lines.len() {
+            (*part, text_editor::LineEnding::None)
+        } else if let Some(text) = part.strip_suffix('\r') {
+            (text, text_editor::LineEnding::CrLf)
+        } else {
+            (*part, text_editor::LineEnding::Lf)
+        };
+        let actual = editor.line(index).unwrap();
+        assert_eq!(actual.text, text);
+        assert_eq!(actual.ending, ending);
+    }
+}
+
+fn check_draw(renderer: &ObservedFontLayout, cursor: text_editor::Cursor, alias: &str) {
+    let (weak, position, clip) = renderer.drawn.as_ref().expect("real editor draw");
+    let editor = weak.upgrade().expect("drawn editor is still live");
+    let buffer = editor.buffer();
+    assert_eq!(weak.bounds, Size::new(608., 318.));
+    assert_eq!(buffer.size(), (Some(608.), Some(318.)));
+    assert_eq!(buffer.metrics().font_size, 14.);
+    assert_eq!(
+        buffer.scroll().horizontal,
+        0.,
+        "fixture origin fits the viewport"
+    );
+    let start = cursor.position;
+    let end = cursor.selection.expect("approved alias selection");
+    assert_eq!(start.line, end.line);
+    assert_eq!(end.column - start.column, alias.len());
+    let line = &buffer.lines[start.line];
+    assert_eq!(&line.text()[start.column..end.column], alias);
+    let color = graphics::text::to_color(Color::from_rgb8(20, 93, 139));
+    let font = graphics::text::to_attributes(Font::MONOSPACE);
+    for byte in start.column..end.column {
+        let attrs = line.attrs_list().get_span(byte);
+        assert_eq!(
+            attrs.color_opt,
+            Some(color),
+            "accepted alias syntax attributes"
+        );
+        assert_eq!(attrs.family, font.family);
+    }
+    let mut covered = vec![false; alias.len()];
+    for run in buffer.layout_runs().filter(|run| run.line_i == start.line) {
+        for glyph in run.glyphs {
+            let from = glyph.start.max(start.column);
+            let to = glyph.end.min(end.column);
+            if from >= to {
+                continue;
+            }
+            assert_eq!(glyph.color_opt, Some(color), "drawn alias glyph color");
+            let x = position.x + glyph.x + glyph.x_offset * glyph.font_size;
+            let y = position.y + run.line_top;
+            assert!(x >= clip.x - 0.5 && x + glyph.w <= clip.x + clip.width + 0.5);
+            assert!(y + run.line_height > clip.y && y < clip.y + clip.height);
+            covered[from - start.column..to - start.column].fill(true);
+        }
+    }
+    assert!(
+        covered.into_iter().all(|seen| seen),
+        "entire alias has visible shaped glyphs"
+    );
+    // This temporary strong upgrade is dropped before the next editor mutation.
+}
+
+#[derive(Clone, Copy)]
+enum Arm {
+    Constructor,
+    Reuse,
+}
+impl Arm {
+    fn name(self) -> &'static str {
+        match self {
+            Self::Constructor => "with_text",
+            Self::Reuse => "same_line_reuse",
+        }
+    }
+    fn phases(self) -> [&'static str; 4] {
+        match self {
+            Self::Constructor => [
+                "constructor_replace_origin",
+                "constructor_next_layout",
+                "constructor_highlight_draw",
+                "constructor_combined",
+            ],
+            Self::Reuse => [
+                "reuse_replace_origin",
+                "reuse_next_layout",
+                "reuse_highlight_draw",
+                "reuse_combined",
+            ],
+        }
+    }
+}
+
+fn trial(
+    fixture: &Fixture,
+    cursor: text_editor::Cursor,
+    arm: Arm,
+    trial: usize,
+    samples: &mut Samples,
+) {
+    let before = &fixture.bundle.files[ORIGIN];
+    let after = &fixture.expected_bundle.files[ORIGIN];
+    let mut editor = Content::with_text(before);
+    editor.move_to(fixture.cursor);
+    let mut renderer = ObservedFontLayout::default();
+    let theme = iced::Theme::Light;
+    let defaults = renderer::Style::default();
+    let viewport = Rectangle::with_size(HOST);
+    let limits = layout::Limits::new(Size::ZERO, HOST);
+    let mut tree = {
+        let mut widget = view(&editor, Arc::from(before.as_str()));
+        let mut tree = Tree::new(widget.as_widget());
+        let node = widget.as_widget_mut().layout(&mut tree, &renderer, &limits);
+        tree.state
+            .downcast_mut::<text_editor::State<highlight::ArcadiaHighlighter>>()
+            .focus();
+        widget.as_widget().draw(
+            &tree,
+            &mut renderer,
+            &theme,
+            &defaults,
+            Layout::new(&node),
+            iced::mouse::Cursor::Unavailable,
+            &viewport,
+        );
+        tree
+    };
+    check_text(&editor, before, fixture.cursor);
+    check_draw(&renderer, fixture.cursor, OLD);
+    // No recorder Weak/Strong from setup may perturb replacement ownership.
+    renderer.drawn = None;
+    let next_source: Arc<str> = Arc::from(after.as_str());
+
+    // Only normal operations and four timestamps occur between start and end.
+    // Source/model oracles, logging and recorder glyph inspection are outside.
+    let started = Instant::now();
+    let replaced = match arm {
+        Arm::Constructor => {
+            editor = Content::with_text(after);
+            true
+        }
+        Arm::Reuse => super::super::editor_patch::replace(&mut editor, before, after),
+    };
+    editor.move_to(cursor);
+    let replaced_at = Instant::now();
+    let mut widget = view(&editor, next_source);
+    let node = widget.as_widget_mut().layout(&mut tree, &renderer, &limits);
+    let laid_out_at = Instant::now();
+    widget.as_widget().draw(
+        &tree,
+        &mut renderer,
+        &theme,
+        &defaults,
+        Layout::new(&node),
+        iced::mouse::Cursor::Unavailable,
+        &viewport,
+    );
+    let drawn_at = Instant::now();
+    drop(widget);
+
+    assert!(replaced, "reuse must not silently time a fallback/refusal");
+    check_text(&editor, after, cursor);
+    check_draw(&renderer, cursor, NEW);
+    renderer.drawn = None;
+    for (phase, duration) in arm.phases().into_iter().zip([
+        replaced_at.duration_since(started),
+        laid_out_at.duration_since(replaced_at),
+        drawn_at.duration_since(laid_out_at),
+        drawn_at.duration_since(started),
+    ]) {
+        println!(
+            "{}",
+            serde_json::json!({
+                "record": "editor_layout_timing", "arm": arm.name(), "phase": phase,
+                "trial": trial, "warmup": trial == 0,
+                "elapsed_ns": duration.as_nanos().to_string(),
+                "elapsed_ms": duration.as_secs_f64() * 1000.0,
+            })
+        );
+        if trial != 0 {
+            samples.0.entry(phase).or_default().push(duration);
+        }
+    }
+}
+
+#[test]
+#[ignore = "manual Windows dev/debug editor replacement + layout/highlight trial; run alone with --ignored --nocapture --test-threads=1"]
+fn accepted_release1_constructor_vs_reuse_through_next_highlight() {
+    let fixture = Fixture::load();
+    // Resolve the exact production approval and verify full Project/source once,
+    // outside all intervals. The actual App Confirm evaluator remains separate.
+    let cursor = {
+        let app = fixture.app();
+        let target = resolve(&app, &app.rename_context());
+        let prepared = app
+            .document
+            .alias_rename_request(target.id, NEW.into())
+            .unwrap()
+            .prepare()
+            .unwrap();
+        fixture.check_candidate(&prepared);
+        prepare_approval(prepared, &target, ORIGIN).unwrap().cursor
+    };
+    println!(
+        "{}",
+        serde_json::json!({
+            "record": "editor_layout_fixture", "host_width": HOST.width, "host_height": HOST.height,
+            "font": "MONOSPACE", "font_size": 14, "padding": 16, "height": "Fill",
+            "active_file": ORIGIN, "before_bytes": fixture.bundle.files[ORIGIN].len(),
+            "after_bytes": fixture.expected_bundle.files[ORIGIN].len(), "warmups_per_arm": 1,
+            "measured_trials_per_arm": 5, "debug_assertions": cfg!(debug_assertions),
+            "scope": "real editor replacement, retained Tree layout and Widget draw/highlight; no GPU, native paint or App Confirm",
+        })
+    );
+    let mut samples = Samples::default();
+    for index in 0..=5 {
+        let arms = if index % 2 == 0 {
+            [Arm::Constructor, Arm::Reuse]
+        } else {
+            [Arm::Reuse, Arm::Constructor]
+        };
+        println!(
+            "{}",
+            serde_json::json!({"record": "editor_layout_order", "trial": index, "first": arms[0].name()})
+        );
+        for arm in arms {
+            trial(&fixture, cursor, arm, index, &mut samples);
+        }
+    }
+    samples.report();
+}

crates/oa-desktop/src/app/source_rename_timing_tests.rs

@@ -0,0 +1,347 @@
+//! Manual timing through the real Document and App paths. No disk writes,
+//! executor polling, layout, GPU work or first-paint measurement occurs here.
+//! Register as a test child of app::source_rename to use its actual worker helpers.
+use super::*;
+use crate::source_workspace::Workspace;
+use oa_core::source_project::SourceBundle;
+use std::{
+    collections::BTreeMap,
+    path::PathBuf,
+    time::{Duration, Instant},
+};
+
+#[cfg(debug_assertions)]
+#[path = "source_rename_layout_timing_tests.rs"]
+mod layout_timing_tests;
+
+const OLD: &str = "oa_restore_work";
+const NEW: &str = "oa_restore_pressure";
+const DECLARATIONS: &str = "oa/activities/activity_oa_restore_work.arcadia";
+const ORIGIN: &str = "traceability.arcadia";
+
+struct Fixture {
+    bundle: SourceBundle,
+    project: Project,
+    expected_bundle: SourceBundle,
+    expected_project: Project,
+    target: Id,
+    cursor: text_editor::Cursor,
+}
+
+impl Fixture {
+    fn load() -> Self {
+        // The optional entry selects a parent-pinned copy of this exact fixture,
+        // not an arbitrary performance generator or a mutable GUI destination.
+        let entry = std::env::var_os("ARCADIA_RENAME_TIMING_ENTRY")
+            .map(PathBuf::from)
+            .unwrap_or_else(|| {
+                PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+                    .join("../../examples/release1/project.arcadia")
+            });
+        let loaded = oa_core::source_files::load_project(&entry, LIMITS).unwrap();
+        let bundle = loaded.reachable_bundle();
+        assert_eq!(
+            bundle.files.len(),
+            30,
+            "use the preserved release1 walkthrough"
+        );
+        let document = Document::from_bundle(bundle.clone(), LIMITS).unwrap();
+        assert_eq!(
+            document.bundle(),
+            &bundle,
+            "fixture must need no stabilization/migration"
+        );
+        assert!(!document.dirty());
+        let project = document.project().clone();
+        let target = Id::parse_str("1b91f8a7-0bdb-514e-b1cd-955658e09927").unwrap();
+        assert_eq!(project.elements[&target].alias, OLD);
+        assert!(!project.identities().iter().any(|(_, alias)| *alias == NEW));
+        let mut expected_project = project.clone();
+        expected_project.elements.get_mut(&target).unwrap().alias = NEW.into();
+
+        // Independent literal source oracle, authored before running the rename.
+        // Do not replace the alias substring in filenames or the trace's alias.
+        let mut expected_bundle = bundle.clone();
+        let declarations = expected_bundle.files.get_mut(DECLARATIONS).unwrap();
+        assert_eq!(
+            declarations.matches("oa_activity oa_restore_work ").count(),
+            1
+        );
+        assert_eq!(declarations.matches("parent @oa_restore_work;").count(), 4);
+        *declarations = declarations
+            .replace(
+                "oa_activity oa_restore_work ",
+                "oa_activity oa_restore_pressure ",
+            )
+            .replace("parent @oa_restore_work;", "parent @oa_restore_pressure;");
+        let traces = expected_bundle.files.get_mut(ORIGIN).unwrap();
+        assert_eq!(traces.matches("oa @oa_restore_work;").count(), 1);
+        *traces = traces.replace("oa @oa_restore_work;", "oa @oa_restore_pressure;");
+        let source = &bundle.files[ORIGIN];
+        let start = source.rfind("@oa_restore_work;").unwrap() + 1;
+        let position = |offset| {
+            let prefix = &source[..offset];
+            text_editor::Position {
+                line: prefix.bytes().filter(|byte| *byte == b'\n').count(),
+                column: prefix
+                    .rsplit_once('\n')
+                    .map_or(prefix.len(), |(_, tail)| tail.len()),
+            }
+        };
+        let cursor = text_editor::Cursor {
+            position: position(start),
+            selection: Some(position(start + OLD.len())),
+        };
+        assert!(nav::exact_cursor(source, cursor));
+        println!(
+            "{}",
+            serde_json::json!({
+                "record": "fixture", "entry": entry, "reachable_files": bundle.files.len(),
+                "source_bytes": bundle.files.values().map(String::len).sum::<usize>(),
+                "identities": project.identities().len(), "active_file": ORIGIN,
+                "active_file_bytes": source.len(), "old": OLD, "new": NEW,
+                "warmups": 1, "measured_trials": 5, "debug_assertions": cfg!(debug_assertions),
+                "scope": "real worker helpers, guarded Document commit, App sync and Confirm update; no task polling or rendering"
+            })
+        );
+        Self {
+            bundle,
+            project,
+            expected_bundle,
+            expected_project,
+            target,
+            cursor,
+        }
+    }
+
+    fn app(&self) -> App {
+        let mut app = App::with_project(Project::empty());
+        app.document = Document::from_bundle(self.bundle.clone(), LIMITS).unwrap();
+        app.source_workspace = Workspace::new(app.document.bundle(), true);
+        app.source_workspace.active = ORIGIN.into();
+        app.selected = app.project().id;
+        app.page = Page::Text;
+        app.sync();
+        app.source_editor.move_to(self.cursor);
+        assert_eq!(app.project(), &self.project);
+        assert_eq!(app.document.bundle(), &self.bundle);
+        assert_eq!(app.document.revision(), 0);
+        assert!(!app.document.dirty() && !app.document.can_undo() && !app.document.can_redo());
+        assert!(app.rename_admission().is_ok());
+        app
+    }
+
+    fn check_candidate(&self, prepared: &PreparedAliasRename) {
+        assert!(prepared.changed());
+        assert_eq!(prepared.before().bundle, self.bundle);
+        assert_eq!(prepared.before().decoded.project, self.project);
+        assert_eq!(prepared.after().bundle, self.expected_bundle);
+        assert_eq!(prepared.after().decoded.project, self.expected_project);
+    }
+
+    fn check_adopted(&self, app: &mut App, candidate_address: *const CompiledSourceProject) {
+        assert!(
+            std::ptr::eq(app.document.compiled(), candidate_address),
+            "adopt exact candidate allocation"
+        );
+        assert_eq!(app.project(), &self.expected_project);
+        assert_eq!(app.document.bundle(), &self.expected_bundle);
+        assert_eq!(app.source_workspace.bundle(), self.expected_bundle);
+        assert_eq!(app.source_editor.text(), self.expected_bundle.files[ORIGIN]);
+        assert_eq!(app.document.revision(), 1);
+        assert!(app.document.dirty() && app.document.can_undo() && !app.document.can_redo());
+        assert!(app.document.undo());
+        assert_eq!(app.project(), &self.project);
+        assert_eq!(app.document.bundle(), &self.bundle);
+        assert!(
+            !app.document.dirty(),
+            "live known saved baseline remains authoritative"
+        );
+        assert!(
+            !app.document.can_undo(),
+            "exactly one preceding model transaction"
+        );
+        assert!(app.document.redo());
+        assert_eq!(app.project(), &self.expected_project);
+        assert_eq!(app.document.bundle(), &self.expected_bundle);
+        assert!(std::ptr::eq(app.document.compiled(), candidate_address));
+    }
+}
+
+#[derive(Default)]
+struct Samples(BTreeMap<&'static str, Vec<Duration>>);
+
+impl Samples {
+    fn time<T>(&mut self, phase: &'static str, trial: usize, action: impl FnOnce() -> T) -> T {
+        let started = Instant::now();
+        let result = action();
+        let elapsed = started.elapsed();
+        // Printing, assertions and dropping the returned value are outside this
+        // interval. Full Confirm still includes production's own local drops.
+        println!(
+            "{}",
+            serde_json::json!({
+                "record": "timing", "phase": phase, "trial": trial,
+                "warmup": trial == 0, "elapsed_ns": elapsed.as_nanos().to_string(),
+                "elapsed_ms": elapsed.as_secs_f64() * 1000.0
+            })
+        );
+        if trial != 0 {
+            self.0.entry(phase).or_default().push(elapsed);
+        }
+        result
+    }
+
+    fn report(mut self) {
+        for (phase, values) in &mut self.0 {
+            assert_eq!(values.len(), 5);
+            values.sort();
+            println!(
+                "{}",
+                serde_json::json!({
+                    "record": "summary", "phase": phase, "samples": values.len(),
+                    "min_ms": values[0].as_secs_f64() * 1000.0,
+                    "median_ms": values[2].as_secs_f64() * 1000.0,
+                    "max_ms": values[4].as_secs_f64() * 1000.0
+                })
+            );
+        }
+    }
+}
+
+fn resolve(app: &App, context: &Context) -> Target {
+    let snapshot = app
+        .with_source_input(|input| query::admit_owned(input, query::Limits::default()))
+        .unwrap()
+        .capture()
+        .unwrap();
+    let offset = nav::cursor_offset(app.source_workspace.text(), context.begin.cursor).unwrap();
+    resolve_target(&snapshot, context, offset).unwrap()
+}
+
+fn active_job(app: &App) -> Job {
+    let form = app.source_rename.form.as_ref().unwrap();
+    let id = form.pending.unwrap();
+    assert_eq!(app.source_rename.in_flight, Some(id));
+    Job {
+        id,
+        invocation: form.invocation,
+        generation: form.generation,
+        context: form.context.clone(),
+    }
+}
+
+fn separate_phases(fixture: &Fixture, samples: &mut Samples, trial: usize) {
+    let mut app = fixture.app();
+    let target = resolve(&app, &app.rename_context());
+    assert_eq!(target.id, fixture.target);
+    let request = samples
+        .time("document_request_mint", trial, || {
+            app.document.alias_rename_request(target.id, NEW.into())
+        })
+        .unwrap();
+    let prepared = samples
+        .time("worker_document_prepare", trial, || request.prepare())
+        .unwrap();
+    fixture.check_candidate(&prepared);
+    let approval = samples
+        .time("worker_preview_and_origin", trial, || {
+            prepare_approval(prepared, &target, ORIGIN)
+        })
+        .unwrap();
+    assert_eq!(approval.preview.files().len(), 2);
+    assert_eq!(approval.preview.changed_line_count(), 6);
+    let candidate_address = approval.prepared.after() as *const CompiledSourceProject;
+    // Same-destination save completion is a legitimate live update after Preview.
+    app.document.mark_saved(app.document.snapshot());
+    let changed = samples
+        .time("document_guarded_commit", trial, || {
+            app.document.commit_alias_rename(&approval.prepared)
+        })
+        .unwrap();
+    assert!(changed);
+    samples.time("app_sync", trial, || app.sync());
+    fixture.check_adopted(&mut app, candidate_address);
+}
+
+fn whole_confirm(fixture: &Fixture, samples: &mut Samples, trial: usize) {
+    let mut app = fixture.app();
+    let begin = app.source_rename_message();
+    // These Tasks are deliberately not polled: deterministic worker helpers
+    // supply the same results through the real readiness messages below.
+    drop(app.update(begin));
+    let target_job = active_job(&app);
+    let target = Arc::new(resolve(&app, &target_job.context));
+    assert_eq!(target.id, fixture.target);
+    drop(app.update(Message::SourceRenameReady(Completion {
+        job: target_job,
+        payload: Payload::Target(Ok(target.clone())),
+    })));
+    let invocation = app.source_rename.form.as_ref().unwrap().invocation;
+    drop(app.update(Message::SourceRename(Event::Input(invocation, NEW.into()))));
+    let generation = app.source_rename.form.as_ref().unwrap().generation;
+    drop(app.update(Message::SourceRename(Event::Preview(
+        invocation, generation,
+    ))));
+    let preview_job = active_job(&app);
+    let prepared = app
+        .document
+        .alias_rename_request(target.id, NEW.into())
+        .unwrap()
+        .prepare()
+        .unwrap();
+    fixture.check_candidate(&prepared);
+    let approval = Arc::new(prepare_approval(prepared, &target, ORIGIN).unwrap());
+    drop(target);
+    let candidate_address = approval.prepared.after() as *const CompiledSourceProject;
+    let expected_cursor = approval.cursor;
+    let approval_id = approval.id;
+    drop(app.update(Message::SourceRenameReady(Completion {
+        job: preview_job,
+        payload: Payload::Preview(Ok(approval)),
+    })));
+    assert_eq!(
+        app.source_rename
+            .form
+            .as_ref()
+            .unwrap()
+            .approval
+            .as_ref()
+            .unwrap()
+            .id,
+        approval_id
+    );
+    app.document.mark_saved(app.document.snapshot());
+    let confirm = Message::SourceRename(Event::Confirm(invocation, generation, approval_id));
+    let task = samples.time("app_confirm_update", trial, || app.update(confirm));
+    samples.time("confirm_returned_task_drop_without_polling", trial, || {
+        drop(task)
+    });
+    assert!(!app.source_rename.open());
+    assert!(app.source_rename.in_flight.is_none());
+    assert!(app.source_rename_undo_message().is_some());
+    assert_eq!(app.source_editor.cursor(), expected_cursor);
+    fixture.check_adopted(&mut app, candidate_address);
+}
+
+#[test]
+#[ignore = "manual Windows dev/debug rename latency trial; run alone with --ignored --nocapture --test-threads=1"]
+fn accepted_release1_prepare_commit_sync_and_confirm_timing() {
+    let fixture = Fixture::load();
+    let mut samples = Samples::default();
+    for trial in 0..=5 {
+        println!(
+            "{}",
+            serde_json::json!({ "record": "order", "trial": trial,
+            "warmup": trial == 0, "separate_phases_first": trial % 2 == 0 })
+        );
+        if trial % 2 == 0 {
+            separate_phases(&fixture, &mut samples, trial);
+            whole_confirm(&fixture, &mut samples, trial);
+        } else {
+            whole_confirm(&fixture, &mut samples, trial);
+            separate_phases(&fixture, &mut samples, trial);
+        }
+    }
+    samples.report();
+}

crates/oa-desktop/src/app/source_symbols.rs

@@ -0,0 +1,464 @@
+//! Current draft navigation, isolated from model application and disk discovery.
+use super::*;
+use crate::source_navigation::{self as nav, query};
+use std::sync::atomic::Ordering;
+
+fn admission_notice(error: query::AdmissionError) -> String {
+    use nav::symbols::{BuildError, InputProblem, Resource};
+    let (limit, resource) = match error {
+        query::AdmissionError::Index(BuildError::Limit { limit, resource, .. }) => (limit, resource),
+        query::AdmissionError::Outline { error, .. } => (error.limit, match error.resource {
+            language::OutlineResource::SourceBytes => Resource::SourceBytes,
+            language::OutlineResource::Tokens => Resource::Tokens,
+            language::OutlineResource::Declarations => Resource::Records,
+        }),
+        query::AdmissionError::Index(BuildError::Input { problem, .. }) => return match problem {
+            InputProblem::NonCanonicalPath | InputProblem::DuplicateOrCaseCollidingPath =>
+                "Navigation needs distinct relative source paths. Check file names and include paths.".into(),
+            _ => "Navigation could not verify the current source locations. Correct source errors and try again.".into(),
+        },
+    };
+    let unit = match resource {
+        Resource::Files => "loaded files",
+        Resource::SourceBytes => "source bytes",
+        Resource::PathBytes => "bytes in file paths",
+        Resource::Tokens => "source tokens",
+        Resource::Records => "declarations and references",
+    };
+    format!(
+        "Navigation reached its limit of {limit} {unit}. Reduce the loaded source size and try again."
+    )
+}
+
+impl App {
+    pub fn source_symbol_context(&self) -> nav::SymbolContext {
+        nav::SymbolContext {
+            session: self.source_workspace.session(),
+            path: self.source_workspace.active.clone(),
+        }
+    }
+
+    pub fn source_symbol_message(&self, event: nav::SymbolEvent) -> Message {
+        Message::SourceSymbols(self.source_symbol_context(), event)
+    }
+
+    pub fn source_find_close_message(&self) -> Message {
+        Message::SourceFindClose(self.source_symbol_context(), self.source_find_instance)
+    }
+    pub fn source_key(&self) -> query::SnapshotKey {
+        query::SnapshotKey {
+            workspace: self.source_workspace.session(),
+            revision: self.source_workspace.revision(),
+        }
+    }
+
+    pub(super) fn with_source_input<T>(&self, use_input: impl FnOnce(query::Input<'_>) -> T) -> T {
+        let files: Vec<_> = self
+            .source_workspace
+            .files
+            .iter()
+            .map(|(path, buffer)| query::DraftFile {
+                path,
+                text: &buffer.text,
+            })
+            .collect();
+        let accepted = self.document.bundle();
+        let validated: Vec<_> = accepted
+            .files
+            .iter()
+            .map(|(path, text)| query::DraftFile { path, text })
+            .collect();
+        use_input(query::Input {
+            key: self.source_key(),
+            entry: &self.source_workspace.entry,
+            files: &files,
+            applied: self.source_workspace.applied,
+            validation: self
+                .source_workspace
+                .applied
+                .then_some(query::ValidatedSources {
+                    entry: &accepted.entry,
+                    files: &validated,
+                }),
+        })
+    }
+
+    pub(super) fn source_snapshot_matches(&self, snapshot: &query::Snapshot) -> bool {
+        snapshot.key() == self.source_key()
+            && self.with_source_input(|input| snapshot.matches(input))
+    }
+
+    pub fn source_navigation_available(&self) -> bool {
+        self.page == Page::Text
+            && !self.source_rename.open()
+            && !self.busy
+            && self.pending.is_none()
+            && self.file_prompt.is_none()
+            && !self.delete_pending
+            && self.workflow.is_none()
+            && !self.hosted.visible
+            && self.model_menu.is_none()
+            && self.architecture.is_none()
+            && !self.behavior.has_pending()
+    }
+
+    /// Mounted widget IDs change when another interaction supersedes a reveal.
+    /// A queued focus operation therefore cannot find a subsequently reused editor.
+    pub fn source_editor_id(&self) -> iced::widget::Id {
+        iced::widget::Id::from(format!(
+            "source-editor-{}-{}-{}",
+            self.source_workspace.session(),
+            self.source_workspace.active,
+            self.source_symbols.interaction
+        ))
+    }
+
+    pub fn source_reveal_ticket(&self) -> Option<Id> {
+        self.source_symbols
+            .reveal
+            .as_ref()
+            .map(|reveal| reveal.ticket)
+    }
+
+    pub(super) fn source_interaction(&mut self) {
+        self.source_symbols.interaction = Id::new_v4();
+        self.source_symbols.request = None;
+        self.source_symbols.reveal = None;
+        self.source_jump = None;
+    }
+
+    pub(super) fn queue_source_reveal(&mut self, cursor: text_editor::Cursor, select_line: bool) {
+        self.source_jump = Some(cursor);
+        self.source_select_line = select_line;
+        self.source_symbols.reveal = Some(nav::Reveal {
+            ticket: Id::new_v4(),
+            interaction: self.source_symbols.interaction,
+            raw_interaction: self.source_symbols.raw_interaction.load(Ordering::SeqCst),
+            snapshot: self.source_key(),
+            path: self.source_workspace.active.clone(),
+        });
+    }
+
+    pub(super) fn restore_source_editor_focus(&mut self) {
+        let cursor = self.source_editor.cursor();
+        if self.source_navigation_available()
+            && nav::exact_cursor(self.source_workspace.text(), cursor)
+        {
+            self.queue_source_reveal(cursor, false);
+        }
+    }
+
+    pub(super) fn source_viewport(&mut self, ticket: Option<Id>) -> Task<Message> {
+        let Some(reveal) = &self.source_symbols.reveal else {
+            return Task::none();
+        };
+        if Some(reveal.ticket) != ticket
+            || reveal.interaction != self.source_symbols.interaction
+            || !nav::interaction::is_current(
+                &self.source_symbols.raw_interaction,
+                reveal.raw_interaction,
+            )
+            || reveal.snapshot != self.source_key()
+            || reveal.path != self.source_workspace.active
+            || !self.source_navigation_available()
+        {
+            return Task::none();
+        }
+        let raw_interaction = reveal.raw_interaction;
+        self.source_symbols.reveal = None;
+        if let Some(cursor) = self.source_jump.take() {
+            if !nav::exact_cursor(self.source_workspace.text(), cursor) {
+                return Task::none();
+            }
+            self.source_editor.move_to(cursor);
+            if self.source_select_line && cursor.selection.is_none() {
+                self.source_editor.perform(text_editor::Action::SelectLine);
+            }
+            return nav::interaction::guarded_focus(
+                self.source_editor_id(),
+                self.source_symbols.raw_interaction.clone(),
+                raw_interaction,
+            );
+        }
+        Task::none()
+    }
+
+    pub(super) fn source_symbol_event(&mut self, event: nav::SymbolEvent) -> Task<Message> {
+        if !self.source_navigation_available() {
+            return Task::none();
+        }
+        match event {
+            nav::SymbolEvent::Close => {
+                self.source_symbols.open = false;
+                self.source_symbols.results = None;
+                self.source_symbols.notice = None;
+            }
+            nav::SymbolEvent::Back => {
+                self.source_symbol_back();
+                // A successful Back needs no empty results panel. Retain an
+                // already open panel, or reveal an actionable return notice.
+                self.source_symbols.open |= self.source_symbols.notice.is_some();
+            }
+            nav::SymbolEvent::Choose {
+                stamp,
+                reference,
+                index,
+            } => {
+                let Some(results) = self.source_symbols.results.clone() else {
+                    return Task::none();
+                };
+                if results.stamp != stamp
+                    || stamp.snapshot != self.source_key()
+                    || self
+                        .source_symbols
+                        .cache
+                        .as_ref()
+                        .is_none_or(|cache| !self.source_snapshot_matches(cache))
+                {
+                    self.source_symbols.notice =
+                        Some("Source changed. Run navigation again for current locations.".into());
+                    return Task::none();
+                }
+                let destination = if reference {
+                    results
+                        .references
+                        .get(index)
+                        .map(|row| (&row.path, row.position, row.end_position))
+                } else {
+                    results
+                        .definitions
+                        .get(index)
+                        .map(|row| (&row.path, row.position, row.end_position))
+                };
+                if let Some((path, start, end)) = destination {
+                    self.source_symbol_jump(path, start, end);
+                }
+            }
+            nav::SymbolEvent::Query(action) => return self.start_source_query(action),
+        }
+        Task::none()
+    }
+
+    fn start_source_query(&mut self, action: query::Action) -> Task<Message> {
+        self.source_symbols.open = true;
+        if !nav::interaction::is_current(
+            &self.source_symbols.raw_interaction,
+            self.source_symbols.raw_interaction.load(Ordering::SeqCst),
+        ) {
+            self.source_symbols.notice = Some("Reopen this workspace to reset navigation.".into());
+            return Task::none();
+        }
+        if self.source_symbols.in_flight.is_some() {
+            self.source_symbols.notice = Some("Navigation is finishing. Try again shortly.".into());
+            return Task::none();
+        }
+        let cursor = self.source_editor.cursor();
+        let Some(offset) = nav::cursor_offset(self.source_workspace.text(), cursor) else {
+            self.source_symbols.notice =
+                Some("Place the cursor on an alias or its @ reference.".into());
+            return Task::none();
+        };
+        self.source_symbols.serial = match self.source_symbols.serial.checked_add(1) {
+            Some(serial) => serial,
+            None => {
+                self.source_workspace.reset_navigation_session();
+                self.source_symbols.back.clear();
+                self.source_symbols.cache = None;
+                0
+            }
+        };
+        let request = nav::Request {
+            job: Id::new_v4(),
+            interaction: self.source_symbols.interaction,
+            raw_interaction: self.source_symbols.raw_interaction.load(Ordering::SeqCst),
+            stamp: query::QueryStamp {
+                snapshot: self.source_key(),
+                serial: self.source_symbols.serial,
+            },
+            path: self.source_workspace.active.clone(),
+            offset,
+            cursor,
+            action,
+        };
+        let cache = self
+            .source_symbols
+            .cache
+            .as_ref()
+            .filter(|cache| self.source_snapshot_matches(cache))
+            .cloned();
+        let input = if cache.is_none() {
+            match self
+                .with_source_input(|input| query::admit_owned(input, query::Limits::default()))
+            {
+                Ok(input) => Some(input),
+                Err(error) => {
+                    self.source_symbols.notice = Some(admission_notice(error));
+                    return Task::none();
+                }
+            }
+        } else {
+            None
+        };
+        self.source_symbols.in_flight = Some(request.job);
+        self.source_symbols.request = Some(request.clone());
+        self.source_symbols.results = None;
+        self.source_symbols.notice = None;
+        Task::perform(
+            async move {
+                let worker_request = request.clone();
+                let result = tokio::task::spawn_blocking(move || {
+                    let snapshot = match cache {
+                        Some(cache) => cache,
+                        None => Arc::new(
+                            input
+                                .expect("admitted input for uncached request")
+                                .capture()
+                                .map_err(admission_notice)?,
+                        ),
+                    };
+                    let results = snapshot
+                        .query(query::Query {
+                            stamp: worker_request.stamp,
+                            path: &worker_request.path,
+                            byte_offset: worker_request.offset,
+                            action: worker_request.action,
+                        })
+                        .map_err(|error| match error {
+                            query::QueryError::ResultEnvelopeLimit => "These result details exceed the display limit. Try literal Find for this alias.".to_owned(),
+                            _ => "Navigation could not verify this location. Place the cursor on an alias and try again.".to_owned(),
+                        })?;
+                    Ok((snapshot, Arc::new(results)))
+                })
+                .await
+                .unwrap_or_else(|error| Err(format!("Navigation task failed: {error}")));
+                nav::Completion { request, result }
+            },
+            Message::SourceSymbolsReady,
+        )
+    }
+
+    pub(super) fn source_symbols_ready(&mut self, completion: nav::Completion) -> Task<Message> {
+        let request = completion.request;
+        if self.source_symbols.in_flight != Some(request.job) {
+            return Task::none();
+        }
+        self.source_symbols.in_flight = None;
+        let wanted = self
+            .source_symbols
+            .request
+            .take()
+            .is_some_and(|current| current.job == request.job)
+            && request.interaction == self.source_symbols.interaction
+            && request.stamp.snapshot == self.source_key()
+            && nav::interaction::is_current(
+                &self.source_symbols.raw_interaction,
+                request.raw_interaction,
+            )
+            && request.path == self.source_workspace.active
+            && request.cursor == self.source_editor.cursor()
+            && self.source_navigation_available();
+        if !wanted {
+            return Task::none();
+        }
+        match completion.result {
+            Ok((snapshot, results)) if self.source_snapshot_matches(&snapshot) => {
+                self.source_symbols.cache = Some(snapshot);
+                self.source_symbols.results = Some(results.clone());
+                if results.disposition == query::Disposition::Direct
+                    && let Some(row) = results.definitions.first()
+                {
+                    self.source_symbol_jump(&row.path, row.position, row.end_position);
+                }
+            }
+            Ok(_) => {
+                self.source_symbols.notice = Some("Source changed. Run navigation again.".into())
+            }
+            Err(error) => self.source_symbols.notice = Some(error),
+        }
+        Task::none()
+    }
+
+    fn source_symbol_jump(&mut self, path: &str, start: query::Position, end: query::Position) {
+        let cursor = text_editor::Cursor {
+            position: text_editor::Position {
+                line: start.line,
+                column: start.byte_column,
+            },
+            selection: Some(text_editor::Position {
+                line: end.line,
+                column: end.byte_column,
+            }),
+        };
+        if self
+            .source_workspace
+            .files
+            .get(path)
+            .is_none_or(|buffer| !nav::exact_cursor(&buffer.text, cursor))
+        {
+            self.source_symbols.notice =
+                Some("That source location is no longer available. Run navigation again.".into());
+            return;
+        }
+        if let Some(buffer) = self
+            .source_workspace
+            .files
+            .get(&self.source_workspace.active)
+        {
+            let origin = nav::HistoryEntry {
+                session: self.source_workspace.session(),
+                path: self.source_workspace.active.clone(),
+                generation: buffer.generation(),
+                cursor: self.source_editor.cursor(),
+            };
+            self.source_symbols
+                .back
+                .retain(|entry| entry.session == origin.session);
+            if self.source_symbols.back.len() == 64 {
+                self.source_symbols.back.remove(0);
+            }
+            self.source_symbols.back.push(origin);
+        }
+        self.source_workspace
+            .switch(path, self.source_editor.cursor());
+        self.show_source_file(false);
+        self.queue_source_reveal(cursor, false);
+    }
+
+    fn source_symbol_back(&mut self) {
+        while let Some(origin) = self.source_symbols.back.pop() {
+            if origin.session != self.source_workspace.session() {
+                continue;
+            }
+            let Some(buffer) = self.source_workspace.files.get(&origin.path) else {
+                self.source_symbols.notice = Some("The previous file is no longer loaded.".into());
+                return;
+            };
+            let unchanged = origin.generation == buffer.generation();
+            let cursor = if unchanged {
+                origin.cursor
+            } else if origin.path == self.source_workspace.active {
+                self.source_editor.cursor()
+            } else {
+                buffer.cursor
+            };
+            if !nav::exact_cursor(&buffer.text, cursor) {
+                self.source_symbols.notice = Some(
+                    "The previous location changed. Open the file to choose a current position."
+                        .into(),
+                );
+                return;
+            }
+            self.source_workspace
+                .switch(&origin.path, self.source_editor.cursor());
+            self.show_source_file(false);
+            self.queue_source_reveal(cursor, false);
+            self.source_symbols.notice =
+                (!unchanged).then(|| "This draft changed; its current cursor was restored.".into());
+            return;
+        }
+        self.source_symbols.notice = Some("No previous source location in this workspace.".into());
+    }
+}
+
+#[cfg(test)]
+mod tests;

crates/oa-desktop/src/behavior.rs

@@ -14,7 +14,11 @@ use iced::{
 };
 use oa_core::*;
 use std::collections::BTreeMap;
+#[cfg(test)]
+mod contextual_source_tests;
+pub(crate) mod creation;
 pub(crate) mod scenario;
+pub(crate) mod source_draft;
 pub(crate) mod state_canvas;
 pub(crate) mod state_edit;
 pub(crate) mod state_menu;
@@ -29,12 +33,12 @@ mod scenario_scroll {
     use iced::advanced::{Clipboard, Layout, Shell, Widget, layout, renderer, widget};
     use iced::{Length, Vector, overlay};
 
-    pub(super) fn observe<'a>(
+    pub(super) fn observe<'a, R: renderer::Renderer + 'a>(
         context: scenario::Context,
         area: scenario::ScrollArea,
         restore: Option<scenario::ScrollRestore>,
-        content: impl Into<Element<'a, Message>>,
-    ) -> Element<'a, Message> {
+        content: impl Into<Element<'a, Message, Theme, R>>,
+    ) -> Element<'a, Message, Theme, R> {
         Element::new(Observer {
             content: content.into(),
             context,
@@ -731,16 +735,41 @@ mod scenario_scroll {
 }
 #[derive(Debug, Clone)]
 pub enum Event {
+    Creation(creation::Event),
     Topology(topology::Event),
     Scenario(scenario::Event),
     States(states::Event),
     Submit,
 }
 impl Event {
+    pub fn is_source_back(&self) -> bool {
+        matches!(
+            self,
+            Self::Creation(creation::Event::Source(source_draft::Event::Edit(
+                _,
+                source_draft::Edit::Back
+            ))) | Self::Scenario(scenario::Event::Source(source_draft::Event::Edit(
+                _,
+                source_draft::Edit::Back
+            ))) | Self::Topology(topology::Event::Source(source_draft::Event::Edit(
+                _,
+                source_draft::Edit::Back
+            )))
+        )
+    }
+    pub fn is_source(&self) -> bool {
+        matches!(
+            self,
+            Self::Creation(creation::Event::Source(_))
+                | Self::Scenario(scenario::Event::Source(_))
+                | Self::Topology(topology::Event::Source(_))
+        )
+    }
     pub fn starts_form(&self) -> bool {
         matches!(
             self,
-            Self::Topology(topology::Event::Start(..))
+            Self::Creation(creation::Event::Open(..))
+                | Self::Topology(topology::Event::Start(..))
                 | Self::Scenario(scenario::Event::Start(..))
                 | Self::States(states::Event::Start(..) | states::Event::Edit(..))
         )
@@ -749,6 +778,7 @@ impl Event {
         matches!(
             self,
             Self::Submit
+                | Self::Creation(creation::Event::Submit)
                 | Self::Topology(topology::Event::Submit)
                 | Self::Scenario(scenario::Event::Submit)
                 | Self::States(states::Event::Submit)
@@ -757,6 +787,7 @@ impl Event {
 }
 #[derive(Default)]
 pub struct State {
+    pub(crate) creation: creation::State,
     pub active_owner: Option<Id>,
     pub diagram: state_view::State,
     pub(crate) topology: topology::State,
@@ -773,6 +804,7 @@ struct RecoveryDraft {
 }
 #[derive(serde::Serialize, serde::Deserialize)]
 enum RecoveryKind {
+    Creation,
     State,
     Scenario,
     Process,
@@ -782,6 +814,7 @@ impl State {
     /// viewport geometry and document/revision tokens never cross a restart.
     pub fn recovery_snapshot(&self) -> Result<Option<serde_json::Value>, String> {
         let drafts = [
+            (RecoveryKind::Creation, self.creation.recovery_snapshot()?),
             (RecoveryKind::State, self.states.recovery_snapshot()?),
             (RecoveryKind::Scenario, self.scenario.recovery_snapshot()?),
             (RecoveryKind::Process, self.topology.recovery_snapshot()?),
@@ -817,6 +850,9 @@ impl State {
         }
         let mut restored = Self::default();
         match saved.kind {
+            RecoveryKind::Creation => {
+                restored.creation = creation::State::from_recovery(saved.draft)?
+            }
             RecoveryKind::State => restored.states = states::State::from_recovery(saved.draft)?,
             RecoveryKind::Scenario => {
                 restored.scenario = scenario::State::from_recovery(saved.draft)?
@@ -831,7 +867,7 @@ impl State {
     }
 
     pub fn has_pending(&self) -> bool {
-        self.pending_owner().is_some()
+        self.creation.has_pending() || self.pending_owner().is_some()
     }
 
     pub fn pending_owner(&self) -> Option<Id> {
@@ -844,7 +880,9 @@ impl State {
     /// Prepare the active form without discarding inputs. The caller must execute
     /// this exact command and acknowledge only a successful document transaction.
     pub fn prepare_pending(&self, p: &Project) -> Result<Option<Command>, String> {
-        if self.topology.pending_owner().is_some() {
+        if self.creation.has_pending() {
+            self.creation.prepare_pending(p).map(Some)
+        } else if self.topology.pending_owner().is_some() {
             self.topology.prepare_pending(p).map(Some)
         } else if self.scenario.pending_owner().is_some() {
             self.scenario.prepare_pending(p).map(Some)
@@ -857,7 +895,20 @@ impl State {
 
     /// Clear the active form after its prepared command commits successfully.
     /// Rejected commands must leave the form available for repair and retry.
+    pub fn source_active(&self) -> bool {
+        self.creation.source_active()
+            || self.scenario.source_active()
+            || self.topology.source_active()
+    }
+    pub fn source_open(&self) -> bool {
+        self.creation.source_open() || self.scenario.source_open() || self.topology.source_open()
+    }
+    pub fn source_back(&mut self) -> bool {
+        self.creation.source_back() || self.scenario.source_back() || self.topology.source_back()
+    }
+
     pub fn acknowledge_commit(&mut self) {
+        self.creation.acknowledge_commit();
         self.topology.acknowledge_commit();
         self.scenario.acknowledge_commit();
         self.states.acknowledge_commit();
@@ -867,7 +918,8 @@ impl State {
         if self.has_pending()
             && matches!(
                 &event,
-                Event::Topology(topology::Event::Start(..))
+                Event::Creation(creation::Event::Open(..))
+                    | Event::Topology(topology::Event::Start(..))
                     | Event::Scenario(scenario::Event::Start(..))
                     | Event::States(states::Event::Start(..) | states::Event::Edit(..))
             )
@@ -885,6 +937,7 @@ impl State {
             return Ok(None);
         }
         match event {
+            Event::Creation(event) => self.creation.update(p, event),
             Event::Topology(event) => self.topology.update(p, event),
             Event::Scenario(event) => self.scenario.update(p, event),
             Event::States(event) => self.states.update(p, event),
@@ -898,6 +951,43 @@ impl State {
 
 pub fn view(app: &App) -> Element<'_, Message> {
     let p = app.project();
+    if let Some(card) = app.behavior.creation.view(p) {
+        return card.map(|event| Message::Behavior(Event::Creation(event)));
+    }
+    if let Some(owner) = app.behavior.pending_owner() {
+        let kind = p.elements.get(&owner).map(oa_core::Element::kind);
+        let unavailable = p.layer_of(owner) != Some(app.layer)
+            || (app.behavior.scenario.pending_owner().is_some() && kind != Some(Kind::Scenario))
+            || (app.behavior.topology.pending_owner().is_some()
+                && !matches!(kind, Some(Kind::Process | Kind::FunctionalChain)));
+        if unavailable {
+            let mut out=column![text("The pending behavior owner is unavailable").size(20),text("Your inputs are retained. Return from the source form or cancel this parent draft before choosing another behavior.").size(13)].spacing(12);
+            if let Some(name) = app
+                .behavior
+                .scenario
+                .pending_name()
+                .or_else(|| app.behavior.topology.pending_name())
+            {
+                out =
+                    out.push(text(format!("Pending consumer name: {}", short(name, 80))).size(14));
+            }
+            if let Some(child) = app.behavior.scenario.source_view(p) {
+                out = out.push(child.map(|e| Message::Behavior(Event::Scenario(e))));
+            } else if let Some(child) = app.behavior.topology.source_view(p) {
+                out = out.push(child.map(|e| Message::Behavior(Event::Topology(e))));
+            } else {
+                let cancel = if app.behavior.scenario.pending_owner().is_some() {
+                    Event::Scenario(scenario::Event::Cancel)
+                } else if app.behavior.topology.pending_owner().is_some() {
+                    Event::Topology(topology::Event::Cancel)
+                } else {
+                    Event::States(states::Event::Cancel)
+                };
+                out = out.push(button("Cancel retained draft").on_press(Message::Behavior(cancel)));
+            }
+            return container(out).padding(16).width(Fill).height(Fill).into();
+        }
+    }
     let choices = p
         .elements
         .values()
@@ -916,23 +1006,40 @@ pub fn view(app: &App) -> Element<'_, Message> {
         .cloned();
     let mut out = column![heading("Behavior & scenarios", "Follow exchanges and operating conditions. Select a message, state or transition to edit it.")].spacing(14);
     let Some(selected) = selected else {
-        return out.push(label("Start with a Process, Scenario or State machine using Create element. Add occurrences or regions inside it to describe behavior.")).padding(24).into();
+        return out
+            .push(label(
+                "Start a named process, scenario or state machine, then model its behavior here.",
+            ))
+            .push(action(
+                "New",
+                Message::Behavior(Event::Creation(creation::Event::Open(app.layer))),
+            ))
+            .padding(24)
+            .into();
     };
     let e = &p.elements[&selected.id];
-    let compact_process = matches!(e.kind(), Kind::Process | Kind::FunctionalChain);
+    let compact_canvas = matches!(
+        e.kind(),
+        Kind::Process | Kind::FunctionalChain | Kind::Scenario
+    );
     if e.kind() == Kind::StateMachine {
         out = column![text("States & modes").size(20)].spacing(8);
-    } else if compact_process {
-        // The process canvas owns its compact header and remaining-height layout.
+    } else if compact_canvas {
+        // The process/scenario canvas owns its compact remaining-height layout.
         out = column![].spacing(6);
-    } else if matches!(e.kind(), Kind::Process | Kind::FunctionalChain) {
-        out = column![text("Processes & functional chains").size(20)].spacing(8);
     }
     out = out.push(
-        pick_list(choices, Some(selected), Message::BehaviorOwner)
-            .width(Fill)
-            .text_size(13)
-            .padding(if compact_process { 6 } else { 10 }),
+        row![
+            pick_list(choices, Some(selected), Message::BehaviorOwner)
+                .width(Fill)
+                .text_size(13)
+                .padding(if compact_canvas { 6 } else { 10 }),
+            action(
+                "New",
+                Message::Behavior(Event::Creation(creation::Event::Open(app.layer)))
+            )
+        ]
+        .spacing(8),
     );
     if matches!(e.kind(), Kind::Process | Kind::FunctionalChain) {
         return topology::view(app, e.id, out);

crates/oa-desktop/src/behavior/creation.rs

@@ -0,0 +1,766 @@
+//! Local behavior creation. A draft is not a model object: only its validated
+//! batch may cross Document::execute, and acknowledgement follows success.
+use iced::{
+    Element as UiElement, Fill,
+    widget::{button, checkbox, column, container, row, scrollable, text, text_input},
+};
+use oa_core::*;
+use serde::{Deserialize, Serialize};
+
+const PAGE_SIZE: usize = 6;
+pub const NAME_INPUT: &str = "behavior-creation-name";
+
+// A focused text input consumes Escape. Preserve the application's modal
+// priority by emitting its ordinary Escape message from this narrow bridge.
+pub fn subscription(active: bool) -> iced::Subscription<()> {
+    if active {
+        iced::event::listen_with(captured_escape)
+    } else {
+        iced::Subscription::none()
+    }
+}
+
+fn captured_escape(
+    event: iced::Event,
+    status: iced::event::Status,
+    _: iced::window::Id,
+) -> Option<()> {
+    (status == iced::event::Status::Captured
+        && matches!(
+            event,
+            iced::Event::Keyboard(iced::keyboard::Event::KeyPressed {
+                key: iced::keyboard::Key::Named(iced::keyboard::key::Named::Escape),
+                ..
+            })
+        ))
+    .then_some(())
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub enum Family {
+    Sequence,
+    Scenario,
+    Machine,
+}
+impl Family {
+    fn kind(self, layer: Layer) -> Kind {
+        match (self, layer) {
+            (Self::Sequence, Layer::Oa) => Kind::Process,
+            (Self::Sequence, Layer::Sa) => Kind::FunctionalChain,
+            (Self::Scenario, _) => Kind::Scenario,
+            (Self::Machine, _) => Kind::StateMachine,
+        }
+    }
+    fn title(self, layer: Layer) -> &'static str {
+        match (self, layer) {
+            (Self::Sequence, Layer::Oa) => "Operational process",
+            (Self::Sequence, Layer::Sa) => "Functional chain",
+            (Self::Scenario, _) => "Scenario",
+            (Self::Machine, _) => "State machine",
+        }
+    }
+}
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Picker {
+    Owner,
+    Context,
+}
+impl Picker {
+    fn index(self) -> usize {
+        match self {
+            Self::Owner => 0,
+            Self::Context => 1,
+        }
+    }
+}
+#[derive(Debug, Clone)]
+pub enum Event {
+    Source(super::source_draft::Event),
+    Open(Layer),
+    Choose(Family),
+    Name(String),
+    Owner(Id),
+    Viewpoint(ScenarioViewpoint),
+    Context(Option<Id>),
+    ContextOptions(bool),
+    FirstView(bool),
+    Search(Picker, String),
+    Page(Picker, usize),
+    Cancel,
+    Submit,
+}
+#[derive(Clone, Default, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Browser {
+    query: String,
+    page: usize,
+}
+#[derive(Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Draft {
+    #[serde(default)]
+    source: super::source_draft::State,
+    #[serde(default = "Id::new_v4")]
+    invocation: Id,
+
+    version: u32,
+    document: Id,
+    layer: Layer,
+    family: Option<Family>,
+    name: String,
+    owner: Option<Id>,
+    viewpoint: Option<ScenarioViewpoint>,
+    context: Option<Id>,
+    #[serde(default)]
+    context_open: bool,
+    first_view: bool,
+    element: Id,
+    diagram: Id,
+    placement: Id,
+    browsers: [Browser; 2],
+}
+#[derive(Default)]
+pub struct State {
+    draft: Option<Draft>,
+}
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Created {
+    pub behavior: Id,
+    pub layer: Layer,
+    pub diagram: Option<Id>,
+}
+
+impl State {
+    pub fn source_active(&self) -> bool {
+        self.draft.as_ref().is_some_and(|d| d.source.engaged())
+    }
+
+    pub fn source_open(&self) -> bool {
+        self.draft.as_ref().is_some_and(|d| d.source.is_open())
+    }
+    pub fn source_back(&mut self) -> bool {
+        self.draft.as_mut().is_some_and(|d| d.source.back())
+    }
+
+    pub fn has_pending(&self) -> bool {
+        self.draft.is_some()
+    }
+    pub fn pending_layer(&self) -> Option<Layer> {
+        self.draft.as_ref().map(|d| d.layer)
+    }
+    /// Capture this before successful acknowledgement; never select these IDs
+    /// on mere planning or a rejected source/model transaction.
+    pub fn created(&self) -> Option<Created> {
+        let d = self.draft.as_ref()?;
+        d.family.map(|family| Created {
+            behavior: d.element,
+            layer: d.layer,
+            diagram: (family == Family::Machine && d.first_view).then_some(d.diagram),
+        })
+    }
+    /// Match before execution, then apply this target only after success.
+    /// Identity alone is insufficient: changed bodies or trailing operations
+    /// must not inherit the prepared creation's selection/opening contract.
+    pub fn created_by(&self, p: &Project, command: &Command) -> Option<Created> {
+        let target = self.created()?;
+        (self.prepare_pending(p).ok().as_ref() == Some(command)).then_some(target)
+    }
+    pub fn recovery_snapshot(&self) -> Result<Option<serde_json::Value>, String> {
+        self.draft
+            .as_ref()
+            .map(serde_json::to_value)
+            .transpose()
+            .map_err(|e| e.to_string())
+    }
+    pub fn from_recovery(value: serde_json::Value) -> Result<Self, String> {
+        let draft: Draft = serde_json::from_value(value).map_err(|e| e.to_string())?;
+        if draft.version != 1 {
+            return Err("Unsupported behavior creation draft version.".into());
+        }
+        // Raw values and stale references remain editable; planning validates
+        // against the current document rather than silently fixing the draft.
+        Ok(Self { draft: Some(draft) })
+    }
+    pub fn acknowledge_commit(&mut self) {
+        self.draft = None;
+    }
+    pub fn prepare_pending(&self, p: &Project) -> Result<Command, String> {
+        self.draft
+            .as_ref()
+            .ok_or("Choose New to start a behavior.")?
+            .command(p)
+    }
+    pub fn update(&mut self, p: &Project, event: Event) -> Result<Option<Command>, String> {
+        if let Event::Source(event) = event {
+            if self
+                .draft
+                .as_mut()
+                .ok_or("Start the consumer form first.")?
+                .source
+                .dismiss(&event)?
+            {
+                return Ok(None);
+            }
+            let d = self
+                .draft
+                .as_ref()
+                .ok_or("Start the consumer form first.")?;
+            if d.family != Some(Family::Machine) {
+                return Err("This reference does not support staged source creation.".into());
+            }
+            if d.document != p.id {
+                return Err("This behavior draft belongs to another document.".into());
+            }
+            let mut next = d.clone();
+            if let Some(id) = next.source.update(
+                p,
+                super::source_draft::Scope::Machine { layer: d.layer },
+                d.invocation,
+                event,
+            )? {
+                next.owner = Some(id);
+                let preview = next
+                    .source
+                    .preview(p, next.owner)?
+                    .ok_or("New owner preview is missing.")?;
+                if !eligible(&preview, next.layer, Picker::Owner, id) {
+                    return Err("This participant cannot own the machine.".into());
+                }
+            }
+            self.draft = Some(next);
+            return Ok(None);
+        }
+        if self.source_open() && !matches!(&event, Event::Cancel) {
+            return Err("Use the new source or go Back before editing the parent form.".into());
+        }
+
+        match event {
+            Event::Cancel => {
+                self.draft = None;
+                return Ok(None);
+            }
+            Event::Open(layer) => {
+                if self.has_pending() {
+                    return Err("Create or cancel the pending behavior first.".into());
+                }
+                self.draft = Some(Draft {
+                    source: Default::default(),
+                    invocation: Id::new_v4(),
+                    version: 1,
+                    document: p.id,
+                    layer,
+                    family: None,
+                    name: String::new(),
+                    owner: None,
+                    viewpoint: None,
+                    context: None,
+                    context_open: false,
+                    first_view: false,
+                    element: Id::new_v4(),
+                    diagram: Id::new_v4(),
+                    placement: Id::new_v4(),
+                    browsers: Default::default(),
+                });
+                return Ok(None);
+            }
+            Event::Submit => return self.prepare_pending(p).map(Some),
+            _ => {}
+        }
+        let d = self
+            .draft
+            .as_mut()
+            .ok_or("Choose New to start a behavior.")?;
+        if d.document != p.id {
+            return Err("This draft belongs to another document. Cancel it to start here.".into());
+        }
+        match event {
+            Event::Choose(family) => {
+                if d.family.is_some_and(|old| old != family) {
+                    return Err(
+                        "Cancel this draft before choosing a different behavior family.".into(),
+                    );
+                }
+                d.family = Some(family);
+            }
+            Event::Name(name) => d.name = name,
+            Event::Owner(id) if d.family == Some(Family::Machine) => {
+                if !eligible(p, d.layer, Picker::Owner, id) {
+                    return Err("Choose an existing participant in this layer.".into());
+                }
+                d.owner = Some(id);
+            }
+            Event::Viewpoint(viewpoint) if d.family == Some(Family::Scenario) => {
+                if !viewpoints(d.layer).contains(&viewpoint) {
+                    return Err("Choose a scenario viewpoint from this layer.".into());
+                }
+                d.viewpoint = Some(viewpoint);
+            }
+            Event::Context(id) if d.family == Some(Family::Scenario) => {
+                if id.is_some_and(|id| !eligible(p, d.layer, Picker::Context, id)) {
+                    return Err("Choose an existing same-layer scenario context.".into());
+                }
+                d.context = id;
+            }
+            Event::ContextOptions(open) if d.family == Some(Family::Scenario) => {
+                d.context_open = open;
+            }
+            Event::FirstView(value) if d.family == Some(Family::Machine) => d.first_view = value,
+            Event::Search(picker, query) => d.browsers[picker.index()] = Browser { query, page: 0 },
+            Event::Page(picker, page) => d.browsers[picker.index()].page = page,
+            Event::Cancel | Event::Open(_) | Event::Submit => unreachable!(),
+            _ => return Err("That field does not apply to this behavior family.".into()),
+        }
+        Ok(None)
+    }
+}
+
+fn viewpoints(layer: Layer) -> [ScenarioViewpoint; 2] {
+    match layer {
+        Layer::Oa => [
+            ScenarioViewpoint::OperationalActivity,
+            ScenarioViewpoint::ParticipantInteraction,
+        ],
+        Layer::Sa => [
+            ScenarioViewpoint::Functional,
+            ScenarioViewpoint::BoundaryInterface,
+        ],
+    }
+}
+fn viewpoint_title(viewpoint: ScenarioViewpoint) -> &'static str {
+    match viewpoint {
+        ScenarioViewpoint::OperationalActivity => "Activities · operational exchanges",
+        ScenarioViewpoint::ParticipantInteraction => "Participants · interactions",
+        ScenarioViewpoint::Functional => "Functions · functional exchanges",
+        ScenarioViewpoint::BoundaryInterface => "System boundary · interface exchanges",
+        ScenarioViewpoint::MixedLegacy => "Legacy mixed viewpoint",
+    }
+}
+fn eligible(p: &Project, layer: Layer, picker: Picker, id: Id) -> bool {
+    p.elements.get(&id).is_some_and(|e| {
+        e.layer() == layer
+            && match picker {
+                Picker::Owner => validation::parent_permits(e.kind(), Kind::StateMachine),
+                Picker::Context => {
+                    e.kind().is_sequence()
+                        || e.kind().is_work()
+                        || e.kind().is_performer()
+                        || matches!(
+                            e.kind(),
+                            Kind::Capability
+                                | Kind::SystemCapability
+                                | Kind::OperationalMission
+                                | Kind::Mission
+                        )
+                }
+            }
+    })
+}
+fn choices<'a>(p: &'a Project, layer: Layer, picker: Picker, query: &str) -> Vec<&'a Element> {
+    let query = query.trim().to_lowercase();
+    let mut matches: Vec<_> = p
+        .elements
+        .values()
+        .filter(|e| eligible(p, layer, picker, e.id))
+        .filter(|e| query.is_empty() || reference_label(p, e.id).to_lowercase().contains(&query))
+        .collect();
+    matches.sort_by(|a, b| {
+        a.name
+            .to_lowercase()
+            .cmp(&b.name.to_lowercase())
+            .then(a.id.cmp(&b.id))
+    });
+    matches
+}
+
+fn reference_context(p: &Project, e: &Element) -> String {
+    let mut names = Vec::new();
+    let mut parent = e.parent;
+    let mut seen = std::collections::BTreeSet::new();
+    while let Some(id) = parent {
+        if !seen.insert(id) {
+            break;
+        }
+        let Some(ancestor) = p.elements.get(&id) else {
+            break;
+        };
+        names.push(ancestor.name.as_str());
+        parent = ancestor.parent;
+    }
+    names.reverse();
+    let location = if names.is_empty() {
+        format!("{} root", e.layer())
+    } else {
+        format!("{} / {}", e.layer(), names.join(" / "))
+    };
+    format!("{} · {} · {location}", e.kind(), e.alias)
+}
+pub(super) fn reference_label(p: &Project, id: Id) -> String {
+    p.elements
+        .get(&id)
+        .map(|e| format!("{} · {}", e.name, reference_context(p, e)))
+        .unwrap_or_else(|| "Missing element — choose a replacement".into())
+}
+impl Draft {
+    fn command(&self, p: &Project) -> Result<Command, String> {
+        self.source.check_scope(
+            super::source_draft::Scope::Machine { layer: self.layer },
+            self.owner,
+        )?;
+        let preview = self.source.preview(p, self.owner)?;
+        let command = self.consumer_command(preview.as_ref().unwrap_or(p))?;
+        self.source.combine(p, self.owner, command)
+    }
+    fn consumer_command(&self, p: &Project) -> Result<Command, String> {
+        if self.document != p.id {
+            return Err("This draft belongs to another document.".into());
+        }
+        let family = self
+            .family
+            .ok_or("Choose the behavior you want to create.")?;
+        if self.name.trim().is_empty() {
+            return Err("Enter the behavior's name before creating it.".into());
+        }
+        if [self.element, self.diagram, self.placement]
+            .into_iter()
+            .any(|id| p.contains(id))
+            || self.element == self.diagram
+            || self.element == self.placement
+            || self.diagram == self.placement
+        {
+            return Err(
+                "A reserved creation identity is already in use. Cancel and start a fresh draft."
+                    .into(),
+            );
+        }
+        let kind = family.kind(self.layer);
+        let parent = if family == Family::Machine {
+            Some(
+                self.owner
+                    .filter(|id| eligible(p, self.layer, Picker::Owner, *id))
+                    .ok_or("Choose the participant that owns this state machine.")?,
+            )
+        } else {
+            if self.owner.is_some() {
+                return Err("Processes and scenarios belong at the layer root; context is a separate reference.".into());
+            }
+            None
+        };
+        if family != Family::Machine && self.first_view {
+            return Err("A state view can only accompany a state machine.".into());
+        }
+        let mut body = ElementBody::new(kind, self.layer)
+            .ok_or("This behavior is unavailable in this layer.")?;
+        if family == Family::Scenario {
+            let viewpoint = self
+                .viewpoint
+                .filter(|v| viewpoints(self.layer).contains(v))
+                .ok_or("Choose the scenario's viewpoint explicitly.")?;
+            if self
+                .context
+                .is_some_and(|id| !eligible(p, self.layer, Picker::Context, id))
+            {
+                return Err(
+                    "The selected scenario context is missing or no longer compatible.".into(),
+                );
+            }
+            body = ElementBody::shared_in(
+                self.layer,
+                SharedBody::Scenario {
+                    viewpoint,
+                    context: self.context,
+                    precondition: String::new(),
+                    postcondition: String::new(),
+                    steps: Vec::new(),
+                },
+            );
+        } else if self.viewpoint.is_some() || self.context.is_some() {
+            return Err(
+                "Scenario viewpoint and context cannot be applied to another behavior family."
+                    .into(),
+            );
+        }
+        let element = Element {
+            id: self.element,
+            alias: p.fresh_alias(&self.name, "behavior", self.element),
+            name: self.name.clone(),
+            description: String::new(),
+            parent,
+            body,
+        };
+        let mut commands = vec![Command::CreateElement(element)];
+        if self.first_view {
+            let working = execute_batch(p, &commands).map_err(|e| e.to_string())?;
+            // Reuse the state editor's geometry contract. A new machine has one
+            // root placement; reserve both presentation IDs across retries.
+            let plan = super::state_edit::create_view(&working, self.element)
+                .map_err(|e| e.to_string())?;
+            let Command::Batch(mut view_commands) = plan.command else {
+                return Err("Unexpected state-view plan.".into());
+            };
+            if view_commands.len() != 2 {
+                return Err("Unexpected additional operation in the first state-view plan.".into());
+            }
+            let Some(Command::Layout(layout)) = view_commands.pop() else {
+                return Err("State-view plan must finish with its layout operation.".into());
+            };
+            let Some(Command::CreateDiagram(mut diagram)) = view_commands.pop() else {
+                return Err("State-view plan is missing its diagram.".into());
+            };
+            if diagram.id != layout || diagram.nodes.len() != 1 {
+                return Err("A first state view must contain only its new machine.".into());
+            }
+            let mut node = diagram
+                .nodes
+                .into_values()
+                .next()
+                .ok_or("State-view root is missing.")?;
+            if node.element != self.element {
+                return Err("State-view root differs from the new machine.".into());
+            }
+            diagram.id = self.diagram;
+            diagram.alias = working.fresh_alias(&diagram.name, "state_view", self.diagram);
+            node.id = self.placement;
+            node.alias = working.fresh_alias(
+                &format!("{} placement", self.name),
+                "placement",
+                self.placement,
+            );
+            diagram.nodes = [(node.id, node)].into_iter().collect();
+            commands.push(Command::CreateDiagram(diagram));
+            commands.push(Command::Layout(self.diagram));
+        }
+        let command = Command::Batch(commands);
+        execute_batch(p, std::slice::from_ref(&command)).map_err(|e| e.to_string())?;
+        Ok(command)
+    }
+}
+
+impl State {
+    /// Parent maps these local events into the existing guarded Behavior route.
+    /// The card's fields scroll; Create/Cancel stay outside that scroll region.
+    pub fn view<'a>(&'a self, p: &'a Project) -> Option<UiElement<'a, Event>> {
+        self.view_with(p)
+    }
+    fn view_with<'a, R: iced::advanced::text::Renderer + 'a>(
+        &'a self,
+        p: &'a Project,
+    ) -> Option<UiElement<'a, Event, iced::Theme, R>> {
+        let d = self.draft.as_ref()?;
+        if let Some(view) = d.source.view(p) {
+            return Some(
+                column![
+                    text(format!(
+                        "State machine name: {}",
+                        crate::views::short(&d.name, 60)
+                    ))
+                    .size(12),
+                    view.map(Event::Source)
+                ]
+                .spacing(6)
+                .height(Fill)
+                .into(),
+            );
+        }
+        let mut fields = column![].spacing(10);
+        let title = if let Some(family) = d.family {
+            fields = fields.push(
+                text_input("Exact behavior name", &d.name)
+                    .id(NAME_INPUT)
+                    .on_input(Event::Name)
+                    .on_submit(Event::Submit)
+                    .padding(8),
+            );
+            match family {
+                Family::Sequence => {
+                    fields = fields.push(
+                        text(format!(
+                            "Owned by the {} layer root. Add work and exchange contributions after creation.",
+                            d.layer
+                        ))
+                        .size(12),
+                    );
+                }
+                Family::Scenario => {
+                    fields = fields.push(
+                        text(format!(
+                            "Owned by the {} layer root. Choose what the lifelines represent:",
+                            d.layer
+                        ))
+                        .size(12),
+                    );
+                    for viewpoint in viewpoints(d.layer) {
+                        fields = fields.push(
+                            button(text(viewpoint_title(viewpoint)).size(13))
+                                .style(if d.viewpoint == Some(viewpoint) {
+                                    button::primary
+                                } else {
+                                    button::secondary
+                                })
+                                .on_press(Event::Viewpoint(viewpoint))
+                                .padding(7),
+                        );
+                    }
+                    let context_label = if d.context_open {
+                        "Hide optional context".into()
+                    } else if let Some(id) = d.context {
+                        format!("Context: {} · Change…", reference_label(p, id))
+                    } else {
+                        "Add optional context…".into()
+                    };
+                    fields = fields.push(
+                        button(text(context_label).size(12))
+                            .on_press(Event::ContextOptions(!d.context_open))
+                            .padding(6),
+                    );
+                    if d.context_open {
+                        fields = fields.push(picker_view(p, d, Picker::Context));
+                    }
+                }
+                Family::Machine => {
+                    if let Some(label) = d.source.label(d.owner) {
+                        fields = fields.push(text(label).size(13)).push(text("Create and open commits the new owner and machine together, including the first view only when selected.").size(12));
+                    }
+                    fields = fields.push(picker_view(p, d, Picker::Owner));
+                    fields = fields.push(
+                        button("Create new owner…")
+                            .on_press(Event::Source(super::source_draft::Event::Open(
+                                d.invocation,
+                            )))
+                            .padding(7),
+                    );
+                    fields = fields.push(
+                        checkbox(d.first_view)
+                            .label("Create the first state view")
+                            .on_toggle(Event::FirstView),
+                    );
+                    fields = fields.push(text("The machine starts without regions or states. Add those explicitly in its workspace.").size(12));
+                }
+            }
+            format!("New {}", family.title(d.layer))
+        } else {
+            for family in [Family::Sequence, Family::Scenario, Family::Machine] {
+                let purpose = match family {
+                    Family::Sequence => "A path through work and exchanges",
+                    Family::Scenario => "Ordered interactions from an explicit viewpoint",
+                    Family::Machine => "States and modes of an explicitly chosen participant",
+                };
+                fields = fields.push(
+                    button(
+                        column![text(family.title(d.layer)).size(15), text(purpose).size(12)]
+                            .spacing(3),
+                    )
+                    .on_press(Event::Choose(family))
+                    .padding(10)
+                    .width(Fill),
+                );
+            }
+            format!("New behavior · {}", d.layer)
+        };
+        let mut actions =
+            row![button("Cancel · Esc").on_press(Event::Cancel).padding(8)].spacing(8);
+        if d.family.is_some() {
+            actions = actions.push(button("Create and open").on_press(Event::Submit).padding(8));
+        }
+        Some(
+            container(
+                column![
+                    text(title).size(20),
+                    scrollable(fields)
+                        .id("behavior-creation-fields")
+                        .height(Fill),
+                    container(actions).id("behavior-creation-actions")
+                ]
+                .spacing(12),
+            )
+            .padding(18)
+            .max_width(680)
+            .height(Fill)
+            .style(crate::style::card)
+            .into(),
+        )
+    }
+}
+fn picker_view<'a, R: iced::advanced::text::Renderer + 'a>(
+    p: &'a Project,
+    d: &'a Draft,
+    picker: Picker,
+) -> UiElement<'a, Event, iced::Theme, R> {
+    let browser = &d.browsers[picker.index()];
+    let options = choices(p, d.layer, picker, &browser.query);
+    let page = browser
+        .page
+        .min(options.len().saturating_sub(1) / PAGE_SIZE);
+    let selected = match picker {
+        Picker::Owner => d.owner,
+        Picker::Context => d.context,
+    };
+    let staged_owner = picker == Picker::Owner && d.source.label(selected).is_some();
+    let title = match picker {
+        Picker::Owner if staged_owner => "Or choose an existing participant",
+        Picker::Owner => "Owned by participant",
+        Picker::Context => "Scenario context · optional",
+    };
+    let mut out = column![
+        text(title).size(13),
+        text_input("Search names, aliases or parent context", &browser.query)
+            .on_input(move |query| Event::Search(picker, query))
+            .padding(6)
+    ]
+    .spacing(5);
+    if let Some(id) = selected
+        && !staged_owner
+    {
+        out = out.push(text(format!("Selected: {}", reference_label(p, id))).size(12));
+    } else if picker == Picker::Context {
+        out = out.push(text("No context selected").size(12));
+    }
+    if options.is_empty() {
+        out = out.push(text(match picker {
+            Picker::Owner if staged_owner => "No existing participants match this search. The new owner above remains selected.",
+            Picker::Owner => "No matching participant. Refine the search or choose Create new owner.",
+            Picker::Context => "No matching context. Refine the search, or leave this optional reference empty.",
+        }).size(12));
+    }
+    for e in options.iter().skip(page * PAGE_SIZE).take(PAGE_SIZE) {
+        let message = match picker {
+            Picker::Owner => Event::Owner(e.id),
+            Picker::Context => Event::Context(Some(e.id)),
+        };
+        out = out.push(
+            container(
+                button(
+                    column![
+                        text(&e.name).size(13),
+                        text(reference_context(p, e)).size(11)
+                    ]
+                    .spacing(2),
+                )
+                .style(if selected == Some(e.id) {
+                    button::primary
+                } else {
+                    button::secondary
+                })
+                .on_press(message)
+                .padding(6)
+                .width(Fill),
+            )
+            .id(format!("behavior-creation-candidate-{}", e.id)),
+        );
+    }
+    let mut navigation = row![text(format!("{} matches", options.len())).size(11)].spacing(8);
+    if page > 0 {
+        navigation = navigation.push(button("Previous").on_press(Event::Page(picker, page - 1)));
+    }
+    if (page + 1) * PAGE_SIZE < options.len() {
+        navigation = navigation.push(button("Next").on_press(Event::Page(picker, page + 1)));
+    }
+    if picker == Picker::Context && selected.is_some() {
+        navigation = navigation.push(button("Clear context").on_press(Event::Context(None)));
+    }
+    out.push(navigation).into()
+}
+
+#[cfg(test)]
+mod app_tests;
+#[cfg(test)]
+mod tests;

crates/oa-desktop/src/behavior/creation/app_tests.rs

@@ -0,0 +1,340 @@
+//! App-boundary regressions for the coordinated parent wiring. No I/O task is
+//! polled: file dialogs, checkpoint writes and lesson loading remain inactive.
+use super::*;
+use crate::app::{App, Message, Page, Pending};
+use std::sync::Arc;
+
+fn send(app: &mut App, event: Event) {
+    let _ = app.update(Message::Behavior(crate::behavior::Event::Creation(event)));
+}
+fn raw_property(app: &App) -> serde_json::Value {
+    serde_json::to_value(app.draft.as_ref().unwrap().recovery_snapshot()).unwrap()
+}
+fn begin(app: &mut App, layer: Layer, family: Family, name: &str) {
+    let _ = app.update(Message::Layer(layer));
+    let _ = app.update(Message::Page(Page::Behavior));
+    send(app, Event::Open(layer));
+    send(app, Event::Choose(family));
+    send(app, Event::Name(name.into()));
+}
+
+fn focused_escape() -> Message {
+    use iced::advanced::{Layout, Shell, layout, widget};
+    use iced::keyboard::{self, key::Named};
+    let mut input: iced::Element<'_, (), iced::Theme, ()> = text_input("Name", "Unfinished name")
+        .id(NAME_INPUT)
+        .on_input(|_| ())
+        .into();
+    let mut tree = widget::Tree::new(input.as_widget());
+    let size = iced::Size::new(300., 40.);
+    let node =
+        input
+            .as_widget_mut()
+            .layout(&mut tree, &(), &layout::Limits::new(iced::Size::ZERO, size));
+    tree.state
+        .downcast_mut::<iced::widget::text_input::State<()>>()
+        .focus();
+    let event = iced::Event::Keyboard(keyboard::Event::KeyPressed {
+        key: keyboard::Key::Named(Named::Escape),
+        modified_key: keyboard::Key::Named(Named::Escape),
+        physical_key: keyboard::key::Physical::Code(keyboard::key::Code::Escape),
+        location: keyboard::Location::Standard,
+        modifiers: keyboard::Modifiers::empty(),
+        text: None,
+        repeat: false,
+    });
+    let mut messages = Vec::new();
+    let mut shell = Shell::new(&mut messages);
+    input.as_widget_mut().update(
+        &mut tree,
+        &event,
+        Layout::new(&node),
+        iced::mouse::Cursor::Unavailable,
+        &(),
+        &mut iced::advanced::clipboard::Null,
+        &mut shell,
+        &iced::Rectangle::new(iced::Point::ORIGIN, size),
+    );
+    assert!(shell.is_event_captured());
+    assert_eq!(
+        captured_escape(
+            event.clone(),
+            iced::event::Status::Ignored,
+            iced::window::Id::unique()
+        ),
+        None
+    );
+    captured_escape(
+        event,
+        iced::event::Status::Captured,
+        iced::window::Id::unique(),
+    )
+    .unwrap();
+    Message::Escape
+}
+
+#[test]
+fn app_first_captured_escape_dismisses_file_or_pending_overlay_before_creation() {
+    for file in [false, true] {
+        let mut app = App::with_project(Project::empty());
+        begin(
+            &mut app,
+            Layer::Oa,
+            Family::Sequence,
+            "Keep while overlay closes",
+        );
+        let raw = app.behavior.recovery_snapshot().unwrap();
+        let accepted = app.document.snapshot();
+        if file {
+            app.file_prompt = Some(crate::app::FilePrompt {
+                operation: crate::app::FileOperation::Save,
+                path: "unsubmitted-name.arcadia".into(),
+                overwrite: false,
+            });
+        } else {
+            app.pending = Some(Pending::Walkthrough);
+        }
+        let _ = app.update(focused_escape());
+        assert!(app.file_prompt.is_none());
+        assert!(app.pending.is_none());
+        assert_eq!(app.behavior.recovery_snapshot().unwrap(), raw);
+        assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+        let _ = app.update(focused_escape());
+        assert!(!app.behavior.has_pending());
+        assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+        assert!(!app.document.can_undo());
+    }
+}
+
+#[test]
+fn app_creation_opens_the_actual_new_owner_instead_of_first_or_previously_active_behavior() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let mut p = Project::empty();
+        let old = p
+            .add_element(Family::Sequence.kind(layer), layer, "Old behavior", None)
+            .unwrap();
+        let mut app = App::with_project(p.clone());
+        let _ = app.update(Message::Select(old));
+        begin(&mut app, layer, Family::Sequence, "  New exact path 雨  ");
+        let target = app.behavior.creation.created().unwrap();
+        assert_ne!(target.behavior, old);
+        let before = app.document.bundle().clone();
+        send(&mut app, Event::Submit);
+        assert_eq!(app.page, Page::Behavior);
+        assert_eq!(app.layer, layer);
+        assert_eq!(app.selected, target.behavior);
+        assert_eq!(app.behavior.active_owner, Some(target.behavior));
+        assert_eq!(crate::behavior::selected_owner(&app), Some(target.behavior));
+        assert_eq!(
+            app.project().elements[&target.behavior].name,
+            "  New exact path 雨  "
+        );
+        assert!(!app.behavior.has_pending());
+        let after = app.document.bundle().clone();
+        let _ = app.update(Message::Undo);
+        assert_eq!(app.document.bundle(), &before);
+        assert!(!app.document.can_undo());
+        let _ = app.update(Message::Redo);
+        assert_eq!(app.document.bundle(), &after);
+        assert_eq!(app.project().elements[&old], p.elements[&old]);
+    }
+}
+
+#[test]
+fn app_machine_behavior_submit_opens_its_opted_in_view_as_one_undoable_transaction() {
+    for first_view in [false, true] {
+        let mut p = Project::empty();
+        let owner = p
+            .add_element(Kind::System, Layer::Sa, "Flight system", None)
+            .unwrap();
+        let mut app = App::with_project(p.clone());
+        begin(&mut app, Layer::Sa, Family::Machine, "  Flight modes 雨  ");
+        send(&mut app, Event::Owner(owner));
+        send(&mut app, Event::FirstView(first_view));
+        let target = app.behavior.creation.created().unwrap();
+        let before = app.document.bundle().clone();
+        let _ = app.update(Message::Behavior(crate::behavior::Event::Submit));
+        assert!(!app.behavior.has_pending(), "{}", app.status);
+        assert_eq!(app.selected, target.behavior);
+        assert_eq!(app.behavior.active_owner, Some(target.behavior));
+        assert_eq!(app.behavior.diagram.diagram, target.diagram);
+        assert_eq!(
+            crate::behavior::state_view::diagram(&app, target.behavior),
+            target.diagram
+        );
+        assert_eq!(app.project().elements[&target.behavior].parent, Some(owner));
+        assert_eq!(app.page, Page::Behavior);
+        let after = app.document.bundle().clone();
+        let _ = app.update(Message::Undo);
+        assert_eq!(app.document.bundle(), &before);
+        assert_eq!(app.project(), &p);
+        assert!(!app.document.can_undo());
+        let _ = app.update(Message::Redo);
+        assert_eq!(app.document.bundle(), &after);
+    }
+}
+
+#[test]
+fn app_stale_layer_open_never_starts_or_replaces_a_draft() {
+    let mut app = App::with_project(Project::empty());
+    let _ = app.update(Message::Layer(Layer::Sa));
+    app.page = Page::Behavior;
+    let accepted = app.document.snapshot();
+    send(&mut app, Event::Open(Layer::Oa));
+    assert!(!app.behavior.has_pending());
+    assert_eq!(app.layer, Layer::Sa);
+    send(&mut app, Event::Open(Layer::Sa));
+    send(&mut app, Event::Choose(Family::Sequence));
+    send(&mut app, Event::Name("Retained system chain".into()));
+    let raw = app.behavior.recovery_snapshot().unwrap();
+    send(&mut app, Event::Open(Layer::Oa));
+    assert_eq!(app.behavior.recovery_snapshot().unwrap(), raw);
+    assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+}
+
+#[test]
+fn app_new_never_auto_applies_valid_or_invalid_property_and_source_drafts() {
+    for dirty in [
+        "property-valid",
+        "property-invalid",
+        "source-valid",
+        "source-invalid",
+    ] {
+        let mut app = App::with_project(Project::empty());
+        app.page = Page::Behavior;
+        match dirty {
+            "property-valid" => app
+                .draft
+                .as_mut()
+                .unwrap()
+                .input("/name", "Raw property name".into()),
+            "property-invalid" => app.draft.as_mut().unwrap().input("/id", "-".into()),
+            "source-valid" => app.source_workspace.edit(
+                format!("{}\n// Retained comment\n", app.source_workspace.text()),
+                app.source_editor.cursor(),
+            ),
+            _ => app
+                .source_workspace
+                .edit("unfinished source 雨".into(), app.source_editor.cursor()),
+        }
+        let accepted = app.document.snapshot();
+        let property = raw_property(&app);
+        let workspace = app.source_workspace.recovery_snapshot();
+        send(&mut app, Event::Open(Layer::Oa));
+        assert!(
+            !app.behavior.creation.has_pending(),
+            "{dirty}: New must refuse without applying another editor"
+        );
+        assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+        assert_eq!(raw_property(&app), property);
+        assert_eq!(
+            serde_json::to_value(app.source_workspace.recovery_snapshot()).unwrap(),
+            serde_json::to_value(workspace).unwrap()
+        );
+        assert!(!app.document.can_undo());
+    }
+}
+
+#[test]
+fn app_choosing_another_behavior_or_layer_cannot_commit_a_creation_draft() {
+    let mut p = Project::empty();
+    let old = p
+        .add_element(Kind::Process, Layer::Oa, "Old process", None)
+        .unwrap();
+    let mut app = App::with_project(p);
+    begin(&mut app, Layer::Oa, Family::Sequence, "Retain this process");
+    let raw = app.behavior.recovery_snapshot().unwrap();
+    let accepted = app.document.snapshot();
+    let _ = app.update(Message::Layer(Layer::Sa));
+    let _ = app.update(Message::BehaviorOwner(crate::app::Choice {
+        id: old,
+        label: "Old process".into(),
+    }));
+    assert_eq!(app.layer, Layer::Oa);
+    assert_eq!(app.behavior.recovery_snapshot().unwrap(), raw);
+    assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+    let _ = app.update(Message::Escape);
+    assert!(!app.behavior.has_pending());
+    assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+    assert!(!app.document.can_undo());
+}
+
+#[test]
+fn app_lesson_request_cancel_retains_creation_then_escape_discards_only_the_draft() {
+    let mut app = App::with_project(Project::empty());
+    begin(
+        &mut app,
+        Layer::Oa,
+        Family::Sequence,
+        "Unfinished engineering path",
+    );
+    let raw = app.behavior.recovery_snapshot().unwrap();
+    let accepted = app.document.snapshot();
+    let task = app.update(Message::Home(crate::home::Event::Walkthrough));
+    assert!(matches!(app.pending, Some(Pending::Walkthrough)));
+    assert!(iced_runtime::task::into_stream(task).is_none());
+    let _ = app.update(Message::Escape);
+    assert!(app.pending.is_none());
+    assert_eq!(app.behavior.recovery_snapshot().unwrap(), raw);
+    assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+    let _ = app.update(Message::Escape);
+    assert!(!app.behavior.has_pending());
+    assert!(Arc::ptr_eq(&accepted, &app.document.snapshot()));
+}
+
+#[test]
+fn app_recovered_rootless_sa_creation_retains_layer_ids_and_other_raw_drafts() {
+    let mut app = App::with_project(Project::empty());
+    begin(
+        &mut app,
+        Layer::Sa,
+        Family::Scenario,
+        "  Recovered system scenario 雨  ",
+    );
+    send(
+        &mut app,
+        Event::Viewpoint(ScenarioViewpoint::BoundaryInterface),
+    );
+    // Recovery can contain simultaneous drafts even though new input is guarded.
+    app.draft
+        .as_mut()
+        .unwrap()
+        .input("/name", "Retained property".into());
+    app.source_workspace.edit(
+        "unfinished source preserved".into(),
+        app.source_editor.cursor(),
+    );
+    let snapshot = crate::recovery::Snapshot::capture(
+        app.canvas_document,
+        &app.document,
+        &app.source_workspace,
+        app.draft.as_ref(),
+        &app.behavior,
+        None,
+        app.selected,
+    )
+    .unwrap();
+    let expected = snapshot.clone().restore().unwrap();
+    let raw = app.behavior.recovery_snapshot().unwrap();
+    let mut restored = App::with_project(Project::empty());
+    let _ = restored.update(Message::CheckpointLoaded(Ok(Arc::new(snapshot))));
+    assert_eq!(restored.page, Page::Behavior);
+    assert_eq!(restored.layer, Layer::Sa);
+    assert_eq!(restored.behavior.recovery_snapshot().unwrap(), raw);
+    assert_eq!(
+        restored.behavior.creation.created(),
+        app.behavior.creation.created()
+    );
+    assert_eq!(restored.project(), expected.document.project());
+    assert_eq!(restored.document.bundle(), expected.document.bundle());
+    assert_eq!(
+        restored.source_workspace.bundle(),
+        expected.workspace.bundle()
+    );
+    assert_eq!(raw_property(&restored), raw_property(&app));
+    let before = restored.document.snapshot();
+    send(&mut restored, Event::Submit);
+    assert!(Arc::ptr_eq(&before, &restored.document.snapshot()));
+    assert_eq!(restored.behavior.recovery_snapshot().unwrap(), raw);
+    assert_eq!(raw_property(&restored), raw_property(&app));
+}

crates/oa-desktop/src/behavior/creation/tests.rs

@@ -0,0 +1,599 @@
+use super::*;
+use crate::document::Document;
+use oa_core::source_project::ProjectLimits;
+
+fn start(p: &Project, layer: Layer, family: Family, name: &str) -> State {
+    let mut state = State::default();
+    assert!(state.update(p, Event::Open(layer)).unwrap().is_none());
+    state.update(p, Event::Choose(family)).unwrap();
+    state.update(p, Event::Name(name.into())).unwrap();
+    state
+}
+
+#[test]
+fn mounted_creation_keeps_actions_visible_and_renders_only_six_owner_candidates() {
+    use iced::advanced::{Layout, layout, widget};
+    use iced::{Rectangle, Size, Vector};
+    struct Geometry {
+        candidates: Vec<widget::Id>,
+        rendered: Vec<widget::Id>,
+        actions: Option<Rectangle>,
+        fields: Option<Rectangle>,
+    }
+    impl widget::Operation for Geometry {
+        fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn widget::Operation)) {
+            visit(self);
+        }
+        fn container(&mut self, id: Option<&widget::Id>, bounds: Rectangle) {
+            if id == Some(&widget::Id::new("behavior-creation-actions")) {
+                self.actions = Some(bounds);
+            }
+            if let Some(id) = id.filter(|id| self.candidates.contains(id)) {
+                self.rendered.push(id.clone());
+            }
+        }
+        fn scrollable(
+            &mut self,
+            id: Option<&widget::Id>,
+            bounds: Rectangle,
+            _: Rectangle,
+            _: Vector,
+            _: &mut dyn widget::operation::Scrollable,
+        ) {
+            if id == Some(&widget::Id::new("behavior-creation-fields")) {
+                self.fields = Some(bounds);
+            }
+        }
+    }
+    let mut p = Project::empty();
+    for index in 0..105 {
+        p.add_element(
+            Kind::Entity,
+            Layer::Oa,
+            &format!(
+                "{index:03} Long engineering participant name {}",
+                "雨 extended ".repeat(20)
+            ),
+            None,
+        )
+        .unwrap();
+    }
+    let candidates: Vec<_> = p
+        .elements
+        .keys()
+        .map(|id| widget::Id::from(format!("behavior-creation-candidate-{id}")))
+        .collect();
+    for family in [Family::Sequence, Family::Scenario, Family::Machine] {
+        let state = start(&p, Layer::Oa, family, "Very long exact behavior name 雨");
+        for size in [
+            Size::new(500., 570.),
+            Size::new(1050., 570.),
+            Size::new(500., 320.),
+        ] {
+            let mut view: UiElement<'_, Event, iced::Theme, ()> = state.view_with(&p).unwrap();
+            let mut tree = widget::Tree::new(view.as_widget());
+            let node =
+                view.as_widget_mut()
+                    .layout(&mut tree, &(), &layout::Limits::new(Size::ZERO, size));
+            let mut geometry = Geometry {
+                candidates: candidates.clone(),
+                rendered: Vec::new(),
+                actions: None,
+                fields: None,
+            };
+            view.as_widget_mut()
+                .operate(&mut tree, Layout::new(&node), &(), &mut geometry);
+            let actions = geometry.actions.unwrap();
+            let fields = geometry.fields.unwrap();
+            assert!(actions.x >= 0. && actions.y >= 0.);
+            assert!(
+                actions.x + actions.width <= size.width
+                    && actions.y + actions.height <= size.height
+            );
+            assert!(fields.height >= 100. && fields.y + fields.height <= actions.y);
+            assert_eq!(
+                geometry.rendered.len(),
+                if family == Family::Machine { 6 } else { 0 }
+            );
+        }
+    }
+}
+
+fn roundtrip(p: Project, state: &mut State) -> Project {
+    let command = state.update(&p, Event::Submit).unwrap().unwrap();
+    assert_eq!(
+        command,
+        state.prepare_pending(&p).unwrap(),
+        "preparation must retain reserved IDs"
+    );
+    let api: Command = serde_json::from_value(serde_json::to_value(&command).unwrap()).unwrap();
+    assert_eq!(api, command);
+    let expected = execute_batch(&p, &[api]).unwrap();
+    let target = state.created().unwrap();
+    let mut document = Document::from_project(p.clone(), ProjectLimits::default()).unwrap();
+    let before_source = document.bundle().clone();
+    document.execute(command).unwrap();
+    assert_eq!(document.project(), &expected);
+    assert!(
+        state.has_pending(),
+        "only successful acknowledgement clears raw fields"
+    );
+    state.acknowledge_commit();
+    assert!(!state.has_pending());
+    assert!(document.project().elements.contains_key(&target.behavior));
+    let after_source = document.bundle().clone();
+    assert!(document.undo());
+    assert_eq!(document.project(), &p);
+    assert_eq!(document.bundle(), &before_source);
+    assert!(!document.can_undo(), "one creation must be one Undo entry");
+    assert!(document.redo());
+    assert_eq!(document.project(), &expected);
+    assert_eq!(document.bundle(), &after_source);
+    let reopened = Document::from_bundle(after_source, ProjectLimits::default()).unwrap();
+    assert_eq!(reopened.project(), &expected);
+    expected
+}
+
+#[test]
+fn oa_process_and_sa_chain_keep_exact_names_root_ownership_and_one_history_entry() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        let p = Project::empty();
+        let name = "  Supply \"water\" — режим  ";
+        let mut state = start(&p, layer, Family::Sequence, name);
+        let target = state.created().unwrap();
+        let result = roundtrip(p, &mut state);
+        let element = &result.elements[&target.behavior];
+        assert_eq!(element.name, name);
+        assert_eq!(element.layer(), layer);
+        assert_eq!(
+            element.kind(),
+            if layer == Layer::Oa {
+                Kind::Process
+            } else {
+                Kind::FunctionalChain
+            }
+        );
+        assert_eq!(element.parent, None);
+        assert!(element.steps().unwrap().is_empty());
+        assert!(result.diagrams.is_empty());
+        assert!(result.relations.is_empty());
+    }
+}
+
+#[test]
+fn all_four_viewpoints_are_explicit_and_survive_source_history_reopen() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        for viewpoint in viewpoints(layer) {
+            let mut p = Project::empty();
+            let context = p
+                .add_element(
+                    if layer == Layer::Oa {
+                        Kind::Capability
+                    } else {
+                        Kind::SystemCapability
+                    },
+                    layer,
+                    "Water supply",
+                    None,
+                )
+                .unwrap();
+            let mut state = start(&p, layer, Family::Scenario, "Nominal supply");
+            assert!(
+                state
+                    .prepare_pending(&p)
+                    .unwrap_err()
+                    .contains("explicitly")
+            );
+            assert!(
+                state
+                    .update(&p, Event::Viewpoint(ScenarioViewpoint::MixedLegacy))
+                    .is_err()
+            );
+            let wrong = viewpoints(if layer == Layer::Oa {
+                Layer::Sa
+            } else {
+                Layer::Oa
+            })[0];
+            assert!(state.update(&p, Event::Viewpoint(wrong)).is_err());
+            state.update(&p, Event::Viewpoint(viewpoint)).unwrap();
+            state.update(&p, Event::Context(Some(context))).unwrap();
+            let id = state.created().unwrap().behavior;
+            let result = roundtrip(p, &mut state);
+            assert_eq!(
+                result.elements[&id].parent, None,
+                "context is not containment"
+            );
+            assert!(
+                matches!(result.elements[&id].shared(), Some(SharedBody::Scenario { viewpoint: actual, context: Some(actual_context), steps, .. }) if *actual == viewpoint && *actual_context == context && steps.is_empty())
+            );
+        }
+    }
+}
+
+#[test]
+fn machine_requires_valid_owner_and_first_view_adds_no_region_or_state() {
+    for layer in [Layer::Oa, Layer::Sa] {
+        for first_view in [false, true] {
+            let mut p = Project::empty();
+            let owner = p
+                .add_element(
+                    if layer == Layer::Oa {
+                        Kind::Entity
+                    } else {
+                        Kind::System
+                    },
+                    layer,
+                    "Pump",
+                    None,
+                )
+                .unwrap();
+            let wrong_kind = p
+                .add_element(
+                    if layer == Layer::Oa {
+                        Kind::Activity
+                    } else {
+                        Kind::Function
+                    },
+                    layer,
+                    "Pump water",
+                    None,
+                )
+                .unwrap();
+            let opposite = if layer == Layer::Oa {
+                Layer::Sa
+            } else {
+                Layer::Oa
+            };
+            let wrong_layer = p
+                .add_element(
+                    if opposite == Layer::Oa {
+                        Kind::Entity
+                    } else {
+                        Kind::System
+                    },
+                    opposite,
+                    "Other layer pump",
+                    None,
+                )
+                .unwrap();
+            let mut state = start(&p, layer, Family::Machine, "Pump modes");
+            assert!(
+                state
+                    .prepare_pending(&p)
+                    .unwrap_err()
+                    .contains("participant")
+            );
+            assert!(state.update(&p, Event::Owner(wrong_kind)).is_err());
+            assert!(state.update(&p, Event::Owner(wrong_layer)).is_err());
+            state.update(&p, Event::Owner(owner)).unwrap();
+            state.update(&p, Event::FirstView(first_view)).unwrap();
+            let target = state.created().unwrap();
+            let expected_count = p.elements.len() + 1;
+            let result = roundtrip(p, &mut state);
+            assert_eq!(result.elements.len(), expected_count);
+            assert_eq!(result.elements[&target.behavior].parent, Some(owner));
+            assert_eq!(result.elements[&target.behavior].kind(), Kind::StateMachine);
+            assert_eq!(result.diagrams.len(), usize::from(first_view));
+            if let Some(view) = target.diagram {
+                let diagram = &result.diagrams[&view];
+                assert_eq!(
+                    diagram.projection,
+                    ProjectionKind::StateMachine {
+                        machine: target.behavior
+                    }
+                );
+                assert_eq!(diagram.nodes.len(), 1);
+                assert_eq!(
+                    diagram.nodes.values().next().unwrap().element,
+                    target.behavior
+                );
+            }
+        }
+    }
+}
+
+#[test]
+fn cancel_and_illegal_family_layer_switches_never_create_model_objects() {
+    let p = Project::empty();
+    let mut state = start(&p, Layer::Oa, Family::Scenario, "Raw name");
+    state
+        .update(
+            &p,
+            Event::Viewpoint(ScenarioViewpoint::ParticipantInteraction),
+        )
+        .unwrap();
+    let snapshot = state.recovery_snapshot().unwrap();
+    assert!(state.update(&p, Event::Open(Layer::Sa)).is_err());
+    assert!(state.update(&p, Event::Choose(Family::Sequence)).is_err());
+    assert_eq!(state.recovery_snapshot().unwrap(), snapshot);
+    assert!(state.update(&p, Event::Cancel).unwrap().is_none());
+    assert!(!state.has_pending());
+    assert!(state.created().is_none());
+    assert!(state.prepare_pending(&p).is_err());
+    assert!(p.elements.is_empty());
+    assert!(p.diagrams.is_empty());
+}
+
+#[test]
+fn recovery_preserves_exact_raw_inputs_reserved_ids_and_revalidates_stale_owner() {
+    let mut p = Project::empty();
+    let owner = p
+        .add_element(Kind::Entity, Layer::Oa, "Plant", None)
+        .unwrap();
+    let mut state = start(&p, Layer::Oa, Family::Machine, " \nRaw rejected name\0 ");
+    state.update(&p, Event::Owner(owner)).unwrap();
+    state.update(&p, Event::FirstView(true)).unwrap();
+    state
+        .update(&p, Event::Search(Picker::Owner, " Plant ".into()))
+        .unwrap();
+    let raw = state.recovery_snapshot().unwrap().unwrap();
+    let mut restored = State::from_recovery(raw.clone()).unwrap();
+    assert_eq!(restored.recovery_snapshot().unwrap(), Some(raw.clone()));
+    assert_eq!(restored.created(), state.created());
+    assert_eq!(restored.pending_layer(), Some(Layer::Oa));
+    assert!(restored.prepare_pending(&p).is_err());
+    restored
+        .update(&p, Event::Name("Plant modes".into()))
+        .unwrap();
+    let command = restored.prepare_pending(&p).unwrap();
+    let again = State::from_recovery(restored.recovery_snapshot().unwrap().unwrap()).unwrap();
+    assert_eq!(again.prepare_pending(&p).unwrap(), command);
+    p.elements.remove(&owner);
+    let before = restored.recovery_snapshot().unwrap();
+    assert!(
+        restored
+            .prepare_pending(&p)
+            .unwrap_err()
+            .contains("participant")
+    );
+    assert_eq!(restored.recovery_snapshot().unwrap(), before);
+    let different = Project::empty();
+    assert!(
+        restored
+            .prepare_pending(&different)
+            .unwrap_err()
+            .contains("another document")
+    );
+}
+
+#[test]
+fn rejected_source_transaction_keeps_draft_and_every_accepted_source_byte() {
+    let p = Project::empty();
+    let initial = Document::from_project(p.clone(), ProjectLimits::default()).unwrap();
+    let bytes: usize = initial.bundle().files.values().map(String::len).sum();
+    let limits = ProjectLimits {
+        model: language::ParseLimits {
+            max_source_bytes: bytes + 32,
+            ..language::ParseLimits::UNLIMITED
+        },
+        ..ProjectLimits::default()
+    };
+    let mut doc = Document::from_bundle(initial.bundle().clone(), limits).unwrap();
+    let mut state = start(
+        &p,
+        Layer::Oa,
+        Family::Sequence,
+        "A long exact name retained after the source budget refuses this new process",
+    );
+    let raw = state.recovery_snapshot().unwrap();
+    let command = state.prepare_pending(&p).unwrap();
+    assert!(doc.execute(command).is_err());
+    assert_eq!(doc.project(), &p);
+    assert_eq!(doc.bundle(), initial.bundle());
+    assert!(!doc.can_undo());
+    assert_eq!(state.recovery_snapshot().unwrap(), raw);
+    state.update(&p, Event::Cancel).unwrap();
+}
+
+#[test]
+fn owner_search_is_name_ordered_filtered_and_page_sized_not_a_catalog() {
+    let mut p = Project::empty();
+    for index in (0..105).rev() {
+        p.add_element(Kind::Entity, Layer::Oa, &format!("Pump {index:03}"), None)
+            .unwrap();
+    }
+    p.add_element(Kind::System, Layer::Sa, "Pump 999", None)
+        .unwrap();
+    p.add_element(Kind::Activity, Layer::Oa, "Pump work", None)
+        .unwrap();
+    let mut state = start(&p, Layer::Oa, Family::Machine, "Pump modes");
+    let all = choices(&p, Layer::Oa, Picker::Owner, "");
+    assert_eq!(all.len(), 105);
+    assert_eq!(all[0].name, "Pump 000");
+    state
+        .update(&p, Event::Page(Picker::Owner, usize::MAX))
+        .unwrap();
+    assert!(
+        state.view(&p).is_some(),
+        "stale pages are clamped before slicing"
+    );
+    state
+        .update(&p, Event::Search(Picker::Owner, "Pump 104".into()))
+        .unwrap();
+    assert_eq!(state.draft.as_ref().unwrap().browsers[0].page, 0);
+    let found = choices(&p, Layer::Oa, Picker::Owner, "Pump 104");
+    assert_eq!(found.len(), 1);
+    state.update(&p, Event::Owner(found[0].id)).unwrap();
+    assert_eq!(state.draft.as_ref().unwrap().owner, Some(found[0].id));
+}
+
+#[test]
+fn repeated_owner_names_remain_distinguishable_by_searchable_parent_context_and_alias() {
+    let mut p = Project::empty();
+    let north = p
+        .add_element(Kind::Entity, Layer::Oa, "North station", None)
+        .unwrap();
+    let south = p
+        .add_element(Kind::Entity, Layer::Oa, "South station", None)
+        .unwrap();
+    let first = p
+        .add_element(Kind::Entity, Layer::Oa, "Pump", Some(north))
+        .unwrap();
+    let second = p
+        .add_element(Kind::Entity, Layer::Oa, "Pump", Some(south))
+        .unwrap();
+    let label = reference_label(&p, second);
+    assert_ne!(reference_label(&p, first), label);
+    assert!(label.contains("South station") && label.contains("Pump"));
+    assert!(label.contains(&p.elements[&second].alias));
+    let found = choices(&p, Layer::Oa, Picker::Owner, "south station");
+    assert!(found.iter().any(|e| e.id == second));
+    assert!(!found.iter().any(|e| e.id == first));
+    let mut state = start(&p, Layer::Oa, Family::Machine, "Pump states");
+    state.update(&p, Event::Owner(second)).unwrap();
+    let result = execute_batch(&p, &[state.prepare_pending(&p).unwrap()]).unwrap();
+    assert_eq!(
+        result.elements[&state.created().unwrap().behavior].parent,
+        Some(second)
+    );
+}
+
+#[test]
+fn corrupted_recovery_and_reserved_identity_collision_refuse_without_repairing_raw_values() {
+    let p = Project::empty();
+    let state = start(&p, Layer::Sa, Family::Sequence, "Supply");
+    let raw = state.recovery_snapshot().unwrap().unwrap();
+    for (field, value) in [
+        ("version", serde_json::json!(99)),
+        ("unexpected", serde_json::json!(true)),
+    ] {
+        let mut bad = raw.clone();
+        bad[field] = value;
+        assert!(State::from_recovery(bad).is_err());
+    }
+    let mut bad = raw;
+    bad["element"] = serde_json::json!(p.id);
+    let restored = State::from_recovery(bad.clone()).unwrap();
+    assert!(
+        restored
+            .prepare_pending(&p)
+            .unwrap_err()
+            .contains("identity")
+    );
+    assert_eq!(restored.recovery_snapshot().unwrap(), Some(bad));
+}
+
+#[test]
+fn post_commit_selection_is_correlated_with_exact_created_behavior_and_view() {
+    let mut p = Project::empty();
+    let owner = p
+        .add_element(Kind::Entity, Layer::Oa, "Pump", None)
+        .unwrap();
+    let mut state = start(&p, Layer::Oa, Family::Machine, "Pump modes");
+    state.update(&p, Event::Owner(owner)).unwrap();
+    state.update(&p, Event::FirstView(true)).unwrap();
+    let command = state.prepare_pending(&p).unwrap();
+    assert_eq!(state.created_by(&p, &command), state.created());
+    assert_eq!(
+        state.created_by(&p, &Command::Rename(owner, "Unrelated change".into())),
+        None
+    );
+    for edit in 0..4 {
+        let mut changed = command.clone();
+        let Command::Batch(ref mut commands) = changed else {
+            panic!("creation batch");
+        };
+        if edit < 3 {
+            let Command::CreateElement(element) = &mut commands[0] else {
+                panic!("new behavior");
+            };
+            match edit {
+                0 => element.id = Id::new_v4(),
+                1 => element.name = "A different authored draft".into(),
+                _ => element.parent = None,
+            }
+        } else {
+            let Command::CreateDiagram(diagram) = &mut commands[1] else {
+                panic!("new view");
+            };
+            diagram.projection = ProjectionKind::StateMachine { machine: owner };
+        }
+        assert_eq!(state.created_by(&p, &changed), None);
+    }
+    let Command::Batch(commands) = command else {
+        panic!("creation batch");
+    };
+    assert_eq!(
+        state.created_by(&p, &commands[0]),
+        None,
+        "an opt-in view must be part of the actual committed batch"
+    );
+}
+
+#[test]
+fn optional_context_collapses_without_losing_authored_reference_or_raw_search() {
+    let mut p = Project::empty();
+    let context = p
+        .add_element(Kind::Capability, Layer::Oa, "Water supply", None)
+        .unwrap();
+    let mut state = start(&p, Layer::Oa, Family::Scenario, "Supply nominal");
+    assert!(!state.draft.as_ref().unwrap().context_open);
+    state
+        .update(&p, Event::Viewpoint(ScenarioViewpoint::OperationalActivity))
+        .unwrap();
+    state.update(&p, Event::ContextOptions(true)).unwrap();
+    state
+        .update(&p, Event::Search(Picker::Context, " Water ".into()))
+        .unwrap();
+    state.update(&p, Event::Context(Some(context))).unwrap();
+    let command = state.prepare_pending(&p).unwrap();
+    state.update(&p, Event::ContextOptions(false)).unwrap();
+    let restored = State::from_recovery(state.recovery_snapshot().unwrap().unwrap()).unwrap();
+    assert!(!restored.draft.as_ref().unwrap().context_open);
+    assert_eq!(
+        restored.draft.as_ref().unwrap().browsers[1].query,
+        " Water "
+    );
+    assert_eq!(restored.prepare_pending(&p).unwrap(), command);
+    assert_eq!(restored.created_by(&p, &command), restored.created());
+}
+
+#[test]
+fn creation_selection_rejects_changed_scenario_body_and_post_creation_operations() {
+    let mut p = Project::empty();
+    let capability = p
+        .add_element(Kind::SystemCapability, Layer::Sa, "Supply", None)
+        .unwrap();
+    let mut state = start(&p, Layer::Sa, Family::Scenario, "Nominal functions");
+    state
+        .update(&p, Event::Viewpoint(ScenarioViewpoint::Functional))
+        .unwrap();
+    let command = state.prepare_pending(&p).unwrap();
+    assert_eq!(state.created_by(&p, &command), state.created());
+    for edit in 0..4 {
+        let mut altered = command.clone();
+        let Command::Batch(commands) = &mut altered else {
+            panic!("creation batch");
+        };
+        match edit {
+            0 => {
+                let Command::CreateElement(element) = &mut commands[0] else {
+                    panic!("scenario");
+                };
+                let Some(SharedBody::Scenario { viewpoint, .. }) = element.shared_mut() else {
+                    panic!("scenario body");
+                };
+                *viewpoint = ScenarioViewpoint::BoundaryInterface;
+            }
+            1 => {
+                let Command::CreateElement(element) = &mut commands[0] else {
+                    panic!("scenario");
+                };
+                let Some(SharedBody::Scenario { context, .. }) = element.shared_mut() else {
+                    panic!("scenario body");
+                };
+                *context = Some(capability);
+            }
+            2 => commands.push(Command::Rename(
+                state.created().unwrap().behavior,
+                "Changed afterward".into(),
+            )),
+            _ => commands.push(Command::Delete(state.created().unwrap().behavior)),
+        }
+        assert!(
+            execute_batch(&p, std::slice::from_ref(&altered)).is_ok(),
+            "the alternate command is valid, but is not this authored creation"
+        );
+        assert_eq!(state.created_by(&p, &altered), None);
+    }
+}

crates/oa-desktop/src/behavior/scenario.rs

@@ -4,6 +4,8 @@ use super::topology::{occurrence, unique_batch};
 use super::*;
 use iced::widget::{Column, column, text_input};
 use std::{cell::RefCell, collections::BTreeSet};
+mod workspace;
+pub use workspace::{Shelf, view};
 
 #[cfg(test)]
 #[path = "scenario_operation_tests.rs"]
@@ -92,8 +94,13 @@ impl std::fmt::Display for CanvasTool {
 }
 #[derive(Debug, Clone)]
 pub enum CanvasEvent {
+    First(Context, Tool),
     Scrolled(Context, ScrollArea, iced::Vector),
     Restored(Context, Id, ScrollArea, iced::Vector),
+    Viewport(Context, Size),
+    Zoom(Context, Option<f32>),
+    Focus(Context),
+    Shelf(Context, Shelf),
     OpenUse(Context, Id),
     Back(Context),
     Choose(Context, CanvasTool),
@@ -120,13 +127,19 @@ pub enum CanvasEvent {
 #[derive(Debug, Clone, Copy)]
 pub enum ScrollArea {
     Canvas,
+    // Retained navigation channel, now the independent Selection/outline shelf.
     Page,
 }
 impl CanvasEvent {
     pub fn context(&self) -> Context {
         match self {
-            Self::Scrolled(context, _, _)
+            Self::First(context, _)
+            | Self::Scrolled(context, _, _)
             | Self::Restored(context, ..)
+            | Self::Viewport(context, _)
+            | Self::Zoom(context, _)
+            | Self::Focus(context)
+            | Self::Shelf(context, _)
             | Self::OpenUse(context, _)
             | Self::Back(context)
             | Self::Choose(context, _)
@@ -151,6 +164,7 @@ impl std::fmt::Display for Operator {
 }
 #[derive(Debug, Clone)]
 pub enum Event {
+    Source(super::source_draft::Event),
     Start(Id, Tool),
     Cancel,
     Submit,
@@ -191,6 +205,7 @@ pub struct State {
     scroll_offsets: [iced::Vector; 2],
     return_to: Vec<Caller>,
     restore: Option<ViewportRestore>,
+    presentation: workspace::Presentation,
 }
 const CALLER_LIMIT: usize = 32;
 pub(crate) struct Caller {
@@ -200,6 +215,7 @@ pub(crate) struct Caller {
     target: Id,
     tool: CanvasTool,
     offsets: [iced::Vector; 2],
+    presentation: workspace::Presentation,
 }
 struct ViewportRestore {
     document: Id,
@@ -227,6 +243,13 @@ struct CallChoiceContext {
 #[derive(Clone, serde::Serialize, serde::Deserialize)]
 #[serde(deny_unknown_fields)]
 struct Draft {
+    #[serde(default)]
+    source: super::source_draft::State,
+    #[serde(default = "Id::new_v4")]
+    invocation: Id,
+    #[serde(default)]
+    source_origin: Option<(Id, oa_core::Element)>,
+
     owner: Id,
     parent: Id,
     before: Option<Id>,
@@ -259,6 +282,54 @@ struct Draft {
     choice_page: usize,
 }
 impl State {
+    pub(super) fn pending_name(&self) -> Option<&str> {
+        self.draft.as_ref().map(|d| d.name.as_str())
+    }
+    pub(super) fn source_view<'a>(&'a self, p: &'a Project) -> Option<iced::Element<'a, Event>> {
+        self.draft
+            .as_ref()?
+            .source
+            .view(p)
+            .map(|v| v.map(Event::Source))
+    }
+
+    pub fn source_active(&self) -> bool {
+        self.draft.as_ref().is_some_and(|d| d.source.engaged())
+    }
+
+    pub fn source_open(&self) -> bool {
+        self.draft.as_ref().is_some_and(|d| d.source.is_open())
+    }
+    pub fn source_back(&mut self) -> bool {
+        self.draft.as_mut().is_some_and(|d| d.source.back())
+    }
+
+    pub(crate) fn enter(&mut self, document: Id, owner: Id) {
+        if self.presentation.identity != Some((document, owner)) {
+            self.presentation = workspace::Presentation {
+                identity: Some((document, owner)),
+                focused: self.presentation.focused,
+                ..Default::default()
+            };
+            self.scroll_offsets = [iced::Vector::ZERO; 2];
+            self.restore = None;
+        }
+    }
+    pub(crate) fn viewport(&mut self, size: Size) -> bool {
+        self.presentation.viewport(size)
+    }
+    pub(crate) fn zoom(&mut self, scale: Option<f32>) -> bool {
+        self.presentation.zoom(scale)
+    }
+    pub(crate) fn focused(&self) -> bool {
+        self.presentation.focused
+    }
+    pub(crate) fn toggle_focus(&mut self) {
+        self.presentation.focused = !self.presentation.focused;
+    }
+    pub(crate) fn toggle_shelf(&mut self, shelf: Shelf) {
+        self.presentation.shelf = (self.presentation.shelf != Some(shelf)).then_some(shelf);
+    }
     pub(crate) fn open_use(
         &mut self,
         p: &Project,
@@ -279,6 +350,7 @@ impl State {
             target,
             tool: self.canvas_tool(context.scenario),
             offsets: self.scroll_offsets,
+            presentation: self.presentation.clone(),
         });
         self.canvas_tool = Some((target, CanvasTool::Select));
         self.scroll_offsets = [iced::Vector::ZERO; 2];
@@ -309,6 +381,8 @@ impl State {
         }
         self.canvas_tool = Some((frame.owner, frame.tool));
         self.scroll_offsets = frame.offsets;
+        self.presentation = frame.presentation;
+        self.presentation.identity = Some((context.document, context.scenario));
         self.restore = Some(ViewportRestore {
             document: context.document,
             owner: frame.owner,
@@ -378,6 +452,9 @@ impl State {
     }
 
     pub(crate) fn scrolled(&mut self, area: ScrollArea, offset: iced::Vector) -> bool {
+        if !offset.x.is_finite() || !offset.y.is_finite() || offset.x < 0. || offset.y < 0. {
+            return false;
+        }
         let index = match area {
             ScrollArea::Canvas => 0,
             ScrollArea::Page => 1,
@@ -387,7 +464,8 @@ impl State {
         changed
     }
     fn scroll_offset(&self) -> iced::Vector {
-        self.scroll_offsets[0] + self.scroll_offsets[1]
+        // The former page scroll now belongs to a sibling outline shelf.
+        self.scroll_offsets[0]
     }
     fn call_choices(&self, p: &Project, context: Context, draft: &Draft) -> Vec<Choice> {
         let key = CallChoiceContext {
@@ -406,8 +484,16 @@ impl State {
         }
         cached.as_ref().unwrap().1.clone()
     }
-    pub(crate) fn created_selection(&self, command: &Command) -> Option<Id> {
+    pub(crate) fn created_selection(&self, p: &Project, command: &Command) -> Option<Id> {
         let draft = self.draft.as_ref()?;
+        if self
+            .draft
+            .as_ref()
+            .is_some_and(|d| d.source.label(d.target).is_some())
+            && self.prepare_pending(p).ok().as_ref() != Some(command)
+        {
+            return None;
+        }
         fn created(command: &Command, parent: Id) -> Option<Id> {
             match command {
                 Command::CreateElement(element) if element.parent == Some(parent) => {
@@ -522,6 +608,61 @@ impl State {
     }
 
     pub fn update(&mut self, p: &Project, event: Event) -> Result<Option<Command>, String> {
+        if let Event::Source(event) = event {
+            if self
+                .draft
+                .as_mut()
+                .ok_or("Start the consumer form first.")?
+                .source
+                .dismiss(&event)?
+            {
+                return Ok(None);
+            }
+            let d = self
+                .draft
+                .as_ref()
+                .ok_or("Start the consumer form first.")?;
+            if d.tool != Tool::Lifeline {
+                return Err("This reference does not support staged source creation.".into());
+            }
+            if d.source_origin.as_ref().is_some_and(|(document, owner)| {
+                *document != p.id || p.elements.get(&d.owner) != Some(owner)
+            }) {
+                return Err("The original consumer changed. Cancel and reopen its form; the current draft is retained.".into());
+            }
+            if d.source_origin.is_none() && d.source.engaged() {
+                return Err("The recovered source draft has no original document binding. Go Back or cancel it.".into());
+            }
+            let mut next = d.clone();
+            if next.source_origin.is_none() && matches!(&event, super::source_draft::Event::Open(_))
+            {
+                next.source_origin = Some((
+                    p.id,
+                    p.elements
+                        .get(&d.owner)
+                        .ok_or("The consumer owner no longer exists.")?
+                        .clone(),
+                ));
+            }
+            if let Some(id) = next.source.update(
+                p,
+                super::source_draft::Scope::Lifeline {
+                    owner: d.owner,
+                    viewpoint: viewpoint(p, d.owner),
+                },
+                d.invocation,
+                event,
+            )? {
+                next.target = Some(id);
+                next.command(p)?;
+            }
+            self.draft = Some(next);
+            return Ok(None);
+        }
+        if self.source_open() && !matches!(&event, Event::Cancel) {
+            return Err("Use the new source or go Back before editing the parent form.".into());
+        }
+
         if self.draft.is_some() && matches!(&event, Event::Start(..)) {
             return Err(PENDING_DRAFT.into());
         }
@@ -531,6 +672,9 @@ impl State {
                     return Err("Choose a scenario.".into());
                 }
                 self.draft = Some(Draft {
+                    source: Default::default(),
+                    invocation: Id::new_v4(),
+                    source_origin: Some((p.id, p.elements[&owner].clone())),
                     owner,
                     parent: owner,
                     before: None,
@@ -894,7 +1038,14 @@ fn valid_body_choice(p: &Project, owner: Id, body: OccurrenceBody) -> bool {
     execute_batch(p, &[Command::CreateElement(e)]).is_ok()
 }
 fn sources(p: &Project, d: &Draft) -> Vec<Choice> {
-    let layer = p.elements[&d.owner].layer();
+    let Some(owner) = p
+        .elements
+        .get(&d.owner)
+        .filter(|e| e.kind() == Kind::Scenario)
+    else {
+        return vec![];
+    };
+    let layer = owner.layer();
     let mut values: Vec<_> = p
         .elements
         .values()
@@ -1210,6 +1361,28 @@ impl Draft {
         e
     }
     fn command(&self, p: &Project) -> Result<Command, String> {
+        if self.source.engaged()
+            && self.source_origin.as_ref().is_none_or(|(document, owner)| {
+                *document != p.id || p.elements.get(&self.owner) != Some(owner)
+            })
+        {
+            return Err("The original consumer document or owner changed. Cancel and reopen its form; your draft is retained.".into());
+        }
+        self.source.check_scope(
+            super::source_draft::Scope::Lifeline {
+                owner: self.owner,
+                viewpoint: viewpoint(p, self.owner),
+            },
+            self.target,
+        )?;
+        let preview = self.source.preview(p, self.target)?;
+        let command = self.consumer_command(preview.as_ref().unwrap_or(p))?;
+        self.source.combine(p, self.target, command)
+    }
+    fn consumer_command(&self, p: &Project) -> Result<Command, String> {
+        if p.elements.get(&self.owner).map(oa_core::Element::kind) != Some(Kind::Scenario) {
+            return Err("The scenario no longer exists. Cancel or restore its owner.".into());
+        }
         if !parents(p, self.owner).iter().any(|c| c.id == self.parent) {
             return Err("Choose this scenario or one of its operands as destination.".into());
         }
@@ -1220,6 +1393,8 @@ impl Draft {
             .unwrap_or(self.tool.label());
         let name = if self.name.trim().is_empty() {
             default
+        } else if self.source.label(self.target).is_some() {
+            self.name.as_str()
         } else {
             self.name.trim()
         };
@@ -1634,493 +1809,6 @@ fn bounded_picker<'a>(
     }
     out.into()
 }
-pub fn view<'a>(app: &'a App, owner: Id, mut out: Column<'a, Message>) -> Element<'a, Message> {
-    let p = app.project();
-    out = out.push(label(match viewpoint(p, owner) {
-        ScenarioViewpoint::OperationalActivity => {
-            "Operational activity scenario · lifelines represent activities"
-        }
-        ScenarioViewpoint::Functional => {
-            "Functional scenario · lifelines represent system functions"
-        }
-        ScenarioViewpoint::ParticipantInteraction => {
-            "Participant scenario · lifelines represent entities, actors or roles"
-        }
-        ScenarioViewpoint::BoundaryInterface => {
-            "Interface scenario · lifelines represent the system and external actors"
-        }
-        ScenarioViewpoint::MixedLegacy => {
-            "Mixed scenario · lifelines may represent work or participants"
-        }
-    }));
-    let pending = app.behavior.has_pending();
-    let context = app.scenario_context().expect("visible scenario context");
-    let tool = app.behavior.scenario.canvas_tool(owner);
-    // Keep the canvas at a stable widget-tree position when a form replaces
-    // the palette, so Iced retains the user's current sequence viewport.
-    let mut controls = column![].spacing(6);
-    if !pending {
-        controls = controls.push(
-            row![
-                button("Select / reorder")
-                    .on_press(Message::ScenarioCanvas(CanvasEvent::Choose(
-                        context,
-                        CanvasTool::Select
-                    )))
-                    .style(if tool == CanvasTool::Select {
-                        style::selected
-                    } else {
-                        style::nav
-                    }),
-                pick_list(
-                    vec![
-                        CanvasTool::Select,
-                        CanvasTool::Message(MessageStyle::CallReply),
-                        CanvasTool::Message(MessageStyle::Asynchronous),
-                        CanvasTool::Message(MessageStyle::Call),
-                        CanvasTool::Message(MessageStyle::Reply),
-                        CanvasTool::Message(MessageStyle::Create),
-                        CanvasTool::Message(MessageStyle::Delete),
-                        CanvasTool::Message(MessageStyle::Timer),
-                        CanvasTool::Add(Tool::Action),
-                        CanvasTool::Add(Tool::Observation),
-                        CanvasTool::Add(Tool::Reuse),
-                        CanvasTool::Add(Tool::Fragment),
-                    ],
-                    Some(tool),
-                    move |tool| Message::ScenarioCanvas(CanvasEvent::Choose(context, tool))
-                )
-                .text_size(12)
-                .padding(8)
-                .width(240),
-                action("+ Lifeline", event(Event::Start(owner, Tool::Lifeline))),
-                action("Properties", Message::EditProperties(owner)),
-            ]
-            .spacing(6)
-            .wrap(),
-        );
-        controls = controls.push(label(match tool {
-            CanvasTool::Message(_) => "Draw message · choose a sequence position on a lifeline, then click or drag to another lifeline · Escape cancels",
-            CanvasTool::Add(Tool::Action | Tool::Observation) => "Click a highlighted sequence position · click on a lifeline to preselect it · Escape cancels",
-            CanvasTool::Add(Tool::Reuse) => "Click a highlighted sequence position to reuse a scenario and bind its lifelines · Escape cancels",
-            CanvasTool::Add(Tool::Fragment) => "Click a highlighted sequence position to insert an empty fragment with operands · Escape cancels",
-            _ => "Select a lifeline or occurrence · drag its ↕ handle to reorder within its sequence",
-        }));
-    } else {
-        controls = controls.push(label(
-            "Pending form · the canvas remains visible · apply or cancel below",
-        ));
-    }
-    let clean = !pending && !app.draft_dirty() && !app.source_dirty();
-    let mut navigation = row![].spacing(6);
-    if referenced_scenario(p, owner, app.selected).is_some() {
-        navigation = navigation.push(button("Open definition").on_press_maybe(clean.then_some(
-            Message::ScenarioCanvas(CanvasEvent::OpenUse(context, app.selected)),
-        )));
-    }
-    if app.behavior.scenario.can_back(p, context) {
-        navigation =
-            navigation.push(button("Back to caller").on_press_maybe(
-                clean.then_some(Message::ScenarioCanvas(CanvasEvent::Back(context))),
-            ));
-    }
-    controls = controls.push(navigation.wrap());
-    out = out.push(controls);
-    let mut scene = Scene::sequence(p, owner, app.selected);
-    scene.interaction = Some((
-        context,
-        tool,
-        !app.behavior.has_pending() && !app.draft_dirty() && !app.source_dirty(),
-    ));
-    scene.scroll_offset = app.behavior.scenario.scroll_offset();
-    scene.pending_placement = app.behavior.scenario.pending_placement(owner);
-    let size = scene.size;
-    out = out.push(
-        container(super::scenario_scroll::observe(
-            context,
-            ScrollArea::Canvas,
-            app.behavior
-                .scenario
-                .scroll_restore(context, ScrollArea::Canvas),
-            scrollable(
-                canvas::Canvas::new(scene)
-                    .width(size.width)
-                    .height(size.height),
-            )
-            .direction(scrollable::Direction::Both {
-                vertical: scrollable::Scrollbar::default(),
-                horizontal: scrollable::Scrollbar::default(),
-            })
-            .height(if pending {
-                (app.window_size.height - 660.).clamp(110., 190.)
-            } else {
-                (app.window_size.height - 410.).clamp(180., 340.)
-            }),
-        ))
-        .padding(8)
-        .style(style::card),
-    );
-    if let Some(d) = app
-        .behavior
-        .scenario
-        .draft
-        .as_ref()
-        .filter(|d| d.owner == owner)
-    {
-        let mut form = column![
-            text(d.tool.label()).size(16),
-            text_input("Name (defaults to selected source)", &d.name)
-                .on_input(|s| event(Event::Name(s)))
-                .padding(9)
-                .size(12)
-        ]
-        .spacing(9);
-        if d.tool != Tool::Lifeline {
-            form = form.push(label(format!(
-                "Insert: {}",
-                slot_label(
-                    p,
-                    Slot {
-                        parent: d.parent,
-                        before: d.before
-                    }
-                )
-            )));
-            if d.before.is_some() {
-                form = form.push(
-                    button("Append to this sequence instead").on_press(event(Event::AppendInstead)),
-                );
-            }
-            form = form.push(picker(
-                parents(p, owner),
-                Some(d.parent),
-                "Destination sequence / operand…",
-                Event::Parent,
-            ));
-        }
-        if matches!(
-            d.tool,
-            Tool::Lifeline | Tool::Reuse | Tool::Action | Tool::Observation
-        ) {
-            form = form.push(picker(
-                sources(p, d),
-                d.target,
-                "Choose a named source…",
-                Event::Target,
-            ));
-        }
-        if d.tool == Tool::Message {
-            form = form.push(
-                pick_list(
-                    vec![
-                        MessageStyle::Asynchronous,
-                        MessageStyle::Call,
-                        MessageStyle::CallReply,
-                        MessageStyle::Reply,
-                        MessageStyle::Create,
-                        MessageStyle::Delete,
-                        MessageStyle::Timer,
-                    ],
-                    Some(d.style),
-                    |style| event(Event::Style(style)),
-                )
-                .width(Fill)
-                .padding(9)
-                .text_size(12),
-            );
-            if d.style == MessageStyle::Reply {
-                form = form.push(bounded_picker(
-                    app.behavior.scenario.call_choices(p, context, d),
-                    d,
-                    d.call,
-                    "Choose the earlier call…",
-                    Event::Call,
-                ));
-                if d.call.is_some() {
-                    form = form.push(label(
-                        "Reply reuses the call exchange in reverse and retains its correlation.",
-                    ));
-                }
-            } else if d.style != MessageStyle::Timer {
-                form = form.push(bounded_picker(
-                    exchanges(p, d),
-                    d,
-                    d.exchange,
-                    "Choose the exchange…",
-                    Event::Exchange,
-                ));
-                form = form.push(label(
-                    "Apply checks that the message is valid at this insertion position.",
-                ));
-            }
-            form = form.push(picker(
-                d.line_choices(p, true),
-                d.sender,
-                "Sending lifeline…",
-                Event::Sender,
-            ));
-            if d.style != MessageStyle::Timer {
-                form = form.push(picker(
-                    d.line_choices(p, false),
-                    d.receiver,
-                    "Receiving lifeline…",
-                    Event::Receiver,
-                ));
-            }
-            if d.style == MessageStyle::Timer {
-                form = form.push(
-                    text_input("Duration / deadline, e.g. 30 s", &d.expression)
-                        .on_input(|s| event(Event::Expression(s)))
-                        .padding(9)
-                        .size(12),
-                );
-            }
-            if p.layer_of(owner) == Some(Layer::Sa)
-                && viewpoint(p, owner) == ScenarioViewpoint::BoundaryInterface
-                && matches!(
-                    d.style,
-                    MessageStyle::Call | MessageStyle::CallReply | MessageStyle::Asynchronous
-                )
-            {
-                form = form.push(
-                    iced::widget::checkbox(d.operation.is_some())
-                        .label("Invoke a specific interface operation")
-                        .on_toggle(|enabled| event(Event::OperationIntent(enabled))),
-                );
-                if let Some(operation) = &d.operation {
-                    form = form
-                        .push(bounded_picker(
-                            crate::data_values::operation_choices(p, &d.proposed_message(p)),
-                            d,
-                            operation.allocation,
-                            "Choose the exact interface operation allocation…",
-                            Event::Operation,
-                        ))
-                        .push(
-                            button("Keep operation unresolved")
-                                .on_press(event(Event::ClearOperation)),
-                        );
-                    if let Some(id) = operation.allocation {
-                        form = form.push(label(crate::data_values::operation_identity(p, id)));
-                    }
-                }
-            }
-            if let Some(description) =
-                crate::data_values::operation_label(p, &d.proposed_message(p))
-            {
-                form = form.push(label(description));
-            }
-            match d.signature(p) {
-                Ok(Some(exchange)) => form = form.push(value_panel(p, d, &exchange)),
-                Err(problem) => {
-                    form = form.push(label(problem));
-                    for (key, expression) in d.authored_values() {
-                        form = form
-                            .push(
-                                text(format!(
-                                    "Retained value · {} / {}",
-                                    key.path
-                                        .iter()
-                                        .map(|id| p.named(*id))
-                                        .collect::<Vec<_>>()
-                                        .join(" → "),
-                                    p.named(key.field)
-                                ))
-                                .size(11),
-                            )
-                            .push(
-                                text_input("Value expression", expression)
-                                    .on_input({
-                                        let key = key.clone();
-                                        move |raw| event(Event::Value(key.clone(), raw))
-                                    })
-                                    .padding(8)
-                                    .size(12),
-                            );
-                    }
-                }
-                Ok(None) => {}
-            }
-            if d.style == MessageStyle::CallReply {
-                form=form.push(label("Creates the call and reversed, correlated reply together in one undoable operation."));
-            }
-        }
-        if matches!(d.tool, Tool::Action | Tool::Observation) {
-            form = form.push(picker(
-                lines(p, owner),
-                d.sender,
-                "Observed lifeline…",
-                Event::Sender,
-            ));
-        }
-        if d.tool == Tool::Reuse
-            && let Some(target) = d.target
-        {
-            for line in lines(p, target) {
-                let referenced = line.id;
-                let compatible: Vec<_> = lines(p, owner)
-                    .into_iter()
-                    .filter(|c| {
-                        compatible_binding(p, referenced, c.id)
-                            && !d
-                                .bindings
-                                .iter()
-                                .any(|(r, l)| *r != referenced && *l == c.id)
-                    })
-                    .collect();
-                if compatible.is_empty() {
-                    form = form.push(label(format!(
-                        "Add a compatible local lifeline before binding '{}'.",
-                        p.named(referenced)
-                    )));
-                }
-                form = form
-                    .push(label(format!("Bind {}", p.named(referenced))))
-                    .push(picker(
-                        compatible,
-                        d.bindings.get(&referenced).copied(),
-                        "Compatible local lifeline…",
-                        move |c| Event::Binding(referenced, c),
-                    ));
-            }
-            form = form.push(label(
-                "Bindings are explicit, one-to-one and refer to existing lifelines.",
-            ));
-        }
-        if d.tool == Tool::Fragment {
-            form = form.push(
-                pick_list(
-                    vec![
-                        Operator(FragmentOperator::Alternative),
-                        Operator(FragmentOperator::Parallel),
-                        Operator(FragmentOperator::Loop),
-                        Operator(FragmentOperator::Optional),
-                    ],
-                    Some(Operator(d.operator)),
-                    |o| event(Event::Operator(o)),
-                )
-                .padding(9)
-                .text_size(12)
-                .width(Fill),
-            );
-            if d.operator != FragmentOperator::Parallel {
-                form = form.push(
-                    text_input("Condition / loop guard", &d.expression)
-                        .on_input(|s| event(Event::Expression(s)))
-                        .padding(9)
-                        .size(12),
-                );
-            }
-            if d.operator == FragmentOperator::Alternative {
-                form = form.push(
-                    text_input("Second alternative guard", &d.second_guard)
-                        .on_input(|s| event(Event::SecondGuard(s)))
-                        .padding(9)
-                        .size(12),
-                );
-            }
-            form=form.push(label("Creates the fragment with its operands. Choose an operand as destination when adding messages or actions."));
-        }
-        let readiness = d.command(p);
-        if let Err(error) = &readiness {
-            form = form.push(label(error.clone()));
-        }
-        let footer = row![
-            button("Create")
-                .padding(9)
-                .on_press_maybe(readiness.is_ok().then_some(event(Event::Submit))),
-            action("Cancel", event(Event::Cancel))
-        ]
-        .spacing(7);
-        out = out.push(
-            container(
-                column![
-                    scrollable(form).height((app.window_size.height - 650.).clamp(110., 240.)),
-                    footer
-                ]
-                .spacing(9),
-            )
-            .padding(14)
-            .style(style::card),
-        );
-    }
-    if lines(p, owner).is_empty() && p.elements[&owner].steps().is_none_or(Vec::is_empty) {
-        out = out.push(container(label("Add lifelines for the participating work or actors, then create messages between them.")).padding(16).width(Fill).style(style::card));
-    } else if !pending {
-        out = sequence_rows(p, context, owner, out);
-    }
-    super::scenario_scroll::observe(
-        context,
-        ScrollArea::Page,
-        app.behavior
-            .scenario
-            .scroll_restore(context, ScrollArea::Page),
-        scrollable(out.padding(24)),
-    )
-}
-fn sequence_rows<'a>(
-    p: &'a Project,
-    context: Context,
-    owner: Id,
-    mut out: Column<'a, Message>,
-) -> Column<'a, Message> {
-    if let Some(SharedBody::Occurrence {
-        body: OccurrenceBody::Fragment { branches, .. },
-        ..
-    }) = p.elements.get(&owner).and_then(|e| e.shared())
-    {
-        for branch in branches {
-            out = out.push(action(
-                &format!("Operand: {}", p.named(*branch)),
-                Message::Select(*branch),
-            ));
-            out = sequence_rows(p, context, *branch, out);
-        }
-    }
-    if let Some(steps) = p.elements.get(&owner).and_then(|e| e.steps()) {
-        for (i, id) in steps.iter().enumerate() {
-            out =
-                out.push(
-                    row![
-                        action(
-                            &format!("{}. {}", i + 1, p.named(*id)),
-                            Message::Select(*id)
-                        )
-                        .width(Fill),
-                        button("↑")
-                            .padding(8)
-                            .on_press_maybe((i > 0).then_some(Message::Command(
-                                Command::MoveStep(owner, i, i.saturating_sub(1))
-                            ))),
-                        button("↓").padding(8).on_press_maybe(
-                            (i + 1 < steps.len()).then_some(Message::Command(Command::MoveStep(
-                                owner,
-                                i,
-                                i + 1
-                            )))
-                        )
-                    ]
-                    .spacing(6),
-                );
-            if let Some(SharedBody::Occurrence {
-                body:
-                    OccurrenceBody::ScenarioUse {
-                        scenario: Some(target),
-                        ..
-                    },
-                ..
-            }) = p.elements[id].shared()
-            {
-                out = out.push(action(
-                    &format!("Open {} →", p.named(*target)),
-                    Message::ScenarioCanvas(CanvasEvent::OpenUse(context, *id)),
-                ));
-            }
-            out = sequence_rows(p, context, *id, out);
-        }
-    }
-    out
-}
 
 #[cfg(test)]
 pub(crate) mod direct_tests {
@@ -2180,7 +1868,7 @@ pub(crate) mod direct_tests {
             epoch: 0,
         }
     }
-    fn placement_fixture() -> (Fixture, Id, Id, Id, Id, Id) {
+    pub(super) fn placement_fixture() -> (Fixture, Id, Id, Id, Id, Id) {
         let mut f = fixture();
         let p = &mut f.project;
         let machine = p
@@ -2334,7 +2022,12 @@ pub(crate) mod direct_tests {
             );
             assert_eq!(
                 app.behavior.scenario.scroll_offset(),
-                iced::Vector::new(25., 250.)
+                iced::Vector::new(25., 170.)
+            );
+            assert_eq!(
+                app.behavior.scenario.scroll_offsets[1],
+                iced::Vector::new(0., 80.),
+                "The caller's independent outline scroll is restored separately"
             );
             assert!(
                 !app.behavior
@@ -2471,6 +2164,11 @@ pub(crate) mod direct_tests {
             assert!(app.document.can_undo(), "{}", app.status);
             navigation_event(&mut app, CanvasEvent::Back);
             assert_eq!(app.selected, if edit == 0 { first } else { b });
+            assert_eq!(
+                app.scenario_context().unwrap().scenario,
+                if edit == 0 { a } else { b },
+                "Back must restore the caller workspace even if a rename already selected its UUID"
+            );
             assert_eq!(app.project(), &project);
             assert_eq!(app.document.bundle(), &source);
             assert_eq!(app.document.revision(), revision);
@@ -2909,7 +2607,7 @@ pub(crate) mod direct_tests {
         assert!(app.busy);
         assert_eq!(
             app.behavior.scenario.scroll_offset(),
-            iced::Vector::new(25., 140.)
+            iced::Vector::new(25., 100.)
         );
         assert_ne!(
             app.scenario_context(),
@@ -2925,7 +2623,7 @@ pub(crate) mod direct_tests {
         )));
         assert_eq!(
             app.behavior.scenario.scroll_offset(),
-            iced::Vector::new(25., 140.)
+            iced::Vector::new(25., 100.)
         );
         let root = std::path::PathBuf::from("scenario-scroll-save-fixture");
         let receipt = crate::app::FileSnapshot {

crates/oa-desktop/src/behavior/scenario/workspace.rs

@@ -0,0 +1,810 @@
+//! Scenario presentation. Layout/camera controls never construct model commands.
+use super::super::scenario_scroll;
+use super::*;
+use iced::widget::{Space, column, sensor};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Shelf {
+    Tools,
+    Selection,
+}
+
+#[derive(Clone, Default)]
+pub(super) struct Presentation {
+    pub(super) identity: Option<(Id, Id)>,
+    pub(super) viewport: Option<Size>,
+    pub(super) focused: bool,
+    pub(super) shelf: Option<Shelf>,
+    pub(super) zoom: Option<f32>,
+    pub(super) fit: bool,
+}
+const MIN_SCALE: f32 = 0.05;
+impl Presentation {
+    pub(super) fn viewport(&mut self, size: Size) -> bool {
+        if !size.width.is_finite()
+            || !size.height.is_finite()
+            || size.width <= 0.
+            || size.height <= 0.
+            || self.viewport == Some(size)
+        {
+            return false;
+        }
+        self.viewport = Some(size);
+        true
+    }
+    pub(super) fn zoom(&mut self, scale: Option<f32>) -> bool {
+        if scale.is_some_and(|value| !value.is_finite() || value <= 0.) {
+            return false;
+        }
+        let next = scale.map(|value| value.clamp(MIN_SCALE, 3.));
+        let changed = self.zoom != next || self.fit != scale.is_none();
+        self.zoom = next;
+        self.fit = scale.is_none();
+        changed
+    }
+    fn fit_scale(&self, scene: Size) -> Option<f32> {
+        let viewport = self.viewport?;
+        // This is the measured inner Scrollable, never a window-height estimate.
+        // Leave room for the overlay scrollbars on both axes.
+        Some(
+            ((viewport.width - 16.).max(1.) / scene.width.max(1.))
+                .min((viewport.height - 16.).max(1.) / scene.height.max(1.)),
+        )
+    }
+    fn scale(&self, scene: Size) -> f32 {
+        if self.fit {
+            self.fit_scale(scene).unwrap_or(1.).clamp(MIN_SCALE, 1.)
+        } else {
+            self.zoom.unwrap_or(1.)
+        }
+    }
+    fn fit_limited(&self, scene: Size) -> bool {
+        self.fit && self.fit_scale(scene).is_some_and(|scale| scale < MIN_SCALE)
+    }
+}
+
+pub fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Element<'a, Message> {
+    let p = app.project();
+    let state = &app.behavior.scenario;
+    let presentation = &state.presentation;
+    let pending = state
+        .draft
+        .as_ref()
+        .is_some_and(|draft| draft.owner == owner);
+    let context = app.scenario_context().expect("visible scenario context");
+    let tool = state.canvas_tool(owner);
+    let clean = !app.behavior.has_pending() && !app.draft_dirty() && !app.source_dirty();
+    let mut scene = Scene::sequence(p, owner, app.selected);
+    let scale = presentation.scale(scene.size);
+    let limited = presentation.fit_limited(scene.size);
+    scene.scale = scale;
+    scene.interaction = Some((context, tool, clean));
+    // The outline is a sibling shelf, not an ancestor of this canvas.
+    scene.scroll_offset = state.scroll_offset();
+    scene.pending_placement = state.pending_placement(owner);
+    let size = Size::new(scene.size.width * scale, scene.size.height * scale);
+    let canvas = canvas_pane(
+        context,
+        state.scroll_restore(context, ScrollArea::Canvas),
+        canvas::Canvas::new(scene)
+            .width(size.width)
+            .height(size.height)
+            .into(),
+    );
+    let mut navigation = row![
+        out.width(Fill),
+        button(
+            text(if presentation.focused {
+                "Restore panels"
+            } else {
+                "Focus canvas"
+            })
+            .size(12)
+        )
+        .padding(6)
+        .on_press(Message::ScenarioCanvas(CanvasEvent::Focus(context)))
+    ]
+    .spacing(6)
+    .align_y(iced::Center);
+    if state.can_back(p, context) {
+        navigation = navigation.push(
+            button(text("Back to caller").size(12))
+                .padding(6)
+                .on_press_maybe(
+                    clean.then_some(Message::ScenarioCanvas(CanvasEvent::Back(context))),
+                ),
+        );
+    }
+    let mut header = column![
+        navigation,
+        row![
+            button(text("Tools").size(12))
+                .padding(6)
+                .style(if presentation.shelf == Some(Shelf::Tools) {
+                    button::primary
+                } else {
+                    style::nav
+                })
+                .on_press(Message::ScenarioCanvas(CanvasEvent::Shelf(
+                    context,
+                    Shelf::Tools
+                ))),
+            button(text("Selection").size(12))
+                .padding(6)
+                .style(if presentation.shelf == Some(Shelf::Selection) {
+                    button::primary
+                } else {
+                    style::nav
+                })
+                .on_press(Message::ScenarioCanvas(CanvasEvent::Shelf(
+                    context,
+                    Shelf::Selection
+                ))),
+            button(text("Fit overview").size(12))
+                .padding(6)
+                .on_press(Message::ScenarioCanvas(CanvasEvent::Zoom(context, None))),
+            button(text("−").size(12))
+                .padding(6)
+                .on_press(Message::ScenarioCanvas(CanvasEvent::Zoom(
+                    context,
+                    Some(scale / 1.25)
+                ))),
+            text(format!("{:.0}%", scale * 100.)).size(12),
+            button(text("+").size(12))
+                .padding(6)
+                .on_press(Message::ScenarioCanvas(CanvasEvent::Zoom(
+                    context,
+                    Some(scale * 1.25)
+                ))),
+            button(text("100%").size(12))
+                .padding(6)
+                .on_press(Message::ScenarioCanvas(CanvasEvent::Zoom(
+                    context,
+                    Some(1.)
+                )))
+        ]
+        .spacing(6)
+        .align_y(iced::Center)
+        .wrap(),
+        text(if pending {
+            "Pending form · the highlighted sequence position is retained".to_owned()
+        } else if !p.children(owner).any(|e| e.kind() == Kind::Lifeline) {
+            "Start with a lifeline representing existing or explicitly new work / participants."
+                .into()
+        } else if !p.children(owner).any(|e| e.kind() == Kind::Occurrence) {
+            "Choose a first message, action or another tool; no occurrence is selected yet.".into()
+        } else {
+            let guidance = match tool {
+                CanvasTool::Message(_) => {
+                    "Click a source position, then click or drag to a target · Esc cancels"
+                }
+                CanvasTool::Add(Tool::Action | Tool::Observation) => {
+                    "Click a highlighted position · a lifeline click preselects that lifeline"
+                }
+                CanvasTool::Add(Tool::Reuse | Tool::Fragment) => {
+                    "Click a highlighted sequence position to open its form"
+                }
+                _ => "Select a lifeline or occurrence · drag its ↕ handle to reorder",
+            };
+            format!("{tool} · {guidance}")
+        })
+        .size(11)
+    ]
+    .spacing(6);
+    if !pending {
+        if !p.children(owner).any(|e| e.kind() == Kind::Lifeline) {
+            header = header.push(
+                row![
+                    text(format!("No lifelines · {:?}", viewpoint(p, owner))).size(12),
+                    button("Add first lifeline").on_press_maybe(clean.then_some({
+                        Message::ScenarioCanvas(CanvasEvent::First(context, Tool::Lifeline))
+                    }))
+                ]
+                .spacing(8),
+            );
+        } else if !p.children(owner).any(|e| e.kind() == Kind::Occurrence) {
+            header = header.push(
+                row![
+                    text("No occurrences yet").size(12),
+                    button("Add first message").on_press_maybe(clean.then_some({
+                        Message::ScenarioCanvas(CanvasEvent::First(context, Tool::Message))
+                    })),
+                    button("Add first action").on_press_maybe(clean.then_some({
+                        Message::ScenarioCanvas(CanvasEvent::First(context, Tool::Action))
+                    }))
+                ]
+                .spacing(8),
+            );
+        }
+    }
+    if limited {
+        header = header
+            .push(text("Minimum zoom reached · scroll to see the remaining scenario.").size(11));
+    }
+    let details = match presentation.shelf {
+        Some(Shelf::Tools) => {
+            let choose = move |tool| Message::ScenarioCanvas(CanvasEvent::Choose(context, tool));
+            let tool_picker: Element<'_, Message> = if clean {
+                pick_list(
+                    vec![
+                        CanvasTool::Select,
+                        CanvasTool::Message(MessageStyle::CallReply),
+                        CanvasTool::Message(MessageStyle::Asynchronous),
+                        CanvasTool::Message(MessageStyle::Call),
+                        CanvasTool::Message(MessageStyle::Reply),
+                        CanvasTool::Message(MessageStyle::Create),
+                        CanvasTool::Message(MessageStyle::Delete),
+                        CanvasTool::Message(MessageStyle::Timer),
+                        CanvasTool::Add(Tool::Action),
+                        CanvasTool::Add(Tool::Observation),
+                        CanvasTool::Add(Tool::Reuse),
+                        CanvasTool::Add(Tool::Fragment),
+                    ],
+                    Some(tool),
+                    choose,
+                )
+                .text_size(12)
+                .padding(6)
+                .width(Fill)
+                .into()
+            } else {
+                button(text(format!("{tool} · finish pending edits to change tools")).size(12))
+                    .padding(6)
+                    .width(Fill)
+                    .into()
+            };
+            column![
+                tool_picker,
+                row![
+                    button(text("+ Lifeline").size(12))
+                        .padding(6)
+                        .on_press_maybe(
+                            clean.then_some(event(Event::Start(owner, Tool::Lifeline)))
+                        ),
+                    button(text("Scenario properties").size(12))
+                        .padding(6)
+                        .on_press_maybe(clean.then_some(Message::EditProperties(owner))),
+                ]
+                .spacing(6)
+                .wrap(),
+                text(match viewpoint(p, owner) {
+                    ScenarioViewpoint::OperationalActivity =>
+                        "Activity scenario · lifelines represent activities",
+                    ScenarioViewpoint::Functional =>
+                        "Functional scenario · lifelines represent system functions",
+                    ScenarioViewpoint::ParticipantInteraction =>
+                        "Participant scenario · entities, actors or roles",
+                    ScenarioViewpoint::BoundaryInterface =>
+                        "Interface scenario · system and external actors",
+                    ScenarioViewpoint::MixedLegacy => "Mixed scenario · work or participants",
+                })
+                .size(11),
+            ]
+            .spacing(6)
+        }
+        _ => {
+            let mut details =
+                column![text(format!("Selected: {}", p.named(app.selected))).size(12)].spacing(6);
+            let mut navigation = row![].spacing(6);
+            if referenced_scenario(p, owner, app.selected).is_some() {
+                navigation = navigation.push(
+                    button(text("Open definition").size(12))
+                        .padding(6)
+                        .on_press_maybe(clean.then_some(Message::ScenarioCanvas(
+                            CanvasEvent::OpenUse(context, app.selected),
+                        ))),
+                );
+            }
+            navigation = navigation.push(
+                button(text("Properties").size(12))
+                    .padding(6)
+                    .on_press_maybe(clean.then_some(Message::EditProperties(app.selected))),
+            );
+            details = details.push(navigation.wrap());
+            if lines(p, owner).is_empty() && p.elements[&owner].steps().is_none_or(Vec::is_empty) {
+                details.push(
+                    text("Use Tools to add lifelines, then draw messages or insert occurrences.")
+                        .size(12),
+                )
+            } else {
+                sequence_rows(p, context, owner, details, clean)
+            }
+        }
+    };
+    let details = details_pane(
+        context,
+        state.scroll_restore(context, ScrollArea::Page),
+        details.into(),
+        presentation.shelf.is_some(),
+        pending,
+    );
+    let mut form_panel = editor_panel(Space::new().height(0).into(), Space::new().height(0).into());
+    if let Some(d) = app
+        .behavior
+        .scenario
+        .draft
+        .as_ref()
+        .filter(|d| d.owner == owner)
+    {
+        if let Some(child) = d.source.view(p) {
+            form_panel = column![
+                text(format!(
+                    "Consumer name: {}",
+                    crate::views::short(&d.name, 60)
+                ))
+                .size(12),
+                child.map(|e| event(Event::Source(e)))
+            ]
+            .spacing(6)
+            .height(Fill)
+            .into();
+        } else {
+            let mut form = column![
+                text(d.tool.label()).size(16),
+                text_input("Name (defaults to selected source)", &d.name)
+                    .on_input(|s| event(Event::Name(s)))
+                    .padding(9)
+                    .size(12)
+            ]
+            .spacing(9);
+            if d.tool != Tool::Lifeline {
+                form = form.push(label(format!(
+                    "Insert: {}",
+                    slot_label(
+                        p,
+                        Slot {
+                            parent: d.parent,
+                            before: d.before
+                        }
+                    )
+                )));
+                if d.before.is_some() {
+                    form = form.push(
+                        button("Append to this sequence instead")
+                            .on_press(event(Event::AppendInstead)),
+                    );
+                }
+                form = form.push(picker(
+                    parents(p, owner),
+                    Some(d.parent),
+                    "Destination sequence / operand…",
+                    Event::Parent,
+                ));
+            }
+            if matches!(
+                d.tool,
+                Tool::Lifeline | Tool::Reuse | Tool::Action | Tool::Observation
+            ) {
+                form = form.push(picker(
+                    sources(p, d),
+                    d.target,
+                    "Choose a named source…",
+                    Event::Target,
+                ));
+            }
+            if d.tool == Tool::Lifeline {
+                if let Some(title) = d.source.label(d.target) {
+                    form = form.push(label(title)).push(label(
+                        "Create commits one new source and this lifeline together.",
+                    ));
+                }
+                if viewpoint(p, owner) != ScenarioViewpoint::MixedLegacy {
+                    form = form.push(button("Create new source…").on_press(event(Event::Source(
+                        super::super::source_draft::Event::Open(d.invocation),
+                    ))));
+                } else {
+                    form=form.push(label("New source creation requires a strict viewpoint. Existing sources remain available."));
+                }
+            }
+            if d.tool == Tool::Message {
+                form = form.push(
+                    pick_list(
+                        vec![
+                            MessageStyle::Asynchronous,
+                            MessageStyle::Call,
+                            MessageStyle::CallReply,
+                            MessageStyle::Reply,
+                            MessageStyle::Create,
+                            MessageStyle::Delete,
+                            MessageStyle::Timer,
+                        ],
+                        Some(d.style),
+                        |style| event(Event::Style(style)),
+                    )
+                    .width(Fill)
+                    .padding(9)
+                    .text_size(12),
+                );
+                if d.style == MessageStyle::Reply {
+                    form = form.push(bounded_picker(
+                        app.behavior.scenario.call_choices(p, context, d),
+                        d,
+                        d.call,
+                        "Choose the earlier call…",
+                        Event::Call,
+                    ));
+                    if d.call.is_some() {
+                        form = form.push(label(
+                        "Reply reuses the call exchange in reverse and retains its correlation.",
+                    ));
+                    }
+                } else if d.style != MessageStyle::Timer {
+                    form = form.push(bounded_picker(
+                        exchanges(p, d),
+                        d,
+                        d.exchange,
+                        "Choose the exchange…",
+                        Event::Exchange,
+                    ));
+                    form = form.push(label(
+                        "Apply checks that the message is valid at this insertion position.",
+                    ));
+                }
+                form = form.push(picker(
+                    d.line_choices(p, true),
+                    d.sender,
+                    "Sending lifeline…",
+                    Event::Sender,
+                ));
+                if d.style != MessageStyle::Timer {
+                    form = form.push(picker(
+                        d.line_choices(p, false),
+                        d.receiver,
+                        "Receiving lifeline…",
+                        Event::Receiver,
+                    ));
+                }
+                if d.style == MessageStyle::Timer {
+                    form = form.push(
+                        text_input("Duration / deadline, e.g. 30 s", &d.expression)
+                            .on_input(|s| event(Event::Expression(s)))
+                            .padding(9)
+                            .size(12),
+                    );
+                }
+                if p.layer_of(owner) == Some(Layer::Sa)
+                    && viewpoint(p, owner) == ScenarioViewpoint::BoundaryInterface
+                    && matches!(
+                        d.style,
+                        MessageStyle::Call | MessageStyle::CallReply | MessageStyle::Asynchronous
+                    )
+                {
+                    form = form.push(
+                        iced::widget::checkbox(d.operation.is_some())
+                            .label("Invoke a specific interface operation")
+                            .on_toggle(|enabled| event(Event::OperationIntent(enabled))),
+                    );
+                    if let Some(operation) = &d.operation {
+                        form = form
+                            .push(bounded_picker(
+                                crate::data_values::operation_choices(p, &d.proposed_message(p)),
+                                d,
+                                operation.allocation,
+                                "Choose the exact interface operation allocation…",
+                                Event::Operation,
+                            ))
+                            .push(
+                                button("Keep operation unresolved")
+                                    .on_press(event(Event::ClearOperation)),
+                            );
+                        if let Some(id) = operation.allocation {
+                            form = form.push(label(crate::data_values::operation_identity(p, id)));
+                        }
+                    }
+                }
+                if let Some(description) =
+                    crate::data_values::operation_label(p, &d.proposed_message(p))
+                {
+                    form = form.push(label(description));
+                }
+                match d.signature(p) {
+                    Ok(Some(exchange)) => form = form.push(value_panel(p, d, &exchange)),
+                    Err(problem) => {
+                        form = form.push(label(problem));
+                        for (key, expression) in d.authored_values() {
+                            form = form
+                                .push(
+                                    text(format!(
+                                        "Retained value · {} / {}",
+                                        key.path
+                                            .iter()
+                                            .map(|id| p.named(*id))
+                                            .collect::<Vec<_>>()
+                                            .join(" → "),
+                                        p.named(key.field)
+                                    ))
+                                    .size(11),
+                                )
+                                .push(
+                                    text_input("Value expression", expression)
+                                        .on_input({
+                                            let key = key.clone();
+                                            move |raw| event(Event::Value(key.clone(), raw))
+                                        })
+                                        .padding(8)
+                                        .size(12),
+                                );
+                        }
+                    }
+                    Ok(None) => {}
+                }
+                if d.style == MessageStyle::CallReply {
+                    form=form.push(label("Creates the call and reversed, correlated reply together in one undoable operation."));
+                }
+            }
+            if matches!(d.tool, Tool::Action | Tool::Observation) {
+                form = form.push(picker(
+                    lines(p, owner),
+                    d.sender,
+                    "Observed lifeline…",
+                    Event::Sender,
+                ));
+            }
+            if d.tool == Tool::Reuse
+                && let Some(target) = d.target
+            {
+                for line in lines(p, target) {
+                    let referenced = line.id;
+                    let compatible: Vec<_> = lines(p, owner)
+                        .into_iter()
+                        .filter(|c| {
+                            compatible_binding(p, referenced, c.id)
+                                && !d
+                                    .bindings
+                                    .iter()
+                                    .any(|(r, l)| *r != referenced && *l == c.id)
+                        })
+                        .collect();
+                    if compatible.is_empty() {
+                        form = form.push(label(format!(
+                            "Add a compatible local lifeline before binding '{}'.",
+                            p.named(referenced)
+                        )));
+                    }
+                    form = form
+                        .push(label(format!("Bind {}", p.named(referenced))))
+                        .push(picker(
+                            compatible,
+                            d.bindings.get(&referenced).copied(),
+                            "Compatible local lifeline…",
+                            move |c| Event::Binding(referenced, c),
+                        ));
+                }
+                form = form.push(label(
+                    "Bindings are explicit, one-to-one and refer to existing lifelines.",
+                ));
+            }
+            if d.tool == Tool::Fragment {
+                form = form.push(
+                    pick_list(
+                        vec![
+                            Operator(FragmentOperator::Alternative),
+                            Operator(FragmentOperator::Parallel),
+                            Operator(FragmentOperator::Loop),
+                            Operator(FragmentOperator::Optional),
+                        ],
+                        Some(Operator(d.operator)),
+                        |o| event(Event::Operator(o)),
+                    )
+                    .padding(9)
+                    .text_size(12)
+                    .width(Fill),
+                );
+                if d.operator != FragmentOperator::Parallel {
+                    form = form.push(
+                        text_input("Condition / loop guard", &d.expression)
+                            .on_input(|s| event(Event::Expression(s)))
+                            .padding(9)
+                            .size(12),
+                    );
+                }
+                if d.operator == FragmentOperator::Alternative {
+                    form = form.push(
+                        text_input("Second alternative guard", &d.second_guard)
+                            .on_input(|s| event(Event::SecondGuard(s)))
+                            .padding(9)
+                            .size(12),
+                    );
+                }
+                form=form.push(label("Creates the fragment with its operands. Choose an operand as destination when adding messages or actions."));
+            }
+            let readiness = d.command(p);
+            if let Err(error) = &readiness {
+                form = form.push(label(error.clone()));
+            }
+            let footer = row![
+                button("Create")
+                    .padding(9)
+                    .on_press_maybe(readiness.is_ok().then_some(event(Event::Submit))),
+                action("Cancel", event(Event::Cancel))
+            ]
+            .spacing(7);
+            form_panel = editor_panel(footer.into(), form.into());
+        }
+    }
+    workspace_layout(header.into(), details, canvas, form_panel, pending)
+}
+
+fn sequence_action<'a>(
+    title: &str,
+    message: Message,
+    enabled: bool,
+) -> iced::widget::Button<'a, Message> {
+    button(text(title.to_owned()).size(12))
+        .padding(8)
+        .style(style::nav)
+        .on_press_maybe(enabled.then_some(message))
+}
+
+// Permanent header/shelf/body and canvas/form slots. Zero-sized disclosures
+// must remain in the tree: Column::push otherwise drops them and remounts siblings.
+fn workspace_layout<'a, R: iced::advanced::text::Renderer + 'a>(
+    header: iced::Element<'a, Message, Theme, R>,
+    details: iced::Element<'a, Message, Theme, R>,
+    canvas: iced::Element<'a, Message, Theme, R>,
+    form: iced::Element<'a, Message, Theme, R>,
+    pending: bool,
+) -> iced::Element<'a, Message, Theme, R> {
+    let panes = Column::from_vec(vec![
+        container(canvas).width(Fill).height(Fill).into(),
+        container(form)
+            .width(Fill)
+            .height(if pending {
+                Fill
+            } else {
+                iced::Length::Fixed(0.)
+            })
+            .clip(true)
+            .into(),
+    ])
+    .spacing(if pending { 6 } else { 0 })
+    .width(Fill)
+    .height(Fill);
+    Column::from_vec(vec![header, details, panes.into()])
+        .spacing(6)
+        .padding(8)
+        .width(Fill)
+        .height(Fill)
+        .into()
+}
+
+fn details_pane<'a, R: iced::advanced::text::Renderer + 'a>(
+    context: Context,
+    restore: Option<ScrollRestore>,
+    details: iced::Element<'a, Message, Theme, R>,
+    open: bool,
+    pending: bool,
+) -> iced::Element<'a, Message, Theme, R> {
+    scenario_scroll::observe(
+        context,
+        ScrollArea::Page,
+        restore,
+        scrollable(details)
+            .id("scenario-details")
+            .width(Fill)
+            .height(if open {
+                if pending { 72. } else { 100. }
+            } else {
+                0.
+            }),
+    )
+}
+
+fn canvas_pane<'a, R: iced::advanced::text::Renderer + 'a>(
+    context: Context,
+    restore: Option<ScrollRestore>,
+    content: iced::Element<'a, Message, Theme, R>,
+) -> iced::Element<'a, Message, Theme, R> {
+    container(
+        sensor(scenario_scroll::observe(
+            context,
+            ScrollArea::Canvas,
+            restore,
+            scrollable(content)
+                .id("scenario-canvas")
+                .direction(scrollable::Direction::Both {
+                    vertical: scrollable::Scrollbar::default(),
+                    horizontal: scrollable::Scrollbar::default(),
+                })
+                .width(Fill)
+                .height(Fill),
+        ))
+        // A new owner/document needs its first measurement even at the same size.
+        .key((context.document, context.scenario))
+        .on_show(move |size| Message::ScenarioCanvas(CanvasEvent::Viewport(context, size)))
+        .on_resize(move |size| Message::ScenarioCanvas(CanvasEvent::Viewport(context, size))),
+    )
+    .padding(8)
+    .width(Fill)
+    .height(Fill)
+    .style(style::card)
+    .into()
+}
+
+fn editor_panel<'a, R: iced::advanced::text::Renderer + 'a>(
+    actions: iced::Element<'a, Message, Theme, R>,
+    fields: iced::Element<'a, Message, Theme, R>,
+) -> iced::Element<'a, Message, Theme, R> {
+    container(
+        column![
+            container(actions).id("scenario-actions").width(Fill),
+            scrollable(fields)
+                .id("scenario-form")
+                .width(Fill)
+                .height(Fill),
+        ]
+        .spacing(6),
+    )
+    .padding(10)
+    .width(Fill)
+    .height(Fill)
+    .style(style::card)
+    .into()
+}
+
+#[cfg(all(test, debug_assertions))]
+mod tests;
+
+fn sequence_rows<'a>(
+    p: &'a Project,
+    context: Context,
+    owner: Id,
+    mut out: Column<'a, Message>,
+    enabled: bool,
+) -> Column<'a, Message> {
+    if let Some(SharedBody::Occurrence {
+        body: OccurrenceBody::Fragment { branches, .. },
+        ..
+    }) = p.elements.get(&owner).and_then(|e| e.shared())
+    {
+        for branch in branches {
+            out = out.push(sequence_action(
+                &format!("Operand: {}", p.named(*branch)),
+                Message::Select(*branch),
+                enabled,
+            ));
+            out = sequence_rows(p, context, *branch, out, enabled);
+        }
+    }
+    if let Some(steps) = p.elements.get(&owner).and_then(|e| e.steps()) {
+        for (i, id) in steps.iter().enumerate() {
+            out = out.push(
+                row![
+                    sequence_action(
+                        &format!("{}. {}", i + 1, p.named(*id)),
+                        Message::Select(*id),
+                        enabled
+                    )
+                    .width(Fill),
+                    button("↑")
+                        .padding(8)
+                        .on_press_maybe((enabled && i > 0).then_some(Message::Command(
+                            Command::MoveStep(owner, i, i.saturating_sub(1))
+                        ))),
+                    button("↓").padding(8).on_press_maybe(
+                        (enabled && i + 1 < steps.len())
+                            .then_some(Message::Command(Command::MoveStep(owner, i, i + 1)))
+                    )
+                ]
+                .spacing(6),
+            );
+            if let Some(SharedBody::Occurrence {
+                body:
+                    OccurrenceBody::ScenarioUse {
+                        scenario: Some(target),
+                        ..
+                    },
+                ..
+            }) = p.elements[id].shared()
+            {
+                out = out.push(sequence_action(
+                    &format!("Open {} →", p.named(*target)),
+                    Message::ScenarioCanvas(CanvasEvent::OpenUse(context, *id)),
+                    enabled,
+                ));
+            }
+            out = sequence_rows(p, context, *id, out, enabled);
+        }
+    }
+    out
+}

crates/oa-desktop/src/behavior/scenario/workspace/tests.rs

@@ -0,0 +1,900 @@
+use super::*;
+use iced::Vector;
+use iced::advanced::{Layout, Shell, layout, widget};
+
+#[derive(Default)]
+struct Geometry {
+    scrolls: BTreeMap<String, (Rectangle, Vector)>,
+    actions: Option<Rectangle>,
+}
+impl widget::Operation for Geometry {
+    fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn widget::Operation)) {
+        visit(self);
+    }
+    fn container(&mut self, id: Option<&widget::Id>, bounds: Rectangle) {
+        if id == Some(&widget::Id::new("scenario-actions")) {
+            self.actions = Some(bounds);
+        }
+    }
+    fn scrollable(
+        &mut self,
+        id: Option<&widget::Id>,
+        bounds: Rectangle,
+        _: Rectangle,
+        translation: Vector,
+        _: &mut dyn widget::operation::Scrollable,
+    ) {
+        for name in ["scenario-canvas", "scenario-details", "scenario-form"] {
+            if id == Some(&widget::Id::new(name)) {
+                assert!(
+                    self.scrolls
+                        .insert(name.into(), (bounds, translation))
+                        .is_none()
+                );
+            }
+        }
+    }
+}
+type TestView = iced::Element<'static, Message, Theme, ()>;
+fn fixture_view(state: &State, context: Context, pending: bool, header: f32) -> TestView {
+    workspace_layout(
+        Space::new().height(header).into(),
+        details_pane(
+            context,
+            state.scroll_restore(context, ScrollArea::Page),
+            Space::new().height(1800.).into(),
+            state.presentation.shelf.is_some(),
+            pending,
+        ),
+        canvas_pane(
+            context,
+            state.scroll_restore(context, ScrollArea::Canvas),
+            Space::new().width(1800.).height(2400.).into(),
+        ),
+        editor_panel(
+            Space::new().height(32.).into(),
+            Space::new().height(2000.).into(),
+        ),
+        pending,
+    )
+}
+fn geometry(view: &mut TestView, tree: &mut widget::Tree, size: Size) -> (layout::Node, Geometry) {
+    let node = view
+        .as_widget_mut()
+        .layout(tree, &(), &layout::Limits::new(Size::ZERO, size));
+    let mut geometry = Geometry::default();
+    view.as_widget_mut()
+        .operate(tree, Layout::new(&node), &(), &mut geometry);
+    (node, geometry)
+}
+fn scroll(
+    view: &mut TestView,
+    tree: &mut widget::Tree,
+    node: &layout::Node,
+    name: &'static str,
+    offset: Vector,
+) {
+    let mut operation = widget::operation::scrollable::scroll_to::<()>(
+        widget::Id::new(name),
+        widget::operation::scrollable::AbsoluteOffset {
+            x: Some(offset.x),
+            y: Some(offset.y),
+        },
+    );
+    view.as_widget_mut()
+        .operate(tree, Layout::new(node), &(), &mut operation);
+}
+fn redraw(view: &mut TestView, tree: &mut widget::Tree, size: Size, app: &mut App) {
+    let (node, _) = geometry(view, tree, size);
+    let mut messages = vec![];
+    view.as_widget_mut().update(
+        tree,
+        &iced::Event::Window(iced::window::Event::RedrawRequested(
+            std::time::Instant::now(),
+        )),
+        Layout::new(&node),
+        mouse::Cursor::Unavailable,
+        &(),
+        &mut iced::advanced::clipboard::Null,
+        &mut Shell::new(&mut messages),
+        &Rectangle::with_size(size),
+    );
+    for message in messages {
+        let _ = app.update(message);
+    }
+}
+
+#[test]
+fn scenario_workspace_allocates_remaining_height_and_pins_actions_at_minimum_and_wide_sizes() {
+    for size in [
+        Size::new(500., 570.),
+        Size::new(1050., 570.),
+        Size::new(840., 770.),
+        Size::new(1394., 802.),
+    ] {
+        for pending in [false, true] {
+            for shelf in [None, Some(Shelf::Tools), Some(Shelf::Selection)] {
+                for header in [68., 100., 132.] {
+                    let mut state = State::default();
+                    state.presentation.shelf = shelf;
+                    let mut view = fixture_view(
+                        &state,
+                        super::super::direct_tests::context(Id::new_v4()),
+                        pending,
+                        header,
+                    );
+                    let mut tree = widget::Tree::new(view.as_widget());
+                    let (node, actual) = geometry(&mut view, &mut tree, size);
+                    assert_eq!(node.size(), size);
+                    let canvas = actual.scrolls["scenario-canvas"].0;
+                    assert!(canvas.x >= 0. && canvas.y >= header);
+                    assert!(
+                        canvas.x + canvas.width <= size.width
+                            && canvas.y + canvas.height <= size.height
+                    );
+                    assert!(
+                        canvas.height >= if pending { 145. } else { 290. },
+                        "{size:?} header={header} pending={pending} shelf={shelf:?}: {canvas:?}"
+                    );
+                    if pending {
+                        let form = actual.scrolls["scenario-form"].0;
+                        let actions = actual.actions.unwrap();
+                        assert!(form.height >= 100. && form.y + form.height <= size.height);
+                        assert!(actions.y >= canvas.y + canvas.height);
+                        assert!(actions.y + actions.height <= form.y);
+                        scroll(
+                            &mut view,
+                            &mut tree,
+                            &node,
+                            "scenario-form",
+                            Vector::new(0., 600.),
+                        );
+                        let (_, after) = geometry(&mut view, &mut tree, size);
+                        assert_eq!(after.actions, Some(actions));
+                        assert_eq!(after.scrolls["scenario-form"].1.y, 600.);
+                        assert_eq!(after.scrolls["scenario-canvas"].1, Vector::ZERO);
+                    }
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn scenario_workspace_canvas_and_form_scroll_survive_disclosures_focus_width_and_resize() {
+    let context = super::super::direct_tests::context(Id::new_v4());
+    let mut state = State::default();
+    let mut view = fixture_view(&state, context, false, 68.);
+    let mut tree = widget::Tree::new(view.as_widget());
+    let (node, _) = geometry(&mut view, &mut tree, Size::new(500., 570.));
+    let offset = Vector::new(90., 180.);
+    scroll(&mut view, &mut tree, &node, "scenario-canvas", offset);
+    let mut prior_form = false;
+    for (pending, shelf, header, size) in [
+        (false, Some(Shelf::Tools), 100., Size::new(500., 570.)),
+        (true, Some(Shelf::Selection), 68., Size::new(1050., 570.)),
+        (true, None, 68., Size::new(1394., 802.)),
+        (true, Some(Shelf::Tools), 100., Size::new(500., 570.)),
+        (false, None, 100., Size::new(500., 570.)),
+    ] {
+        state.presentation.shelf = shelf;
+        view = fixture_view(&state, context, pending, header);
+        tree.diff(view.as_widget());
+        let (node, actual) = geometry(&mut view, &mut tree, size);
+        assert_eq!(actual.scrolls["scenario-canvas"].1, offset);
+        if pending {
+            if prior_form {
+                assert_eq!(actual.scrolls["scenario-form"].1.y, 600.);
+            }
+            scroll(
+                &mut view,
+                &mut tree,
+                &node,
+                "scenario-form",
+                Vector::new(0., 600.),
+            );
+            let (_, after) = geometry(&mut view, &mut tree, size);
+            assert_eq!(after.actions, actual.actions);
+            assert_eq!(after.scrolls["scenario-canvas"].1, offset);
+        }
+        prior_form = pending;
+    }
+}
+
+#[test]
+fn scenario_workspace_caller_restores_actual_mounted_canvas_and_shelf_with_camera() {
+    use super::super::direct_tests::{navigation_event, navigation_fixture};
+    let (p, [a, b, _], [reference, _, _]) = navigation_fixture();
+    let mut app = App::with_project(p);
+    let _ = app.update(Message::Select(a));
+    let _ = app.update(Message::Page(crate::app::Page::Behavior));
+    navigation_event(&mut app, |ctx| CanvasEvent::Shelf(ctx, Shelf::Selection));
+    navigation_event(&mut app, CanvasEvent::Focus);
+    navigation_event(&mut app, |ctx| CanvasEvent::Zoom(ctx, Some(0.75)));
+    let source = app.document.snapshot();
+    let size = Size::new(1050., 570.);
+    let mut view = fixture_view(
+        &app.behavior.scenario,
+        app.scenario_context().unwrap(),
+        false,
+        68.,
+    );
+    let mut tree = widget::Tree::new(view.as_widget());
+    redraw(&mut view, &mut tree, size, &mut app);
+    let (node, _) = geometry(&mut view, &mut tree, size);
+    let canvas_offset = Vector::new(90., 180.);
+    scroll(
+        &mut view,
+        &mut tree,
+        &node,
+        "scenario-canvas",
+        canvas_offset,
+    );
+    scroll(
+        &mut view,
+        &mut tree,
+        &node,
+        "scenario-details",
+        Vector::new(0., 80.),
+    );
+    redraw(&mut view, &mut tree, size, &mut app);
+    assert_eq!(
+        app.behavior.scenario.scroll_offset(),
+        canvas_offset,
+        "shelf is not a canvas ancestor"
+    );
+    navigation_event(&mut app, |ctx| CanvasEvent::OpenUse(ctx, reference));
+    assert_eq!(app.selected, b);
+    view = fixture_view(
+        &app.behavior.scenario,
+        app.scenario_context().unwrap(),
+        false,
+        68.,
+    );
+    tree.diff(view.as_widget());
+    redraw(&mut view, &mut tree, size, &mut app);
+    let (_, opened) = geometry(&mut view, &mut tree, size);
+    assert_eq!(opened.scrolls["scenario-canvas"].1, Vector::ZERO);
+    navigation_event(&mut app, |ctx| CanvasEvent::Zoom(ctx, Some(2.)));
+    navigation_event(&mut app, CanvasEvent::Focus);
+    navigation_event(&mut app, CanvasEvent::Back);
+    assert_eq!(app.selected, reference);
+    assert!(app.behavior.scenario.focused());
+    assert_eq!(
+        app.behavior.scenario.presentation.shelf,
+        Some(Shelf::Selection)
+    );
+    assert_eq!(
+        app.behavior
+            .scenario
+            .presentation
+            .scale(Size::new(800., 1200.)),
+        0.75
+    );
+    view = fixture_view(
+        &app.behavior.scenario,
+        app.scenario_context().unwrap(),
+        false,
+        68.,
+    );
+    tree.diff(view.as_widget());
+    redraw(&mut view, &mut tree, size, &mut app);
+    let (node, returned) = geometry(&mut view, &mut tree, size);
+    assert_eq!(returned.scrolls["scenario-canvas"].1, canvas_offset);
+    assert_eq!(returned.scrolls["scenario-details"].1, Vector::new(0., 80.));
+    for area in [ScrollArea::Canvas, ScrollArea::Page] {
+        assert!(
+            app.behavior
+                .scenario
+                .scroll_restore(app.scenario_context().unwrap(), area)
+                .is_none()
+        );
+    }
+    scroll(
+        &mut view,
+        &mut tree,
+        &node,
+        "scenario-canvas",
+        Vector::new(90., 220.),
+    );
+    redraw(&mut view, &mut tree, size, &mut app);
+    assert_eq!(
+        geometry(&mut view, &mut tree, size).1.scrolls["scenario-canvas"]
+            .1
+            .y,
+        220.,
+        "receipt cannot snap a later gesture back"
+    );
+    assert!(std::sync::Arc::ptr_eq(&source, &app.document.snapshot()));
+    assert!(!app.document.can_undo());
+}
+
+#[test]
+fn scenario_workspace_fit_uses_measured_inner_viewport_and_rejects_nonfinite_inputs() {
+    let graph = Size::new(900., 1400.);
+    let mut presentation = Presentation::default();
+    assert_eq!(presentation.scale(graph), 1.);
+    presentation.zoom(None);
+    assert_eq!(
+        presentation.scale(graph),
+        1.,
+        "no invented window-height fallback"
+    );
+    assert!(presentation.viewport(Size::new(484., 204.)));
+    assert!(!presentation.viewport(Size::new(484., 204.)));
+    let scale = presentation.scale(graph);
+    assert!(graph.width * scale <= 468. && graph.height * scale <= 188.);
+    assert!(!presentation.fit_limited(graph));
+    for bad in [f32::NAN, f32::INFINITY, 0., -1.] {
+        assert!(!presentation.zoom(Some(bad)));
+        assert!(!presentation.viewport(Size::new(bad, 100.)));
+        assert!(!presentation.viewport(Size::new(100., bad)));
+        assert_eq!(presentation.scale(graph), scale);
+    }
+    assert!(presentation.fit_limited(Size::new(900., 10000.)));
+    assert!(presentation.zoom(Some(1.25)));
+    presentation.viewport(Size::new(200., 100.));
+    assert_eq!(
+        presentation.scale(graph),
+        1.25,
+        "manual zoom survives form/viewport resize"
+    );
+}
+
+#[test]
+fn scenario_workspace_fit_reobserves_same_sized_owner_and_document_changes() {
+    use super::super::direct_tests::{navigation_event, navigation_fixture};
+    let (project, [a, b, _], [reference, _, _]) = navigation_fixture();
+    let mut app = App::with_project(project.clone());
+    let _ = app.update(Message::Select(a));
+    let _ = app.update(Message::Page(crate::app::Page::Behavior));
+    let size = Size::new(500., 570.);
+    let graph = Size::new(1800., 2400.);
+    let mut view = fixture_view(
+        &app.behavior.scenario,
+        app.scenario_context().unwrap(),
+        false,
+        68.,
+    );
+    let mut tree = widget::Tree::new(view.as_widget());
+    redraw(&mut view, &mut tree, size, &mut app);
+    let (_, first) = geometry(&mut view, &mut tree, size);
+    let measured = first.scrolls["scenario-canvas"].0.size();
+    assert_eq!(app.behavior.scenario.presentation.viewport, Some(measured));
+
+    let accepted = app.document.snapshot();
+    navigation_event(&mut app, |ctx| CanvasEvent::OpenUse(ctx, reference));
+    assert_eq!(app.scenario_context().unwrap().scenario, b);
+    assert_eq!(app.behavior.scenario.presentation.viewport, None);
+    view = fixture_view(
+        &app.behavior.scenario,
+        app.scenario_context().unwrap(),
+        false,
+        68.,
+    );
+    tree.diff(view.as_widget());
+    redraw(&mut view, &mut tree, size, &mut app);
+    let (_, second) = geometry(&mut view, &mut tree, size);
+    assert_eq!(second.scrolls["scenario-canvas"].0.size(), measured);
+    assert_eq!(app.behavior.scenario.presentation.viewport, Some(measured));
+    navigation_event(&mut app, |ctx| CanvasEvent::Zoom(ctx, None));
+    let fitted = app.behavior.scenario.presentation.scale(graph);
+    assert!(
+        fitted < 1.
+            && graph.width * fitted <= measured.width - 16.
+            && graph.height * fitted <= measured.height - 16.
+    );
+    assert!(std::sync::Arc::ptr_eq(&accepted, &app.document.snapshot()));
+    assert!(!app.document.can_undo());
+
+    let document = app.scenario_context().unwrap().document;
+    let mut replacement = App::with_project(project);
+    let _ = replacement.update(Message::Select(b));
+    let _ = replacement.update(Message::Page(crate::app::Page::Behavior));
+    assert_ne!(replacement.scenario_context().unwrap().document, document);
+    assert_eq!(replacement.behavior.scenario.presentation.viewport, None);
+    let accepted = replacement.document.snapshot();
+    view = fixture_view(
+        &replacement.behavior.scenario,
+        replacement.scenario_context().unwrap(),
+        false,
+        68.,
+    );
+    tree.diff(view.as_widget());
+    redraw(&mut view, &mut tree, size, &mut replacement);
+    let (_, replaced) = geometry(&mut view, &mut tree, size);
+    assert_eq!(replaced.scrolls["scenario-canvas"].0.size(), measured);
+    assert_eq!(
+        replacement.behavior.scenario.presentation.viewport,
+        Some(measured)
+    );
+    navigation_event(&mut replacement, |ctx| CanvasEvent::Zoom(ctx, None));
+    assert_eq!(
+        replacement.behavior.scenario.presentation.scale(graph),
+        fitted
+    );
+    assert!(std::sync::Arc::ptr_eq(
+        &accepted,
+        &replacement.document.snapshot()
+    ));
+    assert!(!replacement.document.can_undo());
+}
+
+#[test]
+fn scenario_workspace_open_and_back_restore_owner_and_mounted_scroll_after_preselection() {
+    use super::super::direct_tests::{navigation_event, navigation_fixture};
+    let (p, [a, b, _], [reference, _, _]) = navigation_fixture();
+    let mut app = App::with_project(p);
+    let _ = app.update(Message::Select(a));
+    let _ = app.update(Message::Page(crate::app::Page::Behavior));
+    navigation_event(&mut app, |ctx| {
+        CanvasEvent::Choose(ctx, CanvasTool::Message(MessageStyle::Timer))
+    });
+    navigation_event(&mut app, |ctx| CanvasEvent::Shelf(ctx, Shelf::Selection));
+    navigation_event(&mut app, CanvasEvent::Focus);
+    navigation_event(&mut app, |ctx| CanvasEvent::Zoom(ctx, Some(0.75)));
+    let size = Size::new(1050., 570.);
+    let mut view = fixture_view(
+        &app.behavior.scenario,
+        app.scenario_context().unwrap(),
+        false,
+        68.,
+    );
+    let mut tree = widget::Tree::new(view.as_widget());
+    redraw(&mut view, &mut tree, size, &mut app);
+    let (node, _) = geometry(&mut view, &mut tree, size);
+    let offset = Vector::new(90., 180.);
+    scroll(&mut view, &mut tree, &node, "scenario-canvas", offset);
+    scroll(
+        &mut view,
+        &mut tree,
+        &node,
+        "scenario-details",
+        Vector::new(0., 80.),
+    );
+    redraw(&mut view, &mut tree, size, &mut app);
+
+    let _ = app.update(Message::Command(Command::Rename(
+        b,
+        "Renamed definition".into(),
+    )));
+    assert_eq!(app.selected, b);
+    assert_eq!(app.scenario_context().unwrap().scenario, a);
+    let before_open = app.document.snapshot();
+    navigation_event(&mut app, |ctx| CanvasEvent::OpenUse(ctx, reference));
+    assert_eq!(app.selected, b);
+    assert_eq!(app.scenario_context().unwrap().scenario, b);
+    assert!(std::sync::Arc::ptr_eq(
+        &before_open,
+        &app.document.snapshot()
+    ));
+    view = fixture_view(
+        &app.behavior.scenario,
+        app.scenario_context().unwrap(),
+        false,
+        68.,
+    );
+    tree.diff(view.as_widget());
+    redraw(&mut view, &mut tree, size, &mut app);
+    let (_, opened) = geometry(&mut view, &mut tree, size);
+    assert_eq!(opened.scrolls["scenario-canvas"].1, Vector::ZERO);
+
+    let _ = app.update(Message::Command(Command::Rename(
+        reference,
+        "Renamed caller use".into(),
+    )));
+    assert_eq!(app.selected, reference);
+    assert_eq!(app.scenario_context().unwrap().scenario, b);
+    let before_back = app.document.snapshot();
+    let revision = app.document.revision();
+    navigation_event(&mut app, CanvasEvent::Back);
+    assert_eq!(app.selected, reference);
+    assert_eq!(app.scenario_context().unwrap().scenario, a);
+    assert_eq!(
+        app.behavior.scenario.canvas_tool(a),
+        CanvasTool::Message(MessageStyle::Timer)
+    );
+    assert!(app.behavior.scenario.focused());
+    assert_eq!(
+        app.behavior.scenario.presentation.shelf,
+        Some(Shelf::Selection)
+    );
+    assert_eq!(app.behavior.scenario.presentation.zoom, Some(0.75));
+    view = fixture_view(
+        &app.behavior.scenario,
+        app.scenario_context().unwrap(),
+        false,
+        68.,
+    );
+    tree.diff(view.as_widget());
+    redraw(&mut view, &mut tree, size, &mut app);
+    let (_, restored) = geometry(&mut view, &mut tree, size);
+    assert_eq!(restored.scrolls["scenario-canvas"].1, offset);
+    assert_eq!(restored.scrolls["scenario-details"].1, Vector::new(0., 80.));
+    assert_eq!(app.behavior.scenario.scroll_offset(), offset);
+    assert!(app.behavior.scenario.restore.is_none());
+    assert!(std::sync::Arc::ptr_eq(
+        &before_back,
+        &app.document.snapshot()
+    ));
+    assert_eq!(app.document.revision(), revision);
+    assert!(app.document.can_undo());
+    assert!(!app.document.can_redo());
+}
+
+#[test]
+fn scenario_workspace_viewport_events_are_passive_guarded_and_do_not_apply_raw_forms() {
+    use super::super::direct_tests::{fixture, navigation_event};
+    let f = fixture();
+    let mut app = App::with_project(f.project);
+    let _ = app.update(Message::Select(f.owner));
+    let _ = app.update(Message::Page(crate::app::Page::Behavior));
+    let _ = app.update(event(Event::Start(f.owner, Tool::Message)));
+    let _ = app.update(event(Event::Name("  raw 雨  ".into())));
+    let raw = app.behavior.recovery_snapshot().unwrap();
+    let accepted = app.document.snapshot();
+    let context = app.scenario_context().unwrap();
+    app.busy = true;
+    let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Viewport(
+        context,
+        Size::new(500., 200.),
+    )));
+    assert_ne!(app.scenario_context(), Some(context));
+    let epoch = app.canvas_epoch;
+    let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Viewport(
+        context,
+        Size::new(500., 200.),
+    )));
+    assert_eq!(app.canvas_epoch, epoch);
+    for mismatch in 0..3 {
+        let mut stale = context;
+        match mismatch {
+            0 => stale.document = Id::new_v4(),
+            1 => stale.scenario = Id::new_v4(),
+            _ => stale.revision += 1,
+        }
+        let _ = app.update(Message::ScenarioCanvas(CanvasEvent::Viewport(
+            stale,
+            Size::new(900., 400.),
+        )));
+        assert_eq!(app.canvas_epoch, epoch);
+    }
+    app.busy = false;
+    navigation_event(&mut app, |ctx| CanvasEvent::Shelf(ctx, Shelf::Tools));
+    navigation_event(&mut app, CanvasEvent::Focus);
+    navigation_event(&mut app, |ctx| CanvasEvent::Zoom(ctx, None));
+    assert_eq!(app.behavior.recovery_snapshot().unwrap(), raw);
+    assert!(std::sync::Arc::ptr_eq(&accepted, &app.document.snapshot()));
+    assert!(!app.document.can_undo());
+}
+
+#[test]
+fn scenario_workspace_choosing_tools_preserves_valid_and_invalid_pending_editors() {
+    use super::super::direct_tests::{fixture, navigation_event};
+    for editor in 0..3 {
+        for valid in [false, true] {
+            let f = fixture();
+            let mut app = App::with_project(f.project);
+            let _ = app.update(Message::Select(f.owner));
+            let _ = app.update(Message::Page(crate::app::Page::Behavior));
+            match editor {
+                0 => {
+                    let _ = app.update(Message::Field(
+                        if valid { "/name" } else { "/id" }.into(),
+                        if valid {
+                            "  Retained property 雨  "
+                        } else {
+                            "not-a-uuid"
+                        }
+                        .into(),
+                    ));
+                    assert!(app.draft_dirty());
+                    assert_eq!(app.draft.as_ref().unwrap().command().is_ok(), valid);
+                }
+                1 => {
+                    let raw = if valid {
+                        format!("// Retained source 雨\n{}", app.source_editor.text())
+                    } else {
+                        "? invalid source 雨".into()
+                    };
+                    let _ = app.update(Message::SourceEdit(
+                        iced::widget::text_editor::Action::SelectAll,
+                    ));
+                    let _ = app.update(Message::SourceEdit(
+                        iced::widget::text_editor::Action::Edit(
+                            iced::widget::text_editor::Edit::Paste(std::sync::Arc::new(raw)),
+                        ),
+                    ));
+                    assert!(app.source_dirty());
+                    assert_eq!(
+                        crate::source_workspace::compile(&app.source_workspace.bundle()).is_ok(),
+                        valid
+                    );
+                }
+                _ => {
+                    let _ = app.update(event(Event::Start(
+                        f.owner,
+                        if valid { Tool::Fragment } else { Tool::Action },
+                    )));
+                    let _ = app.update(event(Event::Name("  Retained behavior 雨  ".into())));
+                    let _ = app.update(event(Event::Expression("ready".into())));
+                    let _ = app.update(event(Event::SecondGuard("otherwise".into())));
+                    assert!(app.behavior.has_pending());
+                    assert_eq!(
+                        app.behavior
+                            .scenario
+                            .draft
+                            .as_ref()
+                            .unwrap()
+                            .command(app.project())
+                            .is_ok(),
+                        valid
+                    );
+                }
+            }
+            let source = serde_json::to_value(app.source_workspace.recovery_snapshot()).unwrap();
+            let properties = app
+                .draft
+                .as_ref()
+                .map(|draft| serde_json::to_value(draft.recovery_snapshot()).unwrap());
+            let behavior = app.behavior.recovery_snapshot().unwrap();
+            let text = app.source_editor.text();
+            let accepted = app.document.snapshot();
+            let selected = app.selected;
+            let context = app.scenario_context();
+            let tool = app.behavior.scenario.canvas_tool(f.owner);
+            navigation_event(&mut app, |ctx| {
+                CanvasEvent::Choose(ctx, CanvasTool::Message(MessageStyle::Timer))
+            });
+            assert!(
+                app.status.contains("Apply or cancel"),
+                "editor={editor} valid={valid}: {}",
+                app.status
+            );
+            assert_eq!(app.source_editor.text(), text);
+            assert_eq!(
+                serde_json::to_value(app.source_workspace.recovery_snapshot()).unwrap(),
+                source
+            );
+            assert_eq!(
+                app.draft
+                    .as_ref()
+                    .map(|draft| serde_json::to_value(draft.recovery_snapshot()).unwrap()),
+                properties
+            );
+            assert_eq!(app.behavior.recovery_snapshot().unwrap(), behavior);
+            assert_eq!(app.selected, selected);
+            assert_eq!(app.scenario_context(), context);
+            assert_eq!(app.behavior.scenario.canvas_tool(f.owner), tool);
+            assert!(std::sync::Arc::ptr_eq(&accepted, &app.document.snapshot()));
+            assert!(!app.document.can_undo());
+            assert!(!app.document.can_redo());
+        }
+    }
+}
+
+#[test]
+fn scenario_workspace_whole_app_canvas_tree_survives_pending_shelves_and_focus() {
+    use iced::advanced::widget::tree;
+    use std::rc::Rc;
+    fn path_to(tree: &widget::Tree, tag: tree::Tag) -> Option<Vec<usize>> {
+        if tree.tag == tag {
+            return Some(vec![]);
+        }
+        tree.children.iter().enumerate().find_map(|(i, child)| {
+            let mut path = path_to(child, tag)?;
+            path.insert(0, i);
+            Some(path)
+        })
+    }
+    fn at<'a>(mut tree: &'a mut widget::Tree, path: &[usize]) -> &'a mut widget::Tree {
+        for &index in path {
+            tree = &mut tree.children[index];
+        }
+        tree
+    }
+    let f = super::super::direct_tests::fixture();
+    let mut app = App::with_project(f.project);
+    let _ = app.update(Message::Select(f.call));
+    let _ = app.update(Message::Page(crate::app::Page::Behavior));
+    let canvas: Element<'_, Message> =
+        canvas::Canvas::new(Scene::sequence(app.project(), f.owner, f.call)).into();
+    let tag = widget::Tree::new(canvas.as_widget()).tag;
+    drop(canvas);
+    let mut tree = widget::Tree::new(crate::views::view(&app).as_widget());
+    let mut path = path_to(&tree, tag).unwrap();
+    path.pop();
+    let marker = Rc::new(());
+    at(&mut tree, &path).state = tree::State::new(Rc::clone(&marker));
+    let _ = app.update(event(Event::Start(f.owner, Tool::Message)));
+    let _ = app.update(event(Event::Name("  untouched 雨  ".into())));
+    let raw = app.behavior.recovery_snapshot().unwrap();
+    let accepted = app.document.snapshot();
+    for shelf in [Shelf::Tools, Shelf::Selection, Shelf::Selection] {
+        super::super::direct_tests::navigation_event(&mut app, |ctx| {
+            CanvasEvent::Shelf(ctx, shelf)
+        });
+        super::super::direct_tests::navigation_event(&mut app, CanvasEvent::Focus);
+        tree.diff(crate::views::view(&app).as_widget());
+        let mut current = path_to(&tree, tag).unwrap();
+        current.pop();
+        assert_eq!(current, path);
+        assert_eq!(Rc::strong_count(&marker), 2);
+        assert!(Rc::ptr_eq(
+            at(&mut tree, &path).state.downcast_ref::<Rc<()>>(),
+            &marker
+        ));
+        assert_eq!(app.behavior.recovery_snapshot().unwrap(), raw);
+        assert_eq!(app.selected, f.call);
+        assert!(std::sync::Arc::ptr_eq(&accepted, &app.document.snapshot()));
+    }
+}
+
+#[test]
+fn scenario_workspace_scaled_and_scrolled_scene_keeps_clicked_slots_and_message_endpoints() {
+    let f = super::super::direct_tests::fixture();
+    for scale in [0.25, 0.5, 1., 2.] {
+        for drag in [false, true] {
+            let mut scene = Scene::sequence(&f.project, f.owner, f.call);
+            let context = super::super::direct_tests::context(f.owner);
+            scene.scale = scale;
+            scene.scroll_offset = Vector::new(35., 40.);
+            scene.interaction = Some((context, CanvasTool::Message(MessageStyle::CallReply), true));
+            let slot = scene.slots.last().unwrap();
+            let expected = slot.slot;
+            let bounds = Rectangle::new(
+                Point::new(20., 80.),
+                Size::new(scene.size.width * scale, scene.size.height * scale),
+            );
+            let screen = |world: Point| {
+                Point::new(bounds.x + world.x * scale, bounds.y + world.y * scale)
+                    - scene.scroll_offset
+            };
+            let a = screen(Point::new(scene.lanes[&f.sender], slot.y));
+            let b = screen(Point::new(scene.lanes[&f.receiver], slot.y));
+            let mut input = super::super::super::SequenceInput::default();
+            let mut messages = vec![];
+            let mut events = vec![
+                (mouse::Event::CursorMoved { position: a }, a),
+                (mouse::Event::ButtonPressed(mouse::Button::Left), a),
+            ];
+            if !drag {
+                events.push((mouse::Event::ButtonReleased(mouse::Button::Left), a));
+            }
+            events.push((mouse::Event::CursorMoved { position: b }, b));
+            if !drag {
+                events.push((mouse::Event::ButtonPressed(mouse::Button::Left), b));
+            }
+            events.push((mouse::Event::ButtonReleased(mouse::Button::Left), b));
+            for (event, cursor) in events {
+                if let Some(action) = canvas::Program::update(
+                    &scene,
+                    &mut input,
+                    &canvas::Event::Mouse(event),
+                    bounds,
+                    mouse::Cursor::Available(cursor + scene.scroll_offset),
+                ) && let Some(message) = action.into_inner().0
+                {
+                    messages.push(message);
+                }
+            }
+            assert!(
+                matches!(messages.as_slice(), [Message::ScenarioCanvas(CanvasEvent::Begin { sender, receiver, slot, .. })]
+                if *sender == f.sender && *receiver == f.receiver && *slot == expected),
+                "scale={scale} drag={drag}"
+            );
+        }
+    }
+}
+
+#[test]
+fn scenario_workspace_scaled_nested_occurrences_and_reorder_keep_exact_sequence_identity() {
+    let (f, branch, anchor, _, _, _) = super::super::direct_tests::placement_fixture();
+    for scale in [0.25, 0.5, 1., 2.] {
+        let mut scene = Scene::sequence(&f.project, f.owner, f.call);
+        let context = super::super::direct_tests::context(f.owner);
+        scene.scale = scale;
+        scene.scroll_offset = Vector::new(35., 40.);
+        let bounds = Rectangle::new(
+            Point::new(20., 80.),
+            Size::new(scene.size.width * scale, scene.size.height * scale),
+        );
+        let screen = |world: Point| {
+            Point::new(bounds.x + world.x * scale, bounds.y + world.y * scale)
+                - Vector::new(35., 40.)
+        };
+        let send =
+            |scene: &Scene, input: &mut super::super::super::SequenceInput, event, cursor| {
+                canvas::Program::update(
+                    scene,
+                    input,
+                    &canvas::Event::Mouse(event),
+                    bounds,
+                    mouse::Cursor::Available(cursor + scene.scroll_offset),
+                )
+                .and_then(|action| action.into_inner().0)
+            };
+        for tool in [Tool::Action, Tool::Observation, Tool::Reuse, Tool::Fragment] {
+            scene.interaction = Some((context, CanvasTool::Add(tool), true));
+            for expected in [
+                Slot {
+                    parent: f.owner,
+                    before: Some(f.reply),
+                },
+                Slot {
+                    parent: branch,
+                    before: Some(anchor),
+                },
+            ] {
+                let slot = scene
+                    .slots
+                    .iter()
+                    .find(|slot| slot.slot == expected)
+                    .unwrap();
+                let point = screen(Point::new(scene.lanes[&f.sender], slot.y));
+                let mut input = super::super::super::SequenceInput::default();
+                send(
+                    &scene,
+                    &mut input,
+                    mouse::Event::CursorMoved { position: point },
+                    point,
+                );
+                assert!(
+                    send(
+                        &scene,
+                        &mut input,
+                        mouse::Event::ButtonPressed(mouse::Button::Left),
+                        point
+                    )
+                    .is_none()
+                );
+                let message = send(
+                    &scene,
+                    &mut input,
+                    mouse::Event::ButtonReleased(mouse::Button::Left),
+                    point,
+                )
+                .unwrap();
+                assert!(
+                    matches!(message, Message::ScenarioCanvas(CanvasEvent::BeginOccurrence { tool: captured, slot, lifeline, .. })
+                    if captured == tool && slot == expected && lifeline == tool.uses_lifeline().then_some(f.sender)),
+                    "scale={scale} tool={tool:?} slot={expected:?}"
+                );
+            }
+        }
+        scene.interaction = Some((context, CanvasTool::Select, true));
+        let mut input = super::super::super::SequenceInput::default();
+        let expected = scene
+            .slots
+            .iter()
+            .rev()
+            .find(|slot| slot.slot.parent == f.owner)
+            .unwrap();
+        let start = screen(scene.reorder_handle().unwrap().center());
+        let end = screen(Point::new(17., expected.y));
+        send(
+            &scene,
+            &mut input,
+            mouse::Event::CursorMoved { position: start },
+            start,
+        );
+        send(
+            &scene,
+            &mut input,
+            mouse::Event::ButtonPressed(mouse::Button::Left),
+            start,
+        );
+        send(
+            &scene,
+            &mut input,
+            mouse::Event::CursorMoved { position: end },
+            end,
+        );
+        assert!(
+            matches!(send(&scene, &mut input, mouse::Event::ButtonReleased(mouse::Button::Left), end),
+                Some(Message::ScenarioCanvas(CanvasEvent::Reorder { occurrence, slot, .. }))
+                if occurrence == f.call && slot == expected.slot),
+            "scale={scale}"
+        );
+    }
+}

crates/oa-desktop/src/behavior/topology.rs

@@ -38,6 +38,7 @@ impl Tool {
 }
 #[derive(Debug, Clone)]
 pub enum Event {
+    Source(super::source_draft::Event),
     Start(Id, Tool, Option<Id>),
     Cancel,
     Submit,
@@ -90,15 +91,22 @@ pub struct State {
     selected_context: Option<oa_core::topology_context::ContextAddress>,
     shelf: Option<Shelf>,
 }
-#[derive(Default, serde::Serialize, serde::Deserialize)]
+#[derive(Clone, Default, serde::Serialize, serde::Deserialize)]
 #[serde(deny_unknown_fields)]
 struct Browser {
     search: String,
     page: usize,
 }
-#[derive(serde::Serialize, serde::Deserialize)]
+#[derive(Clone, serde::Serialize, serde::Deserialize)]
 #[serde(deny_unknown_fields)]
 struct Draft {
+    #[serde(default)]
+    source: super::source_draft::State,
+    #[serde(default = "Id::new_v4")]
+    invocation: Id,
+    #[serde(default)]
+    source_origin: Option<(Id, oa_core::Element)>,
+
     #[serde(with = "recovery_insertion")]
     insertion: Insertion,
     fixed: bool,
@@ -117,6 +125,28 @@ struct Draft {
     contextual: Option<contextual::Draft>,
 }
 impl State {
+    pub(super) fn pending_name(&self) -> Option<&str> {
+        self.draft.as_ref().map(|d| d.name.as_str())
+    }
+    pub(super) fn source_view<'a>(&'a self, p: &'a Project) -> Option<iced::Element<'a, Event>> {
+        self.draft
+            .as_ref()?
+            .source
+            .view(p)
+            .map(|v| v.map(Event::Source))
+    }
+
+    pub fn source_active(&self) -> bool {
+        self.draft.as_ref().is_some_and(|d| d.source.engaged())
+    }
+
+    pub fn source_open(&self) -> bool {
+        self.draft.as_ref().is_some_and(|d| d.source.is_open())
+    }
+    pub fn source_back(&mut self) -> bool {
+        self.draft.as_mut().is_some_and(|d| d.source.back())
+    }
+
     pub(super) fn recovery_snapshot(&self) -> Result<Option<serde_json::Value>, String> {
         self.draft
             .as_ref()
@@ -152,6 +182,58 @@ impl State {
     }
 
     pub fn update(&mut self, p: &Project, event: Event) -> Result<Option<Command>, String> {
+        if let Event::Source(event) = event {
+            if self
+                .draft
+                .as_mut()
+                .ok_or("Start the consumer form first.")?
+                .source
+                .dismiss(&event)?
+            {
+                return Ok(None);
+            }
+            let d = self
+                .draft
+                .as_ref()
+                .ok_or("Start the consumer form first.")?;
+            if d.tool != Tool::Work {
+                return Err("This reference does not support staged source creation.".into());
+            }
+            if d.source_origin.as_ref().is_some_and(|(document, owner)| {
+                *document != p.id || p.elements.get(&d.owner) != Some(owner)
+            }) {
+                return Err("The original consumer changed. Cancel and reopen its form; the current draft is retained.".into());
+            }
+            if d.source_origin.is_none() && d.source.engaged() {
+                return Err("The recovered source draft has no original document binding. Go Back or cancel it.".into());
+            }
+            let mut next = d.clone();
+            if next.source_origin.is_none() && matches!(&event, super::source_draft::Event::Open(_))
+            {
+                next.source_origin = Some((
+                    p.id,
+                    p.elements
+                        .get(&d.owner)
+                        .ok_or("The consumer owner no longer exists.")?
+                        .clone(),
+                ));
+            }
+            if let Some(id) = next.source.update(
+                p,
+                super::source_draft::Scope::Work { owner: d.owner },
+                d.invocation,
+                event,
+            )? {
+                next.target = Some(id);
+                next.command(p)?;
+            }
+            self.draft = Some(next);
+            return Ok(None);
+        }
+        if self.source_open() && !matches!(&event, Event::Cancel) {
+            return Err("Use the new source or go Back before editing the parent form.".into());
+        }
+
         if self.draft.is_some() && matches!(&event, Event::Start(..)) {
             return Err(PENDING_DRAFT.into());
         }
@@ -184,6 +266,9 @@ impl State {
                     }
                 });
                 self.draft = Some(Draft {
+                    source: Default::default(),
+                    invocation: Id::new_v4(),
+                    source_origin: Some((p.id, p.elements[&owner].clone())),
                     insertion: Insertion::default(),
                     fixed: false,
                     browsers: Default::default(),
@@ -508,6 +593,22 @@ fn link(p: &Project, source: Id, target: Id, guard: &str) -> Command {
 }
 impl Draft {
     fn command(&self, p: &Project) -> Result<Command, String> {
+        if self.source.engaged()
+            && self.source_origin.as_ref().is_none_or(|(document, owner)| {
+                *document != p.id || p.elements.get(&self.owner) != Some(owner)
+            })
+        {
+            return Err("The original consumer document or owner changed. Cancel and reopen its form; your draft is retained.".into());
+        }
+        self.source.check_scope(
+            super::source_draft::Scope::Work { owner: self.owner },
+            self.target,
+        )?;
+        let preview = self.source.preview(p, self.target)?;
+        let command = self.consumer_command(preview.as_ref().unwrap_or(p))?;
+        self.source.combine(p, self.target, command)
+    }
+    fn consumer_command(&self, p: &Project) -> Result<Command, String> {
         let owner = p
             .elements
             .get(&self.owner)
@@ -615,6 +716,8 @@ impl Draft {
         });
         let name = if self.name.trim().is_empty() {
             default_name
+        } else if self.source.label(self.target).is_some() {
+            self.name.as_str()
         } else {
             self.name.trim()
         };
@@ -1587,6 +1690,9 @@ mod tests {
     }
     fn branch(owner: Id, a: Id, b: Id, before: Id, after: Id) -> Draft {
         Draft {
+            source: Default::default(),
+            invocation: Id::new_v4(),
+            source_origin: None,
             insertion: Insertion::default(),
             fixed: false,
             browsers: Default::default(),

crates/oa-desktop/src/behavior/topology/contextual.rs

@@ -33,7 +33,7 @@ pub enum Event {
     Search(String),
     Page(usize),
 }
-#[derive(Default, serde::Serialize, serde::Deserialize)]
+#[derive(Clone, Default, serde::Serialize, serde::Deserialize)]
 #[serde(deny_unknown_fields)]
 pub(super) struct Draft {
     edit: Option<Id>,

crates/oa-desktop/src/behavior/topology/direct.rs

@@ -206,8 +206,16 @@ impl State {
         }
         None
     }
-    pub(crate) fn created_selection(&self, command: &Command) -> Option<Id> {
+    pub(crate) fn created_selection(&self, p: &Project, command: &Command) -> Option<Id> {
         let owner = self.pending_owner()?;
+        if self
+            .draft
+            .as_ref()
+            .is_some_and(|d| d.source.label(d.target).is_some())
+            && self.prepare_pending(p).ok().as_ref() != Some(command)
+        {
+            return None;
+        }
         if let Command::CreateRelation(r) | Command::EditRelation(_, r) = command
             && matches!(&r.body, RelationBody::ContextualLink { owner: caller, .. } if *caller == owner)
         {

crates/oa-desktop/src/behavior/topology/view.rs

@@ -369,6 +369,25 @@ pub(super) fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Ele
         .width(Fill)
         .height(Fill)
         .style(style::card);
+        if !pending && !p.children(owner).any(|e| is_contribution(p, owner, e.id)) {
+            let title = if p.layer_of(owner) == Some(Layer::Oa) {
+                "Add first activity contribution"
+            } else {
+                "Add first function contribution"
+            };
+            header = header.push(button(title).on_press_maybe(
+                (!app.behavior.has_pending() && !app.draft_dirty() && !app.source_dirty()).then(
+                    || {
+                        Message::TopologyCanvas(CanvasEvent::Begin {
+                            context,
+                            tool: Tool::Work,
+                            control: ControlKind::Choice,
+                            insertion: Insertion::default(),
+                        })
+                    },
+                ),
+            ));
+        }
         let details: Element<'_, Message> = match state.shelf {
             Some(Shelf::Tools) => controls.into(),
             _ => navigation.push(text("Full qualified identities and definition actions appear here for the selected contribution or link.").size(11)).into(),
@@ -383,201 +402,223 @@ pub(super) fn view<'a>(app: &'a App, owner: Id, out: Column<'a, Message>) -> Ele
     };
     let mut form_panel: Element<'_, Message> = iced::widget::Space::new().height(0).into();
     if let Some(d) = state.draft.as_ref().filter(|d| d.owner == owner) {
-        let mut form = column![text(d.tool.title()).size(16)].spacing(8);
-        if let Some(contextual) = &d.contextual {
-            form = form
-                .push(
-                    text_input("Link name (retain current when blank)", &d.name)
-                        .on_input(|v| event(Event::Name(v)))
-                        .padding(8)
-                        .size(12),
-                )
-                .push(super::contextual::view(p, owner, contextual));
+        if let Some(child) = d.source.view(p) {
+            form_panel = column![
+                text(format!(
+                    "Consumer name: {}",
+                    crate::views::short(&d.name, 60)
+                ))
+                .size(12),
+                child.map(|e| event(Event::Source(e)))
+            ]
+            .spacing(6)
+            .height(Fill)
+            .into();
         } else {
-            if let Some(link) = d.insertion.link.and_then(|id| p.relations.get(&id)) {
-                let guard = if let RelationBody::SequenceLink { guard, .. } = &link.body {
-                    guard.as_str()
-                } else {
-                    ""
-                };
-                form = form.push(label(format!(
-                    "Insert on {} → {} · preserve path identity and condition [{}]",
-                    p.named(link.source()),
-                    p.named(link.target()),
-                    guard
-                )));
-            } else if d.fixed && ordered {
-                form = form.push(label(match (d.before, d.after) {
-                    (Some(before), Some(after)) => format!(
-                        "Insert between {} → {} · preserve the ordered path",
-                        p.named(before),
-                        p.named(after)
-                    ),
-                    (Some(before), None) => format!("Continue after {}", p.named(before)),
-                    (None, Some(after)) => format!("Insert before {}", p.named(after)),
-                    _ => "Start the ordered path".into(),
-                }));
-            } else if d.fixed
-                && d.tool == Tool::Exchange
-                && let Some(before) = d.before
-            {
-                form = form.push(label(format!(
-                    "Append after {} → new exchange · Create adds an explicit sequence link",
-                    p.named(before)
-                )));
-            } else if d.fixed && d.tool != Tool::Connect {
-                form = form.push(label(
-                    d.insertion
-                        .before
-                        .map_or("Append an unconnected contribution".into(), |id| {
-                            format!("Unconnected contribution before {}", p.named(id))
-                        }),
-                ));
-            }
-            if !legacy_order(p, owner).is_empty() {
-                form = form.push(label(
+            let mut form = column![text(d.tool.title()).size(16)].spacing(8);
+            if let Some(contextual) = &d.contextual {
+                form = form
+                    .push(
+                        text_input("Link name (retain current when blank)", &d.name)
+                            .on_input(|v| event(Event::Name(v)))
+                            .padding(8)
+                            .size(12),
+                    )
+                    .push(super::contextual::view(p, owner, contextual));
+            } else {
+                if let Some(link) = d.insertion.link.and_then(|id| p.relations.get(&id)) {
+                    let guard = if let RelationBody::SequenceLink { guard, .. } = &link.body {
+                        guard.as_str()
+                    } else {
+                        ""
+                    };
+                    form = form.push(label(format!(
+                        "Insert on {} → {} · preserve path identity and condition [{}]",
+                        p.named(link.source()),
+                        p.named(link.target()),
+                        guard
+                    )));
+                } else if d.fixed && ordered {
+                    form = form.push(label(match (d.before, d.after) {
+                        (Some(before), Some(after)) => format!(
+                            "Insert between {} → {} · preserve the ordered path",
+                            p.named(before),
+                            p.named(after)
+                        ),
+                        (Some(before), None) => format!("Continue after {}", p.named(before)),
+                        (None, Some(after)) => format!("Insert before {}", p.named(after)),
+                        _ => "Start the ordered path".into(),
+                    }));
+                } else if d.fixed
+                    && d.tool == Tool::Exchange
+                    && let Some(before) = d.before
+                {
+                    form = form.push(label(format!(
+                        "Append after {} → new exchange · Create adds an explicit sequence link",
+                        p.named(before)
+                    )));
+                } else if d.fixed && d.tool != Tool::Connect {
+                    form = form.push(label(
+                        d.insertion
+                            .before
+                            .map_or("Append an unconnected contribution".into(), |id| {
+                                format!("Unconnected contribution before {}", p.named(id))
+                            }),
+                    ));
+                }
+                if d.tool == Tool::Work {
+                    if let Some(title) = d.source.label(d.target) {
+                        form = form.push(label(title)).push(label("Create commits the new work and contribution together at the chosen path position."));
+                    }
+                    form = form.push(button("Create new source…").on_press(event(Event::Source(
+                        super::super::source_draft::Event::Open(d.invocation),
+                    ))));
+                }
+                if !legacy_order(p, owner).is_empty() {
+                    form = form.push(label(
                     "This edit preserves the ordered path as explicit links in the same undo step.",
                 ));
-            }
-            if matches!(
-                d.tool,
-                Tool::Work | Tool::Exchange | Tool::Reuse | Tool::Branch
-            ) {
-                let choices = targets(p, owner, d.tool)
-                    .into_iter()
-                    .filter(|c| compatible_source(p, d, c.id))
-                    .collect();
-                if d.tool == Tool::Branch {
-                    form = form.push(label("First path work"));
                 }
-                form = form.push(picker(
-                    choices,
-                    d,
-                    0,
-                    d.target,
+                if matches!(
+                    d.tool,
+                    Tool::Work | Tool::Exchange | Tool::Reuse | Tool::Branch
+                ) {
+                    let choices = targets(p, owner, d.tool)
+                        .into_iter()
+                        .filter(|c| compatible_source(p, d, c.id))
+                        .collect();
                     if d.tool == Tool::Branch {
-                        "Choose first path work…"
+                        form = form.push(label("First path work"));
+                    }
+                    form = form.push(picker(
+                        choices,
+                        d,
+                        0,
+                        d.target,
+                        if d.tool == Tool::Branch {
+                            "Choose first path work…"
+                        } else {
+                            "Choose existing source…"
+                        },
+                        Event::Target,
+                    ));
+                }
+                if d.tool != Tool::Connect {
+                    form = form.push(
+                        text_input("Contribution name (defaults to source)", &d.name)
+                            .on_input(|v| event(Event::Name(v)))
+                            .padding(8)
+                            .size(12),
+                    );
+                }
+                if matches!(d.tool, Tool::Control | Tool::Branch) {
+                    let kinds = if d.tool == Tool::Branch {
+                        vec![ControlKind::Choice, ControlKind::Fork]
                     } else {
-                        "Choose existing source…"
-                    },
-                    Event::Target,
-                ));
-            }
-            if d.tool != Tool::Connect {
-                form = form.push(
-                    text_input("Contribution name (defaults to source)", &d.name)
-                        .on_input(|v| event(Event::Name(v)))
+                        vec![
+                            ControlKind::Choice,
+                            ControlKind::Merge,
+                            ControlKind::Fork,
+                            ControlKind::Join,
+                            ControlKind::Loop,
+                        ]
+                    };
+                    form = form.push(
+                        pick_list(
+                            kinds.into_iter().map(ControlChoice).collect::<Vec<_>>(),
+                            Some(ControlChoice(d.control)),
+                            |v| event(Event::Control(v)),
+                        )
+                        .padding(8)
+                        .text_size(12),
+                    );
+                }
+                if d.tool == Tool::Branch {
+                    form = form.push(label("Second path work")).push(picker(
+                        targets(p, owner, Tool::Work),
+                        d,
+                        1,
+                        d.alternate,
+                        "Second path work…",
+                        Event::Alternate,
+                    ));
+                    if d.control != ControlKind::Fork {
+                        form = form
+                            .push(label("First path guard"))
+                            .push(
+                                text_input("First path guard", &d.guard)
+                                    .on_input(|v| event(Event::Guard(v)))
+                                    .padding(8),
+                            )
+                            .push(label("Second path guard"))
+                            .push(
+                                text_input("Second path guard (e.g. else)", &d.alternate_guard)
+                                    .on_input(|v| event(Event::AlternateGuard(v)))
+                                    .padding(8),
+                            );
+                    }
+                }
+                if d.fixed {
+                    if let (Some(a), Some(b)) = (d.before, d.after) {
+                        form = form.push(label(format!("{} → {}", p.named(a), p.named(b))));
+                    }
+                } else {
+                    form = form
+                        .push(label("Preceding contribution"))
+                        .push(picker(
+                            contributions(p, owner),
+                            d,
+                            2,
+                            d.before,
+                            "After contribution…",
+                            Event::Before,
+                        ))
+                        .push(button("Clear preceding").on_press(event(Event::ClearBefore)))
+                        .push(label("Following contribution"))
+                        .push(picker(
+                            contributions(p, owner),
+                            d,
+                            3,
+                            d.after,
+                            "Before contribution…",
+                            Event::After,
+                        ))
+                        .push(button("Clear following").on_press(event(Event::ClearAfter)));
+                }
+                if d.tool != Tool::Branch
+                    && d.insertion.link.is_none()
+                    && (d.before.is_some() || d.tool == Tool::Connect)
+                {
+                    form = form.push(
+                        text_input(
+                            "Path condition (empty remains a Choice / Loop warning)",
+                            &d.guard,
+                        )
+                        .on_input(|v| event(Event::Guard(v)))
                         .padding(8)
                         .size(12),
-                );
+                    );
+                }
             }
-            if matches!(d.tool, Tool::Control | Tool::Branch) {
-                let kinds = if d.tool == Tool::Branch {
-                    vec![ControlKind::Choice, ControlKind::Fork]
+            let valid = match d.command(p) {
+                Ok(_) => true,
+                Err(problem) => {
+                    form = form.push(label(problem));
+                    false
+                }
+            };
+            let actions = row![
+                button(if d.contextual.is_some() {
+                    "Apply link"
                 } else {
-                    vec![
-                        ControlKind::Choice,
-                        ControlKind::Merge,
-                        ControlKind::Fork,
-                        ControlKind::Join,
-                        ControlKind::Loop,
-                    ]
-                };
-                form = form.push(
-                    pick_list(
-                        kinds.into_iter().map(ControlChoice).collect::<Vec<_>>(),
-                        Some(ControlChoice(d.control)),
-                        |v| event(Event::Control(v)),
-                    )
-                    .padding(8)
-                    .text_size(12),
-                );
-            }
-            if d.tool == Tool::Branch {
-                form = form.push(label("Second path work")).push(picker(
-                    targets(p, owner, Tool::Work),
-                    d,
-                    1,
-                    d.alternate,
-                    "Second path work…",
-                    Event::Alternate,
-                ));
-                if d.control != ControlKind::Fork {
-                    form = form
-                        .push(label("First path guard"))
-                        .push(
-                            text_input("First path guard", &d.guard)
-                                .on_input(|v| event(Event::Guard(v)))
-                                .padding(8),
-                        )
-                        .push(label("Second path guard"))
-                        .push(
-                            text_input("Second path guard (e.g. else)", &d.alternate_guard)
-                                .on_input(|v| event(Event::AlternateGuard(v)))
-                                .padding(8),
-                        );
-                }
-            }
-            if d.fixed {
-                if let (Some(a), Some(b)) = (d.before, d.after) {
-                    form = form.push(label(format!("{} → {}", p.named(a), p.named(b))));
-                }
-            } else {
-                form = form
-                    .push(label("Preceding contribution"))
-                    .push(picker(
-                        contributions(p, owner),
-                        d,
-                        2,
-                        d.before,
-                        "After contribution…",
-                        Event::Before,
-                    ))
-                    .push(button("Clear preceding").on_press(event(Event::ClearBefore)))
-                    .push(label("Following contribution"))
-                    .push(picker(
-                        contributions(p, owner),
-                        d,
-                        3,
-                        d.after,
-                        "Before contribution…",
-                        Event::After,
-                    ))
-                    .push(button("Clear following").on_press(event(Event::ClearAfter)));
-            }
-            if d.tool != Tool::Branch
-                && d.insertion.link.is_none()
-                && (d.before.is_some() || d.tool == Tool::Connect)
-            {
-                form = form.push(
-                    text_input(
-                        "Path condition (empty remains a Choice / Loop warning)",
-                        &d.guard,
-                    )
-                    .on_input(|v| event(Event::Guard(v)))
-                    .padding(8)
-                    .size(12),
-                );
-            }
+                    "Create"
+                })
+                .on_press_maybe(valid.then(|| event(Event::Submit))),
+                button("Cancel").on_press(event(Event::Cancel))
+            ]
+            .spacing(7);
+            form_panel = editor_panel(actions.into(), form.into());
         }
-        let valid = match d.command(p) {
-            Ok(_) => true,
-            Err(problem) => {
-                form = form.push(label(problem));
-                false
-            }
-        };
-        let actions = row![
-            button(if d.contextual.is_some() {
-                "Apply link"
-            } else {
-                "Create"
-            })
-            .on_press_maybe(valid.then(|| event(Event::Submit))),
-            button("Cancel").on_press(event(Event::Cancel))
-        ]
-        .spacing(7);
-        form_panel = editor_panel(actions.into(), form.into());
     }
     panes(diagram, form_panel, pending)
 }

crates/oa-desktop/src/document.rs

@@ -10,6 +10,10 @@ use std::{fmt, sync::Arc};
 const HISTORY_LIMIT: usize = 100;
 const HISTORY_BYTES: usize = 32 * 1024 * 1024;
 
+#[path = "document_alias_rename.rs"]
+mod alias_rename;
+pub use alias_rename::PreparedAliasRename;
+
 struct HistoryEntry {
     snapshot: Arc<CompiledSourceProject>,
     bytes: usize,
@@ -91,11 +95,13 @@ impl From<Vec<SourceDiagnostic>> for DocumentError {
 }
 
 pub struct Document {
+    // Distinguishes equal accepted snapshots belonging to different documents.
+    alias_owner: Arc<()>,
     current: Arc<CompiledSourceProject>,
     past: Vec<HistoryEntry>,
     future: Vec<HistoryEntry>,
     current_bytes: usize,
-    saved: Arc<SourceBundle>,
+    saved: Option<Arc<SourceBundle>>,
     revision: u64,
     view_index: std::cell::OnceCell<oa_core::view_options::ViewIndex>,
     limits: ProjectLimits,
@@ -121,11 +127,12 @@ impl Document {
         let current = Arc::new(source_project::compile_bundle(&bundle, limits)?);
         let current_bytes = estimated_bytes(&current);
         Ok(Self {
+            alias_owner: Arc::new(()),
             current,
             current_bytes,
             past: Vec::new(),
             future: Vec::new(),
-            saved: Arc::new(bundle),
+            saved: Some(Arc::new(bundle)),
             revision: 0,
             view_index: Default::default(),
             limits,
@@ -156,7 +163,7 @@ impl Document {
     }
 
     pub fn dirty(&self) -> bool {
-        self.recovered_unsaved || self.bundle() != self.saved.as_ref()
+        self.recovered_unsaved || self.saved.as_deref() != Some(self.bundle())
     }
 
     /// Recovered work is a detached copy until explicitly saved by its user.
@@ -181,10 +188,24 @@ impl Document {
     /// Records the bytes actually saved, even when later edits remain current.
     /// The I/O adapter owns document identity and save completion ordering.
     pub fn mark_saved(&mut self, snapshot: Arc<CompiledSourceProject>) {
-        self.saved = Arc::new(snapshot.bundle.clone());
+        self.saved = Some(Arc::new(snapshot.bundle.clone()));
         self.recovered_unsaved = false;
     }
 
+    /// Bind an installed or recovered repair destination to source read there.
+    /// These bytes may be invalid or differ from the retained accepted model,
+    /// but must replace the previous disk baseline. Accepted history is retained;
+    /// applying or undoing to old saved content does not save this destination.
+    pub(crate) fn bind_repair_baseline(&mut self, source: SourceBundle) {
+        self.saved = Some(Arc::new(source));
+    }
+
+    /// Recovery changed the current destination, but its source could not be
+    /// reloaded. No accepted or historical snapshot is known to be saved there.
+    pub(crate) fn invalidate_saved_baseline(&mut self) {
+        self.saved = None;
+    }
+
     /// Check a source Save as before writing any files. A retained included file
     /// must never be displaced by the new entry, including on a later Undo.
     pub fn check_save_entry(&self, entry: &str) -> Result<(), DocumentError> {
@@ -380,8 +401,17 @@ impl Document {
             return false;
         }
         let bytes = estimated_bytes(&compiled);
+        self.commit_snapshot(Arc::new(compiled), bytes)
+    }
+
+    // Only validated internal paths supply a changed snapshot and its exact
+    // estimate. The ordinary commit wrapper checks bundle inequality; the alias
+    // path checks its private changed flag and exact accepted-snapshot authority.
+    // Alias preparation shares this algorithm while retaining the live save and
+    // history state, and does not clone/recompile the candidate on adoption.
+    fn commit_snapshot(&mut self, compiled: Arc<CompiledSourceProject>, bytes: usize) -> bool {
         self.past.push(HistoryEntry {
-            snapshot: std::mem::replace(&mut self.current, Arc::new(compiled)),
+            snapshot: std::mem::replace(&mut self.current, compiled),
             bytes: std::mem::replace(&mut self.current_bytes, bytes),
         });
         self.future.clear();

crates/oa-desktop/src/document_alias_rename.rs

@@ -0,0 +1,233 @@
+//! Alias-only worker preparation and guarded adoption. Public compiled DTOs do
+//! not authorize adoption; only this module can mint a prepared rename.
+use super::*;
+use std::collections::BTreeMap;
+
+/// A pinned intent minted by its owning Document. Move it to a worker and call
+/// `prepare`; preparation has no access to the live Document or its histories.
+#[derive(Debug)]
+pub struct AliasRenameRequest {
+    owner: Arc<()>,
+    before: Arc<CompiledSourceProject>,
+    revision: u64,
+    limits: ProjectLimits,
+    target: Id,
+    old_alias: String,
+    new_alias: String,
+}
+
+#[derive(Debug)]
+struct PreparedData {
+    request: AliasRenameRequest,
+    after: Arc<CompiledSourceProject>,
+    before_bytes: usize,
+    after_bytes: usize,
+    changed: bool,
+}
+
+/// Immutable, Clone-compatible transport for preview and approval. Neither
+/// mutable candidate access nor deserialization can manufacture this authority.
+#[derive(Debug, Clone)]
+pub struct PreparedAliasRename(Arc<PreparedData>);
+
+impl PreparedAliasRename {
+    pub fn before(&self) -> &CompiledSourceProject {
+        &self.0.request.before
+    }
+
+    pub fn after(&self) -> &CompiledSourceProject {
+        &self.0.after
+    }
+
+    pub fn target(&self) -> Id {
+        self.0.request.target
+    }
+
+    pub fn old_alias(&self) -> &str {
+        &self.0.request.old_alias
+    }
+
+    pub fn new_alias(&self) -> &str {
+        &self.0.request.new_alias
+    }
+
+    pub fn revision(&self) -> u64 {
+        self.0.request.revision
+    }
+
+    pub fn changed(&self) -> bool {
+        self.0.changed
+    }
+}
+
+fn refusal(message: &str) -> DocumentError {
+    ModelError(message.into()).into()
+}
+
+fn check_history_capacity(before_bytes: usize, after_bytes: usize) -> Result<(), DocumentError> {
+    if before_bytes.saturating_add(after_bytes) > HISTORY_BYTES {
+        return Err(refusal(
+            "This rename exceeds the model Undo budget. No rename was applied.",
+        ));
+    }
+    Ok(())
+}
+
+impl Document {
+    pub fn alias_rename_request(
+        &self,
+        target: Id,
+        replacement: String,
+    ) -> Result<AliasRenameRequest, DocumentError> {
+        if self.revision == u64::MAX {
+            return Err(refusal(
+                "The document revision is exhausted. Reopen before renaming.",
+            ));
+        }
+        let old_alias = self
+            .project()
+            .identities()
+            .into_iter()
+            .find_map(|(id, alias)| (id == target).then(|| alias.to_owned()))
+            .ok_or_else(|| refusal("The alias target is no longer present."))?;
+        // A candidate has a nonzero estimate. Avoid expensive preparation when
+        // even the current snapshot leaves no room for its immediate Undo.
+        if old_alias != replacement && self.current_bytes >= HISTORY_BYTES {
+            return Err(refusal(
+                "This rename exceeds the model Undo budget. No rename was applied.",
+            ));
+        }
+        Ok(AliasRenameRequest {
+            owner: self.alias_owner.clone(),
+            before: self.current.clone(),
+            revision: self.revision,
+            limits: self.limits,
+            target,
+            old_alias,
+            new_alias: replacement,
+        })
+    }
+
+    /// App must separately consume its current approval and check workspace,
+    /// invocation and draft freshness. This checks accepted Document authority.
+    pub fn commit_alias_rename(
+        &mut self,
+        prepared: &PreparedAliasRename,
+    ) -> Result<bool, DocumentError> {
+        let data = &prepared.0;
+        let request = &data.request;
+        if self.revision == u64::MAX
+            || self.revision != request.revision
+            || !Arc::ptr_eq(&self.alias_owner, &request.owner)
+            || !Arc::ptr_eq(&self.current, &request.before)
+        {
+            return Err(refusal(
+                "This rename preview is stale. Preview the current alias again.",
+            ));
+        }
+        if !data.changed {
+            return Ok(false);
+        }
+        if self.current_bytes != data.before_bytes {
+            return Err(refusal(
+                "The rename history estimate is stale. Preview again.",
+            ));
+        }
+        check_history_capacity(self.current_bytes, data.after_bytes)?;
+        Ok(self.commit_snapshot(data.after.clone(), data.after_bytes))
+    }
+}
+
+impl AliasRenameRequest {
+    /// Run on the preparation worker. The typed command and source updater are
+    /// the only candidate construction path, followed by alias-only invariants.
+    pub fn prepare(self) -> Result<PreparedAliasRename, DocumentError> {
+        let before_project = &self.before.decoded.project;
+        let candidate = prepare_command(
+            before_project,
+            &Command::SetAlias(self.target, self.new_alias.clone()),
+        )?;
+        let mut expected = before_project.clone();
+        assign_expected_alias(&mut expected, self.target, &self.new_alias)?;
+        let identities: BTreeMap<_, _> = before_project
+            .identities()
+            .into_iter()
+            .map(|(id, _)| (id, id))
+            .collect();
+        if candidate.project != expected || candidate.identity_map != identities {
+            return Err(refusal(
+                "Alias preparation changed unrelated model data or identities.",
+            ));
+        }
+        let after = source_project::update_bundle_with_identity_map(
+            &self.before,
+            &candidate.project,
+            &candidate.identity_map,
+            self.limits,
+        )?;
+        let before = &self.before;
+        if after.decoded.project != expected
+            || before.bundle.entry != after.bundle.entry
+            || !before.bundle.files.keys().eq(after.bundle.files.keys())
+            || before.index.lexical_owners != after.index.lexical_owners
+            || !before
+                .index
+                .declarations
+                .iter()
+                .map(|(id, loc)| (id, &loc.path))
+                .eq(after
+                    .index
+                    .declarations
+                    .iter()
+                    .map(|(id, loc)| (id, &loc.path)))
+        {
+            return Err(refusal(
+                "Alias preparation changed source membership or ownership.",
+            ));
+        }
+        let changed = before.bundle != after.bundle;
+        let before_bytes = estimated_bytes(before);
+        let after_bytes = estimated_bytes(&after);
+        if changed {
+            check_history_capacity(before_bytes, after_bytes)?;
+        }
+        Ok(PreparedAliasRename(Arc::new(PreparedData {
+            request: self,
+            after: Arc::new(after),
+            before_bytes,
+            after_bytes,
+            changed,
+        })))
+    }
+}
+
+// Independent full-model expectation: SetAlias may change exactly one header
+// field, across every supported identity family. Do not reuse command execution
+// to derive the expected result, which would hide collateral command changes.
+fn assign_expected_alias(project: &mut Project, id: Id, alias: &str) -> Result<(), DocumentError> {
+    if project.id == id {
+        project.alias = alias.to_owned();
+    } else if let Some(record) = project.elements.get_mut(&id) {
+        record.alias = alias.to_owned();
+    } else if let Some(record) = project.relations.get_mut(&id) {
+        record.alias = alias.to_owned();
+    } else if let Some(record) = project.diagrams.get_mut(&id) {
+        record.alias = alias.to_owned();
+    } else if let Some(record) = project.artifact_links.get_mut(&id) {
+        record.alias = alias.to_owned();
+    } else if let Some(record) = project.traces.get_mut(&id) {
+        record.alias = alias.to_owned();
+    } else {
+        project
+            .diagrams
+            .values_mut()
+            .find_map(|diagram| diagram.nodes.get_mut(&id))
+            .ok_or_else(|| refusal("The alias target is no longer present."))?
+            .alias = alias.to_owned();
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+#[path = "document_alias_rename_tests.rs"]
+mod tests;

crates/oa-desktop/src/document_alias_rename_tests.rs

@@ -0,0 +1,459 @@
+use super::*;
+
+fn fixture() -> Document {
+    let bundle = SourceBundle {
+        entry: "project.arcadia".into(),
+        files: BTreeMap::from([
+            ("project.arcadia".into(), r#"arcadia 7;
+project mission "Испытание" id "10000000-0000-4000-8000-000000000001" {
+ include "work.arcadia"; include "views.arcadia";
+}
+"#.replace('\n', "\r\n")),
+            ("work.arcadia".into(), r#"// @assess and assess are explanatory prose.
+oa_activity assess "Оценка\u0020ущерба" id "10000000-0000-4000-8000-000000000002" { description "Keep @assess and assess"; }
+oa_activity assist "Оценка\u0020ущерба" id "10000000-0000-4000-8000-000000000003" { parent @ // owner evidence
+ assess; }
+sa_function service "Service" id "10000000-0000-4000-8000-000000000004" {}
+interaction transfer "Transfer" id "10000000-0000-4000-8000-000000000005" { source @assess; target @assist; }
+trace review "Reviewed correspondence" id "10000000-0000-4000-8000-000000000006" { oa @assess; sa @service; kind Refinement; baseline { oa { name "Old assess"; description "@assess"; }; sa { name "Old service"; description "Kept"; }; }; }
+artifact evidence "Evidence" id "10000000-0000-4000-8000-000000000007" { owner @review; uri "docs/assess.md"; }
+"#.replace('\n', "\r\n")),
+            ("views.arcadia".into(), r#"diagram overview "Overview" id "10000000-0000-4000-8000-000000000008" { layer Oa; routes [{ edge @ // routed identity
+ transfer; waypoints [{ x 4.20e2; y -16; }]; }]; }
+node placement id "10000000-0000-4000-8000-000000000009" { diagram @overview; element @assess; position { x -0.0; y 12.375; }; size { width 260; height 94; }; }
+"#.replace('\n', "\r\n")),
+        ]),
+    };
+    let document = Document::from_bundle(bundle.clone(), ProjectLimits::default()).unwrap();
+    assert_eq!(
+        document.bundle(),
+        &bundle,
+        "fixture must need no migration or ID insertion"
+    );
+    document
+}
+
+fn id(number: u8) -> Id {
+    Id::parse_str(&format!("10000000-0000-4000-8000-{number:012}")).unwrap()
+}
+
+fn prepare(document: &Document, target: Id, replacement: &str) -> PreparedAliasRename {
+    document
+        .alias_rename_request(target, replacement.into())
+        .unwrap()
+        .prepare()
+        .unwrap()
+}
+
+// Capture every live Document state relevant to refusal/no-op. Arc identity also
+// catches replacing an equal snapshot or saved marker behind the user's back.
+struct Unchanged {
+    current: Arc<CompiledSourceProject>,
+    saved: Option<Arc<SourceBundle>>,
+    past: Vec<(Arc<CompiledSourceProject>, usize)>,
+    future: Vec<(Arc<CompiledSourceProject>, usize)>,
+    revision: u64,
+    current_bytes: usize,
+    recovered: bool,
+}
+
+impl Unchanged {
+    fn capture(document: &Document) -> Self {
+        Self {
+            current: document.snapshot(),
+            saved: document.saved.clone(),
+            past: document
+                .past
+                .iter()
+                .map(|h| (h.snapshot.clone(), h.bytes))
+                .collect(),
+            future: document
+                .future
+                .iter()
+                .map(|h| (h.snapshot.clone(), h.bytes))
+                .collect(),
+            revision: document.revision,
+            current_bytes: document.current_bytes,
+            recovered: document.recovered_unsaved,
+        }
+    }
+
+    fn assert(&self, document: &Document) {
+        assert!(Arc::ptr_eq(&self.current, &document.current));
+        match (&self.saved, &document.saved) {
+            (Some(before), Some(after)) => assert!(Arc::ptr_eq(before, after)),
+            (None, None) => {}
+            _ => panic!("saved baseline changed"),
+        }
+        for (before, after) in [
+            (&self.past, &document.past),
+            (&self.future, &document.future),
+        ] {
+            assert_eq!(before.len(), after.len());
+            for ((snapshot, bytes), entry) in before.iter().zip(after) {
+                assert!(Arc::ptr_eq(snapshot, &entry.snapshot));
+                assert_eq!(*bytes, entry.bytes);
+            }
+        }
+        assert_eq!(self.revision, document.revision);
+        assert_eq!(self.current_bytes, document.current_bytes);
+        assert_eq!(self.recovered, document.recovered_unsaved);
+    }
+}
+
+#[test]
+fn each_identity_family_changes_only_authored_alias_roles_and_one_history_entry() {
+    // Literal role-specific replacements are independent of the updater/tokenizer.
+    // They deliberately exclude prose, historical review text and URI spelling.
+    type AliasCase<'a> = (u8, &'a str, &'a str, &'a [(&'a str, &'a str)]);
+    let cases: &[AliasCase<'_>] = &[
+        (
+            1,
+            "mission",
+            "renamed",
+            &[("project mission ", "project renamed ")],
+        ),
+        (
+            2,
+            "assess",
+            "renamed",
+            &[
+                ("oa_activity assess ", "oa_activity renamed "),
+                ("\r\n assess;", "\r\n renamed;"),
+                ("@assess;", "@renamed;"),
+            ],
+        ),
+        (
+            5,
+            "transfer",
+            "renamed",
+            &[
+                ("interaction transfer ", "interaction renamed "),
+                ("\r\n transfer;", "\r\n renamed;"),
+            ],
+        ),
+        (
+            6,
+            "review",
+            "renamed",
+            &[
+                ("trace review ", "trace renamed "),
+                ("owner @review;", "owner @renamed;"),
+            ],
+        ),
+        (
+            7,
+            "evidence",
+            "renamed",
+            &[("artifact evidence ", "artifact renamed ")],
+        ),
+        (
+            8,
+            "overview",
+            "renamed",
+            &[
+                ("diagram overview ", "diagram renamed "),
+                ("diagram @overview;", "diagram @renamed;"),
+            ],
+        ),
+        (
+            9,
+            "placement",
+            "renamed",
+            &[("node placement ", "node renamed ")],
+        ),
+    ];
+    for &(number, old, new, replacements) in cases {
+        let mut document = fixture();
+        let original = document.snapshot();
+        let mut expected_model = document.project().clone();
+        // Explicit per-family oracle, separate from production expectation helper.
+        match number {
+            1 => expected_model.alias = new.into(),
+            2 => expected_model.elements.get_mut(&id(2)).unwrap().alias = new.into(),
+            5 => expected_model.relations.get_mut(&id(5)).unwrap().alias = new.into(),
+            6 => expected_model.traces.get_mut(&id(6)).unwrap().alias = new.into(),
+            7 => expected_model.artifact_links.get_mut(&id(7)).unwrap().alias = new.into(),
+            8 => expected_model.diagrams.get_mut(&id(8)).unwrap().alias = new.into(),
+            9 => {
+                expected_model
+                    .diagrams
+                    .get_mut(&id(8))
+                    .unwrap()
+                    .nodes
+                    .get_mut(&id(9))
+                    .unwrap()
+                    .alias = new.into()
+            }
+            _ => unreachable!(),
+        }
+        let mut expected_bundle = document.bundle().clone();
+        for source in expected_bundle.files.values_mut() {
+            for &(before, after) in replacements {
+                *source = source.replace(before, after);
+            }
+        }
+        let state = Unchanged::capture(&document);
+        let prepared = prepare(&document, id(number), new);
+        state.assert(&document);
+        assert!(prepared.changed());
+        assert_eq!(prepared.old_alias(), old);
+        assert_eq!(prepared.new_alias(), new);
+        assert_eq!(prepared.target(), id(number));
+        assert_eq!(prepared.revision(), 0);
+        assert_eq!(prepared.before().bundle, original.bundle);
+        assert_eq!(prepared.after().bundle, expected_bundle);
+        assert_eq!(prepared.after().decoded.project, expected_model);
+        assert!(document.commit_alias_rename(&prepared).unwrap());
+        assert!(
+            Arc::ptr_eq(&document.current, &prepared.0.after),
+            "adopt the exact prepared Arc"
+        );
+        assert_eq!(document.past.len(), 1);
+        assert!(document.dirty());
+        let after = Unchanged::capture(&document);
+        assert!(document.commit_alias_rename(&prepared.clone()).is_err());
+        after.assert(&document);
+        assert!(document.undo());
+        assert!(Arc::ptr_eq(&document.current, &original));
+        assert!(!document.dirty());
+        assert!(!document.can_undo());
+        assert!(document.redo());
+        assert_eq!(document.bundle(), &expected_bundle);
+        assert_eq!(document.project(), &expected_model);
+        document.mark_saved(document.snapshot());
+        let reopened =
+            Document::from_bundle(document.bundle().clone(), ProjectLimits::default()).unwrap();
+        assert_eq!(reopened.project(), &expected_model);
+        assert_eq!(reopened.bundle(), &expected_bundle);
+        assert!(!reopened.dirty());
+    }
+}
+
+#[test]
+fn highlighted_keyword_alias_is_valid_without_normalizing_input() {
+    assert!(matches!(
+        language::tokenize("oa_activity")[0].class,
+        language::TokenClass::Keyword
+    ));
+    let mut document = fixture();
+    let prepared = prepare(&document, id(2), "oa_activity");
+    document.commit_alias_rename(&prepared).unwrap();
+    assert_eq!(document.project().elements[&id(2)].alias, "oa_activity");
+    assert_eq!(document.project().elements[&id(2)].name, "Оценка ущерба");
+}
+
+#[test]
+fn invalid_and_identical_aliases_preserve_live_state_and_redo() {
+    let mut document = fixture();
+    let first = prepare(&document, id(2), "changed");
+    document.commit_alias_rename(&first).unwrap();
+    assert!(document.undo());
+    document.invalidate_saved_baseline();
+    document.mark_recovered();
+    let state = Unchanged::capture(&document);
+    for replacement in ["", "has space", "project", "assist", " assess", "assess "] {
+        assert!(
+            document
+                .alias_rename_request(id(2), replacement.into())
+                .unwrap()
+                .prepare()
+                .is_err()
+        );
+        state.assert(&document);
+    }
+    assert!(
+        document
+            .alias_rename_request(Id::nil(), "new".into())
+            .is_err()
+    );
+    let no_op = prepare(&document, id(2), "assess");
+    assert!(!no_op.changed());
+    assert!(!document.commit_alias_rename(&no_op).unwrap());
+    state.assert(&document);
+    assert!(document.redo());
+    assert_eq!(document.project().elements[&id(2)].alias, "changed");
+}
+
+#[test]
+fn equal_bytes_undo_replay_cross_document_and_exhausted_revision_refuse() {
+    let mut document = fixture();
+    let old = prepare(&document, id(2), "renamed");
+    let mut second = fixture();
+    let second_state = Unchanged::capture(&second);
+    assert!(second.commit_alias_rename(&old).is_err());
+    second_state.assert(&second);
+    // Even an identical shared accepted Arc cannot confer this Document's owner.
+    second.current = document.current.clone();
+    let second_state = Unchanged::capture(&second);
+    assert!(second.commit_alias_rename(&old).is_err());
+    second_state.assert(&second);
+    document
+        .execute(Command::Rename(id(2), "Later name".into()))
+        .unwrap();
+    let edited = Unchanged::capture(&document);
+    assert!(document.commit_alias_rename(&old).is_err());
+    edited.assert(&document);
+    assert!(document.undo());
+    assert!(Arc::ptr_eq(&document.current, &old.0.request.before));
+    let undone = Unchanged::capture(&document);
+    assert!(document.commit_alias_rename(&old).is_err());
+    undone.assert(&document);
+    document.revision = u64::MAX - 1;
+    let last = prepare(&document, id(2), "renamed");
+    document
+        .execute(Command::Rename(id(2), "Exhaust revision".into()))
+        .unwrap();
+    document.undo();
+    assert!(Arc::ptr_eq(&document.current, &last.0.request.before));
+    let exhausted = Unchanged::capture(&document);
+    assert!(document.commit_alias_rename(&last).is_err());
+    assert!(
+        document
+            .alias_rename_request(id(2), "renamed".into())
+            .is_err()
+    );
+    assert!(
+        document
+            .alias_rename_request(id(2), "assess".into())
+            .is_err()
+    );
+    exhausted.assert(&document);
+}
+
+#[test]
+fn preview_retains_latest_saved_baseline_and_recovery_state() {
+    for baseline in ["saved_before", "unknown", "raw_repair", "recovered"] {
+        let mut document = fixture();
+        let prepared = prepare(&document, id(2), "renamed");
+        let original = document.snapshot();
+        match baseline {
+            "saved_before" => document.mark_saved(original.clone()),
+            "unknown" => document.invalidate_saved_baseline(),
+            "raw_repair" => {
+                let mut raw = document.bundle().clone();
+                raw.files
+                    .insert("project.arcadia".into(), "invalid repair source".into());
+                document.bind_repair_baseline(raw);
+            }
+            "recovered" => document.mark_recovered(),
+            _ => unreachable!(),
+        }
+        let saved = document.saved.clone();
+        let recovered = document.recovered_unsaved;
+        assert!(document.commit_alias_rename(&prepared).unwrap());
+        assert_eq!(document.saved, saved);
+        assert_eq!(document.recovered_unsaved, recovered);
+        assert!(document.dirty());
+        assert!(document.undo());
+        assert_eq!(document.saved, saved);
+        assert_eq!(document.recovered_unsaved, recovered);
+        assert_eq!(document.dirty(), baseline != "saved_before");
+    }
+    // A completed save after Preview remains authoritative, including when it
+    // clears recovery; a worker must not restore its earlier state on Confirm.
+    let mut document = fixture();
+    document.mark_recovered();
+    document.invalidate_saved_baseline();
+    let prepared = prepare(&document, id(2), "renamed");
+    document.mark_saved(document.snapshot());
+    document.commit_alias_rename(&prepared).unwrap();
+    assert!(!document.recovered_unsaved);
+    document.undo();
+    assert!(!document.dirty());
+    // Undo from saved C to B, then a new B->C rename can correctly finish clean.
+    document.redo();
+    document.mark_saved(document.snapshot());
+    document.undo();
+    let return_to_saved = prepare(&document, id(2), "renamed");
+    document.commit_alias_rename(&return_to_saved).unwrap();
+    assert!(!document.dirty());
+    assert!(!document.can_redo());
+}
+
+#[test]
+fn mutable_public_preview_copies_cannot_change_prepared_authority() {
+    let mut document = fixture();
+    let prepared = prepare(&document, id(2), "renamed");
+    let exact = prepared.after().clone();
+    let mut counterfeit = prepared.after().clone();
+    counterfeit.decoded.project.name = "Injected unrelated edit".into();
+    counterfeit.index.declarations.clear();
+    let unchanged = Unchanged::capture(&document);
+    assert!(document.apply_compiled(counterfeit).is_err());
+    unchanged.assert(&document);
+    let mut unrelated = exact.decoded.project.clone();
+    unrelated.name = "A self-consistent unrelated candidate".into();
+    let forged_dto = source_project::compile_bundle(
+        &source_project::format_bundle(&unrelated),
+        ProjectLimits::default(),
+    )
+    .unwrap();
+    assert_ne!(forged_dto.decoded.project, prepared.after().decoded.project);
+    // No API converts either DTO to PreparedAliasRename. Mutating owned copies
+    // leaves the opaque capability and its exact adopted model/source intact.
+    document.commit_alias_rename(&prepared).unwrap();
+    assert_eq!(document.project(), &exact.decoded.project);
+    assert_eq!(document.bundle(), &exact.bundle);
+}
+
+#[test]
+fn exact_history_capacity_admits_immediate_undo_and_rejects_larger_candidate() {
+    let mut document = fixture();
+    let mut bundle = document.bundle().clone();
+    let padding = HISTORY_BYTES / 2 - document.current_bytes;
+    bundle
+        .files
+        .get_mut("views.arcadia")
+        .unwrap()
+        .push_str(&format!("//{}\r\n", "x".repeat(padding - 4)));
+    document.apply_bundle(bundle).unwrap();
+    assert_eq!(document.current_bytes, HISTORY_BYTES / 2);
+    // A same-length alias retains the exact estimate; older history is evictable.
+    let boundary = prepare(&document, id(2), "rating");
+    assert_eq!(
+        boundary.0.before_bytes + boundary.0.after_bytes,
+        HISTORY_BYTES
+    );
+    let unchanged = Unchanged::capture(&document);
+    assert!(
+        document
+            .alias_rename_request(id(2), "longer_alias".into())
+            .unwrap()
+            .prepare()
+            .is_err()
+    );
+    unchanged.assert(&document);
+    document.commit_alias_rename(&boundary).unwrap();
+    assert_eq!(document.past.len(), 1);
+    assert!(document.undo());
+    assert!(Arc::ptr_eq(&document.current, &boundary.0.request.before));
+    assert!(!document.can_undo());
+    assert!(document.redo());
+    assert!(Arc::ptr_eq(&document.current, &boundary.0.after));
+    assert!(check_history_capacity(usize::MAX, 1).is_err());
+    assert!(check_history_capacity(HISTORY_BYTES, 1).is_err());
+}
+
+#[test]
+fn mint_and_commit_refuse_exhausted_or_inconsistent_live_history_estimate() {
+    let mut document = fixture();
+    let prepared = prepare(&document, id(2), "renamed");
+    // Inject cache corruption to falsify the commit-side check independently of
+    // the preparation admission. Normal edits also change revision and Arc.
+    document.current_bytes = HISTORY_BYTES;
+    let unchanged = Unchanged::capture(&document);
+    assert!(
+        document
+            .alias_rename_request(id(2), "renamed".into())
+            .is_err()
+    );
+    assert!(document.commit_alias_rename(&prepared).is_err());
+    // No-op intent needs no Undo reservation even at the admission boundary.
+    assert!(
+        document
+            .alias_rename_request(id(2), "assess".into())
+            .is_ok()
+    );
+    unchanged.assert(&document);
+}

crates/oa-desktop/src/forms/history_fields.rs

@@ -120,7 +120,9 @@ fn seed(schema: &'static Value, depth: usize) -> Result<Value, &'static str> {
     if let Some(options) = alternatives(schema) {
         if options
             .iter()
-            .any(|s| matches_value(s, &json!("NotApplicable"), 0))
+            .filter_map(|s| resolve(s).ok())
+            .filter_map(|s| s.get("enum").and_then(Value::as_array))
+            .any(|values| values.contains(&json!("NotApplicable")))
         {
             return Ok(json!("NotApplicable"));
         }
@@ -577,11 +579,11 @@ fn render<'a>(
             for (index, item) in items.iter().enumerate().skip(page * PAGE_SIZE).take(PAGE_SIZE) {
                 let item_path = format!("{path}/{index}");
                 let mut card = column![render(draft, project, item_schema, Some(item), &item_path, &format!("{} {}", title, index + 1), depth + 1)].spacing(8);
-                if path == FACETS {
-                    if let Some(current) = current_observation(draft, project, &item_path) {
-                        card = card.push(button("Use current counterpart observations")
-                            .on_press(Message::FieldShape(item_path.clone(), json!(current))).style(style::nav));
-                    }
+                if path == FACETS
+                    && let Some(current) = current_observation(draft, project, &item_path)
+                {
+                    card = card.push(button("Use current counterpart observations")
+                        .on_press(Message::FieldShape(item_path.clone(), json!(current))).style(style::nav));
                 }
                 card = card.push(row![
                     button("↑").on_press_maybe((index > 0).then(|| Message::FieldArray(path.into(), Some(index), -1))),

crates/oa-desktop/src/forms/history_fields/tests.rs

@@ -752,6 +752,38 @@ fn choose_history_constructor(draft: &mut Draft, path: &str, label: &str) {
     draft.shape(&path, value).unwrap();
 }
 
+#[test]
+fn history_optional_uuid_and_text_seed_absence_without_inventing_observations() {
+    for fact in ["Header/Parent", "Artifact/review/Revision"] {
+        let side = format!("{FACETS}/0/{fact}/oa");
+        let schema = resolve(schema_at(&side).unwrap()).unwrap();
+        assert_eq!(seed(schema, 0).unwrap(), json!("NotApplicable"));
+        let observed_value = alternatives(schema)
+            .unwrap()
+            .iter()
+            .find(|branch| branch_label(branch) == "Observed value")
+            .unwrap();
+        let value = branch_seed(observed_value).unwrap();
+        assert_eq!(value, json!({"Value": null}));
+        assert_eq!(
+            seed(schema_at(&format!("{side}/Value")).unwrap(), 0).unwrap(),
+            Value::Null,
+            "a plain text/UUID shape is not the NotApplicable enum constructor"
+        );
+        if fact == "Header/Parent" {
+            assert_eq!(
+                serde_json::from_value::<Observed<Option<Id>>>(value).unwrap(),
+                Observed::Value(None)
+            );
+        } else {
+            assert_eq!(
+                serde_json::from_value::<Observed<Option<String>>>(value).unwrap(),
+                Observed::Value(None)
+            );
+        }
+    }
+}
+
 #[test]
 fn history_nested_optional_number_events_switch_absent_present_and_recover_invalid_raw() {
     let (project, id) = fixture(Some(baseline(vec![])));

crates/oa-desktop/src/guide.rs

@@ -187,8 +187,8 @@ fn article(topic: Topic) -> Article {
                             &[
                                 "Choose New in the top bar. Use Project properties to name the model and describe its purpose. Apply changes commits the property draft.",
                                 "On Architecture, choose Create architecture view. Architecture · allocated work shows work inside its performer.",
-                                "Choose Entity in the diagram's Create toolbar. Enter Rescue coordinator, choose Choose position, then click the diagram. Use Actor for an external participant such as a Vessel in distress. You can also right-click a blank area, choose Create Entity here, enter its name and choose Create here.",
-                                "Choose Activity in the same toolbar, name it Assess incident and place it. Select Rescue coordinator and use + Relationship with Allocation to assign Assess incident to it. The allocated-work view then shows the activity inside its performer.",
+                                "Expand the diagram's side palette to see tool names. Choose Entity, click its position in the diagram, enter Rescue coordinator and press Enter. Escape cancels the draft. Use Actor for an external participant such as a Vessel in distress. Right-clicking a blank area also offers Create Entity here.",
+                                "Right-click Rescue coordinator and choose Add activity. Enter Assess incident and press Enter to create the activity and its performer allocation together. Ordinary Activity creation in the palette leaves work unallocated; use + Relationship with Allocation to assign existing work. The allocated-work view shows work inside its performer.",
                                 "Use Add existing to place an element that is already in the model. The initial choices match this view; no search is required. Include already shown offers Locate for elements already placed here.",
                                 "Add a second activity for another participant. Select an activity, choose + Relationship, select Interaction and choose the compatible target. Name the exchange after what is conveyed.",
                                 "Visit Model checks to review unfinished work. Save all writes the accepted model and applied drafts to your chosen file.",
@@ -262,8 +262,8 @@ fn article(topic: Topic) -> Article {
                             "Create and allocate work",
                             &[
                                 "Choose the Operational or System perspective. Create participants using Entity/Actor in OA or System/System actor in SA.",
-                                "In the diagram's Create toolbar, choose Activity in OA or Function in SA, enter a name and click to place it. For semantic decomposition, use Model explorer, select existing work and use + In selected to create smaller work units.",
-                                "To assign work to a participant, use + Relationship with Allocation from the participant to the leaf work. Model explorer also offers + Allocated when a participant and the appropriate work kind are selected.",
+                                "In the diagram's side palette, choose Activity in OA or Function in SA, click its position, enter a name and press Enter. Escape cancels without creating an element. Select a card and press F2 to rename it in place. For semantic decomposition, use Model explorer, select existing work and use + In selected to create smaller work units.",
+                                "Right-click a participant and choose Add activity or Add function to create new work and its allocation together. To assign existing leaf work, use + Relationship with Allocation from the participant to the work. Model explorer also offers + Allocated when a participant and the appropriate work kind are selected.",
                                 "Choose Architecture · allocated work to review responsibilities. Choose Functional dataflow to review the activity/function hierarchy and its exchanges independently.",
                             ],
                         ),
@@ -445,9 +445,9 @@ fn article(topic: Topic) -> Article {
                         walkthrough(
                             "Describe a path through exchanges",
                             &[
-                                "First create the activities/functions and their exchanges. Check the source and target work for every exchange.",
-                                "Open Behavior & scenarios. Create Process in OA or Functional chain in SA using Create element and + At root.",
-                                "Select that behavior in the page's selector. Open Tools and choose Work or Exchange, then a highlighted path or contribution position to involve an existing source. Each contribution keeps its own identity while referring to the shared engineering definition.",
+                                "A blank path offers Add first activity/function contribution. You can use existing work or stage a new source in that form; exchanges still need explicit compatible source and target work.",
+                                "Open Behavior & scenarios → New. Choose Operational process in OA or Functional chain in SA, enter its exact name, then Create and open. The new behavior belongs at the layer root and opens immediately; Undo removes the creation as one edit.",
+                                "Open Tools and choose Work or Exchange, then a highlighted position. In Work, Create new source keeps the contribution name and position while you name its Activity/Function and choose its semantic parent. Use this new source stages it; Create commits source and contribution in one Undo. An adjacent exchange may require a particular existing work identity.",
                                 "In Tools, choose Sequence link and click or drag from the preceding contribution to the following contribution. Choose Tools → Select / reorder to drag a selected path endpoint and reconnect it; a contribution's ↕ handle changes its position within a column. These are local contributions and sequence links, not new architecture exchanges.",
                                 "Select a contribution, then add another after it. Tools → Two paths… creates a split, two paths and their merge in one undoable edit. Enter explicit alternative conditions. Fit overview uses the visible canvas area; 100% keeps working scale with scrollbars. If the minimum zoom is reached, scroll to inspect the remainder.",
                                 "Use Chain involvement from the Process/Functional chain to the capability it supports. Read Model checks for unfinished or disconnected paths.",
@@ -489,8 +489,8 @@ fn article(topic: Topic) -> Article {
                         walkthrough(
                             "Create a scenario",
                             &[
-                                "Open Behavior & scenarios, choose Scenario under Create element and add it at a legal root/owner. Select the scenario in the behavior selector.",
-                                "Use + Lifeline and choose the participant or work it represents. Choices follow the scenario's viewpoint: operational activities, operational participants, system functions or system boundary participants.",
+                                "Open Behavior & scenarios → New → Scenario and enter its name. Explicitly choose Activities or Participants in OA, or Functions or System boundary in SA. Add optional context only when needed: this is a reference, while the scenario itself belongs at the layer root. Create and open starts the empty scenario.",
+                                "Use Add first lifeline on an empty scenario, or + Lifeline. Choose existing work/participant or Create new source. The explicit viewpoint limits its kinds; choose participant kinds deliberately. Source name and lifeline name are separate, and the source semantic parent is independent of the scenario. No allocation or capability involvement is inferred.",
                                 "Choose + Message and its style. Call + correlated reply creates both occurrences in one edit. Select the exchange and compatible sending/receiving lifelines. Reply to existing call offers valid unanswered calls.",
                                 "Use Action, Observe state or Fragment for other behavior. A local timer has an expression and a lifeline, with no global exchange. Create and delete messages describe participant lifetime; Model checks also flag risks inside repeated loops.",
                                 "Choose a message style and Draw message. Start at a highlighted sequence position on a lifeline, then click or drag to the receiving lifeline. The form retains the chosen position while you select the exchange and details. Escape cancels the gesture.",
@@ -543,7 +543,9 @@ fn article(topic: Topic) -> Article {
                         walkthrough(
                             "Build a state machine",
                             &[
-                                "In Behavior & scenarios, create or select a State machine, then choose Create diagram. This places its existing regions and vertices in a saved view. + View creates another independent layout.",
+                                "In Behavior & scenarios → New → State machine, enter its name and search for the existing same-layer participant that owns it. Candidate labels show parent context and alias to distinguish repeated names.",
+                                "If the owner does not exist, Create new owner retains the machine name and first-view option. Choose its participant kind and semantic parent explicitly. Use this new source returns without changing the model; Create and open commits owner, machine and optional view together.",
+                                "Optionally select Create the first state view, then Create and open. The new machine starts without regions or states. For an existing machine, Create diagram places its existing regions and vertices in a saved view; + View creates another independent layout.",
                                 "Choose + Region and click the highlighted machine, or a State/Mode for a nested region. Choose Initial, State, Mode or another kind from + State / symbol, then click its highlighted owning region. Rename the new element in Properties.",
                                 "Choose Transition and drag from a source vertex to a compatible target, or click the source and then the target. In Select / move, drag states or containers to arrange them; a container moves its descendant placements without changing ownership.",
                                 "Select a drawn transition and drag its endpoint handle to reconnect it. Its right-click menu also offers Reconnect source and Reconnect target; choose one, then click a compatible vertex.",
@@ -783,7 +785,7 @@ fn article(topic: Topic) -> Article {
             const {
                 Article {
                     summary: "The text editor and graphical forms edit the same model. Source projects preserve file organization and comments for human review, automation and version control.",
-                    keywords: "text textual source language syntax highlighting lint parser git aliases uuid identity rename diff merge restructuredtext spec canonical parity",
+                    keywords: "text textual source language syntax highlighting lint parser git aliases uuid identity rename F2 preview diff merge restructuredtext spec canonical parity definition references lexical navigation F12 back",
                     sections: &[
                         walkthrough(
                             "Edit and review source",
@@ -796,10 +798,27 @@ fn article(topic: Topic) -> Article {
                                 "Save all writes the entry and its included UTF-8 files. Review the Git diff before committing, including relationships, traces and diagram changes that belong to the same engineering edit.",
                             ],
                         ),
+                        explain(
+                            "Follow definitions and lexical references",
+                            "Place the caret on a declaration alias or an @reference. Choose Definition (F12) to locate its declaration, or References (Shift+F12) to list lexical uses. Choose a row when a definition is ambiguous, draft or detached. Lexical uses exclude comments and strings; they do not establish typed relationships or resolve an ambiguous alias to one declaration. Back (Alt+Left) returns to the previous source location; if that draft changed, it restores the current cursor instead of an obsolete selection. These shortcuts work while the source editor has focus; the Text toolbar also offers the actions.",
+                        ),
+                        explain(
+                            "Read the navigation scope",
+                            "Queries inspect bounded snapshots of currently loaded drafts, without applying them or loading missing included files. The panel identifies partial scope, draft evidence, detached or unverified files, and alias or ID collisions. Counts show total, displayed and omitted rows. A missing result in partial scope does not establish that the whole project has no match. If sources change, stale rows are disabled; run Definition or References again. Row locations use one-based lines and UTF-8 byte columns. Navigation preserves your source drafts and the accepted model.",
+                        ),
                         explain(
                             "Names, aliases and IDs serve different purposes",
                             "The displayed name is engineering prose. A stable @alias is the readable source reference and need not change when the name changes. UUID identity distinguishes the persistent record. Preserve IDs when revising the same engineering object; changing identity is a deliberate operation that affects references.",
                         ),
+                        walkthrough(
+                            "Rename a source alias",
+                            &[
+                                "Place the caret on a declaration alias or live @reference, then choose Rename alias or press F2 in the source editor. First finish or revert pending source, property and behavior drafts; close or reattach any extra loaded detached files. Accepted edits do not need to be saved first.",
+                                "Edit Source alias and choose Preview (Enter also previews). Pasting line breaks, tabs or other control characters is rejected without changing the field; choose Preview again after correcting the paste. Review the changed files, hunks and lines; long lines have additional segments. The engineering name and UUID stay unchanged. Comments and quoted prose keep their original spelling. This preview covers the rename; a later Save can include earlier accepted edits too.",
+                                "Choose Rename alias to accept the complete preview, or Cancel/Escape to leave everything unchanged. An invalid, unchanged, stale or oversized preview cannot be confirmed. After editing the replacement, choose Preview again. If the source context changes, close the form and invoke Rename again on the current alias.",
+                                "Use Undo rename immediately, or the model Undo/Redo controls, to restore the complete source/model snapshot. Ctrl+Z in Text still undoes source drafting. Save all and reopen use the normal project workflow; an unconfirmed preview is not saved.",
+                            ],
+                        ),
                         example(
                             "Readable references",
                             "For example, renaming an activity does not require renaming @assess_incident. A related record can still refer to that alias.",
@@ -894,6 +913,10 @@ fn article(topic: Topic) -> Article {
                             "A property draft is not yet the model",
                             "Apply changes validates the candidate. When it is rejected, correct the retained draft or use Revert. The canvas continues to show accepted values. Navigation that needs to apply an invalid draft may remain on the current record so your work is not lost. You can read this guide without applying or discarding that draft.",
                         ),
+                        explain(
+                            "A new behavior is still a draft",
+                            "Inside a source subform, Back or the first Escape returns to the unchanged parent. Use this new source stages the prerequisite only. Canceling the parent discards it; choosing an existing reference excludes the staged source from creation. Recovery retains both forms and their reserved identities. An open dialog still receives Escape first. Behavior → New keeps the exact name, owner and viewpoint choices outside the model until Create and open succeeds. Cancel or Escape discards only this draft; if a dialog is open, the first Escape dismisses that dialog. New refuses other unfinished property, source or behavior drafts without applying them. Recovery restores the creation form in its original layer, including rejected raw text, for correction or cancellation.",
+                        ),
                         explain(
                             "Aliases and references",
                             "Stable source aliases must follow the language's identifier rules and avoid reserved words. Use a simple descriptive identifier such as assess_incident. Spaces belong in the displayed Name, not the alias. Reference pickers offer compatible model records; creating the required target first is often the missing step.",

crates/oa-desktop/src/main.rs

@@ -24,6 +24,7 @@ mod recovery;
 mod route_edit;
 mod semantic_review;
 mod source_navigation;
+mod source_rename;
 mod source_tree;
 mod source_workspace;
 mod style;

crates/oa-desktop/src/source_navigation.rs

@@ -1,4 +1,9 @@
 //! Literal source search and line navigation, independent of accepted model state.
+mod controller;
+pub mod interaction;
+pub mod query;
+pub mod symbols;
+pub use controller::*;
 use iced::widget::text_editor::{Cursor, Position};
 
 #[derive(Debug, Clone)]

crates/oa-desktop/src/source_navigation/controller.rs

@@ -0,0 +1,125 @@
+//! Ephemeral editor navigation; no model commands or filesystem operations.
+use super::query;
+use iced::widget::text_editor::{Cursor, Position};
+use oa_core::Id;
+use std::sync::Arc;
+use std::sync::atomic::AtomicU64;
+
+#[derive(Debug, Clone)]
+pub enum SymbolEvent {
+    Query(query::Action),
+    Back,
+    Close,
+    Choose {
+        stamp: query::QueryStamp,
+        reference: bool,
+        index: usize,
+    },
+}
+
+/// Identity of the mounted source view that emitted an action. Message queues
+/// may outlive that view; request-time stamping alone cannot detect replay.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SymbolContext {
+    pub session: Id,
+    pub path: String,
+}
+
+#[derive(Debug, Clone)]
+pub struct HistoryEntry {
+    pub session: Id,
+    pub path: String,
+    pub generation: u64,
+    pub cursor: Cursor,
+}
+
+#[derive(Debug, Clone)]
+pub struct Request {
+    pub job: Id,
+    pub interaction: Id,
+    pub raw_interaction: u64,
+    pub stamp: query::QueryStamp,
+    pub path: String,
+    pub offset: usize,
+    pub cursor: Cursor,
+    pub action: query::Action,
+}
+
+#[derive(Debug, Clone)]
+pub struct Completion {
+    pub request: Request,
+    pub result: Result<(Arc<query::Snapshot>, Arc<query::Results>), String>,
+}
+
+pub struct Reveal {
+    pub ticket: Id,
+    pub interaction: Id,
+    pub raw_interaction: u64,
+    pub snapshot: query::SnapshotKey,
+    pub path: String,
+}
+
+pub struct SymbolState {
+    pub open: bool,
+    pub interaction: Id,
+    pub raw_interaction: Arc<AtomicU64>,
+    pub serial: u64,
+    pub in_flight: Option<Id>,
+    pub request: Option<Request>,
+    pub cache: Option<Arc<query::Snapshot>>,
+    pub results: Option<Arc<query::Results>>,
+    pub notice: Option<String>,
+    pub back: Vec<HistoryEntry>,
+    pub reveal: Option<Reveal>,
+}
+
+impl Default for SymbolState {
+    fn default() -> Self {
+        Self {
+            open: false,
+            interaction: Id::new_v4(),
+            raw_interaction: Arc::new(AtomicU64::new(0)),
+            serial: 0,
+            in_flight: None,
+            request: None,
+            cache: None,
+            results: None,
+            notice: None,
+            back: Vec::new(),
+            reveal: None,
+        }
+    }
+}
+
+/// Iced uses zero-based UTF-8 byte columns. Reject stale or split-codepoint
+/// coordinates; do not normalize CRLF or silently clamp query destinations.
+pub fn byte_offset(text: &str, position: Position) -> Option<usize> {
+    let start = if position.line == 0 {
+        0
+    } else {
+        text.match_indices('\n').nth(position.line - 1)?.0 + 1
+    };
+    let end = text[start..]
+        .find('\n')
+        .map_or(text.len(), |end| start + end);
+    let offset = start.checked_add(position.column)?;
+    (offset <= end && text.is_char_boundary(offset)).then_some(offset)
+}
+
+pub fn cursor_offset(text: &str, cursor: Cursor) -> Option<usize> {
+    let position = cursor.selection.map_or(cursor.position, |selection| {
+        if (selection.line, selection.column) < (cursor.position.line, cursor.position.column) {
+            selection
+        } else {
+            cursor.position
+        }
+    });
+    byte_offset(text, position)
+}
+
+pub fn exact_cursor(text: &str, cursor: Cursor) -> bool {
+    byte_offset(text, cursor.position).is_some()
+        && cursor
+            .selection
+            .is_none_or(|position| byte_offset(text, position).is_some())
+}

crates/oa-desktop/src/source_navigation/interaction.rs

@@ -0,0 +1,284 @@
+//! Raw input invalidation and focus checks at widget-operation execution time.
+use iced::advanced::{Clipboard, Layout, Shell, Widget, layout, overlay, renderer, widget};
+use iced::{Element, Event, Length, Rectangle, Size, Task, Vector, keyboard, mouse, touch};
+use std::sync::{
+    Arc,
+    atomic::{AtomicU64, Ordering},
+};
+
+/// Exhaustion fails closed: a saturated clock can never authorize navigation.
+/// Replace the clock with a new workspace/controller, rather than wrapping it.
+pub fn is_current(clock: &AtomicU64, expected: u64) -> bool {
+    expected != u64::MAX && clock.load(Ordering::Acquire) == expected
+}
+
+fn invalidate(clock: &AtomicU64, event: &Event) {
+    if matches!(
+        event,
+        Event::Keyboard(keyboard::Event::KeyPressed { .. })
+            | Event::Mouse(mouse::Event::ButtonPressed(_) | mouse::Event::WheelScrolled { .. })
+            | Event::Touch(touch::Event::FingerPressed { .. })
+            | Event::Window(iced::window::Event::Unfocused)
+    ) {
+        let _ = clock.fetch_update(Ordering::AcqRel, Ordering::Acquire, |value| {
+            Some(value.saturating_add(1))
+        });
+    }
+}
+
+/// Transparent, including overlays: invalidate before the child can capture input.
+pub fn observe<'a, Message: 'a, Theme: 'a, Renderer: renderer::Renderer + 'a>(
+    content: Element<'a, Message, Theme, Renderer>,
+    clock: Arc<AtomicU64>,
+) -> Element<'a, Message, Theme, Renderer> {
+    Element::new(Observed { content, clock })
+}
+
+struct Observed<'a, Message, Theme, Renderer> {
+    content: Element<'a, Message, Theme, Renderer>,
+    clock: Arc<AtomicU64>,
+}
+
+impl<Message, Theme, Renderer: renderer::Renderer> Widget<Message, Theme, Renderer>
+    for Observed<'_, Message, Theme, Renderer>
+{
+    fn size(&self) -> Size<Length> {
+        self.content.as_widget().size()
+    }
+    fn size_hint(&self) -> Size<Length> {
+        self.content.as_widget().size_hint()
+    }
+    fn tag(&self) -> widget::tree::Tag {
+        self.content.as_widget().tag()
+    }
+    fn state(&self) -> widget::tree::State {
+        self.content.as_widget().state()
+    }
+    fn children(&self) -> Vec<widget::Tree> {
+        self.content.as_widget().children()
+    }
+    fn diff(&self, tree: &mut widget::Tree) {
+        self.content.as_widget().diff(tree);
+    }
+    fn layout(
+        &mut self,
+        tree: &mut widget::Tree,
+        renderer: &Renderer,
+        limits: &layout::Limits,
+    ) -> layout::Node {
+        self.content.as_widget_mut().layout(tree, renderer, limits)
+    }
+    fn draw(
+        &self,
+        tree: &widget::Tree,
+        renderer: &mut Renderer,
+        theme: &Theme,
+        style: &renderer::Style,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        viewport: &Rectangle,
+    ) {
+        self.content
+            .as_widget()
+            .draw(tree, renderer, theme, style, layout, cursor, viewport);
+    }
+    fn operate(
+        &mut self,
+        tree: &mut widget::Tree,
+        layout: Layout<'_>,
+        renderer: &Renderer,
+        operation: &mut dyn widget::Operation,
+    ) {
+        self.content
+            .as_widget_mut()
+            .operate(tree, layout, renderer, operation);
+    }
+    fn update(
+        &mut self,
+        tree: &mut widget::Tree,
+        event: &Event,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        renderer: &Renderer,
+        clipboard: &mut dyn Clipboard,
+        shell: &mut Shell<'_, Message>,
+        viewport: &Rectangle,
+    ) {
+        invalidate(&self.clock, event);
+        self.content.as_widget_mut().update(
+            tree, event, layout, cursor, renderer, clipboard, shell, viewport,
+        );
+    }
+    fn mouse_interaction(
+        &self,
+        tree: &widget::Tree,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        viewport: &Rectangle,
+        renderer: &Renderer,
+    ) -> mouse::Interaction {
+        self.content
+            .as_widget()
+            .mouse_interaction(tree, layout, cursor, viewport, renderer)
+    }
+    fn overlay<'a>(
+        &'a mut self,
+        tree: &'a mut widget::Tree,
+        layout: Layout<'a>,
+        renderer: &Renderer,
+        viewport: &Rectangle,
+        translation: Vector,
+    ) -> Option<overlay::Element<'a, Message, Theme, Renderer>> {
+        let clock = self.clock.clone();
+        self.content
+            .as_widget_mut()
+            .overlay(tree, layout, renderer, viewport, translation)
+            .map(|content| overlay::Element::new(Box::new(ObservedOverlay { content, clock })))
+    }
+}
+
+struct ObservedOverlay<'a, Message, Theme, Renderer> {
+    content: overlay::Element<'a, Message, Theme, Renderer>,
+    clock: Arc<AtomicU64>,
+}
+impl<Message, Theme, Renderer: renderer::Renderer> overlay::Overlay<Message, Theme, Renderer>
+    for ObservedOverlay<'_, Message, Theme, Renderer>
+{
+    fn layout(&mut self, renderer: &Renderer, bounds: Size) -> layout::Node {
+        self.content.as_overlay_mut().layout(renderer, bounds)
+    }
+    fn draw(
+        &self,
+        renderer: &mut Renderer,
+        theme: &Theme,
+        style: &renderer::Style,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+    ) {
+        self.content
+            .as_overlay()
+            .draw(renderer, theme, style, layout, cursor);
+    }
+    fn operate(
+        &mut self,
+        layout: Layout<'_>,
+        renderer: &Renderer,
+        operation: &mut dyn widget::Operation,
+    ) {
+        self.content
+            .as_overlay_mut()
+            .operate(layout, renderer, operation);
+    }
+    fn update(
+        &mut self,
+        event: &Event,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        renderer: &Renderer,
+        clipboard: &mut dyn Clipboard,
+        shell: &mut Shell<'_, Message>,
+    ) {
+        invalidate(&self.clock, event);
+        self.content
+            .as_overlay_mut()
+            .update(event, layout, cursor, renderer, clipboard, shell);
+    }
+    fn mouse_interaction(
+        &self,
+        layout: Layout<'_>,
+        cursor: mouse::Cursor,
+        renderer: &Renderer,
+    ) -> mouse::Interaction {
+        self.content
+            .as_overlay()
+            .mouse_interaction(layout, cursor, renderer)
+    }
+    fn overlay<'a>(
+        &'a mut self,
+        layout: Layout<'a>,
+        renderer: &Renderer,
+    ) -> Option<overlay::Element<'a, Message, Theme, Renderer>> {
+        let clock = self.clock.clone();
+        self.content
+            .as_overlay_mut()
+            .overlay(layout, renderer)
+            .map(|content| overlay::Element::new(Box::new(ObservedOverlay { content, clock })))
+    }
+    fn index(&self) -> f32 {
+        self.content.as_overlay().index()
+    }
+}
+
+/// Inspect all focus owners, then focus only the mounted target. Iced executes
+/// Operation::Chain synchronously, without an intervening input event. Both
+/// traversals recheck the raw clock; no result message authorizes later focus.
+pub fn guarded_focus<Message: Send + 'static>(
+    target: widget::Id,
+    clock: Arc<AtomicU64>,
+    expected: u64,
+) -> Task<Message> {
+    widget::operate(GuardedFocus::new(target, clock, expected))
+}
+
+struct GuardedFocus {
+    target: widget::Id,
+    clock: Arc<AtomicU64>,
+    expected: u64,
+    target_count: usize,
+    foreign_focus: bool,
+    apply: bool,
+}
+impl GuardedFocus {
+    fn new(target: widget::Id, clock: Arc<AtomicU64>, expected: u64) -> Self {
+        Self {
+            target,
+            clock,
+            expected,
+            target_count: 0,
+            foreign_focus: false,
+            apply: false,
+        }
+    }
+}
+impl<Message: 'static> widget::Operation<Message> for GuardedFocus {
+    fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn widget::Operation<Message>)) {
+        if is_current(&self.clock, self.expected) {
+            visit(self);
+        }
+    }
+    fn focusable(
+        &mut self,
+        id: Option<&widget::Id>,
+        _: Rectangle,
+        state: &mut dyn widget::operation::Focusable,
+    ) {
+        if !is_current(&self.clock, self.expected) {
+            return;
+        }
+        if id == Some(&self.target) {
+            self.target_count += 1;
+            if self.apply {
+                state.focus();
+            }
+        } else if state.is_focused() {
+            self.foreign_focus = true;
+        }
+    }
+    fn finish(&self) -> widget::operation::Outcome<Message> {
+        if !self.apply
+            && self.target_count == 1
+            && !self.foreign_focus
+            && is_current(&self.clock, self.expected)
+        {
+            widget::operation::Outcome::Chain(Box::new(Self {
+                apply: true,
+                ..Self::new(self.target.clone(), self.clock.clone(), self.expected)
+            }))
+        } else {
+            widget::operation::Outcome::None
+        }
+    }
+}
+
+#[cfg(all(test, debug_assertions))]
+mod tests;

crates/oa-desktop/src/source_navigation/interaction/tests.rs

@@ -0,0 +1,190 @@
+use super::*;
+use iced::advanced::widget::operation::{Focusable, Outcome};
+use iced::widget::{column, text_input};
+use iced::{Point, Theme};
+
+#[derive(Default)]
+struct FocusMap(Vec<(Option<widget::Id>, Rectangle, bool)>);
+impl widget::Operation for FocusMap {
+    fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn widget::Operation)) {
+        visit(self);
+    }
+    fn focusable(&mut self, id: Option<&widget::Id>, bounds: Rectangle, state: &mut dyn Focusable) {
+        self.0.push((id.cloned(), bounds, state.is_focused()));
+    }
+}
+
+struct Mounted {
+    element: Element<'static, (), Theme, ()>,
+    tree: widget::Tree,
+    node: layout::Node,
+}
+impl Mounted {
+    fn new(clock: Arc<AtomicU64>) -> Self {
+        let content = column![
+            text_input("Editor", "source")
+                .id("editor")
+                .on_input(|_| ())
+                .padding(12),
+            text_input("Find", "")
+                .id("find")
+                .on_input(|_| ())
+                .padding(12),
+        ]
+        .spacing(10)
+        .into();
+        let mut element = observe(content, clock);
+        let mut tree = widget::Tree::new(element.as_widget());
+        let node = element.as_widget_mut().layout(
+            &mut tree,
+            &(),
+            &layout::Limits::new(Size::ZERO, Size::new(400., 200.)),
+        );
+        Self {
+            element,
+            tree,
+            node,
+        }
+    }
+    fn pass(&mut self, operation: &mut dyn widget::Operation) {
+        self.element.as_widget_mut().operate(
+            &mut self.tree,
+            Layout::new(&self.node),
+            &(),
+            operation,
+        );
+    }
+    fn run(&mut self, operation: impl widget::Operation + 'static) {
+        let mut next: Box<dyn widget::Operation> = Box::new(operation);
+        loop {
+            self.pass(next.as_mut());
+            match next.finish() {
+                Outcome::Chain(chained) => next = chained,
+                Outcome::None => break,
+                Outcome::Some(()) => panic!("focus must not publish an application message"),
+            }
+        }
+    }
+    fn focus(&mut self) -> FocusMap {
+        let mut focus = FocusMap::default();
+        self.pass(&mut focus);
+        focus
+    }
+    fn click(&mut self, id: &str) {
+        let bounds = self
+            .focus()
+            .0
+            .into_iter()
+            .find(|(found, _, _)| found.as_ref() == Some(&widget::Id::from(id.to_owned())))
+            .unwrap()
+            .1;
+        let mut messages = Vec::new();
+        let mut shell = Shell::new(&mut messages);
+        self.element.as_widget_mut().update(
+            &mut self.tree,
+            &Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
+            Layout::new(&self.node),
+            mouse::Cursor::Available(bounds.center()),
+            &(),
+            &mut iced::advanced::clipboard::Null,
+            &mut shell,
+            &Rectangle::with_size(Size::new(400., 200.)),
+        );
+        assert!(shell.is_event_captured());
+        assert!(
+            messages.is_empty(),
+            "focus-only click must not rely on App messages"
+        );
+    }
+    fn focused(&mut self, id: &str) -> bool {
+        self.focus()
+            .0
+            .into_iter()
+            .find(|(found, _, _)| found.as_ref() == Some(&widget::Id::from(id.to_owned())))
+            .unwrap()
+            .2
+    }
+}
+
+#[test]
+fn captured_find_click_invalidates_without_app_message_and_preserves_focus() {
+    let clock = Arc::new(AtomicU64::new(0));
+    let mut ui = Mounted::new(clock.clone());
+    ui.run(GuardedFocus::new("editor".into(), clock.clone(), 0));
+    assert!(ui.focused("editor"));
+    ui.click("find");
+    assert!(!is_current(&clock, 0));
+    assert!(ui.focused("find"));
+    ui.run(GuardedFocus::new("editor".into(), clock.clone(), 0));
+    assert!(ui.focused("find"));
+    // Even a matching clock cannot authorize stealing another widget's focus.
+    ui.run(GuardedFocus::new(
+        "editor".into(),
+        clock.clone(),
+        clock.load(Ordering::Acquire),
+    ));
+    assert!(ui.focused("find"));
+    assert!(!ui.focused("editor"));
+}
+
+#[test]
+fn focus_rechecks_clock_between_inspection_and_application_and_missing_target_is_inert() {
+    let clock = Arc::new(AtomicU64::new(0));
+    let mut ui = Mounted::new(clock.clone());
+    let mut operation = GuardedFocus::new("editor".into(), clock.clone(), 0);
+    ui.pass(&mut operation);
+    let Outcome::Chain(mut apply) = <GuardedFocus as widget::Operation<()>>::finish(&operation)
+    else {
+        panic!("mounted, unopposed target must be eligible");
+    };
+    clock.store(1, Ordering::Release);
+    ui.pass(apply.as_mut());
+    assert!(!ui.focused("editor"));
+    ui.run(GuardedFocus::new("editor".into(), clock.clone(), 1));
+    assert!(ui.focused("editor"));
+    ui.run(GuardedFocus::new("removed-editor".into(), clock, 1));
+    assert!(ui.focused("editor"));
+}
+
+#[test]
+fn raw_navigation_inputs_advance_but_passive_geometry_does_not_and_exhaustion_refuses() {
+    let clock = AtomicU64::new(0);
+    let events = [
+        Event::Keyboard(keyboard::Event::KeyPressed {
+            key: keyboard::Key::Named(keyboard::key::Named::ArrowLeft),
+            modified_key: keyboard::Key::Named(keyboard::key::Named::ArrowLeft),
+            physical_key: keyboard::key::Physical::Code(keyboard::key::Code::ArrowLeft),
+            location: keyboard::Location::Standard,
+            modifiers: keyboard::Modifiers::empty(),
+            text: None,
+            repeat: false,
+        }),
+        Event::Mouse(mouse::Event::ButtonPressed(mouse::Button::Left)),
+        Event::Mouse(mouse::Event::WheelScrolled {
+            delta: mouse::ScrollDelta::Lines { x: 0., y: 1. },
+        }),
+        Event::Touch(touch::Event::FingerPressed {
+            id: touch::Finger(1),
+            position: Point::ORIGIN,
+        }),
+        Event::Window(iced::window::Event::Unfocused),
+    ];
+    for (index, event) in events.iter().enumerate() {
+        invalidate(&clock, event);
+        assert_eq!(clock.load(Ordering::Acquire), index as u64 + 1);
+    }
+    invalidate(
+        &clock,
+        &Event::Mouse(mouse::Event::CursorMoved {
+            position: Point::ORIGIN,
+        }),
+    );
+    invalidate(&clock, &Event::Window(iced::window::Event::Focused));
+    assert!(is_current(&clock, 5));
+    clock.store(u64::MAX - 1, Ordering::Release);
+    invalidate(&clock, &events[0]);
+    assert!(!is_current(&clock, u64::MAX));
+    invalidate(&clock, &events[0]);
+    assert_eq!(clock.load(Ordering::Acquire), u64::MAX);
+    assert!(!is_current(&clock, 0));
+}

crates/oa-desktop/src/source_rename.rs

@@ -0,0 +1,3 @@
+//! Pure preview and exact origin mapping for the guarded alias-rename controller.
+pub mod origin;
+pub mod preview;

crates/oa-desktop/src/source_rename/origin.rs

@@ -0,0 +1,278 @@
+//! Map a role-proven alias occurrence through the exact prepared source change.
+//! This is cursor restoration, not target resolution or commit authority.
+use oa_core::language::{self, Outline, OutlineLimits, Span, TokenClass};
+use std::fmt;
+
+const LIMITS: OutlineLimits = OutlineLimits {
+    max_source_bytes: 64 * 1024 * 1024,
+    max_tokens: 1_000_000,
+    max_declarations: 250_000,
+};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum OriginError {
+    Budget,
+    InvalidSource,
+    MissingOrigin,
+    ChangedStructure,
+}
+
+impl fmt::Display for OriginError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(match self {
+            Self::Budget => "The alias cursor preview exceeds its source scan budget. No rename was applied.",
+            Self::InvalidSource => "The alias cursor could not be verified in this source. No rename was applied.",
+            Self::MissingOrigin => "The original alias occurrence no longer matches. Preview again; no rename was applied.",
+            Self::ChangedStructure => "The preview changed source outside the expected alias tokens. No rename was applied.",
+        })
+    }
+}
+
+impl std::error::Error for OriginError {}
+
+fn word(class: TokenClass) -> bool {
+    matches!(class, TokenClass::Identifier | TokenClass::Keyword)
+}
+
+/// The controller passes the exact alias span returned by the admitted symbol
+/// hit. `marker` is Some only for a reference (its separate @ span), including
+/// invocation with the caret on @. A declaration passes None.
+pub fn map(
+    before: &str,
+    after: &str,
+    old_alias: &str,
+    new_alias: &str,
+    origin: Span,
+    marker: Option<Span>,
+) -> Result<Span, OriginError> {
+    let old = language::outline(before, LIMITS).map_err(|_| OriginError::Budget)?;
+    let new = language::outline(after, LIMITS).map_err(|_| OriginError::Budget)?;
+    if old.has_lexical_errors || new.has_lexical_errors {
+        return Err(OriginError::InvalidSource);
+    }
+    if old.tokens.len() != new.tokens.len() {
+        return Err(OriginError::ChangedStructure);
+    }
+    let roles_before = roles(&old);
+    let roles_after = roles(&new);
+    let mut mapped = None;
+    for (index, (a, b)) in old.tokens.iter().zip(&new.tokens).enumerate() {
+        let left = &before[a.span.start..a.span.end];
+        let right = &after[b.span.start..b.span.end];
+        let alias_pair = word(a.class)
+            && word(b.class)
+            && left == old_alias
+            && right == new_alias
+            && roles_before[index].is_some()
+            && roles_after[index].is_some()
+            && roles_before[index].map(|role| role.is_some())
+                == roles_after[index].map(|role| role.is_some());
+        if a.span == origin {
+            if !alias_pair || roles_before[index] != Some(marker) {
+                return Err(OriginError::MissingOrigin);
+            }
+            mapped = Some(b.span);
+        }
+        if !alias_pair && (left != right || a.class != b.class) {
+            return Err(OriginError::ChangedStructure);
+        }
+    }
+    mapped.ok_or(OriginError::MissingOrigin)
+}
+
+/// Outer None is not an alias role; Some(None) is a declaration alias;
+/// Some(Some(span)) is a live @ reference with its exact separate marker.
+/// Scan sorted declaration spans and tokens together, without repeated searches.
+fn roles(outline: &Outline<'_>) -> Vec<Option<Option<Span>>> {
+    let mut result = vec![None; outline.tokens.len()];
+    let mut declarations = outline.declarations.iter().peekable();
+    let mut significant = None;
+    for (index, token) in outline.tokens.iter().enumerate() {
+        while declarations
+            .peek()
+            .is_some_and(|d| d.alias_span.start < token.span.start)
+        {
+            declarations.next();
+        }
+        if word(token.class) {
+            if declarations
+                .peek()
+                .is_some_and(|d| d.alias_span == token.span)
+            {
+                result[index] = Some(None);
+            } else if let Some(previous) = significant {
+                let span: Span = previous;
+                if &outline.source[span.start..span.end] == "@" {
+                    result[index] = Some(Some(span));
+                }
+            }
+        }
+        if !matches!(token.class, TokenClass::Whitespace | TokenClass::Comment) {
+            significant = Some(token.span);
+        }
+    }
+    result
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn occurrence(source: &str, needle: &str, which: usize) -> Span {
+        let start = source.match_indices(needle).nth(which).unwrap().0;
+        Span {
+            start,
+            end: start + needle.len(),
+        }
+    }
+
+    #[test]
+    fn maps_last_repeated_reference_with_unicode_crlf_and_comment_separator() {
+        let before =
+            "oa_activity a \"救援\" {}\r\n// @a is prose\r\nsource @a; target @ // a\r\n a;\r\n";
+        let after = "oa_activity renamed \"救援\" {}\r\n// @a is prose\r\nsource @renamed; target @ // a\r\n renamed;\r\n";
+        let start = before.rfind(" a;").unwrap() + 1;
+        let marker = before.rfind("@ //").unwrap();
+        let mapped = map(
+            before,
+            after,
+            "a",
+            "renamed",
+            Span {
+                start,
+                end: start + 1,
+            },
+            Some(Span {
+                start: marker,
+                end: marker + 1,
+            }),
+        )
+        .unwrap();
+        assert_eq!(&after[mapped.start..mapped.end], "renamed");
+        assert_eq!(mapped.start, after.rfind(" renamed;").unwrap() + 1);
+        assert_eq!(
+            before[..start].bytes().filter(|b| *b == b'\n').count(),
+            after[..mapped.start]
+                .bytes()
+                .filter(|b| *b == b'\n')
+                .count()
+        );
+    }
+
+    #[test]
+    fn preserves_final_same_line_occurrence_not_first_or_prose() {
+        let before = "oa_activity a \"a @a\" {} source @a; target @a;";
+        let after = "oa_activity longer \"a @a\" {} source @longer; target @longer;";
+        let start = before.rfind("@a").unwrap();
+        let result = map(
+            before,
+            after,
+            "a",
+            "longer",
+            Span {
+                start: start + 1,
+                end: start + 2,
+            },
+            Some(Span {
+                start,
+                end: start + 1,
+            }),
+        )
+        .unwrap();
+        assert_eq!(result.start, after.rfind("@longer").unwrap() + 1);
+        let prose = occurrence(before, "a @a", 0);
+        assert!(
+            map(
+                before,
+                after,
+                "a",
+                "longer",
+                Span {
+                    start: prose.start,
+                    end: prose.start + 1
+                },
+                None
+            )
+            .is_err()
+        );
+    }
+
+    #[test]
+    fn permits_identifier_keyword_transitions_in_alias_roles() {
+        let before = "oa_activity a \"Name\" {} source @a;";
+        let alias = occurrence(before, "a \"Name", 0);
+        let origin = Span {
+            start: alias.start,
+            end: alias.start + 1,
+        };
+        for replacement in ["none", "include", "oa_activity"] {
+            assert!(oa_core::valid_alias(replacement));
+            assert_eq!(
+                language::tokenize(replacement)[0].class,
+                TokenClass::Keyword
+            );
+            let after = format!("oa_activity {replacement} \"Name\" {{}} source @{replacement};");
+            let mapped = map(before, &after, "a", replacement, origin, None).unwrap();
+            assert_eq!(&after[mapped.start..mapped.end], replacement);
+            assert_eq!(
+                map(&after, before, replacement, "a", mapped, None).unwrap(),
+                origin
+            );
+        }
+    }
+
+    #[test]
+    fn rejects_changed_trivia_non_alias_words_and_wrong_marker() {
+        let before = "oa_activity a \"Name\" {} source @a;";
+        let after = "oa_activity b \"Name\" {} source @b;";
+        let start = before.rfind("@a").unwrap();
+        let span = Span {
+            start: start + 1,
+            end: start + 2,
+        };
+        let marker = Some(Span {
+            start,
+            end: start + 1,
+        });
+        assert_eq!(
+            map(
+                before,
+                &after.replace("Name", "Other"),
+                "a",
+                "b",
+                span,
+                marker
+            ),
+            Err(OriginError::ChangedStructure)
+        );
+        assert_eq!(
+            map(
+                before,
+                &after.replace(" source", "  source"),
+                "a",
+                "b",
+                span,
+                marker
+            ),
+            Err(OriginError::ChangedStructure)
+        );
+        assert_eq!(
+            map(before, after, "a", "b", span, None),
+            Err(OriginError::MissingOrigin)
+        );
+        assert!(
+            map(
+                before,
+                after,
+                "a",
+                "b",
+                Span {
+                    start: 0,
+                    end: usize::MAX
+                },
+                marker
+            )
+            .is_err()
+        );
+    }
+}

crates/oa-desktop/src/source_rename/preview.rs

@@ -0,0 +1,578 @@
+//! Complete, bounded line-ordinal previews of an already prepared alias rename.
+//!
+//! Source text remains in the caller's immutable before/after snapshots. This
+//! module owns only paths and indexes; it is not rename or commit authority.
+use oa_core::source_project::SourceBundle;
+use std::{fmt, ops::Range};
+
+const CONTEXT: usize = 3;
+// A byte-grid boundary can move back by at most three UTF-8 continuation bytes,
+// so a 252-byte grid yields fragments of at most 255 bytes, independent of input.
+const SEGMENT_GRID: usize = 252;
+
+/// Count all bounded fragments of exact source text; an empty line has one
+/// empty fragment. Page these as well as lines, never mount an unbounded line.
+pub fn segment_count(text: &str) -> usize {
+    text.len().div_ceil(SEGMENT_GRID).max(1)
+}
+
+/// Constant-time UTF-8-safe page lookup. Concatenating every fragment gives the
+/// original bytes, including CRLF. No ellipsis or truncation replaces content.
+pub fn text_segment(text: &str, index: usize) -> Option<&str> {
+    if index >= segment_count(text) {
+        return None;
+    }
+    let mut start = index.checked_mul(SEGMENT_GRID)?;
+    let mut end = start.saturating_add(SEGMENT_GRID).min(text.len());
+    while !text.is_char_boundary(start) {
+        start -= 1;
+    }
+    while !text.is_char_boundary(end) {
+        end -= 1;
+    }
+    text.get(start..end)
+}
+const LIMITS: Limits = Limits {
+    files: 256,
+    changed_lines: 50_000,
+    display_bytes: 8 * 1024 * 1024,
+};
+
+#[derive(Clone, Copy)]
+struct Limits {
+    files: usize,
+    changed_lines: usize,
+    display_bytes: usize,
+}
+
+#[derive(Debug)]
+pub struct Preview {
+    files: Vec<File>,
+    changed_lines: usize,
+    display_bytes: usize,
+}
+
+#[derive(Debug)]
+pub struct File {
+    path: String,
+    hunks: Vec<Hunk>,
+}
+
+#[derive(Debug)]
+pub struct Hunk {
+    lines: Vec<Line>,
+}
+
+#[derive(Debug)]
+pub struct Line {
+    number: usize,
+    before: Range<usize>,
+    after: Range<usize>,
+    changed: bool,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub enum PreviewError {
+    MembershipChanged,
+    LineCountChanged(String),
+    LineEndingChanged { path: String, line: usize },
+    TooManyFiles { limit: usize },
+    TooManyChangedLines { limit: usize },
+    TooManyDisplayBytes { limit: usize },
+}
+
+impl fmt::Display for PreviewError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::MembershipChanged => write!(
+                f,
+                "Rename preview refused: the entry or source file membership changed. No rename was applied."
+            ),
+            Self::LineCountChanged(path) => write!(
+                f,
+                "Rename preview refused: the line count changed in {path}. No rename was applied."
+            ),
+            Self::LineEndingChanged { path, line } => write!(
+                f,
+                "Rename preview refused: the line ending changed in {path}:{line}. No rename was applied."
+            ),
+            Self::TooManyFiles { limit } => write!(
+                f,
+                "Rename preview exceeds {limit} changed files. A complete preview is required; no rename was applied."
+            ),
+            Self::TooManyChangedLines { limit } => write!(
+                f,
+                "Rename preview exceeds {limit} changed source lines. A complete preview is required; no rename was applied."
+            ),
+            Self::TooManyDisplayBytes { limit } => write!(
+                f,
+                "Rename preview exceeds {limit} display bytes (paths and both versions of changed/context lines). A complete preview is required; no rename was applied."
+            ),
+        }
+    }
+}
+
+impl std::error::Error for PreviewError {}
+
+impl Preview {
+    pub fn build(before: &SourceBundle, after: &SourceBundle) -> Result<Self, PreviewError> {
+        Self::with_limits(before, after, LIMITS)
+    }
+
+    fn with_limits(
+        before: &SourceBundle,
+        after: &SourceBundle,
+        limits: Limits,
+    ) -> Result<Self, PreviewError> {
+        if before.entry != after.entry
+            || !before.files.contains_key(&before.entry)
+            || !before.files.keys().eq(after.files.keys())
+        {
+            return Err(PreviewError::MembershipChanged);
+        }
+        let mut preview = Self {
+            files: Vec::new(),
+            changed_lines: 0,
+            display_bytes: 0,
+        };
+        for ((path, old), (_, new)) in before.files.iter().zip(&after.files) {
+            if old == new {
+                continue;
+            }
+            if preview.files.len() == limits.files {
+                return Err(PreviewError::TooManyFiles {
+                    limit: limits.files,
+                });
+            }
+            // A changed source line can contain arbitrarily many renamed tokens.
+            // Count the line once; this count is never a semantic-reference count.
+            let mut changed = Vec::new();
+            let mut old_lines = Lines::new(old);
+            let mut new_lines = Lines::new(new);
+            let mut count = 0;
+            loop {
+                match (old_lines.next(), new_lines.next()) {
+                    (None, None) => break,
+                    (Some(a), Some(b)) => {
+                        count += 1;
+                        if old[a.content_end..a.end] != new[b.content_end..b.end] {
+                            return Err(PreviewError::LineEndingChanged {
+                                path: path.clone(),
+                                line: count,
+                            });
+                        }
+                        if old[a.start..a.end] != new[b.start..b.end] {
+                            if preview.changed_lines == limits.changed_lines {
+                                return Err(PreviewError::TooManyChangedLines {
+                                    limit: limits.changed_lines,
+                                });
+                            }
+                            preview.changed_lines += 1;
+                            changed.push(count - 1);
+                        }
+                    }
+                    _ => return Err(PreviewError::LineCountChanged(path.clone())),
+                }
+            }
+
+            // Merge touching context intervals in order, without pairwise diff.
+            // At most 7 indexed lines per changed line are retained; unchanged
+            // lines outside these intervals are scanned but never indexed.
+            let mut ranges: Vec<Range<usize>> = Vec::new();
+            for line in changed {
+                let range =
+                    line.saturating_sub(CONTEXT)..line.saturating_add(CONTEXT + 1).min(count);
+                if let Some(previous) = ranges.last_mut()
+                    && range.start <= previous.end
+                {
+                    previous.end = previous.end.max(range.end);
+                    continue;
+                }
+                ranges.push(range);
+            }
+            preview.charge(path.len(), limits)?;
+            let mut file = File {
+                path: path.clone(),
+                hunks: Vec::new(),
+            };
+            let mut pairs = Lines::new(old).zip(Lines::new(new)).enumerate();
+            for range in ranges {
+                let mut hunk = Hunk { lines: Vec::new() };
+                for (ordinal, (a, b)) in pairs.by_ref() {
+                    if ordinal < range.start {
+                        continue;
+                    }
+                    // Charge exact UTF-8 bytes, including preserved endings and
+                    // both copies of shared context, before adding the index.
+                    // No render-time omission or shortening grants admission.
+                    preview.charge(a.end - a.start, limits)?;
+                    preview.charge(b.end - b.start, limits)?;
+                    hunk.lines.push(Line {
+                        number: ordinal + 1,
+                        changed: old[a.start..a.end] != new[b.start..b.end],
+                        before: a.start..a.end,
+                        after: b.start..b.end,
+                    });
+                    if ordinal + 1 == range.end {
+                        break;
+                    }
+                }
+                file.hunks.push(hunk);
+            }
+            preview.files.push(file);
+        }
+        Ok(preview)
+    }
+
+    fn charge(&mut self, bytes: usize, limits: Limits) -> Result<(), PreviewError> {
+        let Some(total) = self.display_bytes.checked_add(bytes) else {
+            return Err(PreviewError::TooManyDisplayBytes {
+                limit: limits.display_bytes,
+            });
+        };
+        if total > limits.display_bytes {
+            return Err(PreviewError::TooManyDisplayBytes {
+                limit: limits.display_bytes,
+            });
+        }
+        self.display_bytes = total;
+        Ok(())
+    }
+
+    /// All admitted files in source path order; suitable for a file picker/search.
+    pub fn files(&self) -> &[File] {
+        &self.files
+    }
+
+    /// Changed source lines, not occurrences, declarations or semantic uses.
+    pub fn changed_line_count(&self) -> usize {
+        self.changed_lines
+    }
+
+    /// Exact displayed source bytes for both sides plus each stored path once.
+    /// Index metadata is separately bounded by 7 lines per changed line.
+    pub fn display_bytes(&self) -> usize {
+        self.display_bytes
+    }
+
+    #[cfg(test)]
+    pub fn is_empty(&self) -> bool {
+        self.files.is_empty()
+    }
+}
+
+impl File {
+    pub fn path(&self) -> &str {
+        &self.path
+    }
+
+    /// Every hunk is present; the caller may page these indexes, never truncate.
+    pub fn hunks(&self) -> &[Hunk] {
+        &self.hunks
+    }
+}
+
+impl Hunk {
+    /// The complete ordered line slice supports paging even a large single hunk.
+    pub fn lines(&self) -> &[Line] {
+        &self.lines
+    }
+}
+
+impl Line {
+    /// One-based source line number, identical on both sides.
+    pub fn number(&self) -> usize {
+        self.number
+    }
+
+    pub fn changed(&self) -> bool {
+        self.changed
+    }
+
+    /// Borrow from the immutable original file; includes its exact line ending.
+    pub fn before_text<'a>(&self, original: &'a str) -> Option<&'a str> {
+        original.get(self.before.clone())
+    }
+
+    /// Borrow from the immutable candidate file; includes its exact line ending.
+    pub fn after_text<'a>(&self, candidate: &'a str) -> Option<&'a str> {
+        candidate.get(self.after.clone())
+    }
+}
+
+struct RawLine {
+    start: usize,
+    content_end: usize,
+    end: usize,
+}
+
+struct Lines<'a> {
+    bytes: &'a [u8],
+    offset: usize,
+}
+
+impl<'a> Lines<'a> {
+    fn new(text: &'a str) -> Self {
+        Self {
+            bytes: text.as_bytes(),
+            offset: 0,
+        }
+    }
+}
+
+impl Iterator for Lines<'_> {
+    type Item = RawLine;
+
+    fn next(&mut self) -> Option<Self::Item> {
+        if self.offset == self.bytes.len() {
+            return None;
+        }
+        let start = self.offset;
+        // The compiler and source navigation count LF, not bare CR, as a line
+        // boundary. Preserve CRLF as an ending and bare CR as source content.
+        while self.offset < self.bytes.len() && self.bytes[self.offset] != b'\n' {
+            self.offset += 1;
+        }
+        let mut content_end = self.offset;
+        if self.offset < self.bytes.len() {
+            if self.offset > start && self.bytes[self.offset - 1] == b'\r' {
+                content_end -= 1;
+            }
+            self.offset += 1;
+        }
+        Some(RawLine {
+            start,
+            content_end,
+            end: self.offset,
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn bundle(source: &str) -> SourceBundle {
+        SourceBundle {
+            entry: "救援.arcadia".into(),
+            files: [("救援.arcadia".into(), source.into())].into(),
+        }
+    }
+
+    #[test]
+    fn long_unicode_lines_are_fully_reachable_as_bounded_fragments() {
+        let text = format!("{}救援🙂{}\r\n", "a".repeat(251), "🙂".repeat(200));
+        let pieces: Vec<_> = (0..segment_count(&text))
+            .map(|i| text_segment(&text, i).unwrap())
+            .collect();
+        assert!(pieces.len() > 2);
+        assert!(pieces.iter().all(|part| part.len() <= 255));
+        assert_eq!(pieces.concat(), text);
+        assert_eq!(text_segment(&text, segment_count(&text)), None);
+        assert_eq!(text_segment(&text, usize::MAX), None);
+        assert_eq!(segment_count(""), 1);
+        assert_eq!(text_segment("", 0), Some(""));
+    }
+
+    #[test]
+    fn preserves_unicode_mixed_endings_and_counts_lines_not_repeated_uses() {
+        let old = bundle("// 救援\r\n@a @a\ncontext\r@a");
+        let new = bundle("// 救援\r\n@long @long\ncontext\r@long");
+        let preview = Preview::build(&old, &new).unwrap();
+        assert_eq!(preview.changed_line_count(), 2);
+        let file = &preview.files()[0];
+        assert_eq!(file.path(), "救援.arcadia");
+        assert_eq!(file.hunks().len(), 1);
+        let lines = file.hunks()[0].lines();
+        assert_eq!(
+            lines.iter().map(Line::number).collect::<Vec<_>>(),
+            [1, 2, 3]
+        );
+        assert_eq!(
+            lines[0].before_text(&old.files[&old.entry]),
+            Some("// 救援\r\n")
+        );
+        assert_eq!(
+            lines[1].after_text(&new.files[&new.entry]),
+            Some("@long @long\n")
+        );
+        assert_eq!(
+            lines[2].after_text(&new.files[&new.entry]),
+            Some("context\r@long")
+        );
+        assert!(lines[1].changed() && lines[2].changed());
+        assert!(!lines[0].changed());
+        assert_eq!(
+            preview.display_bytes(),
+            old.entry.len() + old.files[&old.entry].len() + new.files[&new.entry].len()
+        );
+    }
+
+    #[test]
+    fn first_and_last_lines_form_complete_separate_hunks_and_pages() {
+        let old = bundle("a\n1\n2\n3\n4\n5\n6\n7\n8\n9\na");
+        let new = bundle("long\n1\n2\n3\n4\n5\n6\n7\n8\n9\nlong");
+        let preview = Preview::build(&old, &new).unwrap();
+        let hunks = preview.files()[0].hunks();
+        assert_eq!(hunks.len(), 2);
+        let page_numbers: Vec<_> = hunks
+            .iter()
+            .flat_map(|h| h.lines().chunks(2))
+            .flat_map(|page| page.iter().map(Line::number))
+            .collect();
+        assert_eq!(page_numbers, [1, 2, 3, 4, 8, 9, 10, 11]);
+        assert_eq!(
+            hunks[1].lines()[3].after_text(&new.files[&new.entry]),
+            Some("long")
+        );
+    }
+
+    #[test]
+    fn nearby_changes_merge_and_all_changed_files_are_reachable() {
+        let mut old = bundle("a\n1\n2\n3\n4\n5\na\n");
+        let mut new = bundle("b\n1\n2\n3\n4\n5\nb\n");
+        old.files.insert("other.arcadia".into(), "a a a".into());
+        new.files.insert("other.arcadia".into(), "b b b".into());
+        let preview = Preview::build(&old, &new).unwrap();
+        assert_eq!(preview.changed_line_count(), 3);
+        assert_eq!(preview.files().len(), 2);
+        assert_eq!(preview.files()[0].path(), "other.arcadia");
+        assert_eq!(preview.files()[0].hunks()[0].lines().len(), 1);
+        assert_eq!(preview.files()[1].hunks().len(), 1);
+        assert_eq!(preview.files()[1].hunks()[0].lines().len(), 7);
+    }
+
+    #[test]
+    fn unchanged_and_empty_sources_have_no_preview() {
+        for source in ["", "a\r\nb\n", "a"] {
+            let original = bundle(source);
+            let preview = Preview::build(&original, &original).unwrap();
+            assert!(preview.is_empty());
+            assert_eq!(preview.changed_line_count(), 0);
+            assert_eq!(preview.display_bytes(), 0);
+        }
+    }
+
+    #[test]
+    fn refuses_membership_entry_line_count_and_line_ending_changes() {
+        let old = bundle("a\nb");
+        let mut new = old.clone();
+        new.files.insert("extra.arcadia".into(), "".into());
+        assert_eq!(
+            Preview::build(&old, &new).unwrap_err(),
+            PreviewError::MembershipChanged
+        );
+        let mut new = old.clone();
+        new.entry = "missing.arcadia".into();
+        assert_eq!(
+            Preview::build(&old, &new).unwrap_err(),
+            PreviewError::MembershipChanged
+        );
+        assert!(matches!(
+            Preview::build(&old, &bundle("a\nb\nc")),
+            Err(PreviewError::LineEndingChanged { .. }) | Err(PreviewError::LineCountChanged(_))
+        ));
+        assert!(matches!(
+            Preview::build(&bundle("a\nb\n"), &bundle("a\n")),
+            Err(PreviewError::LineCountChanged(_))
+        ));
+        for (a, b) in [("a\r\n", "a\n"), ("a\r", "a\n"), ("a", "a\n")] {
+            assert_eq!(
+                Preview::build(&bundle(a), &bundle(b)).unwrap_err(),
+                PreviewError::LineEndingChanged {
+                    path: old.entry.clone(),
+                    line: 1
+                }
+            );
+        }
+    }
+
+    #[test]
+    fn each_bound_is_exact_and_overflow_never_returns_a_partial_preview() {
+        let old = bundle("a\ncontext\na");
+        let new = bundle("bbb\ncontext\nbbb");
+        let exact = old.entry.len() + old.files[&old.entry].len() + new.files[&new.entry].len();
+        let limits = Limits {
+            files: 1,
+            changed_lines: 2,
+            display_bytes: exact,
+        };
+        assert!(Preview::with_limits(&old, &new, limits).is_ok());
+        assert_eq!(
+            Preview::with_limits(&old, &new, Limits { files: 0, ..limits }).unwrap_err(),
+            PreviewError::TooManyFiles { limit: 0 }
+        );
+        assert_eq!(
+            Preview::with_limits(
+                &old,
+                &new,
+                Limits {
+                    changed_lines: 1,
+                    ..limits
+                }
+            )
+            .unwrap_err(),
+            PreviewError::TooManyChangedLines { limit: 1 }
+        );
+        assert_eq!(
+            Preview::with_limits(
+                &old,
+                &new,
+                Limits {
+                    display_bytes: exact - 1,
+                    ..limits
+                }
+            )
+            .unwrap_err(),
+            PreviewError::TooManyDisplayBytes { limit: exact - 1 }
+        );
+        let long = bundle(&"a".repeat(LIMITS.display_bytes));
+        assert!(matches!(
+            Preview::build(&bundle("b"), &long),
+            Err(PreviewError::TooManyDisplayBytes { .. })
+        ));
+    }
+
+    #[test]
+    fn limits_apply_to_the_whole_preview_not_each_file() {
+        let mut old = bundle("a");
+        let mut new = bundle("b");
+        old.files.insert("second.arcadia".into(), "a".into());
+        new.files.insert("second.arcadia".into(), "b".into());
+        let limits = Limits {
+            files: 2,
+            changed_lines: 2,
+            display_bytes: old.entry.len() + "second.arcadia".len() + 4,
+        };
+        let complete = Preview::with_limits(&old, &new, limits).unwrap();
+        assert_eq!(complete.files().len(), 2);
+        assert_eq!(complete.changed_line_count(), 2);
+        assert_eq!(complete.display_bytes(), limits.display_bytes);
+        assert!(matches!(
+            Preview::with_limits(&old, &new, Limits { files: 1, ..limits }),
+            Err(PreviewError::TooManyFiles { limit: 1 })
+        ));
+        assert!(matches!(
+            Preview::with_limits(
+                &old,
+                &new,
+                Limits {
+                    changed_lines: 1,
+                    ..limits
+                }
+            ),
+            Err(PreviewError::TooManyChangedLines { limit: 1 })
+        ));
+        assert!(matches!(
+            Preview::with_limits(
+                &old,
+                &new,
+                Limits {
+                    display_bytes: limits.display_bytes - 1,
+                    ..limits
+                }
+            ),
+            Err(PreviewError::TooManyDisplayBytes { .. })
+        ));
+    }
+}

crates/oa-desktop/src/source_workspace.rs

@@ -1,7 +1,7 @@
 //! Per-file drafts and navigation. Accepted model/source history lives in Document.
 use iced::widget::text_editor::Cursor;
 use oa_core::{
-    language,
+    Id, language,
     source_project::{self, CompiledSourceProject, ProjectLimits, SourceBundle, SourceDiagnostic},
 };
 use std::collections::{BTreeMap, BTreeSet};
@@ -86,6 +86,7 @@ pub struct Buffer {
     pub cursor: Cursor,
     past: Vec<String>,
     future: Vec<String>,
+    generation: u64,
 }
 
 impl Buffer {
@@ -99,14 +100,20 @@ impl Buffer {
             },
             past: Vec::new(),
             future: Vec::new(),
+            generation: 0,
         }
     }
     pub fn dirty(&self) -> bool {
         self.text != self.baseline
     }
+    pub fn generation(&self) -> u64 {
+        self.generation
+    }
 }
 
 pub struct Workspace {
+    session: Id,
+    revision: u64,
     pub entry: String,
     pub active: String,
     pub files: BTreeMap<String, Buffer>,
@@ -117,6 +124,35 @@ pub struct Workspace {
 }
 
 impl Workspace {
+    /// Ephemeral editor identity, never a model identity or recovery payload.
+    pub fn session(&self) -> Id {
+        self.session
+    }
+    pub fn revision(&self) -> u64 {
+        self.revision
+    }
+    fn advance(&mut self) -> u64 {
+        if let Some(revision) = self.revision.checked_add(1) {
+            self.revision = revision;
+        } else {
+            self.reset_navigation_session();
+        }
+        self.revision
+    }
+    /// A changed filesystem root must not reuse queued navigation from Save As.
+    pub fn reset_navigation_session(&mut self) {
+        self.session = Id::new_v4();
+        self.revision = 0;
+        for buffer in self.files.values_mut() {
+            buffer.generation = 0;
+        }
+    }
+    pub fn set_reachable(&mut self, reachable: BTreeSet<String>) {
+        if self.reachable != reachable {
+            self.advance();
+            self.reachable = reachable;
+        }
+    }
     pub fn recovery_snapshot(&self) -> RecoveryWorkspace {
         RecoveryWorkspace {
             entry: self.entry.clone(),
@@ -136,6 +172,8 @@ impl Workspace {
     pub fn from_recovery(saved: RecoveryWorkspace) -> Result<Self, String> {
         saved.validate()?;
         Ok(Self {
+            session: Id::new_v4(),
+            revision: 0,
             entry: saved.entry,
             active: saved.active,
             files: saved
@@ -154,6 +192,8 @@ impl Workspace {
     }
     pub fn new(bundle: &SourceBundle, applied: bool) -> Self {
         Self {
+            session: Id::new_v4(),
+            revision: 0,
             entry: bundle.entry.clone(),
             active: bundle.entry.clone(),
             files: bundle
@@ -191,11 +231,20 @@ impl Workspace {
         }
     }
     pub fn edit(&mut self, text: String, cursor: Cursor) {
+        let changed = self.files.get(&self.active).is_none_or(|b| b.text != text);
+        let generation = if changed {
+            self.advance()
+        } else {
+            self.revision
+        };
         let buffer = self
             .files
             .entry(self.active.clone())
             .or_insert_with(|| Buffer::new(String::new()));
         buffer.cursor = cursor;
+        if changed {
+            buffer.generation = generation;
+        }
         if text != buffer.text {
             buffer.past.push(std::mem::replace(&mut buffer.text, text));
             if buffer.past.len() > 100 {
@@ -268,6 +317,8 @@ impl Workspace {
         } else {
             buffer.future.push(previous);
         }
+        let generation = self.advance();
+        self.files.get_mut(&self.active).unwrap().generation = generation;
         self.trim_history(DRAFT_HISTORY_BYTES);
         true
     }
@@ -281,6 +332,7 @@ impl Workspace {
         }
     }
     pub fn accept(&mut self, bundle: &SourceBundle) {
+        let generation = self.advance();
         if self.entry != bundle.entry
             && !bundle.files.contains_key(&self.entry)
             && self.files.get(&self.entry).is_some_and(|b| !b.dirty())
@@ -291,7 +343,13 @@ impl Workspace {
         self.reachable = bundle.files.keys().cloned().collect();
         for (path, text) in &bundle.files {
             let cursor = self.files.get(path).map(|b| b.cursor);
+            let previous_generation = self
+                .files
+                .get(path)
+                .filter(|b| b.text == *text)
+                .map(|b| b.generation);
             let mut buffer = Buffer::new(text.clone());
+            buffer.generation = previous_generation.unwrap_or(generation);
             if let Some(cursor) = cursor {
                 buffer.cursor = cursor;
             }
@@ -303,10 +361,22 @@ impl Workspace {
         self.applied = true;
     }
     pub fn discovered(&mut self, bundle: &SourceBundle, reachable: BTreeSet<String>) {
+        let changed = self.reachable != reachable
+            || bundle
+                .files
+                .keys()
+                .any(|path| !self.files.contains_key(path));
+        let generation = if changed {
+            self.advance()
+        } else {
+            self.revision
+        };
         for (path, text) in &bundle.files {
-            self.files
-                .entry(path.clone())
-                .or_insert_with(|| Buffer::new(text.clone()));
+            self.files.entry(path.clone()).or_insert_with(|| {
+                let mut buffer = Buffer::new(text.clone());
+                buffer.generation = generation;
+                buffer
+            });
         }
         self.reachable = reachable;
     }
@@ -314,6 +384,7 @@ impl Workspace {
         if self.reachable.contains(path) || self.files.get(path).is_none_or(Buffer::dirty) {
             return false;
         }
+        self.advance();
         self.files.remove(path);
         if self.active == path {
             self.active = self.entry.clone();
@@ -376,6 +447,148 @@ pub fn lint(bundle: &SourceBundle) -> Vec<SourceDiagnostic> {
 mod tests {
     use super::*;
     use oa_core::Project;
+
+    #[test]
+    fn fresh_session_cannot_reuse_a_retained_buffer_generation() {
+        let bundle = SourceBundle {
+            entry: "main.arcadia".into(),
+            files: BTreeMap::from([
+                ("main.arcadia".into(), "first".into()),
+                ("other.arcadia".into(), "other".into()),
+            ]),
+        };
+        let mut workspace = Workspace::new(&bundle, true);
+        let cursor = workspace.files["main.arcadia"].cursor;
+        workspace.edit("second".into(), cursor);
+        workspace.reset_navigation_session();
+        let before = workspace.files["main.arcadia"].generation();
+        workspace.edit("third".into(), cursor);
+        assert_ne!(workspace.files["main.arcadia"].generation(), before);
+        workspace.switch("other.arcadia", cursor);
+        workspace.revision = u64::MAX;
+        workspace.edit("changed other".into(), cursor);
+        let after_wrap = workspace.files["main.arcadia"].generation();
+        workspace.switch("main.arcadia", cursor);
+        workspace.edit("fourth".into(), cursor);
+        assert_ne!(workspace.files["main.arcadia"].generation(), after_wrap);
+        assert!(workspace.undo(false));
+        assert_eq!(workspace.text(), "third");
+    }
+
+    #[test]
+    fn navigation_versions_distinguish_reopened_recovered_and_changed_drafts() {
+        let bundle = SourceBundle {
+            entry: "project.arcadia".into(),
+            files: BTreeMap::from([
+                ("project.arcadia".into(), "entry\r\n".into()),
+                ("part.arcadia".into(), "雨 draft\r\n".into()),
+            ]),
+        };
+        let mut workspace = Workspace::new(&bundle, true);
+        let reopened = Workspace::new(&bundle, true);
+        let recovered = Workspace::from_recovery(workspace.recovery_snapshot()).unwrap();
+        assert_ne!(workspace.session(), reopened.session());
+        assert_ne!(workspace.session(), recovered.session());
+        assert_eq!(workspace.bundle(), recovered.bundle());
+        let saved = serde_json::to_value(workspace.recovery_snapshot()).unwrap();
+        assert!(saved.get("session").is_none() && saved.get("revision").is_none());
+
+        let cursor = Cursor {
+            position: iced::widget::text_editor::Position { line: 0, column: 3 },
+            selection: None,
+        };
+        let revision = workspace.revision();
+        workspace.edit(workspace.text().into(), cursor);
+        assert_eq!(
+            workspace.revision(),
+            revision,
+            "selection is not a text change"
+        );
+        workspace.switch("part.arcadia", cursor);
+        assert_eq!(
+            workspace.revision(),
+            revision,
+            "switching retains the snapshot"
+        );
+        let untouched = workspace.files["project.arcadia"].generation();
+        workspace.edit("雨 unfinished !\r\n".into(), cursor);
+        let edited = workspace.files["part.arcadia"].generation();
+        assert!(workspace.revision() > revision);
+        assert_eq!(workspace.files["project.arcadia"].generation(), untouched);
+        assert!(workspace.undo(false));
+        assert_eq!(workspace.bundle(), bundle);
+        assert!(workspace.files["part.arcadia"].generation() > edited);
+        assert!(workspace.undo(true));
+        assert_eq!(workspace.text(), "雨 unfinished !\r\n");
+        let previous_session = workspace.session();
+        let previous_text = workspace.bundle();
+        workspace.reset_navigation_session();
+        assert_ne!(workspace.session(), previous_session);
+        assert_eq!(workspace.bundle(), previous_text);
+        assert!(
+            workspace.undo(false),
+            "session reset preserves text history"
+        );
+    }
+
+    #[test]
+    fn navigation_scope_changes_invalidate_without_changing_unchanged_positions() {
+        let bundle = SourceBundle {
+            entry: "project.arcadia".into(),
+            files: BTreeMap::from([
+                ("project.arcadia".into(), "entry".into()),
+                ("part.arcadia".into(), "part".into()),
+            ]),
+        };
+        let mut workspace = Workspace::new(&bundle, true);
+        let entry_generation = workspace.files[&bundle.entry].generation();
+        let initial_revision = workspace.revision();
+        workspace.set_reachable(BTreeSet::from([bundle.entry.clone()]));
+        assert!(workspace.revision() > initial_revision);
+        let membership_revision = workspace.revision();
+        workspace.set_reachable(workspace.reachable.clone());
+        assert_eq!(workspace.revision(), membership_revision);
+        assert!(workspace.discard_detached("part.arcadia"));
+        assert!(workspace.revision() > membership_revision);
+        let closed_revision = workspace.revision();
+        workspace.discovered(&bundle, BTreeSet::from([bundle.entry.clone()]));
+        assert!(workspace.revision() > closed_revision);
+        assert_eq!(
+            workspace.files[&bundle.entry].generation(),
+            entry_generation
+        );
+        assert!(workspace.files["part.arcadia"].generation() > closed_revision);
+        let discovered_revision = workspace.revision();
+        workspace.discovered(&bundle, workspace.reachable.clone());
+        assert_eq!(workspace.revision(), discovered_revision);
+        workspace.accept(&bundle);
+        assert!(
+            workspace.revision() > discovered_revision,
+            "validation evidence changed"
+        );
+        assert_eq!(
+            workspace.files[&bundle.entry].generation(),
+            entry_generation
+        );
+        assert_eq!(workspace.bundle(), bundle);
+    }
+
+    #[test]
+    fn navigation_revision_wrap_cannot_reuse_an_old_workspace_key() {
+        let bundle = SourceBundle {
+            entry: "project.arcadia".into(),
+            files: BTreeMap::from([("project.arcadia".into(), "original".into())]),
+        };
+        let mut workspace = Workspace::new(&bundle, true);
+        workspace.revision = u64::MAX;
+        let before = workspace.session();
+        let cursor = workspace.files[&bundle.entry].cursor;
+        workspace.edit("changed".into(), cursor);
+        assert_ne!(workspace.session(), before);
+        assert_eq!(workspace.revision(), 0);
+        assert!(workspace.undo(false));
+        assert_eq!(workspace.bundle(), bundle);
+    }
     #[test]
     fn draft_history_budget_covers_inactive_files_without_discarding_drafts() {
         let bundle = SourceBundle {

crates/oa-desktop/src/tests.rs

@@ -377,7 +377,8 @@ fn source_navigation_waits_for_editor_layout_and_cancels_on_edit() {
     send(&mut app, Message::SourceForSelection);
     assert_eq!(app.page, Page::Text);
     assert!(app.source_jump.is_some());
-    send(&mut app, Message::SourceViewport);
+    let ticket = app.source_reveal_ticket();
+    send(&mut app, Message::SourceViewport(ticket));
     assert!(app.source_jump.is_none());
     send(&mut app, Message::SourceForSelection);
     assert!(app.source_jump.is_some());
@@ -409,7 +410,8 @@ fn source_find_navigates_an_invalid_draft_without_applying_or_losing_it() {
         cursor.selection,
         Some(text_editor::Position { line: 0, column: 9 })
     );
-    send(&mut app, Message::SourceViewport);
+    let ticket = app.source_reveal_ticket();
+    send(&mut app, Message::SourceViewport(ticket));
     assert_eq!(app.source_editor.cursor(), cursor);
     send(
         &mut app,

crates/oa-desktop/src/views.rs

@@ -1,3 +1,4 @@
+mod source_symbols;
 pub(crate) mod traceability;
 use crate::{
     app::{App, Choice, FileOperation, Message, Page, Pending},
@@ -228,13 +229,15 @@ pub fn view(app: &App) -> View<'_, Message> {
         Page::Guide => crate::guide::view(&app.guide),
     };
     let process_layout = app.topology_context().is_some();
-    let focus_process = process_layout && app.behavior.topology.focused;
+    let scenario_layout = app.scenario_context().is_some();
+    let focus_behavior = (process_layout && app.behavior.topology.focused)
+        || (scenario_layout && app.behavior.scenario.focused());
     let mut body = if app.page == Page::Home {
         row![container(main).width(Fill).height(Fill)].height(Fill)
-    } else if process_layout {
+    } else if process_layout || scenario_layout {
         // Keep main at the same widget-tree path across Focus toggles. The
         // collapsed slot has no controls, so it cannot paint over or hit the canvas.
-        let process_sidebar: View<'_, Message> = if focus_process {
+        let process_sidebar: View<'_, Message> = if focus_behavior {
             Space::new().width(0).into()
         } else {
             sidebar.into()
@@ -242,7 +245,7 @@ pub fn view(app: &App) -> View<'_, Message> {
         // Row::push would discard the zero-width slot and shift main again.
         widget::Row::from_vec(vec![
             container(process_sidebar)
-                .width(if focus_process { 0 } else { 260 })
+                .width(if focus_behavior { 0 } else { 260 })
                 .height(Fill)
                 .clip(true)
                 .into(),
@@ -253,7 +256,7 @@ pub fn view(app: &App) -> View<'_, Message> {
     } else {
         row![sidebar, container(main).width(Fill).height(Fill)].height(Fill)
     };
-    if !focus_process && !matches!(app.page, Page::Home | Page::Text | Page::Guide) {
+    if !focus_behavior && !matches!(app.page, Page::Home | Page::Text | Page::Guide) {
         body = body.push(inspector(app));
     }
     let footer = container(
@@ -347,6 +350,13 @@ pub fn view(app: &App) -> View<'_, Message> {
     if app.pending.is_some() {
         return modal(root,column![text("Keep your changes?").size(21),text("Save the model and pending edits before continuing. Invalid drafts stay available for correction.").size(13),row![action("Cancel",Message::Cancel),action("Discard changes",Message::Discard),button("Save & continue").padding(10).on_press(Message::SaveAndContinue)].spacing(8)].spacing(16).into());
     }
+    if app.source_rename.open() {
+        return modal_width(
+            root,
+            crate::app::source_rename::dialog(app),
+            (app.window_size.width - 32.).clamp(120., 760.),
+        );
+    }
     root
 }
 fn modal<'a>(base: View<'a, Message>, content: View<'a, Message>) -> View<'a, Message> {
@@ -1001,6 +1011,13 @@ fn source_files(app: &App) -> View<'_, Message> {
 
 fn source(app: &App) -> View<'_, Message> {
     use crate::source_navigation::Event as SourceEvent;
+    let (undo_label, undo_message) = match app.source_rename_undo_message() {
+        Some(message) => ("Undo rename", Some(message)),
+        None => (
+            "Undo model",
+            (app.document.can_undo() && !app.source_dirty()).then_some(Message::Undo),
+        ),
+    };
     let navigation: View<'_, Message> = if app.source_navigation.open {
         column![
             row![
@@ -1017,7 +1034,7 @@ fn source(app: &App) -> View<'_, Message> {
                 ),
                 action("Next", Message::SourceNavigation(SourceEvent::Next(false))),
                 label(app.source_navigation.label()),
-                action("Close", Message::SourceNavigation(SourceEvent::Close)),
+                action("Close", app.source_find_close_message()),
             ]
             .spacing(6)
             .align_y(iced::Center),
@@ -1111,8 +1128,13 @@ fn source(app: &App) -> View<'_, Message> {
         }
     }
     let editor = widget::text_editor(&app.source_editor)
-        .id("source-editor")
+        .id(app.source_editor_id())
         .on_action(Message::SourceEdit)
+        .key_binding({
+            let context = app.source_symbol_context();
+            let rename = app.source_rename_begin();
+            move |press| source_binding(press, &context, Some(&rename))
+        })
         .font(Font::MONOSPACE)
         .size(14)
         .padding(16)
@@ -1121,8 +1143,7 @@ fn source(app: &App) -> View<'_, Message> {
             app.source_snapshot.clone(),
             crate::highlight::format,
         );
-    column![
-        container(
+    let header = container(
             column![
                 row![
                     container(heading(
@@ -1140,8 +1161,8 @@ fn source(app: &App) -> View<'_, Message> {
                 row![
                     action("Undo text", Message::SourceUndo),
                     action("Redo text", Message::SourceRedo),
-                    button(text("Undo model").size(12)).padding([8,10]).style(style::nav)
-                        .on_press_maybe((app.document.can_undo() && !app.source_dirty()).then_some(Message::Undo)),
+                    button(text(undo_label).size(12)).padding([8,10]).style(style::nav)
+                        .on_press_maybe(undo_message),
                     button(text("Redo model").size(12)).padding([8,10]).style(style::nav)
                         .on_press_maybe((app.document.can_redo() && !app.source_dirty()).then_some(Message::Redo)),
                     action("Find / go to…", Message::SourceNavigation(SourceEvent::Open(false))),
@@ -1165,17 +1186,511 @@ fn source(app: &App) -> View<'_, Message> {
                     "Undo text affects this file's draft. Model Undo restores accepted files together (100 changes / about 32 MiB)."
                 }),
                 navigation,
+                row![
+                    action("Definition · F12", app.source_symbol_message(crate::source_navigation::SymbolEvent::Query(crate::source_navigation::query::Action::Definition))),
+                    action("References · Shift F12", app.source_symbol_message(crate::source_navigation::SymbolEvent::Query(crate::source_navigation::query::Action::References))),
+                    action("Rename alias · F2", app.source_rename_message()),
+                    button(text("Back · Alt ←").size(12)).padding([8, 10]).style(style::nav)
+                        .on_press_maybe((app.source_symbols.back.iter().any(|entry| entry.session == app.source_workspace.session())).then(|| app.source_symbol_message(crate::source_navigation::SymbolEvent::Back))),
+                ].spacing(7),
                 scrollable(diagnostics)
                     .height((visible_diagnostics as f32 * 32.).min(132.))
             ]
             .spacing(12)
         )
-        .padding(18),
-        widget::sensor(editor).key((app.source_workspace.active.clone(),app.source_jump))
-            .on_show(|_| Message::SourceViewport).on_resize(|_| Message::SourceViewport)
+        .padding(18);
+    let editor = widget::sensor(editor)
+        .key((
+            app.source_workspace.active.clone(),
+            app.source_reveal_ticket(),
+        ))
+        .on_show({
+            let ticket = app.source_reveal_ticket();
+            move |_| Message::SourceViewport(ticket)
+        })
+        .on_resize({
+            let ticket = app.source_reveal_ticket();
+            move |_| Message::SourceViewport(ticket)
+        });
+    let workspace: View<'_, Message> = if app.source_symbols.open {
+        row![
+            container(editor).width(Fill).height(Fill),
+            container(scrollable(source_symbols::panel(app)))
+                .width(300)
+                .height(Fill),
+        ]
+        .height(Fill)
+        .into()
+    } else {
+        container(editor).width(Fill).height(Fill).into()
+    };
+    source_layout(header.into(), workspace, app.window_size.height)
+}
+
+fn source_layout<'a, Renderer: iced::advanced::text::Renderer + 'a>(
+    header: View<'a, Message, iced::Theme, Renderer>,
+    workspace: View<'a, Message, iced::Theme, Renderer>,
+    window_height: f32,
+) -> View<'a, Message, iced::Theme, Renderer> {
+    // Lint clears and repopulates diagnostics asynchronously. Reserve the same
+    // outer slot so a pointer aimed at the editor cannot land in the header.
+    column![
+        container(scrollable(header).id("source-header")).height((window_height * 0.42).max(180.)),
+        workspace,
     ]
+    .height(Fill)
     .into()
 }
+pub(crate) fn source_binding(
+    press: widget::text_editor::KeyPress,
+    context: &crate::source_navigation::SymbolContext,
+    rename: Option<&crate::app::source_rename::Begin>,
+) -> Option<widget::text_editor::Binding<Message>> {
+    use crate::source_navigation::{SymbolEvent, query::Action};
+    use iced::keyboard::{Key, key::Named};
+    use widget::text_editor::{Binding, Status};
+    if matches!(press.status, Status::Focused { .. })
+        && press.modifiers.is_empty()
+        && press.key == Key::Named(Named::F2)
+        && let Some(begin) = rename
+    {
+        return Some(Binding::Custom(Message::SourceRename(
+            crate::app::source_rename::Event::Begin(begin.clone()),
+        )));
+    }
+    // Windows owns Alt+Space for its window menu. Iced's default binding would
+    // otherwise insert a supplied space payload, even after that menu closes.
+    // Keep Ctrl+Alt (AltGr), shifted input, and ordinary Space unchanged.
+    #[cfg(target_os = "windows")]
+    if matches!(press.status, Status::Focused { .. })
+        && press.modifiers == iced::keyboard::Modifiers::ALT
+        && matches!(
+            press.key.as_ref(),
+            Key::Named(Named::Space) | Key::Character(" ")
+        )
+    {
+        return None;
+    }
+    if matches!(press.status, Status::Focused { .. })
+        && !press.modifiers.control()
+        && !press.modifiers.logo()
+    {
+        let event = match &press.key {
+            Key::Named(Named::F12) if !press.modifiers.alt() => {
+                Some(SymbolEvent::Query(if press.modifiers.shift() {
+                    Action::References
+                } else {
+                    Action::Definition
+                }))
+            }
+            Key::Named(Named::ArrowLeft) if press.modifiers.alt() && !press.modifiers.shift() => {
+                Some(SymbolEvent::Back)
+            }
+            _ => None,
+        };
+        if let Some(event) = event {
+            return Some(Binding::Custom(Message::SourceSymbols(
+                context.clone(),
+                event,
+            )));
+        }
+    }
+    Binding::from_key_press(press)
+}
+
+#[cfg(all(test, debug_assertions))]
+pub(crate) mod source_tests {
+    use super::*;
+    use iced::advanced::{
+        Layout, Shell, graphics, layout, renderer, text as shaped, widget as core_widget,
+    };
+    use iced::widget::column;
+    use iced::{Background, Color, Pixels, Point, Rectangle, Size, Transformation, Vector};
+
+    // Measure real Iced paragraphs/editor text without constructing a window or GPU.
+    pub(crate) struct FontLayout;
+    impl renderer::Renderer for FontLayout {
+        fn start_layer(&mut self, _: Rectangle) {}
+        fn end_layer(&mut self) {}
+        fn start_transformation(&mut self, _: Transformation) {}
+        fn end_transformation(&mut self) {}
+        fn reset(&mut self, _: Rectangle) {}
+        fn fill_quad(&mut self, _: renderer::Quad, _: impl Into<Background>) {}
+        fn allocate_image(
+            &mut self,
+            handle: &iced::advanced::image::Handle,
+            callback: impl FnOnce(
+                Result<iced::advanced::image::Allocation, iced::advanced::image::Error>,
+            ) + Send
+            + 'static,
+        ) {
+            renderer::Renderer::allocate_image(&mut (), handle, callback);
+        }
+    }
+    impl shaped::Renderer for FontLayout {
+        type Font = Font;
+        type Paragraph = graphics::text::Paragraph;
+        type Editor = graphics::text::Editor;
+        const ICON_FONT: Font = Font::DEFAULT;
+        const CHECKMARK_ICON: char = '0';
+        const ARROW_DOWN_ICON: char = '0';
+        const SCROLL_UP_ICON: char = '0';
+        const SCROLL_DOWN_ICON: char = '0';
+        const SCROLL_LEFT_ICON: char = '0';
+        const SCROLL_RIGHT_ICON: char = '0';
+        const ICED_LOGO: char = '0';
+        fn default_font(&self) -> Font {
+            Font::DEFAULT
+        }
+        fn default_size(&self) -> Pixels {
+            Pixels(16.)
+        }
+        fn fill_paragraph(&mut self, _: &Self::Paragraph, _: Point, _: Color, _: Rectangle) {}
+        fn fill_editor(&mut self, _: &Self::Editor, _: Point, _: Color, _: Rectangle) {}
+        fn fill_text(&mut self, _: shaped::Text, _: Point, _: Color, _: Rectangle) {}
+    }
+
+    #[derive(Default)]
+    struct Geometry {
+        header: Option<(Rectangle, Rectangle, Vector)>,
+        editor: Option<Rectangle>,
+    }
+    impl core_widget::Operation for Geometry {
+        fn traverse(&mut self, visit: &mut dyn FnMut(&mut dyn core_widget::Operation)) {
+            visit(self);
+        }
+        fn container(&mut self, id: Option<&core_widget::Id>, bounds: Rectangle) {
+            if id == Some(&core_widget::Id::new("test-source-editor")) {
+                self.editor = Some(bounds);
+            }
+        }
+        fn scrollable(
+            &mut self,
+            id: Option<&core_widget::Id>,
+            bounds: Rectangle,
+            content: Rectangle,
+            offset: Vector,
+            _: &mut dyn core_widget::operation::Scrollable,
+        ) {
+            if id == Some(&core_widget::Id::new("source-header")) {
+                self.header = Some((bounds, content, offset));
+            }
+        }
+    }
+
+    fn mounted_source<'a>(
+        content: &'a widget::text_editor::Content<FontLayout>,
+        diagnostics: usize,
+        find: bool,
+        window_height: f32,
+    ) -> View<'a, Message, iced::Theme, FontLayout> {
+        let mut notices = column![].spacing(5);
+        for index in 0..diagnostics {
+            notices = notices.push(button(text(format!(
+                "救援/assess.arcadia:{}:5 · Warning: verify this participant's engineering allocation", index + 1,
+            )).size(12)).padding([4, 6]).width(Fill));
+        }
+        let find: View<'_, Message, iced::Theme, FontLayout> = if find {
+            column![
+                text_input("Find literal text", "assess").on_input(|s| Message::SourceNavigation(
+                    crate::source_navigation::Event::Query(s)
+                )),
+                text_input("Line", "1").on_input(|s| Message::SourceNavigation(
+                    crate::source_navigation::Event::Line(s)
+                )),
+            ]
+            .spacing(8)
+            .into()
+        } else {
+            Space::new().into()
+        };
+        let header = container(
+            column![
+                text("Textual model").size(24),
+                text("Edit the current file. Apply text validates the complete included model.")
+                    .size(11),
+                row![
+                    button(text("Apply text")),
+                    button(text("Undo text")),
+                    button(text("Model Undo"))
+                ]
+                .spacing(8),
+                text("救援/assess.arcadia · All files applied to the accepted model").size(11),
+                text("Undo text affects this draft. Model Undo restores accepted files together.")
+                    .size(11),
+                find,
+                row![
+                    button(text("Definition · F12")),
+                    button(text("References · Shift F12")),
+                    button(text("Back"))
+                ]
+                .spacing(7),
+                scrollable(notices).height((diagnostics as f32 * 32.).min(132.)),
+            ]
+            .spacing(12),
+        )
+        .padding(18);
+        let editor = container(
+            widget::text_editor(content)
+                .on_action(Message::SourceEdit)
+                .font(Font::MONOSPACE)
+                .size(14)
+                .padding(16)
+                .height(Fill),
+        )
+        .id("test-source-editor")
+        .height(Fill)
+        .width(Fill);
+        source_layout(header.into(), editor.into(), window_height)
+    }
+
+    #[test]
+    fn source_header_keeps_editor_bounds_stable_through_lint_and_find_rebuilds() {
+        for (host, window_height) in [
+            (Size::new(720., 540.), 700.),
+            (Size::new(1180., 890.), 1080.),
+        ] {
+            let content = widget::text_editor::Content::<FontLayout>::with_text(
+                "// is excluded\r\n// 雨\r\n",
+            );
+            let mut tree = core_widget::Tree::empty();
+            let mut baseline = None;
+            for (diagnostics, find) in [
+                (0, false),
+                (6, false),
+                (0, false),
+                (6, true),
+                (1, true),
+                (0, false),
+            ] {
+                let mut ui = mounted_source(&content, diagnostics, find, window_height);
+                tree.diff(ui.as_widget());
+                let node = ui.as_widget_mut().layout(
+                    &mut tree,
+                    &FontLayout,
+                    &layout::Limits::new(Size::ZERO, host),
+                );
+                let mut geometry = Geometry::default();
+                ui.as_widget_mut().operate(
+                    &mut tree,
+                    Layout::new(&node),
+                    &FontLayout,
+                    &mut geometry,
+                );
+                let editor = geometry.editor.unwrap();
+                let (header, _, _) = geometry.header.unwrap();
+                let slot = node.children()[0].bounds();
+                assert_eq!(slot.height, (window_height * 0.42).max(180.));
+                assert!(
+                    header.height <= slot.height,
+                    "short content may shrink inside the fixed slot"
+                );
+                assert!(
+                    editor.height >= 240.,
+                    "remaining editor must stay usable: {editor:?}"
+                );
+                assert_eq!(editor.y, slot.y + slot.height);
+                if let Some(expected) = baseline {
+                    assert_eq!(editor, expected, "diagnostics={diagnostics}, find={find}");
+                } else {
+                    baseline = Some(editor);
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn source_header_remains_scrollable_and_preserves_offset_across_diagnostic_refresh() {
+        let content = widget::text_editor::Content::<FontLayout>::with_text("// 雨\r\n");
+        let host = Size::new(720., 540.);
+        let mut tree = core_widget::Tree::empty();
+        let mut saved = None;
+        for diagnostics in [6, 7] {
+            let mut ui = mounted_source(&content, diagnostics, true, 700.);
+            tree.diff(ui.as_widget());
+            let node = ui.as_widget_mut().layout(
+                &mut tree,
+                &FontLayout,
+                &layout::Limits::new(Size::ZERO, host),
+            );
+            let mut geometry = Geometry::default();
+            ui.as_widget_mut()
+                .operate(&mut tree, Layout::new(&node), &FontLayout, &mut geometry);
+            let (bounds, contents, _) = geometry.header.unwrap();
+            assert!(
+                contents.height > bounds.height,
+                "fixture must actually overflow"
+            );
+            if saved.is_none() {
+                let mut messages = Vec::new();
+                let mut shell = Shell::new(&mut messages);
+                ui.as_widget_mut().update(
+                    &mut tree,
+                    &iced::Event::Mouse(iced::mouse::Event::WheelScrolled {
+                        delta: iced::mouse::ScrollDelta::Pixels { x: 0., y: -45. },
+                    }),
+                    Layout::new(&node),
+                    iced::mouse::Cursor::Available(Point::new(bounds.x + 8., bounds.y + 8.)),
+                    &FontLayout,
+                    &mut iced::advanced::clipboard::Null,
+                    &mut shell,
+                    &Rectangle::with_size(host),
+                );
+                assert!(shell.is_event_captured());
+            }
+            let mut geometry = Geometry::default();
+            ui.as_widget_mut()
+                .operate(&mut tree, Layout::new(&node), &FontLayout, &mut geometry);
+            let offset = geometry.header.unwrap().2;
+            assert!(offset.y > 0., "the actual mounted Scrollable must move");
+            if let Some(before) = saved {
+                assert_eq!(offset, before);
+            } else {
+                saved = Some(offset);
+            }
+        }
+    }
+
+    #[cfg(target_os = "windows")]
+    #[test]
+    fn source_editor_windows_menu_payload_is_inert_but_space_and_altgr_still_edit() {
+        use core_widget::operation::Focusable;
+        use iced::keyboard::{
+            self, Key, Modifiers,
+            key::{Code, Named, Physical},
+        };
+        use widget::text_editor::{Binding, Content, KeyPress, State, Status};
+        let baseline = "// is excluded\r\n// 雨\r\n";
+        let context = crate::source_navigation::SymbolContext {
+            session: Id::new_v4(),
+            path: "救援/assess.arcadia".into(),
+        };
+        for (key, physical_key, modifiers, payload, inserted) in [
+            (
+                Key::Named(Named::Space),
+                Physical::Code(Code::Space),
+                Modifiers::ALT,
+                " ",
+                false,
+            ),
+            (
+                Key::Character(" ".into()),
+                Physical::Code(Code::Space),
+                Modifiers::ALT,
+                " ",
+                false,
+            ),
+            (
+                Key::Named(Named::Space),
+                Physical::Code(Code::Space),
+                Modifiers::empty(),
+                " ",
+                true,
+            ),
+            (
+                Key::Named(Named::Space),
+                Physical::Code(Code::Space),
+                Modifiers::CTRL | Modifiers::ALT,
+                " ",
+                true,
+            ),
+            (
+                Key::Character("e".into()),
+                Physical::Code(Code::KeyE),
+                Modifiers::CTRL | Modifiers::ALT,
+                "€",
+                true,
+            ),
+            (
+                Key::Named(Named::Space),
+                Physical::Code(Code::Space),
+                Modifiers::ALT | Modifiers::SHIFT,
+                " ",
+                true,
+            ),
+        ] {
+            let mut content = Content::<FontLayout>::with_text(baseline);
+            content.move_to(widget::text_editor::Cursor {
+                position: widget::text_editor::Position { line: 0, column: 5 },
+                selection: None,
+            });
+            let press = KeyPress {
+                key: key.clone(),
+                modified_key: key.clone(),
+                physical_key,
+                modifiers,
+                text: Some(payload.into()),
+                status: Status::Focused { is_hovered: false },
+            };
+            assert!(
+                matches!(
+                    Binding::<Message>::from_key_press(press),
+                    Some(Binding::Insert(_))
+                ),
+                "the supplied event must expose the default insertion path"
+            );
+            let mut messages = Vec::new();
+            {
+                let mut editor: View<'_, Message, iced::Theme, FontLayout> =
+                    widget::text_editor(&content)
+                        .on_action(Message::SourceEdit)
+                        .font(Font::MONOSPACE)
+                        .size(14)
+                        .padding(16)
+                        .height(Fill)
+                        .key_binding(|press| source_binding(press, &context, None))
+                        .into();
+                let mut tree = core_widget::Tree::new(editor.as_widget());
+                let size = Size::new(600., 240.);
+                let node = editor.as_widget_mut().layout(
+                    &mut tree,
+                    &FontLayout,
+                    &layout::Limits::new(Size::ZERO, size),
+                );
+                tree.state
+                    .downcast_mut::<State<shaped::highlighter::PlainText>>()
+                    .focus();
+                let event = iced::Event::Keyboard(keyboard::Event::KeyPressed {
+                    key: key.clone(),
+                    modified_key: key,
+                    physical_key,
+                    location: keyboard::Location::Standard,
+                    modifiers,
+                    text: Some(payload.into()),
+                    repeat: false,
+                });
+                let mut shell = Shell::new(&mut messages);
+                editor.as_widget_mut().update(
+                    &mut tree,
+                    &event,
+                    Layout::new(&node),
+                    iced::mouse::Cursor::Unavailable,
+                    &FontLayout,
+                    &mut iced::advanced::clipboard::Null,
+                    &mut shell,
+                    &Rectangle::with_size(size),
+                );
+            }
+            assert_eq!(
+                messages.len(),
+                usize::from(inserted),
+                "modifiers={modifiers:?}"
+            );
+            for message in messages {
+                let Message::SourceEdit(action) = message else {
+                    panic!("unexpected navigation action");
+                };
+                content.perform(action);
+            }
+            let expected = if inserted {
+                format!("// is{payload} excluded\r\n// 雨\r\n")
+            } else {
+                baseline.into()
+            };
+            assert_eq!(content.text(), expected);
+        }
+    }
+}
 fn checks(app: &App) -> View<'_, Message> {
     let issues = &app.model_issues;
     let mut out = column![heading(

crates/oa-desktop/src/views/source_symbols.rs

@@ -0,0 +1,260 @@
+use crate::{
+    app::{App, Message},
+    source_navigation::{
+        SymbolEvent,
+        query::{self, Declaration, Disposition, Evidence, Identity, Membership, Position},
+    },
+    style,
+};
+use iced::{
+    Element, Fill,
+    widget::{Space, button, column, container, row, scrollable, text, tooltip},
+};
+
+pub(super) fn panel(app: &App) -> Element<'_, Message> {
+    let state = &app.source_symbols;
+    if !state.open
+        || (state.results.is_none() && state.in_flight.is_none() && state.notice.is_none())
+    {
+        return column![].into();
+    }
+    let title = state.results.as_ref().map_or_else(
+        || "Source symbols".to_owned(),
+        |results| {
+            let action = match results.action {
+                query::Action::Definition => "Definitions",
+                query::Action::References => "References",
+            };
+            results.alias.as_ref().map_or_else(
+                || action.to_owned(),
+                |alias| format!("{action} · @{}", preview(alias, 40)),
+            )
+        },
+    );
+    let mut content = column![
+        row![
+            text(title).size(13),
+            Space::new().width(Fill),
+            button(text("Close").size(11))
+                .padding([3, 8])
+                .style(style::nav)
+                .on_press(app.source_symbol_message(SymbolEvent::Close)),
+        ]
+        .align_y(iced::Center)
+    ]
+    .spacing(5);
+
+    if let Some(notice) = &state.notice {
+        content = content.push(super::label(preview(notice, 240)));
+    }
+    if state.in_flight.is_some() {
+        content = content.push(super::label("Finding source symbols…"));
+    } else if let Some(results) = &state.results {
+        let stale = results.stamp.snapshot != app.source_key();
+        if stale {
+            content = content.push(super::label(
+                "Stale results — source changed. Run Definition or References again.",
+            ));
+        }
+        let scope = &results.scope;
+        content = content.push(super::label(format!(
+            "{} · {} · {} included / {} detached / {} unverified files · {} scope issues",
+            if scope.partial() {
+                "Partial scope"
+            } else {
+                "Complete include scope"
+            },
+            if !scope.applied {
+                "Unapplied drafts"
+            } else if scope.validated {
+                "Validated sources"
+            } else {
+                "Draft sources"
+            },
+            scope.included_files,
+            scope.detached_files,
+            scope.unverified_files,
+            scope.issues.len(),
+        )));
+        let explanation = match results.disposition {
+            Disposition::NoSymbol => "Place the caret on a declaration alias or an @reference.",
+            Disposition::NoDefinition => "No matching declaration in the loaded sources.",
+            Disposition::Choices => {
+                "Choose a declaration; draft and detached candidates need an explicit choice."
+            }
+            Disposition::Direct => "Definition in the current sources.",
+            Disposition::LexicalReferences => {
+                "Lexical uses of this alias; these do not establish a semantic target."
+            }
+        };
+        content = content.push(super::label(explanation));
+        if results.total_definitions > 1 {
+            content = content.push(super::label(format!(
+                "Alias collision: {} declarations. Uses are not attributed to a single declaration.",
+                results.total_definitions,
+            )));
+        }
+        let enabled = !stale && !app.busy;
+        let mut rows = column![super::label(counts(
+            "Declarations",
+            results.definitions.len(),
+            results.total_definitions,
+            results.omitted_definitions,
+        ))]
+        .spacing(4);
+        for (index, definition) in results.definitions.iter().enumerate() {
+            rows = rows.push(location_row(
+                declaration_title(&definition.declaration),
+                &definition.path,
+                definition.position,
+                provenance(
+                    definition.membership,
+                    definition.evidence,
+                    definition.declaration.identity,
+                    false,
+                ),
+                enabled.then(|| {
+                    app.source_symbol_message(SymbolEvent::Choose {
+                        stamp: results.stamp,
+                        reference: false,
+                        index,
+                    })
+                }),
+            ));
+        }
+        rows = rows.push(super::label(counts(
+            "Lexical uses",
+            results.references.len(),
+            results.total_references,
+            results.omitted_references,
+        )));
+        for (index, reference) in results.references.iter().enumerate() {
+            let title = reference.context.as_ref().map_or_else(
+                || format!("@{} · lexical use", preview(&reference.alias, 48)),
+                |context| {
+                    format!(
+                        "@{} · inside {}",
+                        preview(&reference.alias, 48),
+                        declaration_title(context)
+                    )
+                },
+            );
+            rows = rows.push(location_row(
+                title,
+                &reference.path,
+                reference.position,
+                provenance(
+                    reference.membership,
+                    reference.evidence,
+                    reference
+                        .context
+                        .as_ref()
+                        .map_or(Identity::Missing, |context| context.identity),
+                    true,
+                ),
+                enabled.then(|| {
+                    app.source_symbol_message(SymbolEvent::Choose {
+                        stamp: results.stamp,
+                        reference: true,
+                        index,
+                    })
+                }),
+            ));
+        }
+        let row_count = results.definitions.len() + results.references.len();
+        content =
+            content.push(scrollable(rows).height((44.0 + row_count as f32 * 48.0).min(180.0)));
+    }
+    container(content)
+        .padding(8)
+        .width(Fill)
+        .style(style::subtle)
+        .into()
+}
+
+fn counts(label: &str, shown: usize, total: usize, omitted: usize) -> String {
+    format!("{label}: {total} total · {shown} shown · {omitted} omitted")
+}
+
+fn declaration_title(declaration: &Declaration) -> String {
+    let name = declaration
+        .name
+        .as_ref()
+        .map_or_else(String::new, |name| format!(" \"{}\"", preview(name, 48)));
+    format!(
+        "{}{} · @{}",
+        preview(&declaration.kind, 24),
+        name,
+        preview(&declaration.alias, 48)
+    )
+}
+
+fn provenance(
+    membership: Membership,
+    evidence: Evidence,
+    identity: Identity,
+    context: bool,
+) -> String {
+    let membership = match membership {
+        Membership::Included => "Included",
+        Membership::Detached => "Detached",
+        Membership::Unverified => "Unverified",
+    };
+    let evidence = match evidence {
+        Evidence::Validated => "Validated",
+        Evidence::Draft => "Draft",
+    };
+    let collision = match identity {
+        Identity::Collision { count } => format!(
+            " · {}ID collision ({count})",
+            if context { "Context " } else { "" },
+        ),
+        Identity::Missing | Identity::Unique(_) => String::new(),
+    };
+    format!("{membership} · {evidence}{collision}")
+}
+
+fn location_row(
+    title: String,
+    path: &str,
+    position: Position,
+    status: String,
+    event: Option<Message>,
+) -> Element<'static, Message> {
+    let line = position.line.saturating_add(1);
+    let column = position.byte_column.saturating_add(1);
+    let location = format!("{}:{line}:{column}", preview(path, 72));
+    tooltip(
+        button(
+            column![
+                text(title).size(12),
+                super::label(format!("{location} · {status}"))
+            ]
+            .spacing(2),
+        )
+        .padding([4, 6])
+        .width(Fill)
+        .style(style::nav)
+        .on_press_maybe(event),
+        text(format!(
+            "{path}:{line}:{column} (1-based line and UTF-8 byte column)"
+        ))
+        .size(11),
+        tooltip::Position::Top,
+    )
+    .into()
+}
+
+/// Keep headings compact without copying the remainder of a long admitted value.
+fn preview(value: &str, limit: usize) -> String {
+    let mut chars = value.chars();
+    let mut result: String = chars
+        .by_ref()
+        .take(limit)
+        .map(|ch| if ch.is_whitespace() { ' ' } else { ch })
+        .collect();
+    if chars.next().is_some() {
+        result.push('…');
+    }
+    result
+}

deployment/Dockerfile

@@ -1,9 +1,19 @@
+# syntax=docker/dockerfile:1
+# Requires --build-context server_notices=<prepared server-notices directory>.
+# See docs/linux-packaging.md. Missing/stale notices fail before application build.
 FROM rust:1.90-bookworm AS builder
+RUN apt-get update && apt-get install -y --no-install-recommends python3 \
+    && rm -rf /var/lib/apt/lists/*
 WORKDIR /src
 COPY Cargo.toml Cargo.lock ./
+COPY LICENSE ./LICENSE
 COPY build ./build
 COPY crates ./crates
 COPY docs/openapi.json ./docs/openapi.json
+COPY scripts/package-artifacts.py ./scripts/package-artifacts.py
+COPY --from=server_notices / /tmp/server-notices/
+RUN python3 scripts/package-artifacts.py verify-notices \
+    --directory /tmp/server-notices --repository /src --target x86_64-unknown-linux-gnu
 RUN cargo build --release --locked -p oa-server
 
 FROM debian:bookworm-slim
@@ -12,6 +22,7 @@ RUN groupadd --gid 10001 arcadia \
     && mkdir /data \
     && chown 10001:10001 /data
 COPY --from=builder /src/target/release/arcadia-server /usr/local/bin/arcadia-server
+COPY --from=builder /tmp/server-notices/ /usr/share/doc/arcadia-server/
 USER 10001:10001
 VOLUME ["/data"]
 EXPOSE 8787

deployment/Dockerfile.dockerignore

@@ -1,9 +1,24 @@
-.git
-target
-dist
-harness
+# Only inputs consumed by this Dockerfile enter the ordinary repository context.
+# The server_notices named context is supplied separately and verified in builder.
+**
+!Cargo.toml
+!Cargo.lock
+!LICENSE
+!build/
+!build/**
+!crates/
+!crates/**
+!docs/
+!docs/openapi.json
+!scripts/
+!scripts/package-artifacts.py
+!deployment/
+!deployment/Dockerfile
+!deployment/Dockerfile.dockerignore
+# Do not admit generated/private files even inside an allowed source tree.
 **/target
-**/*.sqlite3
+**/.git
+**/.env
+**/.env.*
 **/*.log
-.codex
-.openai
+**/*.sqlite3

docs/language.html

@@ -752,7 +752,7 @@ lists all additional fields. <span class="docutils literal">ref</span> means <sp
 </tr>
 <tr><td><p><span class="docutils literal">oa_scenario</span>, <span class="docutils literal">sa_scenario</span></p></td>
 <td><p><span class="docutils literal">viewpoint</span>: ScenarioViewpoint; <span class="docutils literal">context</span>: ref?; <span class="docutils literal">precondition</span>, <span class="docutils literal">postcondition</span>: strings; <span class="docutils literal">steps</span>: occurrence refs</p></td>
-<td><p>MixedLegacy for omitted schema-2 source; none; <span class="docutils literal">&quot;&quot;</span>; <span class="docutils literal">&quot;&quot;</span>; <span class="docutils literal">[]</span></p></td>
+<td><p>MixedLegacy when viewpoint is omitted, including newly authored source 7 (see section 4.3); none; <span class="docutils literal">&quot;&quot;</span>; <span class="docutils literal">&quot;&quot;</span>; <span class="docutils literal">[]</span></p></td>
 </tr>
 <tr><td><p><span class="docutils literal">oa_lifeline</span>, <span class="docutils literal">sa_lifeline</span></p></td>
 <td><p><span class="docutils literal">represented</span>: participant, work, or role ref?</p></td>
@@ -792,49 +792,71 @@ An Enumeration contains unique string literals. For example:</p>
 <pre class="code text literal-block"><code>definition { Enumeration { literals [&quot;Clear&quot;, &quot;Fog&quot;]; }; };
 type_ref { Named &#64;weather_classification; };</code></pre>
 <p>These are typed constructors with named fields, not embedded JSON documents.
-Constructor field names and enum spellings are case-sensitive. When replacing
-a constructor, all of its fields MUST be supplied; the containing declaration
-defaults do not silently fill a different constructor's missing fields.
-During schema-2 compatibility, the new Exchange fields <span class="docutils literal">message_kind</span>,
-<span class="docutils literal">reply_to</span> and <span class="docutils literal">values</span> are exceptions: omitted values hydrate as
-Asynchronous, none and [] respectively. Canonical output writes them explicitly.
-This preserves older schema-2 source/JSON without inventing call correlation or
-value annotations. It is not a rule for an unspecified future schema.</p>
+Constructor field names and enum spellings are case-sensitive. A selected
+constructor uses its own field contract; it does not inherit the payload of a
+different constructor from the declaration default. Required fields MUST be
+supplied. Nullability and omission are separate properties: <span class="docutils literal">?</span> denotes a
+value that can be <span class="docutils literal">none</span>; a constructor's omission contract determines whether
+the field may be absent. There is no general all-constructor-fields-required
+rule. Other typed constructors use their contracts in the corresponding
+sections; the occurrence rules below do not establish defaults for them.</p>
+<p>The following table records the source-7 OccurrenceBody contracts. Optional
+references may be omitted and then mean <span class="docutils literal">none</span>. Exchange also admits omitted
+<span class="docutils literal">message_kind</span> and <span class="docutils literal">values</span>, meaning Asynchronous and <span class="docutils literal">[]</span> respectively.
+These omissions are accepted in newly authored source 7, not only in schema-2
+compatibility input. Earlier schema admission of constructors and fields is
+still governed by its version rules.</p>
+<p>Canonical formatting writes the hydrated occurrence references and default
+<span class="docutils literal">message_kind</span>, <span class="docutils literal">reply_to</span> and <span class="docutils literal">values</span> explicitly. An absent
+<span class="docutils literal">operation</span> remains omitted in canonical output. Lossless no-op updates and
+unrelated name edits retain authored omissions; canonical formatting is a
+different operation. An admitted incomplete occurrence can still produce model
+checks requesting its missing work, exchange, lifeline or referenced scenario.</p>
 <table>
 <caption>Occurrence body constructors</caption>
 <colgroup>
-<col style="width: 22.0%" />
-<col style="width: 78.0%" />
+<col style="width: 18.0%" />
+<col style="width: 36.0%" />
+<col style="width: 46.0%" />
 </colgroup>
 <thead>
 <tr><th class="head"><p>Constructor</p></th>
 <th class="head"><p>Required fields</p></th>
+<th class="head"><p>Fields that may be omitted, with their resulting values</p></th>
 </tr>
 </thead>
 <tbody>
 <tr><td><p>Exchange</p></td>
-<td><p><span class="docutils literal">exchange</span>: exchange relation ref?; <span class="docutils literal">sender</span>, <span class="docutils literal">receiver</span>: lifeline refs?; <span class="docutils literal">message_kind</span>: MessageKind; <span class="docutils literal">reply_to</span>: occurrence ref?; <span class="docutils literal">values</span>: MessageValue records</p></td>
+<td><p>None</p></td>
+<td><p><span class="docutils literal">exchange</span>: exchange relation ref?, <span class="docutils literal">sender</span>, <span class="docutils literal">receiver</span>: lifeline refs?, <span class="docutils literal">reply_to</span>: occurrence ref?, <span class="docutils literal">operation</span>: OperationUse? → <span class="docutils literal">none</span>; <span class="docutils literal">message_kind</span>: MessageKind → Asynchronous; <span class="docutils literal">values</span>: MessageValue records → <span class="docutils literal">[]</span></p></td>
 </tr>
 <tr><td><p>Action</p></td>
-<td><p><span class="docutils literal">action</span>: activity/function ref?; <span class="docutils literal">lifeline</span>: ref?</p></td>
+<td><p>None</p></td>
+<td><p><span class="docutils literal">action</span>: activity/function ref?, <span class="docutils literal">lifeline</span>: ref? → <span class="docutils literal">none</span></p></td>
 </tr>
 <tr><td><p>Control</p></td>
 <td><p><span class="docutils literal">kind</span>: Choice, Merge, Fork, Join, Loop</p></td>
+<td><p>None</p></td>
 </tr>
 <tr><td><p>SequenceReference</p></td>
-<td><p><span class="docutils literal">sequence</span>: process/functional-chain ref?</p></td>
+<td><p>None</p></td>
+<td><p><span class="docutils literal">sequence</span>: process/functional-chain ref? → <span class="docutils literal">none</span></p></td>
 </tr>
 <tr><td><p>ScenarioUse</p></td>
-<td><p><span class="docutils literal">scenario</span>: scenario ref?; <span class="docutils literal">bindings</span>: LifelineBinding records</p></td>
+<td><p><span class="docutils literal">bindings</span>: LifelineBinding records</p></td>
+<td><p><span class="docutils literal">scenario</span>: scenario ref? → <span class="docutils literal">none</span></p></td>
 </tr>
 <tr><td><p>State</p></td>
-<td><p><span class="docutils literal">state</span>: state/mode ref?; <span class="docutils literal">lifeline</span>: ref?</p></td>
+<td><p>None</p></td>
+<td><p><span class="docutils literal">state</span>: state/mode ref?, <span class="docutils literal">lifeline</span>: ref? → <span class="docutils literal">none</span></p></td>
 </tr>
 <tr><td><p>Fragment</p></td>
 <td><p><span class="docutils literal">operator</span>: Alternative, Parallel, Loop, Optional; <span class="docutils literal">branches</span>: branch occurrence refs</p></td>
+<td><p>None</p></td>
 </tr>
 <tr><td><p>Branch</p></td>
 <td><p><span class="docutils literal">guard</span>: string; <span class="docutils literal">occurrences</span>: occurrence refs</p></td>
+<td><p>None</p></td>
 </tr>
 </tbody>
 </table>
@@ -1274,9 +1296,21 @@ reference checks.</p>
 <p>Omitted schema-2 viewpoints hydrate as MixedLegacy in both source and JSON.
 This preserves pre-extension mixed work/participant scenes without discarding
 their lifelines or silently assigning a stricter meaning. MixedLegacy emits a
-review warning. New graphical factories explicitly select OperationalActivity
-or Functional by layer. Authors can select a strict viewpoint after reviewing
-the legacy scene; canonical source then records that choice.</p>
+review warning. Source parsing also uses MixedLegacy when <span class="docutils literal">viewpoint</span> is
+omitted from a newly authored source-7 scenario; it does not infer a strict
+viewpoint from the layer or lifelines. Write the intended viewpoint explicitly
+when starting a scenario. For example, this new OA source project starts an
+activity-based scenario whose lifelines and occurrences can be added later:</p>
+<pre class="literal-block">arcadia 7;
+project response &quot;Distress response&quot; {
+    oa_scenario assessment &quot;Assess the distress report&quot; {
+        viewpoint OperationalActivity;
+    }
+}</pre>
+<p>An empty scenario can produce completeness warnings while remaining editable.
+The desktop's Behavior <strong>New</strong> flow asks authors to choose one of the layer's
+two strict viewpoints explicitly. Authors can also select a strict viewpoint
+after reviewing a legacy scene; canonical source then records that choice.</p>
 <p>MessageKind is Asynchronous, Call, Reply, Create, Delete, or
 <span class="docutils literal">{ Timer { expression &quot;after 5 s&quot;; }; }</span>. A process/chain exchange
 contribution MUST remain Asynchronous with no reply correlation. Call/reply,
@@ -2217,6 +2251,23 @@ strings use JSON string escaping, including <span class="docutils literal">\n</s
 and Unicode escapes. Literal unescaped newlines inside strings are invalid.
 Numbers use JSON decimal/exponent syntax; NaN, infinity, hexadecimal numbers,
 leading plus signs, and leading zeroes are invalid.</p>
+<p>A small model may begin with engineering declarations alone. This complete
+source describes two participants, their work, responsibility and an exchange:</p>
+<pre class="literal-block">arcadia 7;
+project distress &quot;Distress response&quot; {
+    oa_actor vessel &quot;Vessel in distress&quot; {}
+    oa_entity rescue &quot;Rescue coordination&quot; {}
+    oa_activity report &quot;Report distress&quot; {}
+    oa_activity assess &quot;Assess incident&quot; {}
+    allocation vessel_reports &quot;Crew reports&quot; { source &#64;vessel; target &#64;report; }
+    allocation rescue_assesses &quot;Team assesses&quot; { source &#64;rescue; target &#64;assess; }
+    interaction distress_report &quot;Distress report&quot; { source &#64;report; target &#64;assess; }
+}</pre>
+<p>No diagram, placement, empty description or explicit root parent is required.
+The accepted source adds identities; keep those clauses during later edits.
+Changing <span class="docutils literal">&quot;Assess incident&quot;</span> changes the display name while <span class="docutils literal">&#64;assess</span> still
+resolves to the same activity. Behavior-coverage warnings permit this intermediate
+model to be saved. Allocation remains explicit and distinct from decomposition.</p>
 <p>Aliases match <span class="docutils literal"><span class="pre">[A-Za-z_][A-Za-z0-9_]*</span></span>. The following aliases are reserved:
 arcadia, project, id, oa, sa, element, relation, diagram, node, artifact,
 trace, body, alias, name, description, parent, from, to, entity, actor,
@@ -2227,7 +2278,7 @@ spellings can be used in alias positions because references begin with <span cla
 <span class="docutils literal"><span class="pre">element-kind</span></span> and <span class="docutils literal"><span class="pre">relation-kind</span></span> are exactly the corresponding declaration
 keywords listed above. Typed field
 sets and enum constructors are closed by sections 3–5.</p>
-<pre class="code text literal-block"><code>document    = &quot;arcadia&quot; &quot;5&quot; &quot;;&quot; project
+<pre class="code text literal-block"><code>document    = &quot;arcadia&quot; &quot;7&quot; &quot;;&quot; project
 project     = &quot;project&quot; alias string identity? &quot;{&quot; project-entry* &quot;}&quot;
 project-entry = &quot;description&quot; string &quot;;&quot; | declaration
 declaration = element
@@ -2582,6 +2633,62 @@ trace links, occurrence identity, comments and file ownership. Each open file
 retains its own unapplied draft across file navigation. Located lint diagnostics
 refer to the raw draft bytes rather than an identity-stabilized intermediate.
 Property editing MUST NOT silently discard a pending source draft.</p>
+<p>In Textual model, place the caret on a declaration alias or an <span class="docutils literal">&#64;reference</span>
+and choose <strong>Definition</strong> (<span class="docutils literal">F12</span>) or <strong>References</strong> (<span class="docutils literal">Shift+F12</span>).
+<strong>Back</strong> (<span class="docutils literal">Alt+Left</span>) returns to the previous source location in this
+workspace. These shortcuts act while the source editor has focus; the Text
+toolbar also exposes the actions. If the previous draft changed, Back restores
+its current cursor rather than reusing an obsolete selection.</p>
+<p>Symbol navigation reads bounded snapshots of the currently loaded source
+drafts. It does not apply drafts or load missing included files. The results
+identify partial scope, draft evidence, detached or unverified files, alias
+ambiguity and authored-ID collisions. Draft, detached and ambiguous definition
+candidates require an explicit row choice. References are lexical uses of an
+alias, not a list of resolved typed relationships; comments and strings are
+excluded. Declaration and use counts include any rows omitted by the result
+limits. If sources change, stale rows cannot navigate: run the query again.
+Navigation MUST preserve the accepted model and every source draft, and select
+locations in the original UTF-8 bytes. Displayed locations use one-based lines
+and UTF-8 byte columns.</p>
+<p><strong>Rename alias</strong> (<span class="docutils literal">F2</span> while the source editor has focus) changes the alias
+under the caret or its exact selection. It requires a unique authored identity
+in the complete accepted source bundle, with no pending source, property or
+behavior drafts and no extra loaded detached files. Accepted but unsaved source
+is eligible. The operation MUST NOT implicitly apply a draft or allocate an ID.
+The engineering name and UUID remain unchanged.</p>
+<p>The <strong>Source alias</strong> field does not trim or normalize the entered alias. Pasting
+line breaks, tabs or other control characters is explicitly rejected as a whole:
+the field and its selection remain unchanged, and any previous preview approval
+is invalidated. <strong>Preview</strong>
+prepares a typed alias change and displays every changed file and source line;
+comments, strings, engineering data, file membership and declaration ownership
+remain unchanged. Enter in the field requests Preview, never confirmation.
+The preview is for this operation against accepted source, so a later Save may
+also contain earlier accepted edits. A changing rename requires enough model
+history capacity to retain its immediate Undo. An invalid, identical, stale or
+oversized candidate cannot enable confirmation.</p>
+<p>The preview MUST provide access to all admitted files, hunks, lines and long-line
+segments. Refuse a candidate whose complete preview exceeds the editor's bounds:
+256 changed files, 50,000 changed lines or 8 MiB of displayed source bytes
+(both versions of changed/context lines and file paths). Index metadata is
+separately bounded to seven retained line records per changed line. These
+limits do not restrict the language itself. A changed-line count is not a count
+of semantic references. Cancel, Preview and Rename alias remain reachable
+outside the independently scrolling source preview.</p>
+<p>Explicit <strong>Rename alias</strong> confirms the current preview once, as one accepted
+model/source transaction. A source, document, recovery or replacement change
+invalidates its approval even if later bytes match the old preview. Closing the
+form cancels approval; a late worker result MUST NOT reopen it. Rejected,
+canceled and unchanged operations preserve accepted bytes, drafts, save state,
+revisions, selection and both histories. Successful rename selects the new alias
+at the original occurrence rather than the first matching spelling in the file.
+Editing the replacement permits a new Preview in the same form. After a source
+context change, close the form and invoke Rename again on the current alias.</p>
+<p><strong>Undo rename</strong> is guarded against intervening edits and uses model history;
+the persistent <strong>Undo model</strong> and <strong>Redo model</strong> controls restore the complete
+accepted snapshots. Text <span class="docutils literal">Ctrl+Z</span> remains <strong>Undo text</strong>. Save is separate and
+uses the ordinary guarded source-save contract. An unconfirmed preview and Undo
+history are not persisted on reopening.</p>
 <p>Changing a graphical UUID must atomically update map keys and every reference.
 Alias changes preserve UUID identity. Deletion must account for owned elements,
 incident relationships, ordered occurrences, and diagram placements without

docs/language.rst

@@ -120,7 +120,7 @@ lists all additional fields. ``ref`` means ``@alias``; ``ref?`` also accepts
      - No implicit contract; ``legacy`` defaults none. OA admits Legacy only.
    * - ``oa_scenario``, ``sa_scenario``
      - ``viewpoint``: ScenarioViewpoint; ``context``: ref?; ``precondition``, ``postcondition``: strings; ``steps``: occurrence refs
-     - MixedLegacy for omitted schema-2 source; none; ``""``; ``""``; ``[]``
+     - MixedLegacy when viewpoint is omitted, including newly authored source 7 (see section 4.3); none; ``""``; ``""``; ``[]``
    * - ``oa_lifeline``, ``sa_lifeline``
      - ``represented``: participant, work, or role ref?
      - none
@@ -155,37 +155,60 @@ An Enumeration contains unique string literals. For example:
     type_ref { Named @weather_classification; };
 
 These are typed constructors with named fields, not embedded JSON documents.
-Constructor field names and enum spellings are case-sensitive. When replacing
-a constructor, all of its fields MUST be supplied; the containing declaration
-defaults do not silently fill a different constructor's missing fields.
-During schema-2 compatibility, the new Exchange fields ``message_kind``,
-``reply_to`` and ``values`` are exceptions: omitted values hydrate as
-Asynchronous, none and [] respectively. Canonical output writes them explicitly.
-This preserves older schema-2 source/JSON without inventing call correlation or
-value annotations. It is not a rule for an unspecified future schema.
+Constructor field names and enum spellings are case-sensitive. A selected
+constructor uses its own field contract; it does not inherit the payload of a
+different constructor from the declaration default. Required fields MUST be
+supplied. Nullability and omission are separate properties: ``?`` denotes a
+value that can be ``none``; a constructor's omission contract determines whether
+the field may be absent. There is no general all-constructor-fields-required
+rule. Other typed constructors use their contracts in the corresponding
+sections; the occurrence rules below do not establish defaults for them.
+
+The following table records the source-7 OccurrenceBody contracts. Optional
+references may be omitted and then mean ``none``. Exchange also admits omitted
+``message_kind`` and ``values``, meaning Asynchronous and ``[]`` respectively.
+These omissions are accepted in newly authored source 7, not only in schema-2
+compatibility input. Earlier schema admission of constructors and fields is
+still governed by its version rules.
+
+Canonical formatting writes the hydrated occurrence references and default
+``message_kind``, ``reply_to`` and ``values`` explicitly. An absent
+``operation`` remains omitted in canonical output. Lossless no-op updates and
+unrelated name edits retain authored omissions; canonical formatting is a
+different operation. An admitted incomplete occurrence can still produce model
+checks requesting its missing work, exchange, lifeline or referenced scenario.
 
 .. list-table:: Occurrence body constructors
    :header-rows: 1
-   :widths: 22 78
+   :widths: 18 36 46
 
    * - Constructor
      - Required fields
+     - Fields that may be omitted, with their resulting values
    * - Exchange
-     - ``exchange``: exchange relation ref?; ``sender``, ``receiver``: lifeline refs?; ``message_kind``: MessageKind; ``reply_to``: occurrence ref?; ``values``: MessageValue records
+     - None
+     - ``exchange``: exchange relation ref?, ``sender``, ``receiver``: lifeline refs?, ``reply_to``: occurrence ref?, ``operation``: OperationUse? → ``none``; ``message_kind``: MessageKind → Asynchronous; ``values``: MessageValue records → ``[]``
    * - Action
-     - ``action``: activity/function ref?; ``lifeline``: ref?
+     - None
+     - ``action``: activity/function ref?, ``lifeline``: ref? → ``none``
    * - Control
      - ``kind``: Choice, Merge, Fork, Join, Loop
+     - None
    * - SequenceReference
-     - ``sequence``: process/functional-chain ref?
+     - None
+     - ``sequence``: process/functional-chain ref? → ``none``
    * - ScenarioUse
-     - ``scenario``: scenario ref?; ``bindings``: LifelineBinding records
+     - ``bindings``: LifelineBinding records
+     - ``scenario``: scenario ref? → ``none``
    * - State
-     - ``state``: state/mode ref?; ``lifeline``: ref?
+     - None
+     - ``state``: state/mode ref?, ``lifeline``: ref? → ``none``
    * - Fragment
      - ``operator``: Alternative, Parallel, Loop, Optional; ``branches``: branch occurrence refs
+     - None
    * - Branch
      - ``guard``: string; ``occurrences``: occurrence refs
+     - None
 
 For example, ``body { Action { action @assess; lifeline @operator_line; }; };``
 selects an Action occurrence. Processes and functional chains contain Exchange,
@@ -631,9 +654,23 @@ reference checks.
 Omitted schema-2 viewpoints hydrate as MixedLegacy in both source and JSON.
 This preserves pre-extension mixed work/participant scenes without discarding
 their lifelines or silently assigning a stricter meaning. MixedLegacy emits a
-review warning. New graphical factories explicitly select OperationalActivity
-or Functional by layer. Authors can select a strict viewpoint after reviewing
-the legacy scene; canonical source then records that choice.
+review warning. Source parsing also uses MixedLegacy when ``viewpoint`` is
+omitted from a newly authored source-7 scenario; it does not infer a strict
+viewpoint from the layer or lifelines. Write the intended viewpoint explicitly
+when starting a scenario. For example, this new OA source project starts an
+activity-based scenario whose lifelines and occurrences can be added later::
+
+    arcadia 7;
+    project response "Distress response" {
+        oa_scenario assessment "Assess the distress report" {
+            viewpoint OperationalActivity;
+        }
+    }
+
+An empty scenario can produce completeness warnings while remaining editable.
+The desktop's Behavior **New** flow asks authors to choose one of the layer's
+two strict viewpoints explicitly. Authors can also select a strict viewpoint
+after reviewing a legacy scene; canonical source then records that choice.
 
 MessageKind is Asynchronous, Call, Reply, Create, Delete, or
 ``{ Timer { expression "after 5 s"; }; }``. A process/chain exchange
@@ -1582,6 +1619,26 @@ and Unicode escapes. Literal unescaped newlines inside strings are invalid.
 Numbers use JSON decimal/exponent syntax; NaN, infinity, hexadecimal numbers,
 leading plus signs, and leading zeroes are invalid.
 
+A small model may begin with engineering declarations alone. This complete
+source describes two participants, their work, responsibility and an exchange::
+
+    arcadia 7;
+    project distress "Distress response" {
+        oa_actor vessel "Vessel in distress" {}
+        oa_entity rescue "Rescue coordination" {}
+        oa_activity report "Report distress" {}
+        oa_activity assess "Assess incident" {}
+        allocation vessel_reports "Crew reports" { source @vessel; target @report; }
+        allocation rescue_assesses "Team assesses" { source @rescue; target @assess; }
+        interaction distress_report "Distress report" { source @report; target @assess; }
+    }
+
+No diagram, placement, empty description or explicit root parent is required.
+The accepted source adds identities; keep those clauses during later edits.
+Changing ``"Assess incident"`` changes the display name while ``@assess`` still
+resolves to the same activity. Behavior-coverage warnings permit this intermediate
+model to be saved. Allocation remains explicit and distinct from decomposition.
+
 Aliases match ``[A-Za-z_][A-Za-z0-9_]*``. The following aliases are reserved:
 arcadia, project, id, oa, sa, element, relation, diagram, node, artifact,
 trace, body, alias, name, description, parent, from, to, entity, actor,
@@ -1596,7 +1653,7 @@ sets and enum constructors are closed by sections 3–5.
 
 .. code-block:: text
 
-    document    = "arcadia" "5" ";" project
+    document    = "arcadia" "7" ";" project
     project     = "project" alias string identity? "{" project-entry* "}"
     project-entry = "description" string ";" | declaration
     declaration = element
@@ -1997,6 +2054,69 @@ retains its own unapplied draft across file navigation. Located lint diagnostics
 refer to the raw draft bytes rather than an identity-stabilized intermediate.
 Property editing MUST NOT silently discard a pending source draft.
 
+In Textual model, place the caret on a declaration alias or an ``@reference``
+and choose **Definition** (``F12``) or **References** (``Shift+F12``).
+**Back** (``Alt+Left``) returns to the previous source location in this
+workspace. These shortcuts act while the source editor has focus; the Text
+toolbar also exposes the actions. If the previous draft changed, Back restores
+its current cursor rather than reusing an obsolete selection.
+
+Symbol navigation reads bounded snapshots of the currently loaded source
+drafts. It does not apply drafts or load missing included files. The results
+identify partial scope, draft evidence, detached or unverified files, alias
+ambiguity and authored-ID collisions. Draft, detached and ambiguous definition
+candidates require an explicit row choice. References are lexical uses of an
+alias, not a list of resolved typed relationships; comments and strings are
+excluded. Declaration and use counts include any rows omitted by the result
+limits. If sources change, stale rows cannot navigate: run the query again.
+Navigation MUST preserve the accepted model and every source draft, and select
+locations in the original UTF-8 bytes. Displayed locations use one-based lines
+and UTF-8 byte columns.
+
+**Rename alias** (``F2`` while the source editor has focus) changes the alias
+under the caret or its exact selection. It requires a unique authored identity
+in the complete accepted source bundle, with no pending source, property or
+behavior drafts and no extra loaded detached files. Accepted but unsaved source
+is eligible. The operation MUST NOT implicitly apply a draft or allocate an ID.
+The engineering name and UUID remain unchanged.
+
+The **Source alias** field does not trim or normalize the entered alias. Pasting
+line breaks, tabs or other control characters is explicitly rejected as a whole:
+the field and its selection remain unchanged, and any previous preview approval
+is invalidated. **Preview**
+prepares a typed alias change and displays every changed file and source line;
+comments, strings, engineering data, file membership and declaration ownership
+remain unchanged. Enter in the field requests Preview, never confirmation.
+The preview is for this operation against accepted source, so a later Save may
+also contain earlier accepted edits. A changing rename requires enough model
+history capacity to retain its immediate Undo. An invalid, identical, stale or
+oversized candidate cannot enable confirmation.
+
+The preview MUST provide access to all admitted files, hunks, lines and long-line
+segments. Refuse a candidate whose complete preview exceeds the editor's bounds:
+256 changed files, 50,000 changed lines or 8 MiB of displayed source bytes
+(both versions of changed/context lines and file paths). Index metadata is
+separately bounded to seven retained line records per changed line. These
+limits do not restrict the language itself. A changed-line count is not a count
+of semantic references. Cancel, Preview and Rename alias remain reachable
+outside the independently scrolling source preview.
+
+Explicit **Rename alias** confirms the current preview once, as one accepted
+model/source transaction. A source, document, recovery or replacement change
+invalidates its approval even if later bytes match the old preview. Closing the
+form cancels approval; a late worker result MUST NOT reopen it. Rejected,
+canceled and unchanged operations preserve accepted bytes, drafts, save state,
+revisions, selection and both histories. Successful rename selects the new alias
+at the original occurrence rather than the first matching spelling in the file.
+Editing the replacement permits a new Preview in the same form. After a source
+context change, close the form and invoke Rename again on the current alias.
+
+**Undo rename** is guarded against intervening edits and uses model history;
+the persistent **Undo model** and **Redo model** controls restore the complete
+accepted snapshots. Text ``Ctrl+Z`` remains **Undo text**. Save is separate and
+uses the ordinary guarded source-save contract. An unconfirmed preview and Undo
+history are not persisted on reopening.
+
 Changing a graphical UUID must atomically update map keys and every reference.
 Alias changes preserve UUID identity. Deletion must account for owned elements,
 incident relationships, ordered occurrences, and diagram placements without

docs/linux-packaging.md

@@ -0,0 +1,65 @@
+# Linux packaging and deployment inputs
+
+The packaging command stages **already-built** desktop/server executables for `x86_64-unknown-linux-gnu`. It runs on Windows PowerShell 5.1 or PowerShell 7 (including Linux) with Python 3.11+ standard library, Git, and the matching Rust/Cargo dependency cache. It does not build, download, install runtime libraries or launch the application. Python creates and reads back the tar archive; end users do not need Python, PowerShell or Rust.
+
+Build and validate first in a source checkout. The current runtime validation baseline is Ubuntu 24.04 x86-64. A glibc symbol inventory is not a claim that every distribution with that glibc version supports the renderer and dialogs.
+
+```powershell
+./scripts/package-linux.ps1 -Target x86_64-unknown-linux-gnu `
+  -Version 0.2.0-rc1 -BinaryDirectory ./target/release -Python python3
+```
+
+For an explicit-target build, use `target/x86_64-unknown-linux-gnu/release`. A cross-build may supply another directory containing both `arcadia-studio` and `arcadia-server`. Select the Rust compiler used for the intended build before packaging; its Linux target libraries, copyright reports and locked source/archive cache must be installed. Read-only `cargo metadata --locked --offline --filter-platform x86_64-unknown-linux-gnu` and Rust version/sysroot queries are the only Rust commands run by packaging. When packaging from Windows, `-Python C:/path/to/python.exe` selects Python explicitly.
+
+The script refuses existing output/claim names. It creates `dist/ArcadiaStudio-<version>-x86_64-unknown-linux-gnu/`, a `.tar.gz`, and an adjacent `.sha256`. A failed attempt leaves its claim and any partial outputs for diagnosis; choose a fresh version or output root rather than overwriting them. Archives use sorted paths, zero timestamps and uid/gid, 0755 for the two Linux executables and 0644 for other files. Every entry is read back and compared against staging, including permissions. The same unchanged inputs on the same Python/zlib implementation produce the same bytes; this does not promise reproducible compiler output.
+
+## Contents and provenance
+
+Both executables, the MIT license, a package-specific README, complete tracked examples (including all water-pressure teaching/evidence files), deployment references and the reachable documentation closure are included. Relative Markdown/reST/HTML file links are checked before archiving; upstream license texts are preserved verbatim and their internal source-tree hyperlinks are outside that documentation check. Untracked private files, caches and unrelated harness history are not included merely because they exist on disk.
+
+`package.json` records input hashes and static ELF dependencies. `SHA256SUMS.txt` inventories every file except itself; the archive checksum covers that inventory too. `dependency-notices.json`, `THIRD-PARTY-NOTICES.txt` and `licenses/` use the same strict collector as Windows: exact target-filtered normal/build dependency graph, locked crate archives, actual source hashes, checksum-bound supplements and embedded fonts, Rust distribution notices and target-library hashes. Unknown sources, absent notices or changed supplements stop packaging. No Linux system libraries are bundled by this pipeline; their runtime distribution supplies them and its notices.
+
+ELF preflight requires little-endian x86-64 executables/PIE, the glibc dynamic loader, no RPATH/RUNPATH and a reviewed set of direct libc/compiler-runtime imports. Unknown libraries require an explicit packaging design instead of being silently copied from a developer machine. Graphics/window/portal libraries loaded at runtime are outside that static import list.
+
+Optionally pass `-BuildEvidence <json-file>`, containing nonempty `source_identity`, `profile`, `compiler`, exact `target`, and `binary_sha256` keyed by `arcadia-studio` and `arcadia-server`. Hash strings must be lowercase SHA256. Target and binary hashes are checked; other fields remain explicit caller assertions. Omission records build provenance as unknown. Never label a development binary an optimized release because of its directory or package version.
+
+## Native extracted-bundle checks
+
+Extract into a fresh user-writable Linux directory and run from an unrelated working directory. Verify SHA256SUMS, file permissions, `file`/`ldd` and actual desktop/runtime libraries. A typical Ubuntu runtime needs X11/XKB and Wayland clients, Vulkan loader/Mesa Vulkan drivers, and working session DBus plus an xdg-desktop-portal backend for file dialogs. A successful `ldd` alone is insufficient because these libraries can be loaded dynamically.
+
+For a software Vulkan trial, first locate the installed lavapipe ICD; only if it exists, use:
+
+```sh
+WGPU_BACKEND=vulkan VK_DRIVER_FILES=/usr/share/vulkan/icd.d/lvp_icd.x86_64.json ./arcadia-studio
+```
+
+A compatible native GPU may run without these variables. WSLg uses real Linux user space with a particular display environment; record the actual X11/Wayland backend and do not infer support for all Linux sessions from one trial. Exercise Home walkthrough, Help/search, native Open/Save dialogs, a multi-file project, diagram/source edits, Undo/Redo and reopening at normal/minimum window sizes. Compare complete saved model/source and inspect stderr, not merely whether a window appeared.
+
+Run the server against a separate local data directory and unused loopback port. Follow [server configuration](server.md) for health, authentication, ETags, restart and backup/restore. Test create/import, a changed conditional update, unchanged no-op, stale/invalid rejection, and persistence after a clean restart. Record exact binary/archive/source/compiler hashes and platform. Packaging verification is separate from current-tree release acceptance.
+
+## Container server notices and context
+
+The Dockerfile is x86-64 Linux only and requires BuildKit named build contexts. Before its application build it verifies a prepared server-only notice bundle against Cargo.lock, Rust compiler release/commit, exact Linux target-library hashes, notice-file checksums and workspace source hashes. This prevents using Windows dependency notices or a stale source/compiler inventory as the container's notice claim.
+
+In the source checkout, select **Rust 1.90.0** and its `x86_64-unknown-linux-gnu` target libraries to match `rust:1.90-bookworm`. Populate the locked dependency cache through your ordinary documented build/setup first; notice collection itself remains offline. On a Windows host, a Rust 1.90 GNU-host toolchain with installed Linux target libraries can provide this read-only inventory. Prepare a fresh output root:
+
+```powershell
+./scripts/package-linux.ps1 -Target x86_64-unknown-linux-gnu `
+  -ServerNoticesOnly -OutputRoot ./.local/container-notices-rc1
+```
+
+This writes `.local/container-notices-rc1/server-notices` and a sibling claim file. Pass only the notice directory as the named context:
+
+```sh
+docker buildx build --platform linux/amd64 --load \
+  --build-context server_notices=./.local/container-notices-rc1/server-notices \
+  -f deployment/Dockerfile -t arcadia-server:0.2.0-rc1 .
+```
+
+The Dockerfile-specific ignore file allows only its ordinary source/build inputs; `.local`, model data, `.env` files and arbitrary caches are excluded from that root context. The separate named context includes only the explicitly prepared notices. The image retains them at `/usr/share/doc/arcadia-server/`, alongside Debian's own distribution notices. Do not pass a broad cache or home directory as the named context. Updating Cargo.lock, workspace sources or the compiler requires regenerating the bundle under a fresh output name.
+
+The image runs as UID/GID 10001 and expects its data volume and token as described in [server configuration](server.md). Verify the actual image build, service health/authentication, writable volume and restart on a Docker-capable Linux runner. A Dockerfile review and successful local package checks do not establish container build/runtime acceptance.
+
+## Runner-independent validation commands
+
+Run `cargo fmt --all -- --check`, `cargo clippy --locked --workspace --all-targets -- -D warnings`, `cargo test --locked --workspace --all-targets`, and `cargo build --release --locked --workspace --bins` with the explicit supported compiler and native prerequisites. Run `python3 scripts/test-package-artifacts.py` and the PowerShell notice contract checks. Then package the resulting binaries and perform the native checks above. These commands are usable on a suitably provisioned runner; this document does not assert that GitLab, Gitea or GitHub has an active runner for this repository.

docs/server.md

@@ -1,6 +1,6 @@
 # Arcadia Studio server
 
-`arcadia-server` is a headless Rust REST service for the same schema-5 model, commands, source language, validation, artifacts and OA/SA traces used by the desktop. It stores each model and its authored source project together in an atomic JSON envelope. The service provides a deployment artifact and configuration examples; this repository does not assert that a remote instance has been deployed.
+`arcadia-server` is a headless Rust REST service for the same schema-7 model, commands, source language, validation, artifacts and OA/SA traces used by the desktop. It stores each model and its authored source project together in an atomic JSON envelope. The service provides a deployment artifact and configuration examples; this repository does not assert that a remote instance has been deployed.
 
 The complete HTTP contract is [api.rst](api.rst); machine-readable schemas are in [openapi.json](openapi.json), also served at `/api/v1/openapi.json`. The original [service research](research-v2-service.md) discusses broader alternatives; retained history, SQLite, idempotency receipts and stored transition plans from that research are **not** the implemented storage contract.
 
@@ -68,10 +68,12 @@ Errors use `application/problem+json` with stable `code`, HTTP `status`, human `
 
 ## Linux deployment
 
-`deployment/Dockerfile` builds a headless image from the repository root:
+Prepare the server-only dependency notices using the pinned Rust toolchain as described in [Linux packaging](linux-packaging.md), then build the headless image from the repository root. BuildKit supplies this checksum-bound notice bundle as a separate context; the ordinary build context excludes local caches and model data.
 
 ```sh
-docker build -f deployment/Dockerfile -t arcadia-server:local .
+docker buildx build --platform linux/amd64 --load \
+  --build-context server_notices=./.local/container-notices-rc1/server-notices \
+  -f deployment/Dockerfile -t arcadia-server:local .
 docker run --rm --name arcadia-server \
   -p 127.0.0.1:8787:8787 \
   -v arcadia-data:/data \

docs/source-cli.md

@@ -0,0 +1,66 @@
+# Source CLI
+
+Use `arcadia` to check or update local `.arcadia` projects without opening Studio
+or starting a server. Pass the entry file explicitly; its relative include paths
+resolve from their containing source files.
+
+Build with `cargo build --locked -p oa-cli --bin arcadia`. The resulting command
+is `target/debug/arcadia.exe` on Windows or `target/debug/arcadia` on Linux unless
+your Cargo configuration chooses another target directory. A workspace release
+build also includes it. Use the platform's usual executable path prefix when
+running these examples.
+
+```sh
+arcadia check project.arcadia
+arcadia check project.arcadia --json
+arcadia stabilize project.arcadia
+arcadia stabilize project.arcadia --write
+arcadia rename-alias project.arcadia old_alias new_alias
+arcadia rename-alias project.arcadia old_alias new_alias --write --json
+```
+
+`lint` is an alias for `check`. Checks accept incomplete engineering models with
+warnings; syntax errors and structural violations fail. Located diagnostics
+refer to the named file and coordinate space. Line and column numbers are
+one-based and columns count Unicode scalar values; byte ranges are half-open
+UTF-8 offsets.
+
+`stabilize` previews missing persistent identities and any supported source
+migration. `rename-alias` changes one existing global alias and its typed
+references while preserving comments, strings and unrelated source. Pass alias
+names without `@`. The command does not rename an element's display name.
+
+Both editing commands preview by default. Human output writes unified file
+diffs to stdout and diagnostics to stderr. `--json` writes one versioned report
+with diagnostics, migration information, exact before/after text for every
+changed file, diffs and the write result. Unchanged files are not included in
+that report. They are still checked for conflicts before a write.
+
+Add `--write` to save the candidate prepared by that invocation. Even an empty
+diff checks the captured files and pending-save state before returning. A failed
+write reports `written: false` and retains its proposed diff. This does not
+guarantee rollback; the reported conflict or recovery outcome determines the
+next step. A pending save
+requires explicit recovery through the existing project recovery workflow;
+the CLI does not recover it automatically.
+
+Missing IDs in a separate earlier preview remain provisional. A later command
+may allocate different IDs until you save them. This CLI does not persist a
+review plan for later application. It does not canonicalize the whole project
+or delete detached files. Source versions 3–7 use the core's supported migration
+rules; invalid source is not rewritten.
+
+| Exit code | Meaning |
+| --- | --- |
+| 0 | Valid check or successful preview/write; warnings may remain |
+| 1 | Invalid source or refused semantic alias change |
+| 2 | Invalid command arguments |
+| 3 | File/path, conflict, pending-save or output failure |
+
+Admission bounds match the desktop: 256 files, include depth 32, 1024 include
+edges, 64 MiB total UTF-8, 100,000 graph objects, 250,000 records and 500,000
+ordered references. `arcadia --help` lists the commands and bounds. These limits
+are not a claim of interactive performance at the maximum project size.
+
+For the notation itself, start with [the text-first examples](../examples/text-first/README.md)
+and the [language contract](language.rst).

docs/windows-packaging.md

@@ -2,12 +2,12 @@
 
 The standard build target is x86_64 MSVC. The optional gnullvm build uses LLVM-MinGW UCRT and currently needs `libunwind.dll` alongside both executables. Packaging is a separate operation on already-built inputs; it neither builds nor launches applications and does not confer release acceptance.
 
-Run from a Git checkout with Windows PowerShell 5.1 or PowerShell 7. Build and test first using the [README](../README.md). Select the actual output directory explicitly; a native-host Cargo build normally uses `target/release`, while an explicit `--target` uses `target/<target>/release`.
+Run from a Git checkout with Windows PowerShell 5.1 or PowerShell 7 and Python 3.11+ (standard library only). Build and test first using the [README](../README.md). Select the actual output directory explicitly; a native-host Cargo build normally uses `target/release`, while an explicit `--target` uses `target/<target>/release`. `-Python <executable>` selects Python when it is not named `python` on PATH; it collects/checks the package-local documentation closure without running binaries.
 
 Packaging also needs the build's matching `cargo` and `rustc` on the packaging process PATH, the locked dependency sources/archive cache, and installed Rust target libraries and copyright reports. The script invokes only read-only `cargo metadata --locked --offline --filter-platform <target>` and Rust version/sysroot queries. It does not download dependencies or build. These tools are packaging prerequisites; the extracted application does not require them.
 
 ```powershell
-# Standard MSVC outputs, already built:
+# MSVC outputs, already built with a verified runtime strategy:
 ./scripts/package-windows.ps1 -Target x86_64-pc-windows-msvc `
   -Version 0.2.0-rc1 -BinaryDirectory ./target/release
 
@@ -17,11 +17,13 @@ Packaging also needs the build's matching `cargo` and `rustc` on the packaging p
   -LlvmMinGWRoot C:/Tools/llvm-mingw-20260826-ucrt-x86_64
 ```
 
-The caller must supply the matching build target, version, and final binaries. PE headers establish x86_64 architecture, but do not prove a source revision or Cargo profile. `package.json` records input hashes and inspected imports; retain build/test evidence tied to those hashes separately. The version labels the package and does not change the embedded application version.
+The caller must supply the matching build target, version, and final binaries. PE headers establish x86_64 architecture, but do not prove a source revision or Cargo profile. `package.json` records input hashes and inspected imports; retain build/test evidence tied to those hashes separately. The version labels the package and does not change the embedded application version. Optional `-BuildEvidence <json>` requires nonempty `source_identity`, `profile`, `compiler`, exact `target`, and `binary_sha256` keyed by both executable filenames. Target and lowercase SHA256 values are checked; source/compiler/profile remain explicitly supplied assertions, never inferred from a directory name.
+
+Ordinary dynamic-CRT MSVC output can import VC redistributables and will be refused by the strict runtime check. One candidate recipe is an explicit-target build with `CARGO_TARGET_X86_64_PC_WINDOWS_MSVC_RUSTFLAGS=-C target-feature=+crt-static`; validate its actual imports and runtime on the intended platform before packaging. This guide does not assert that such a build has been performed. The existing GNU/LLVM recipe has its own exact libunwind staging below. Do not silence an unknown import or copy arbitrary DLLs to make packaging pass.
 
 The script creates a fresh `dist/ArcadiaStudio-<version>-<target>/`, matching ZIP, and ZIP `.sha256` file. `-OutputRoot` selects another location. Existing output names are refused; no directories are deleted or overwritten. A `.packaging.lock` claim and partial outputs remain after failure for inspection; retry under a fresh version/output location. ZIP file order and timestamps are fixed so unchanged inputs can be compared across runs; this is not a reproducible compiler-build guarantee.
 
-Each package includes desktop and server executables, README, MIT license, built-in Help in the application, tracked docs (including language/API specifications and OpenAPI), tracked examples and deployment recipes, current coverage/runtime notes, START-HERE, provenance, and SHA-256 inventory. It includes current working-tree contents of tracked files, so review uncommitted documentation edits before packaging. Untracked sample/user files are excluded. Repository sources are needed separately for the documented Cargo and Docker build recipes.
+Each package includes both executables, a package-specific README, MIT license, built-in Help, language/API specifications and OpenAPI, server/platform guides and their reachable documentation closure, all tracked examples and deployment references, START-HERE, provenance, and SHA256 inventory. Relative Markdown/reST/HTML file links are checked before archiving; upstream license texts retain their own source-tree links unchanged. Current working-tree contents of tracked inputs are copied, so review uncommitted documentation edits before packaging. Untracked sample/user files are excluded. Repository sources and tools are needed separately for Cargo/Docker recipes; the archive README makes this distinction explicit.
 
 For gnullvm, the exact selected toolchain's x86_64 `libunwind.dll` and full distribution `LICENSE.TXT` are included; both are hashed. Standard MSVC packaging has no LLVM-MinGW coupling. The script reads ordinary PE imports recursively for packaged runtime DLLs, accepts a bounded list of Windows system components/API sets, and fails on unknown imports. For example, a build importing a VC redistributable DLL must have its redistribution and dependency handling resolved before packaging; it is not silently treated as part of Windows. Do not copy arbitrary DLLs from System32. Dynamically loaded graphics libraries and delay-load imports require the runtime check below.
 
@@ -64,6 +66,6 @@ try {
 }
 ```
 
-This snippet only starts processes; it does not verify readiness. Check the server's health route documented in [server setup](server.md), import/read/update a model, restart with the same temporary store, and verify persistence. Close only the processes started for this smoke. Exercise the desktop's Home/example/open/save/reopen and Help, inspect real diagrams, and perform the [Save-as Undo/Redo recheck](../harness/release-save-as-runtime-packaging.md). Close normally and check stderr/exit state. A process that survives a few seconds alone is not adequate GUI evidence.
+This snippet only starts processes; it does not verify readiness. Check the server's health route documented in [server setup](server.md), import/read/update a model, restart with the same temporary store, and verify persistence. Close only the processes started for this smoke. Exercise Home/example/open/save/reopen and Help, inspect real diagrams, and verify a graphical edit → Save as → Undo → Redo → Save → reopen against the complete intended model/source. Close normally and check stderr/exit state. A process that survives a few seconds alone is not adequate GUI evidence.
 
 Acceptance is pending until these checks are actually performed against the packaged final binaries. Historical V2 bundles, this machine's Cargo checks, and a successful development launch with compiler PATH are separate evidence.

examples/release1/README.md

@@ -65,12 +65,12 @@ The integration oracle executes this exact semantic review and source update. It
 | `oa/`, `sa/` | Participants, work, data, capabilities and reusable behavior |
 | `views/` | Five saved views; filters and placements are presentation state |
 | `traceability.arcadia` | OA↔SA correspondence and review history |
-| `model.json` | Current schema-6 interchange of the final accepted model |
+| `model.json` | Current schema-7 interchange of the final accepted model |
 | `transition-before.json`, `transition-request.json` | Explicit first-transition replay inputs |
 | `evidence/repair-check.md` | Local teaching evidence linked from the SA conversation |
 | `model.rs` | Deterministic lesson builder shared by generator and tests |
 
-The REST routes are documented in [the API reference](../../docs/api.rst). Import `model.json` with `POST /api/v1/projects/import`; query the returned resource's `/model` and `/validation`. Expect schema 6 and the one warning above. JSON import provides canonical source; to retain the exact modular source layout, use `/api/v1/projects/import-source-project` with a SourceBundle containing entry `project.arcadia` and only the 30 reachable `.arcadia` file strings, keyed by slash-separated relative paths. Neither route reads the artifact target from your local filesystem.
+The REST routes are documented in [the API reference](../../docs/api.rst). Import `model.json` with `POST /api/v1/projects/import`; query the returned resource's `/model` and `/validation`. Expect schema 7 and the one warning above. JSON import provides canonical source; to retain the exact modular source layout, use `/api/v1/projects/import-source-project` with a SourceBundle containing entry `project.arcadia` and only the 30 reachable `.arcadia` file strings, keyed by slash-separated relative paths. Neither route reads the artifact target from your local filesystem.
 
 For transition replay, import `transition-before.json` instead. Submit `transition-request.json` to that baseline resource's `/transitions/preview` with its current ETag in `If-Match`. Review the returned plan, then follow the documented `/transitions/apply` protocol. Use the baseline resource for this exercise: the final model already contains the mapped records and subsequent refinements. This tutorial's automated evidence is core/source validation; it does not claim a separate native or HTTP acceptance run of this particular example.
 

examples/text-first/README.md

@@ -0,0 +1,24 @@
+# Start a model in text
+
+Open `project.arcadia`, then choose **Textual model**. The model describes who
+reports distress, who assesses it, and the information passing between those
+activities. It needs no diagram or handwritten UUIDs.
+
+1. Read each declaration as **kind, alias, display name**. References such as
+   `@assess` use the alias. The two allocations state responsibility; the
+   interaction states the direction of the exchange.
+2. Change `"Assess incident"` to a name suited to your project. Use **Apply all**,
+   then **Save all**. Keep the identity clauses added to the accepted source:
+   they preserve the same model objects in later edits.
+3. Add work and exchanges as your understanding grows. Behavior coverage checks
+   identify activities and exchanges that still need process or scenario context;
+   these advisory checks allow you to save the intermediate model.
+
+Changing a display name keeps references intact. Changing an alias requires
+updating every `@alias` use. Nesting expresses decomposition; an allocation
+expresses who performs work. Neither implies the other.
+
+For a larger example with behavior, ports, views and OA/SA correspondence, use
+[the water-pressure walkthrough](../release1/README.md). The
+[language reference](../../docs/language.rst) defines all declarations and the
+rules for splitting a project into included files.

examples/text-first/project.arcadia

@@ -0,0 +1,10 @@
+arcadia 7;
+project distress "Distress response" {
+    oa_actor vessel "Vessel in distress" {}
+    oa_entity rescue "Rescue coordination" {}
+    oa_activity report "Report distress" {}
+    oa_activity assess "Assess incident" {}
+    allocation vessel_reports "Crew reports" { source @vessel; target @report; }
+    allocation rescue_assesses "Team assesses" { source @rescue; target @assess; }
+    interaction distress_report "Distress report" { source @report; target @assess; }
+}

harness/PLAN.md

@@ -1,117 +1,135 @@
+> Historical record — superseded on 2026-09-11. Live plans, ownership and blockers
+> were migrated once to [Gitea issue 1, comment 408](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/1#issuecomment-408)
+> and [issue 2](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/2).
+> Do not update this as a live ledger. [STATE.md](STATE.md) links the verified integrated result.
+> The historical text below is preserved; its old active-status wording is not current guidance.
+
 # First release execution plan
 
-## Active execution — 2026-09-10
+Updated 2026-09-11, Codex-9e8r6t `/root`.
+[PROJECT_GOAL.md](../PROJECT_GOAL.md) defines the outcome;
+[TASK_LEDGER.md](TASK_LEDGER.md) separates evidence from assumptions;
+[STATE.md](STATE.md) owns active leases and results.
 
-1. Restore a reproducible local toolchain; repair the interrupted compact palette;
-   verify focused history/draft/placement regressions and the actual native workflow.
-2. Independently reassess current behavior/scenario ergonomics and OA/SA semantic,
-   source/API and documentation completeness. Resolve verified high-impact gaps
-   with bounded changes and cross-representation acceptance criteria.
-3. Complete realistic graphical OA/SA teaching, transition, behavior, recovery and
-   hosted workflows. Exercise minimum and wide layouts, rejected edits and history.
-4. Run current Windows/Linux automated and native acceptance, fresh independent
-   end-state reviews, optimized builds and package verification. Publish accurate
-   build/run evidence and handoff only when the original release criteria hold.
+Resumed after the user's virtualization/reboot update. STATE.md supersedes the
+historical [RESTART_HANDOFF.md](RESTART_HANDOFF.md) for live status. Postboot
+focused3 ran25 passing tests and one failing overflow-fixture assertion; its
+test-only correction passed all26 focused4 tests. Strict Clippy, formatting and
+matching GUI5657 build also passed; fresh native acceptance continues.
+Nondeleting compression completed across282 generated binaries with identical
+hashes and11.78GB free; supported Ubuntu26.04 installation passed exit0. Actual
+root shell identifies Ubuntu26.04/WSL2. User328 replaces failed mirrored mode
+with VirtioProxy; the VPN is immutable. Both new guest startups timed out before
+execution, then the distinct WslService restart failed at OS access permissions.
+All60 apt archives and five Rust components are downloaded and hash-verified;
+guest signature verification/install and Linux Cargo remain pending. No compiler
+or WSL client lease is active. The user has now paused Linux builds/checking
+until they report WSL networking resolved; do not schedule more Linux setup,
+launches, diagnostics or checks before that notice (Gitea comment356).
+Lifeline/Chain history and Machine Create/Undo/postboot reopen passed on GUI52;
+Fresh GUI5657 cancellation/recovery, Lifeline direct creation/history and Machine
+minimum-size owner/Create/Undo/Redo/reopen now pass; full679 desktop tests pass.
 
-This ordering supersedes historical stopped-session next actions below. Preserve
-their scoped evidence; no test or runtime result transfers to a new binary without
-verification. Root holds the serialized build/native lease; Gitea #1 tracks workers.
+## Immediate implementation and acceptance
 
-**Latest refinement:** consult actual installed Capella 7.1, replace the user-rejected horizontal creation/connection rows with a compact contextual palette and inline authoring, independently critique interaction risks, then build and verify the real workflow at wide/minimum sizes. [Benchmark and concrete acceptance](release-capella-basic-editing-20260907.md). Do not ship the rejected toolbar as the usability correction.
+1. Preserve and publish the completed native acceptance of GUI `5657BAB5…D3846CE` using
+   the [v2 plan](release-contextual-source-native-v2-plan-20260911.md). All26
+   affected tests, strict all-target Clippy, formatting and matching build pass;
+   the full679 immutable Windows test run also passed. Minimum-size
+   child visibility, exact recovery/cancel and direct Lifeline Create/Undo/Redo
+   now pass, along with Machine owner visibility/Create/Undo/Redo/reopen. Preserve
+   independent first UUID carriers and serialize future compiler/source leases.
+   Prepare an updated Windows prerelease only with honest per-binary source
+   identity, package verification and clean packaged runtime checks.
+2. Exercise the implemented source subform for Lifeline, process/chain Work and
+   machine owner, plus semantic first-action prompts. Verify parent-draft
+   retention, explicit prerequisite and consumer adoption, exact source/history,
+   cancellation and recovery against the independent staged-source oracle.
+   Final source guards and guide corrections are complete and reviewed; native
+   acceptance remains; source/evidence are integrated in `df6f595`. Named creation, nine-file reopen and
+   SA pending-draft recovery already have their separate native passes.
+3. Complete local SA B2 and the saved basic
+   supplementary move/camera/invalid-draft and minimum-size story; the main basic
+   model and explicit transition passed full Project+SourceBundle, Undo/Redo and
+   reopen on candidate 3 at wide size. OA B2 Action, State, bound Reuse and Fragment
+   now pass complete model/two-source Create, one Undo, one Redo and final OA
+   reopen/Save with exact original identities. Preserve the existing B3 layer/size
+   scope; do not infer SA B2 or broader camera/focus coverage from these passes.
+4. Integrate standalone B4 scenario lifetimes and the external independent
+   scenario contract without overwriting local layout work. Resolve source-derived
+   lifetime versus insertion bounds, activation-after-Delete and lane-map issues.
+   Close remaining
+   contextual operand, missing-source and state-naming workflow gaps identified
+   by the current behavior audit and native study.
 
-**Current priority (7 September):** the user's usability correction takes precedence over the advanced feature sequence below. Establish contextual named diagram creation, existing-element placement, basic editing and clear layer transitions, then verify them natively. Desktop checks were explicitly reauthorized. See [priority reset and acceptance](release-basic-editing-reset-20260907.md).
+## Foundational semantic additions
 
-## Outcome and baseline
+The updated objective explicitly requires functional constraints/calculations,
+quantities/units and maintained model libraries. Current metadata/includes are
+insufficient. This work runs independently of useful behavior improvements.
 
-Deliver the first release of Arcadia Studio for system engineers: complete Operational Analysis and System Analysis/System Architecture workflows, equivalent graphical and textual models, clear artifact traceability and a deployable/programmatically accessible Rust service. Logical/Physical Architecture and later Arcadia layers are future releases, as the new objective explicitly states.
+Peer comment 231 ratifies schema 8/local-definition core steps in an isolated
+worktree. Coordinate those actual shared types and ownership before local
+integration; the current local core remains descriptive. Source grammar,
+evaluation, server/CLI/UI representation and acceptance are separate unfinished
+steps. Peer956 now reports focus regression5/5 and isolated numeric26/26 plus
+analysis28/28; their codec/lifecycle work remains isolated. Local integration and
+coherent union gates remain necessary. Do not replace peer efforts with a
+parallel local implementation. Comment338 separately reserves our bounded
+syntax-only outline seam for current-text navigation; its private query module
+and prepared tests remain uncompiled pending review.
 
-The authoritative objective is attachment `10b0f701-1743-4de7-9ee1-225920e19649/goal-objective.md`. It retains first-release scope and strengthens domain coherence, alternative evaluation and target-user task evidence. TASK_LEDGER.md separates given/verified facts, assumptions and open candidates; STATE.md records progress. The accepted 0.2.0 prototype is a historical baseline, not proof of release completeness. Its old D:/CodexBuilds archives are unavailable on this machine; existing dist archives must not be replaced until new acceptance passes.
+The newest objective also requires complete uncluttered text-only workflows.
+Combine the local three-task usability audit with the other host's language/
+identity/API design. Two concise current-grammar recipes now pass their bounded
+REST identity/source/persistence experiment. The published CLI now covers checked
+stabilization and typed alias rename with exact source-preserving preview/write.
+Next evaluate cross-file definitions/references and engineering task completion
+on repeated-name modular models. Do not equate shorter examples
+or parser throughput with task usability, and do not silently change omissions.
 
-The user's cross-branch reminder led to an ancestry/patch/tree audit. Continue from integrated `c091f80` on `codex/release1-continuation`; direct state/scenario/process, data, hosted and semantic review work already exists here. `release-branch-integration-20260906.md` records the audit. `release-current-coverage-20260906.md` is the current measurable acceptance map and supersedes stale absence claims in older narratives below.
+- Compare real candidate semantics before large changes. Use primary Capella,
+  SysML and quantity/unit evidence, with explicit compatibility limits.
+- Falsify candidates through mass/power/latency budgets, mixed/affine units,
+  unknown/error/false results, dependency cycles, reference identity and bounded
+  evaluation. Separate descriptive existing text from executable declarations.
+- Probe libraries through two projects/two instances, pinned offline content,
+  exports/dependency closure, bindings, distinct origin/local identities, updates
+  with local divergence, detachment and exact transactional rollback.
+- Review and test the peer-ratified pure core and its explicit migration/admission
+  boundaries before local integration. Retain independent falsifiers and current
+  typed Project, Command and source-writer guarantees across representations.
+- Implement the ratified contracts across validation, visitors, deletion,
+  identity, OA/SA transitions, source/reST, schema/REST, ergonomic graphical
+  authoring and help. Add real examples and independent parity acceptance.
 
-## Existing architecture and retained decisions
+## Integration and release
 
-Retain three Rust crates and one typed Project/validated atomic Command boundary. oa-core owns semantics, references, history, transitions, source and persistence; oa-desktop owns Iced interaction/drafts/projections; oa-server owns REST/ETag/current-model storage. Keep identity, semantic containment, allocation and per-diagram placement separate. No runtime plugin framework or later-layer skeleton.
+- GUI/server release 1, `v0.2.0-preview.authoring.20260911`, and standalone CLI
+  release 2, `cli-v0.2.0-preview.authoring.20260911`, are published and read back.
+  Their exact notices, archive, runtime and uploaded-asset evidence is preserved.
+  CLI packaging is integrated at `27df4a3`; instruction sync `07eb3cd` and
+  contextual source checkpoint `df6f595` and its raw evidence are integrated.
+  CLI publication `d95b1ab` and OA native checkpoint `c4bad4b` are also integrated;
+  then publish later coherent milestones under the assigned owner. Preserve each
+  artifact's source/profile/native scope and complete final-release gates separately.
+- Publish coherent commits and verified bundle transfers through Gitea; keep
+  concise host-scoped handoffs and Wiki. Do not overwrite another host's branch.
+- Refresh relevant source/schema/example/doc gates and run current core,
+  desktop/server and real REST transport/restart/ETag/draft-conflict workflows.
+- Build matching optimized desktop/server packages. Regenerate complete notices
+  for actual inputs and verify archive contents, hashes and clean-runtime launch.
+  Historical ELF fixtures and build preparation do not replace execution.
+- Follow the external owner's supported Linux guest route and run current
+  GUI/server workflows when viable. This local host has no usable Linux runtime;
+  supported WSL2 failed. Preserve failed attempts rather than repeating rejected
+  workarounds, and continue independent Windows/semantic work.
+- After the user reboot, check local Ubuntu registration and launch first. A
+  version2 default alone is not an installed/running Linux environment.
+- Conduct fresh independent requirements, semantic, usability, architecture,
+  correctness, runtime and documentation reviews. Resolve all material findings,
+  reverify affected behavior and only then declare release completion.
 
-The current forms are a closed typed-record adapter, not a second metamodel. Expand their real creation/reference/variant controls with every semantic addition. Core choices must drive graphical choices. New persistent fields participate in text round trips, identity/removal visitors, transitions, API schemas and graphical authoring tests.
-
-## Milestones and measurable acceptance
-
-Nested source ownership and persistent REST bundles are implemented and verified: Windows minimum-size source-to-graphics, nested reparent/source/Undo/Redo/Save/reopen, recovery, rebuilt Linux source/history/Save/reopen, independent review and both platform suites passed. Preserve the existing grammar/updater and separate allocation/order semantics.
-
-Explorer/port discovery, custom routing, direct palette connections, four-side port
-anchors, contextual menus and source folders have scoped Windows/Linux acceptance.
-See release-explorer-usability.md, release-routing-verification.md,
-release-routing-linux.md and release-port-drawing.md for exact evidence and limits.
-
-Direct state-machine editing is accepted through316dc55: typed persisted views,
-explicit-owner creation, movement, direct transitions/reconnection, typed detail
-forms, folding, placement and correct camera/tool lifetime. Windows default/minimum
-and Linux native acceptance plus independent reviews are recorded in
-release-state-editing.md. Direct scenario/process gestures remain required.
-
-R6 data contracts and direct scenario/process gestures are integrated; native
-acceptance continues on both platforms. Typed R3 core/source5/REST and scalar review
-milestones1–2 are integrated and pass full platform checks. Close independent scalar
-fixes and native review, then finish constructor/keyed/order/reset/artifact and
-multi-source graphical authoring using the existing shared core planner. Source5
-migration retains lexical ownership/comments; no flat source rewrite is allowed.
-See release-data-contract.md, release-semantic-integration.md and release-semantic-gui.md.
-
-Continue source authoring improvements only through the production parser/updater.
-The23-test experiment is evidence, not architecture: independent probes exposed
-comment misattachment and unsupported edits. Additional shorthand must preserve
-complete edit/delete behavior and exact source history, and justify itself in real
-human authoring tasks. Shared state placements are now validated; scenario/chain
-interaction must preserve its own occurrence and ordering semantics.
-
-1. **Release coverage audit and interfaces.** Compare actual core/UI/API with official Capella OA/SA semantics and the new objective. Freeze a coverage table and concrete variant/reference/transition contracts before editing shared interfaces. Distinguish unsupported later layers from missing OA/SA workflows; V2 exclusions are reconsidered. Native audit exercises onboarding/help/authoring at supported sizes. Independent audits have separate file ownership.
-2. **Complete engineering semantics.** Fill verified gaps in capability relationships and mission involvement; operational process/functional-chain function/control topology; scenario/state/data constructs needed by OA/SA engineers. Add typed semantic-content drift and reviewed existing-counterpart reconciliation, including reference mapping and explicit dependency/ownership decisions. Every addition has a usable graphical authoring workflow, equivalent source/API representation, meaningful reject/undo/delete/reidentify/transition tests and a worked example. Exact additions and invariants are recorded in the coverage/interface artifact from milestone1, avoiding speculative LA/PA concepts.
-3. **Approachable authoring and help.** Replace static help with searchable topic navigation, concise concepts, numbered OA→SA tutorials, related topics and direct workspace actions. Add a focused starting workspace, recent models and practical creation guidance. Improve source authoring with asynchronous versioned lint, semantic warnings, diagnostic navigation and find/go-to tools. Make selection/navigation and hidden/placed model distinctions clear. Add recoverable local checkpoints for unsaved accepted models and drafts; preserve explicit file-save/conflict behavior.
-4. **Connected automation workflow.** Keep headless deployment and shared core REST contract. Add direct optional desktop open/publish/save of hosted models using explicit connection details and conditional ETags, preserving drafts on failure/conflict and keeping credentials in memory. Verify actual desktop→API→desktop edits and artifact integration locally. Update OpenAPI, deployment and source contracts for the expanded release semantics.
-5. **Release integration and polish.** Guided examples cover OA goals/roles/process alternatives, system missions/capabilities/boundary contracts, chains/scenarios/states and evidence. Review default/minimum/wide layouts, practical keyboard paths, empty/loading/error/recovery states and performance on representative models. Build/run the actual native app after each meaningful UI milestone, fix from evidence, then reverify.
-6. **Independent final acceptance and packaging.** Fresh requirements, correctness, native UX and simplicity reviews in parallel; fix all material findings and rerun affected checks. Full Windows/Linux locked tests, formatting, strict Clippy and optimized builds. Operate primary GUI workflows and actual service transport. Verify current docs/reST rendering, examples/migration, reproducible source workflow, package binary equality/archive contents and checksums. Only then replace 0.2.0 bundles and mark this goal complete.
-
-Dependencies: milestone1 freezes shared interfaces for2; guide/lifecycle work in3 can proceed independently once UI ownership is partitioned. Structural counterpart work depends on2. Hosted client4 depends on final core/API types but transport/lifecycle can be developed independently. Milestones5–6 integrate all preceding work.
-
-## UI and state flow
-
-Keep task navigation, engineering perspective and context-sensitive properties. A Home/start workspace offers projects, recovery and tutorials without obscuring active modeling. Help uses local Rust-owned content and search/category navigation; workspace links pass explicit events and respect draft/modal guards.
-
-Text edits update a snapshot/version; parsing/semantic lint runs on a blocking worker and only the latest result is adopted. Syntax errors and semantic warnings have distinct severity/location and navigate to source. Applying text remains one atomic model transaction. Invalid text and property input are recoverable drafts.
-
-Recovery writes separate per-session checkpoints in user-local application data, never silently overwrites a model file, and offers explicit restore. Recent paths are convenience metadata. Hosted models use a separate connection/resource/revision/ETag handle; ordinary core editing and Undo stay local until explicit conditional Save. Network/file failures retain the same draft. Tokens are not persisted or included in diagnostics.
-
-## Failure and verification strategy
-
-Cover wrong-layer/reference/kind input, ownership/reference cycles, duplicate or ambiguous counterpart matches, stale plans/ETags, typed semantic drift, sequence control topology and repeated occurrences, invalid source/property drafts, external file edits, failed storage/network operations, oversized models and unavailable graphics. Keep incomplete engineering work editable through warnings while rejecting structural corruption.
-
-Tests must cover user-visible meaning and cross-representation invariants, not just serialize the same value twice. Use actual HTTP and native CUA for end-to-end behaviors. Independent review targets current artifacts and the original release objective, not only implementation summaries. Record unsupported/unavailable environments without turning missing required functionality into a limitation.
-
-## Definition of done
-
-Every concrete requirement in the new objective and release coverage table has authoritative current evidence. Primary OA/SA engineering workflows work graphically, textually and through the API; help is navigable and useful; native Windows/Linux UI is intentionally designed and exercised; no blocking/high-impact defect remains; strict checks pass; independent findings are closed; durable docs accurately reflect the release; another engineer can build/run/test and use the supplied packages. V2 completion alone does not satisfy this goal.
-
-## Historical milestone progress — hosted integration
-
-Milestone4 desktop adapter is implemented on the existing Document/REST boundary.
-Windows native publish, graphical/text save, rejected invalid source, API artifact
-reload and stale-revision recovery are demonstrated. Offline/retry and exact local-copy/catalog Open native acceptance passed on Windows.
-Destination and catalog defects found afterward were fixed/reviewed/integrated; remaining platform/native cases retain their report scope. Constructor/keyed/order/Child/Incident/artifact and multi-source review, Home/recents and checkpoint recovery are now implemented. Their scoped native and automated results are in STATE.md; this older milestone is not a current absence list.
-
-## Current execution refinement — 2026-09-07
-
-First-release scope above is unchanged. The user-requested Windows development preview is packaged with565files, including all37 teaching-folder files, and is linked from `DEVELOPMENT_SUMMARY.md`. Latest Fit6 and two existing scroll/branch regressions pass; full desktop570/570, workspace bins, formatting and strict workspace/all-target Clippy pass. Corrected full server56/56 retains its unchanged-server scope. Exact build status and provenance are recorded in STATE.md. This is not an optimized final release.
-
-Native6BAB operation/recovery/history passes and BCC1 corrected OA/SA nested routing passes retain their separate binary scopes. The latest DC50 preview launched with a clean PATH, and its four-card OA Fit overview was visible at1444×932 and1102×932. Minimum-height, pending-form and remaining process-purpose acceptance are still open. Computer Use was stopped by the user's Escape; leave both live GUI processes untouched and continue independent work.
-
-Native Linux core436passed/2ignored is complete on its frozen455-file snapshot. The original server compile passed, unit2/2 and HTTP50/51 passed, and the single504-versus412 timing fixture failed twice. Its private preparation-gate replacement passes on Windows but still requires Linux execution. Preserve the original failures and exact final-state assertions; do not alter the production30-second deadline to make the fixture pass.
-
-The fresh Linux GUI cross-build passed on immutable458-file snapshot `source7-20260907T102528493108Z`, including the Fit constructor fix. Run `20260907T1025486926611Z` completed in2m20s Cargo time with pre/post checks, ELF requirements and all37 lesson files verified; the compiler lease is released. The subsequent headless guest failed its early IO-APIC timer check on three bounded boots, before SSH/tests. Exact matching boot assets were extracted, but automatic approval review rejected the proposed transient boot workaround before launch. All task VMs are stopped; no application failure or current Linux server pass is inferred. Latest guide-label changes and the validated Exchange/CommonWork native oracles follow the frozen binary snapshot.
-
-Next actions:
-
-1. Retain all three guest boot records and exact-kernel proof; the proposed direct-boot action was denied by automatic approval review and must not be retried or split to bypass it. Resolve the runtime gate through an approved route or changed environment. Verify actual readiness and remaining monotonic budget before running the corrected Linux server gate. Do not restart on observation timeout alone.
-2. Preserve the reviewed guide corrections and validated expected-model/source Exchange/CommonWork oracles; the updated guide now builds on Windows and belongs in the next packaged/native snapshot. Complete native purpose authoring/history once control is available.
-3. Once native control is authorized again, complete current-layout minimum-height/Focus/pending-form checks, remaining engineering/hosted walkthroughs and actual Linux GUI acceptance using exact model/source/history evidence.
-4. Execute the corrected Linux server suite; complete final Windows/Linux optimized builds, package provenance, documentation/contracts, and fresh independent cross-disciplinary end-state review. Successful slices do not complete the goal.
+Historical milestones and evidence remain intact in
+[the dated plan archive](history/2026-09-10-ledgers-before-second-consolidation/PLAN.md).
+They do not supersede current user scope or imply current-tree acceptance.

harness/RESTART_HANDOFF.md

@@ -0,0 +1,63 @@
+# Restart handoff — 2026-09-11
+
+Historical reboot checkpoint. User has returned and enabled virtualization;
+current STATE.md and the postboot native/layout/WSL reports supersede the pause
+and pending-result wording below. Preserve this record for exact resume history.
+
+Codex-9e8r6t /root. User explicitly requested a reboot pause to make WSL2/Ubuntu
+available. Full PROJECT_GOAL remains active and incomplete. Resume only after
+the user returns; do not schedule automatic work during the reboot.
+
+## Saved state
+
+- Branch `codex/release1-9e8r6t`: contextual source `df6f595`, CLI publication
+  evidence `d95b1ab` and complete local OA scenario evidence `c4bad4b` were pushed
+  and read back. The following reboot commit also preserves reviewed WIP below.
+- Both Windows Studio/server and standalone CLI prereleases remain published.
+  This checkpoint does not update either release or establish Linux acceptance.
+- Immutable GUI52DE82 native source trial: Lifeline Save-adoption and Chain
+  direct Create each passed complete model/source, one Undo and one Redo with
+  original IDs. Machine direct Create/Save passed six exact files; one Undo/Save
+  passed four reachable/six physical files. Machine Redo/reopen remain pending.
+  Test GUI closed normally, and its returned window was absent at 13:38 UTC.
+  `work` contains the saved Machine Undo state. Do not infer persistent history;
+  use preserved first machine checkpoint for isolated reopen and a fresh trial
+  for missing history coverage. See release-contextual-source-native-20260911.md
+  and experiments/contextual-source-native-20260911/README.md.
+- Reviewed WIP: source_draft.rs essentials-first layout, explicit wrapped kinds
+  before unbounded parent text, plus creation.rs staged-owner caption fix.
+  Three real Paragraph tests are prepared. First compile failed in test helpers
+  (ambiguous macro and wrong Id constructor); corrected only those helpers.
+  Corrected focused2 was interrupted for this reboot before any tests ran;
+  Clippy/fmt/GUI did not launch. There is NO new passing suite or matching GUI.
+- Worker release_audit stopped its command with Ctrl+C; all Cargo/rustc/linker
+  processes were absent. All 238 frozen input hashes were unchanged.
+  Final source_draft SHA prefix C8D36BD6; creation SHA prefix 0FB19BE3.
+  Exact freeze inputs3 SHA256
+  `6B3F3088FF18AF3899C3764B3F3671DA9240A5DE184D871BF08F8012456E556B`.
+
+## Next actions after reboot
+
+1. Read AGENTS, PROJECT_GOAL, STATE, PLAN and latest Gitea issue 1/2 comments and
+   relevant Wiki. Preserve Codex-956atf canvas/chooser/schema8 and Codex-ytr83r
+   B4/Linux ownership. User issue2 comment250 allows domain-constrained diagram
+   manipulation; arbitrary free movement is not required.
+2. Recheck `wsl --list --verbose`. Before reboot it reported no installed
+   distribution despite default version2. Launch/setup Ubuntu as needed with
+   the user handling any authentication. Verify a real usable Linux environment
+   before claiming a build. Do not repeat rejected VM workarounds.
+3. Validate the frozen input manifest, then resume a new focused3 run. Keep
+   focused1 failure and focused2 interrupted evidence. On a pass, run strict
+   desktop all-target Clippy, formatting and matching GUI build; use a distinct
+   immutable stage. No broad full-suite repeat without a new reason.
+4. Root alone performs native Computer Use with @oai/sky. Relaunch the corrected
+   artifact in a fresh profile and verify initial Name/kind/parent visibility at
+   1100×700, the owner label, direct Lifeline Create, remaining cancellation/
+   recovery and machine history/reopen using independent expected contracts.
+5. Continue SA B2, basic supplementary workflows, peer integration, complete
+   semantic/text/REST/library work, Windows/Linux packaging and fresh final
+   cross-disciplinary acceptance. The full release remains unfinished.
+
+Private runtime and build stages under `.local` are retained; no temporary
+binary, token or credential was committed. Raw interruption/native records are
+archived separately with exact hashes. All workers are idle for the reboot.

harness/STATE.md

@@ -1,170 +1,112 @@
-# Progress Ledger — first release
+# Integrated checkpoint — first release
 
-## Active continuation — 2026-09-10
+Updated 2026-09-12 by Codex-9e8r6t `/root`, Windows host.
+**Full OA/SA release acceptance is incomplete. Linux work remains user-paused.**
 
-The renewed user request is preserved in `PROJECT_GOAL.md`. Root is integrating
-the first release, prioritizing direct diagram authoring and behavior/scenario
-usability. The checkout began clean at `1797516` on `codex/release1-continuation`.
-Gitea issue #1 and Wiki Home were read; ownership and progress are coordinated there.
+[PROJECT_GOAL.md](../PROJECT_GOAL.md) owns the application requirements.
+Current objective attachment `9467fa86-4606-4fe2-93ec-122137d03079` was read in full.
+Instruction synchronization `b70bf1d` preserves the user specification and
+[AGENTS.md](../AGENTS.md). It changes instructions, not the verified package inputs.
 
-- Root owns integration, serialized builds, native Computer Use and these ledgers.
-  `palette_repair` owns architecture authoring and `diagram.rs`; `behavior_audit`
-  and `release_audit` independently inspect ergonomics and release coverage.
-- The recorded palette compilation errors have local corrections pending a fresh
-  build. Earlier 584-test evidence does not cover those corrections.
-- This checkout began without the historical `.local` toolchain/cache/packages.
-  Project-local Rust/Cargo 1.98.1 GNU/LLVM and verified LLVM-MinGW 20260908
-  (clang 23.1.1) are installed. Locked dependencies are being fetched.
-  Host: four logical processors, 8 GiB RAM; builds remain serialized.
-- Computer Use initialized successfully. The renewed request authorizes native
-  evaluation; old session Escape holds and process IDs are historical. No Arcadia
-  or Capella window is currently running.
-- WSL lists no installed distribution. Linux runtime/build acceptance remains an
-  open gate; no historical denied guest workaround is being retried.
+## Delivered Windows milestone
 
-**Current branch is `codex/behavior-authoring-20260910`.** A distinct Gitea user
-`Codex-9e8r6t` is running another root/team on a separate environment with the old
-build cache. Our identity is **Codex-956atf**. Gitea #25 and #38 acknowledge the
-scope split: their palette/platform/package and subsequent scenario layout work;
-our process/scenario adapters and typed-history work. We will publish a clearly
-untested coherent snapshot on this distinct branch for their warm-cache checks.
-No shared branch-tip push or merge has occurred here.
-Their reports/results must not be claimed as local validation or overwritten.
+[Source navigation prerelease](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/releases/tag/v0.2.0-preview.navigation.20260911)
+was published and read back on September 12 at 10:54:02 UTC. Extract the whole ZIP and run
+`arcadia-studio.exe`; keep its sibling `libunwind.dll`. Studio, the optional REST
+server, examples, offline help and dependency notices are included.
 
-Implemented locally, awaiting compilation:
+The tag points to exact raw-input reconstruction **802855f7**, based on corrected
+source **33c6d83** and distinct from the original build capture. The
+package pairs GUI B183 with the unchanged, separately verified EFEE server.
+All 559 package files and all three downloaded release assets were verified.
+The binaries use the development profile; this is a prerelease.
 
-- Palette compile repair, retained inline name after rejected stale Submit,
-  nonfinite click rejection and rename/allocation/history regressions.
-- One interactive process renderer with presentation-only inferred ordered
-  paths; first editing batch preserves adjacency atomically. Independent source
-  review found no confirmed defect. Root added 3+ step/before-first insertion
-  and incompatible imported conversion tests after the reviewer hit model capacity.
-- Scenario Action/State/Reuse/empty Fragment tools capture clicked operand/slot
-  and optional lifeline. Pointer-to-App, recovery, stale-event and history tests
-  are written. A bounded exact caller/use return path and scoped mounted-scroll
-  restoration are implemented with regressions, also untested.
-- Advanced typed stored-history editor uses existing OpenAPI type descriptors;
-  twelve focused tests cover typed selectors, historical IDs, invalid raw input,
-  recovery and source/history. Core validation remains authoritative.
-- Normative catalogs now include ExchangeCategory, ContextualLink and both
-  Exchange trace pairs. Manual trace help and scope source version corrected;
-  strict Docutils 0.22.2 HTML regeneration passed.
+The GUI adds Definition/References/Back for current Text drafts and corrects
+repair/recovery saved-state handling. All 755 desktop tests passed (one ignored),
+with strict Clippy, formatting and a matching build. Earlier navigation native
+checks cover minimum-size interaction, ambiguous/partial scope and the 30-file
+engineering workflow; the corrected binary separately passed repair/rollback,
+Close/Cancel and exact Save checks. Fresh package acceptance verified Home/help,
+native Open, navigation, edit/Undo, Apply, Save and complete saved-model/source
+equality. Independent server checks verified exact API content and persistence
+across restart. Each result retains its specific build and workflow scope.
 
-Reference evidence: actual Capella 7.1 scenario/lifeline/LOOP creation and saved
-XML are recorded in `release-capella-scenario-benchmark-20260910.md`; the isolated
-Capella process closed normally and is absent. This is not Studio acceptance.
+Authoritative records:
 
-Toolchain bootstrap exec session **20812** completed successfully: verified
-LLVM-MinGW 20260908 ZIP SHA256
-`1bcf74d06b724aeecaa6412ca85f5b26fb1da770e7cdcefa9263c9c5c3ad34b6`, extracted
-successfully; stable **1.98.1** GNU/LLVM, rustfmt and Clippy installed.
-`.local/toolchain/env.ps1` configures task-local Cargo/Rustup/PATH and one build
-job. Locked dependency fetch is local exec session **13108**. No build/test pass
-is established; the target cache is still cold.
+- [Publication, artifacts and limitations](release-navigation-prerelease-published-20260912.md)
+- [Per-binary preparation](release-navigation-prerelease-preparation-20260911.md)
+  and [independent archive/server review](release-navigation-prerelease-review-20260911.md)
+- [Fresh native package acceptance](release-navigation-prerelease-native-20260911.md)
+  and [integrated navigation evidence](release-text-navigation-integrated-20260911.md)
+- [Previous contextual authoring milestone](release-contextual-source-prerelease-published-20260911.md)
+- [Verified code/evidence checkpoint](release-postboot-checkpoint-review-20260911.md)
+- [Standalone CLI prerelease](release-cli-prerelease-published-20260911.md),
+  supplying checked source stabilization and typed alias rename separately
 
-The coherent candidate `01bb52a` passed `cargo fmt --all` and `git diff --check`.
-Direct push failed because this fresh host has no Git credentials. Authenticated
-Gitea MCP transferred its exact verified Git bundle through
-`codex/behavior-transfer-20260910` (`harness/transfers/behavior-01bb52a.bundle.b64`),
-prerequisite `1797516`, decoded SHA256
-`85A38B00207036DCB8DB24ED4A7E80B2BE670275EEB7B00413D36153322ADA5D`.
-This **UNTESTED integration snapshot** lets the other host use its warm cache;
-transfer is not acceptance. Their broader architecture
-palette/Escape repair should be reconciled with our overlapping compile/stale
-repairs while retaining the additional invariant tests. Their measured minimum
-scenario canvas is too small; they own the subsequent layout implementation.
-Their isolated palette commit is `7d1df4f`, fetched locally for reconciliation.
+## Material unfinished scope
 
-Independent F1 review found a real optional-value cache collision in `01bb52a`.
-The follow-up distinguishes null/scalar/list/tagged constructor identities and
-adds actual inner selector-event tests. Independent source recheck found no
-remaining collision; execution is still pending. The original full-platform
-fetch was stopped after network timeouts; current Windows desktop test build
-is exec session **51036**, compiling dependencies. Root owns this Cargo lease.
+Current-draft Definition/References/Back was implemented in source checkpoint
+**[36db9356](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/commit/36db9356cce3c7614ae37eec9fe17678ca210afe)**.
+The [initial native trial](release-text-navigation-native-initial-20260911.md)
+found four interaction defects. Their [correction](release-text-navigation-native-corrections-20260911.md)
+at **eeeaa126** passed 188 focused tests, the full 750-test desktop suite and
+strict Clippy, with exact input readback and independent review. Matching GUI5478
+[native evaluation](release-text-navigation-native-v3-20260911.md) verified those
+fixes, ambiguous/partial source navigation, and the 30-file engineering workflow;
+explicit Save preserved complete models, identities and source bytes. It also
+found a repair-mode false-clean status against the prior saved destination.
+Its [saved-baseline correction](release-text-repair-save-state-20260911.md)
+at **33c6d83** passes the full 755-test suite, strict Clippy and matching GUI B183
+build. Its [native repair verification](release-text-repair-save-native-v4-20260911.md)
+passed missing-include and duplicate-alias repairs plus interrupted-save rollback:
+Apply/Recover retain unsaved status, Close warns, Cancel retains work, and explicit
+Save yields exact complete model/identity/source equality. The fresh package
+passed its separate native and independent server checks and is now delivered above.
+The [integrated evaluation](release-text-navigation-integrated-20260911.md) links
+exact input archives, earlier full-test scope and independent findings.
+The published contextual preview remains unchanged.
 
-Next: focused `architecture_authoring_tests`,
-`behavior::topology`, `direct_clicked`, caller-navigation and `history_fields::tests`,
-then full relevant gates and a fresh native binary. Root owns all Cargo on this
-host. Worker output or tests existing in source are not passes.
+The integrated release does not yet contain Text alias rename, newer peer canvas/chooser and
+scenario-lifetime work, complete constraints/calculations, dimensional quantities,
+maintained model libraries.
+Those additions require coherent graphical/text/REST realization and validation.
+Some scenario forms retain old scroll positions and dense labels remain crowded.
+Local SA action/state/reuse/fragment and supplementary camera/focus tasks retain
+explicit unfinished scopes in [scenario evidence](release-scenario-native-local-20260911.md).
 
-Gitea Actions run16 is queued for both ubuntu-latest and windows-latest with no
-started steps, as are older listed runs. No usable current Linux runner result
-is established and no duplicate dispatch was made. Progress is concrete;
-release acceptance remains incomplete. Older checkpoint paragraphs below retain
-their original revision scope.
+Optimized builds, remaining real engineering workflows and a fresh independent
+cross-disciplinary end-state review remain necessary. Old MVP exclusions and
+individual passing tests do not reduce the user's full requirements.
 
-**Checkpoint publication — 2026-09-10:** the user requested committing all current changes and pushing `codex/release1-continuation` to both `origin` and `gitea`. This is a work-in-progress snapshot. The interrupted palette-focused compilation failed with E0659 (ambiguous `column!` in `app/architecture_authoring/palette.rs:168`) and E0507 (moving the view out of an Arc in `diagram.rs:624`); an unnecessary-pattern-parentheses warning also remains in `architecture_authoring.rs:346`. The prior 584-test pass does not cover this newer palette revision. No Cargo/rustc process or local subagent was active at the publication preflight. Fix these errors and complete automated/native acceptance before packaging the redesign. Gitea coordination starts at issue #1 and the project Wiki; older evidence below retains its original scope.
+Ubuntu/WSL setup and all Linux diagnostics/builds/checks are paused until the user
+explicitly reports networking resolved. Preserve existing configuration, caches
+and evidence. [WSL readiness](release-wsl-readiness-9e8r6t-20260911.md) owns the
+historical attempts; it is not a current Linux application acceptance claim.
 
-**Latest priority checkpoint — Capella consultation and redesign:** the user rejected the large creation buttons and explicitly requested consulting the installed Capella. Native control resumed for that consultation in a disposable Capella 7.1 workspace. Actual palette, F2 rename and activity allocation were exercised; saved XML confirms allocation distinct from ownership. The horizontal creation/connection rows are being replaced with a compact expandable palette and inline naming. This supersedes the Escape hold and toolbar-fix proposal below. New implementation, native acceptance and a fresh user build remain pending. [Observed benchmark, alternatives and acceptance criteria](release-capella-basic-editing-20260907.md). The first-release goal remains active.
+## Coordination and history
 
-**Latest checkpoint:** basic-editing v1 passed full desktop584/584, Windows binaries, format and strict all-target Clippy. Native v1 D8CFAA confirmed direct contextual named Entity creation at100%, and found a22px placement shift caused by the pending toolbar changing canvas height. The user pressed Escape at the attempted Undo; that action did not execute. **Desktop control is paused again.** Process9600 remains the isolated unsaved QA application; do not overwrite its binary or presume a clean close. Code-only placement fix is continuing. [Exact v1 evidence and remaining acceptance](release-basic-editing-reset-20260907.md). This supersedes the resumed-control state below; the first-release goal remains incomplete.
+The user requested splitting oversized [issue 1](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/1).
+Live coordination now uses focused [behavior/canvas](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/2),
+[activity movement](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/3),
+[child work](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/4),
+[lifecycle Windows acceptance](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/5),
+[source navigation](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/6),
+[quantities/calculations](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/7),
+[maintained libraries](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/8),
+and [Text alias rename](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/9).
+Read current comments for ownership and execution state; this checkpoint does
+not track active leases.
+[Authoring Wiki](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/wiki/Authoring20260911)
+is the shared entrypoint. Durable decisions remain in [DECISIONS.md](DECISIONS.md)
+and topic reports; the [text-navigation design](release-text-navigation-design-20260911.md)
+records the current bounded design and its falsifiers.
+The [Text alias-rename proposal](release-source-alias-rename-design-20260911.md)
+and its [critique](release-source-alias-rename-critique-20260911.md) are design
+preparation, not implemented or verified Text capability.
 
-**Superseding priority checkpoint:** the user explicitly said “Resume desktop checks” and rejected the focus on advanced review before basic diagram editing. Isolated native checks resumed and reproduced the global creation catalog, placeholder creation/camera jump and noisy review. Contextual named creation and compatible layer-transition destinations are now being implemented and tested. Their new executable has not yet been accepted. [Current priority and scoped evidence](release-basic-editing-reset-20260907.md). The older Escape hold and next-step priorities below are superseded; historical binary/test results retain their original scope.
-
-Current checkpoint: 2026-09-07. The requested Windows development preview is built and packaged with its runtime, documentation, notices and complete examples. Latest Fit6, two existing scroll/branch regressions, full desktop570/570, workspace bins, formatting and strict workspace/all-target Clippy pass. Corrected server56/56 retains its earlier unchanged-server scope. Packaged DC50 GUI launched and the OA graph Fit overview was observed at1444×932 and1102×932; minimum-height and pending-form native acceptance remain open. The user stopped Computer Use with Escape; do not resume native control without renewed authorization. Native Linux core436passed/2ignored remains verified; corrected Linux server and full Linux GUI build/runtime remain open. The fresh Linux desktop cross-build passed on Rust1.90 in2m20s using the preserved cache; ELF and all37 teaching files are verified. Three later guest boots failed the early IO-APIC timer check before SSH/tests; the exact-kernel workaround was then rejected by automatic approval review before launch. All task VM processes are stopped. **Goal active; release incomplete.** The authoritative objective is `C:\Users\User\.codex\attachments\10b0f701-1743-4de7-9ee1-225920e19649\goal-objective.md`: a usable, feature-complete OA/SA engineering tool for Windows and Linux with graphical/source/REST parity, artifact traceability, offline guidance and independent end-state acceptance.
-
-## Workspace and ownership
-
-- Current branch `codex/release1-continuation`, checkpoint **4b6b5fc1977523e8cf52fdd5503a0a71c87a3f63** commits290files of source6 work and evidence. [Bounded checkpoint audit](release-checkpoint-integration-review-20260906.md) verified65pinned manifest entries and145exact staged/working fixture/archive files; `.gitattributes` protects their measured line endings. Integrated ancestry starts at `c091f80`; [branch audit](release-branch-integration-20260906.md) prevents reimplementing already integrated work. New source7 implementation is authorized but not yet accepted.
-- Historical6BAB native scope (superseded in rendering by BCC1 and Fit by DC50): acceptance binary `.local/native-qa/bin-source7-acceptance/arcadia-studio.exe` SHA256 `6BAB6CDE7D31326F3C3CF7342D9B25FB6ADA032864BBE8104625E5EC9736283B` follows the Windows433/55/561 and strict/build gates below. Reset and ReadStatus each passed exact complete model/source Save/Undo/Redo and reopening with the correct derived Reply allocation30/31. OA caller→First.B passed exact persistence/history/reopen; routing remains open. Process11060 closed cleanly; isolated old6 recovery process11240 also closed after its complete source/JSON/raw-draft pass. Old5 process5244 subsequently passed exact30-source/full-JSON recovery and raw-workspace comparison. Current7 process8224→10420 passed invalid nested-link draft crash recovery; completing the recovered SA X→[R3,Inner]/B link passed exact model/two-source Save/Undo/Redo and saved reopening. Those historical native processes closed; the later BCC1 routing and DC50 Fit evidence is recorded separately below. [Native evidence](release-source7-native-acceptance-20260907.md).
-- Completed bounded90minute Linux gate: one-job Rust1.90,455-file immutable snapshot SHA256 `7104946c89b2be7a1a030fdff47cb4405bacf05357d68cf35d181e860f55c279`, launched07:02:43UTC, deadline08:32:43UTC. Server compilation passed17m10s; unit2/2 and HTTP50/51 passed, with one504-vs-412 test assertion reproduced in an isolated rerun. Its two-second read/PATCH checks passed, but later persisted-state assertions were not reached. This establishes a timing-dependent fixture/deadline mismatch, not a production locking defect. Native core completed436passed/0failed/2ignored across40targets, Rust1.90, compile23m03 and1992seconds total; all455 source pre/post checks passed. The two ignored cases are optional inheritance scaling and explicit strace fault injection (earlier separately scoped injection passes remain historical). All artifacts were copied before sync/poweroff; QEMU6280, launcher5000 and seed816 were absent08:13:56UTC. [Current Linux report](release-source7-linux-gate-20260907.md). Earlier Linux evidence retains its older snapshot scope. WSL remains pending restart; no host restart is authorized.
-- Windows session5735 completed all six gates with exit0: focused prepared-HTTP and cancellation, full server56/56 in68.78s, format10.44s, strict workspace/all-target Clippy99.60s, bins102.22s. Status/logs: `.local/source7-post-routing-gates-status.json`. Distinct GUI BCC1FC6DB68123C9D3A43CE53AA8EF59E33C54080632C104C99ED13270D5333F process8568 passed the scoped corrected routing checks and closed cleanly. [HTTP evaluator correction](release-http-preparation-phase-regression-20260907.md), [routing correction](release-contextual-route-native-fix-20260907.md), [native details](release-source7-native-acceptance-20260907.md). These passes precede the now-tested [Fit/layout correction](release-process-fit-layout-audit-20260907.md).
-- The requested Windows preview is `dist/ArcadiaStudio-preview-source7-20260907-x86_64-pc-windows-gnullvm/arcadia-studio.exe`; its565-file ZIP includes all37 teaching-folder files and has SHA256 `1fac10b30daf2f8e1dac29e9469485e4bea142e77ff5a13e4c9d1e41ff03abb2`. The adjacent provenance records actual source/binary hashes. This is a development profile, not an optimized final release. Latest gates are in `.local/source7-latest-preview-status.json`; full desktop570/570 completed in198.82s test time,200.63s command time, exit0 in `.local/source7-latest-full-desktop-status.json`. Initial Fit4/2 failures exposed real zero-size-slot remounting; corrected constructors pass unchanged expectations. [Fit review](release-process-fit-independent-review-20260907.md), [development summary](../DEVELOPMENT_SUMMARY.md).
-- Computer Use is stopped. Read-only inspection initially found preview9148 and second GUI8044 live; later9148 exited without agent intervention, while8044 remained untouched. No GUI control/closure is authorized for background verification. The cross-compiler lease ended after the successful142.766s monotonic run; no cross processes remain. The Linux worker completed a bounded headless guest experiment and released the lease. Three boots (same configuration twice, then Normal boot priority) reached terminal IO-APIC timer panic before SSH/Cargo; all task VM trees stopped and exact evidence was preserved. Exact matching kernel/microcode extraction passed without changing base/overlay hashes; automatic approval review rejected preparation/launch of the transient no_timer_check experiment as “blocked by policy.” No fourth boot or corrected tests ran. No task VM is live; see [the preserved boot evidence](release-source7-linux-server-corrected-gate-20260907.md). [Cross-build report](release-source7-linux-gui-cross-build-20260907.md).
-
-## Current source build and stopped runtime gate
-
-The guide-only followup compiled successfully with locked Windows workspace bins in12.70s Cargo/12.82s command, exit0. Status `.local/source7-guide-current-build-status.json` records guide SHA256 `80A6797051FB28E767F2AB5DD2F335ABCD9F3E5F3A75C731CDE46D8B90D5C92E`; resulting GUI SHA256 `327FBDF734716A7F1AF2874183D46A531A8F429BA1A478E83A3E7F2EB1D6248B`. Formatting and independent actual-label review pass. This later debug artifact does not replace the user-facing packaged DC50 preview, its archive or earlier native evidence. No full570 rerun is claimed for the text-only followup.
-
-Previous goal turn made progress by confirming full570 tests and handing off the package/summary. This continuation produced the successful Linux GUI build/ELF evidence, validated purpose oracles, corrected/built guide text, and concrete guest-boot evidence. Goal remains active/incomplete. The denied direct-boot action must not be split or retried to bypass automatic review; no new Linux job is running or scheduled.
-
-## Latest Linux build and purpose-oracle evidence
-
-Linux GUI snapshot458files `source7-20260907T102528493108Z` has archive SHA256 `9b10aa8457a5371367f7e24a0b2260b63c19fed69873d98a3972062a744503d7`. Run `20260907T1025486926611Z` passed locked/offline Rust1.90 zigbuild, both source checks and independent ELF/package readback. GUI72,953,296bytes SHA256 `330A3872D48EBF24AD21E6D4FA13CB6098BEBB3CB7FF82A2E082925CCF3DD346`; ELF64PIE, glibc requirements≤2.28, all37 lesson files exact. Actual Linux GUI runtime is still unverified. Subsequent guide-label text is excluded from both published Windows and this frozen Linux preview.
-
-Extended native checker `source7-native-contract-incidence.exe` SHA256 `16994DC437F5CCC5E5F6FBB4212C03449F2389AE4615FA98B2930B3637468EE3` compiled with warnings denied in4.05s during a coordinated short lease. OA Exchange and SA CommonWork self-checks pass: exact contextual assembly, unchanged precedence, wrong direction/work rejection, caller-only exchange coverage and stable source update. Separate43-element/10-relation incidence fixture baseline passes; all original golden hashes and preserved OA-link/Reset accepted cases remain exact. Independent review found no material issue. [Cases and reproducible native steps](fixtures/source7-native/README.md). Native purpose authoring/history remains pending.
-
-## Completed and verified at this checkpoint
-
-| Scope | Evidence and limit |
-|---|---|
-| Historical source6 diagnostics and guide | Semantic filter **108 desktop + 2 core** passed; full desktop **527/527** passed; strict all-target Clippy and GUI/server build passed (`.local/semantic-diagnostics-final-tests.log`, `desktop-diagnostics-final-tests.log`, `diagnostics-final-clippy.log`, `diagnostics-final-build.log`). Subsequent guide **3/3** focused tests, strict Clippy and build passed (`.local/guide-navigation-{tests,clippy,build}.log`). The guide test increases compiled desktop inventory to528; no full528 run or final full-workspace total is claimed. |
-| Current artifact implementation checkpoint | Full desktop **518/518**, corrected fresh artifact picker **6/6**, strict all-target Clippy passed. Logs `.local/source6-artifact-inspector-desktop-tests2.log`, `.local/source6-artifacts-final-tests2.log`, `.local/source6-artifacts-final-clippy3.log`. Four subsequent artifact recovery falsifiers and two core absence oracles passed separately. This predates latest display corrections. |
-| Native artifact MOVE / CREATE / DELETE | All three complete source Apply/Save, one Undo/Save and one Redo/Save oracles passed; **nine saves succeeded first attempt**. MOVE invalid Owner and disabled optional text, and CREATE excluded row/all eight decisions/reserved UUID survived controlled-stop recovery exactly. DELETE removed destination from identified moved-source absence while retaining the source link. [Exact native report](release-artifacts-native-20260906.md), [fixture/generator instructions](fixtures/release1-native/artifacts/README.md). |
-| Source-6 atomic batch review | Included valid and excluded invalid raw rows survived forced-stop recovery; repaired two-source Apply and complete Save/Undo/Redo source comparisons passed. [Native report](release-current-native-verification.md). |
-| Scenario ordered-member variant | At1100×700, Take rejected ambiguous insertion; explicit final order retained the local self-test. Complete Apply/Save, Undo/Save and Redo/Save matched the independent source oracles with only the schema5→6 header token upgrade. All three saves succeeded first attempt. Branch steps/fragment branches and this variant's crash recovery remain separate cases. [Exact native report](release-current-native-verification.md). |
-| Native guide navigation | On current guide binary at1100×700: related Scenarios-bottom→Exchanges opens the new heading; filtering `exchange` retains the current topic's bottom position; `Git` auto-selects Build first and opens its heading. No dirty model. Root's actual native observations close these bounded scroll cases; [implementation/tests](release-semantic-conflict-diagnostics-20260906.md) remain separately scoped. |
-| Communication means | Drawing/create/reuse and legacy reverse full-model/source/history passes are retained. Corrected reverse Apply now opens the explicitly requested OA scenario in Behavior, preserving the original four-object Architecture. Distinct oracle predicts10UUIDs/zero placements; accepted model/all3sources, Undo baseline, Redo and reopen pass. Every Save succeeded first submission. Navigation5focused tests, strict Clippy and bins build pass; compiled desktop535 is not a full535 run. [Exact report](release-communication-native-20260906.md), [implementation](release-behavior-transition-context-20260906.md). |
-| Teaching project and Home hook | Corrected94element/62relation/5view/68trace/30source example passes4expanded direct-rustc tests. Minimum-size Home/guide, raw-source guard, reviewed NameTake and exact source/history/reopen pass. Navigation fix is reverified. Additional data/interface/type drill-down, saved-view comparisons, invalid-view guard and typed Entry action selection pass. Fold/unfold and function rename/Undo/Redo each match complete model/all30source oracles, five first-submission saves; saved reopen retains the Entry target identity. Complete process/scenario/reuse/evidence lesson remains open. [Native report](release-teaching-native-20260906.md). |
-| Child/Incident and source-5 recovery | Two-row attachment recovery and complete Apply/Save/Undo/Redo passed, every save first attempt. Exact old source-5 raw/base/include/path retention, manual repair and two-file Save passed. [Attachments](release-attachments-native-20260906.md), [source-5 native](release-source5-native-recovery-20260906.md), [independent review](release-source5-checkpoint-independent-review-20260906.md). |
-| Dense saved views | Forty-label baseline and selected real relation identities inspected; filter, duplicate/hide, original10/copy9 persistence across restart and exact model oracle passed. Additional coverage/context intersections, empty selections and Names-and-items preview/Apply/Undo observed. Minimum-size overview requires working zoom/pan. Limits remain in [native evidence](release-current-native-verification.md). |
-| Core/source/REST integration | Fresh `--all-targets` core run: **433 passed/1 ignored**,44 target summaries, exit0 in138.72s; fresh server run: **55/55**,4 summaries, exit0 in64.74s. Logs `.local/source7-core-all-targets.log`, `.local/source7-server-all-targets.log`; exits/timings in `.local/source7-current-gates-status.json`. These supersede the earlier combined core count and pre-budget-fix HTTP51 checkpoint. OpenAPI **72fixtures/204schemas/90leaves** and both strict reST renders pass. [Core checkpoint](release-source7-core-checkpoint-20260906.md), [API integration](release-source7-api-integration-20260906.md). |
-| Source7 desktop authoring and recovery | Latest routing3/3 and full desktop **564/564 pass**; [routing checkpoint](release-contextual-route-native-fix-20260907.md) records exact logs. Earlier full desktop **561/561 passed**, zero failed/ignored,263.39s in `.local/source7-desktop-full-tests2.log`. The initial560/1 run exposed canvas scroll-state loss when a new conditional navigation control shifted its widget; a fixed navigation container corrected it, and the unchanged regression passed. Coverage includes qualified5, operation3 (selected Async request fields), semantic source7 facets/omission3, recovery8, legacy source5 13, artifact search2 and focus guard1. Exact old-version enum/cache-path intent rejection and raw text retention are covered. The complete-scope endpoint picker preserves access beyond512; canvas preview remains bounded. Guide now accurately describes attachment/artifact reconciliation and artifact filtering. [Desktop checkpoint](release-source7-desktop-authoring-20260906.md), [recovery](release-source7-recovery-20260906.md). |
-| Windows strict/build checkpoint and native7 | Strict workspace/all-target Clippy passed2m50s; root observed final format exit0/empty log. Three affected semantic tests passed3.46s after equivalent lint edits; native build exit0 recorded in `.local/source7-current-gates-status.json`. These earlier results scope the6BAB binary, not the later routing test binary or pending new strict/build sequence. Reset/ReadStatus full model/all-source Save/Undo/Redo/reopen pass. OA First.B persistence passes but routing acceptance remains open. Old6 Recover preserved the complete30-file bundle/workspace/Ports DTO, exact spaces/Unicode/fingerprint/reserved identity; Cancel/Save as and JSON export passed full independent source/model equality. Original seed unchanged. Old5 complete accepted/raw recovery, exact repair/30-source Save and full-model export pass. Current7 invalid nested draft crash recovery plus completed link Save/Undo/Redo/reopen pass; rendering still uses the older binary. [Native report](release-source7-native-acceptance-20260907.md). |
-| Current Linux source7 and cross-built probe | Frozen native server compilation passed17m10s; unit2/2 and HTTP50/51, with one timing-dependent504-vs-412 assertion reproduced twice. No complete server pass; later targets not claimed. Native core436passed/0failed/2ignored; VM cleanly off08:13:56UTC. Separately, the complete Windows macro/build-script cross-build probe's hash-verified ELF executed successfully on Linux; this is neither a full desktop build nor GUI acceptance. [Native Linux gate](release-source7-linux-gate-20260907.md), [cross-build probe](release-linux-cross-build-probe-20260906.md). |
-| Historical Linux/MSRV core and server | Ubuntu24.04.4/x86_64/glibc2.39/ext4/Rust1.90: core38/38, patched journal4focused/42full and3explicit syscall fault cases pass on recorded snapshots. Actual server build passes34m42s including3m24s pause. Real HTTP modular import, invalid PUT unchanged source/ETag, clean SIGTERM and exact model/source/ETag restart pass on the older28-source lesson snapshot. Full server test command timed out while compiling; zero tests executed. That gate shut down cleanly21:53:56; the separate current gate has the scoped results above. Current desktop/Linux package unverified. [Linux report](release-linux-validation-options.md), [journal contract](release-linux-journal-publication.md). |
-| Packaging foundation | Portable Windows QA staging, dependency/runtime/font/Rust notices, archive readback and clean-PATH smoke passed at earlier binaries. [Package report](release-windows-package-review.md). QA archives are not current final release artifacts. |
-
-Historical full platform/native milestones retain their original revision scope; [complete prior ledger](history/2026-09-06-ledgers-before-consolidation/STATE.md) preserves all evidence links and previous environments. A test or native pass never transfers automatically to a changed executable.
-
-## Active findings and checks
-
-Native artifact review exposed same-row conflict wording and reserved identities shown as deleted. Corrections retain typed actual-slot equality, row-addressed reservations and accepted-identity precedence; independent re-review found no further material defect. The completed108-semantic/527-desktop checks supersede the earlier interrupted run and include reserved-label/partial-creation regressions. Revised artifact wording still needs its own native observation on the current binary. Guide-scroll implementation/tests/build and the bounded native cases above passed. [Diagnostic/guide report](release-semantic-conflict-diagnostics-20260906.md).
-
-**F1** teaching onboarding/review/history has current-binary native evidence; remaining tutorial work is scoped in its report. **F2**, faithful behavior-canvas SVG export, is deferred by root's scope decision: export remains architecture-only and must be described that way; no faithful scenario/process/state SVG acceptance is claimed.
-
-Reverse scenario's first-dependency focus/overlapping architecture placements and teaching NameTake's separate layer/view mismatch are fixed and natively reverified. Latest NameTake4focused tests, strict alltargetClippy28.26s and binsbuild50.50s pass; no full539desktop pass is claimed. [Navigation evidence](release-semantic-review-navigation-20260906.md). Minimum-size process working space is cramped; native lesson evidence records23% overview versus100% scrolling rather than claiming readability at Fit.
-
-Independent scope reconciliation verified **S1** missing contextual assembly into repeated/nested process references and **S2** missing maintained interface-operation identity in parameterless messages. Isolated existing-core probes falsify the proposed workarounds. Root ratified the jointly critiqued [source7 integration decision](release-source7-integration-decision-20260906.md), including deterministic cache-independent admission, whole-link deletion, purpose-specific analysis, exact Call-derived operation/Reply identity and one frozen old5/6 checkpoint migration. These contracts now have implemented core/source/REST/desktop/recovery paths and the current automated gates above; remaining native7 and current Linux acceptance remain incomplete. [Scope reconciliation](release-scope-reconciliation-20260906.md).
-
-Linux ordinary rename's empty-target replacement was independently reproduced and corrected using `renameat2(RENAME_NOREPLACE)` without fallback. Exact errno/no-write assertions now pass under actual syscall injection. This establishes the ext4 publication invariant, not power-loss durability, hostile ancestor protection or model-file compare-and-swap. Windows retains its no-replace API and bounded scanner retries.
-
-## Remaining gates and next actions
-
-1. Fit implementation/review and automated gates are complete, including full570 desktop tests. Finish its native minimum-height/Focus/pending-form checks when native control resumes. Preserve completed BCC1 routing and old5/old6/current7 recovery/source/history oracles. Complete remaining current-binary S1/S2 purpose workflows and teaching cases; operation allocation deletion remains subject to independent channel validation. Native-check revised reserved labels and same-row conflicts. The later guide-only control-label correction passed formatting, independent review and the fresh workspace-binary build; it awaits the next packaged/native release snapshot.
-2. Close uncovered selective-view lifecycle cases; advanced ordered/process/scenario/fragment variants beyond the accepted Scenario case; typed state actions and pending Linux data/hosted/compact workflows. Implemented semantics must not be called missing merely because acceptance is outstanding; [coverage audit](release-current-coverage-20260906.md) is the baseline map, newer scoped reports supersede its old gap claims.
-3. Verify complete current Linux integration suites and desktop/server build/runtime, then supported-size native workflows. The successful core/MSRV pilot is a reusable starting point, not application acceptance.
-4. Preserve current strict Clippy/format/reST/example/source/OpenAPI results and rerun affected checks after changes. Complete optimized/MSRV/final platform gates, actual hosted transport variants and final migration/package checks. Rebuild portable distributions from the accepted exact tree, validate notices/runtime/content/checksums and clean-environment launch before replacing old bundles.
-5. Conduct fresh independent requirements/domain/parity/architecture/runtime/UX/end-state reviews; resolve material findings. Commit/integrate authorized source with reviewable scope; remote publication is not requested. Only complete the goal when its applicable criteria are met.
-
-Meaningful progress continues: native lifecycle and Linux no-replace uncertainty have been resolved with exact oracles. The highest-value work is current-binary validation and closing uncovered engineering workflows, not accumulating repeated historical headings or treating aggregate test counts as release completion.
+Legacy TASK_LEDGER/PLAN live content was migrated once in
+[comment 408](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/1#issuecomment-408).
+Those files are marked historical. Previous detailed STATE was preserved
+[byte-for-byte](history/2026-09-11-state-before-gitea-migration/STATE.md), including
+failed attempts, prior releases, transfer paths and earlier evidence links.
+Do not restore historical active-status or environment-next-step wording.

harness/TASK_LEDGER.md

@@ -1,96 +1,196 @@
+> Historical record — superseded on 2026-09-11. Live plans, ownership and blockers
+> were migrated once to [Gitea issue 1, comment 408](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/1#issuecomment-408)
+> and [issue 2](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/2).
+> Do not update this as a live ledger. [STATE.md](STATE.md) links the verified integrated result.
+> The historical text below is preserved; its old active-status wording is not current guidance.
+
 # Task Ledger — first release
 
-## Current knowledge — 2026-09-10
+Updated 2026-09-11 by Codex-9e8r6t `/root`. Full release not accepted.
 
-Given: the renewed objective in `PROJECT_GOAL.md` requires a feature-complete,
-usable OA/SA first release and prioritizes direct behavior/scenario authoring.
-Graphical/source/REST parity, explicit reST semantics, traceability, offline
-guidance, Windows/Linux acceptance and independent review remain required.
-Older scope deferrals must be checked against this request.
-
-Verified: the checkout began clean at `1797516`; Gitea contains one active
-continuation issue and no open PR. Current code includes direct behavior editors,
-so old blanket descriptions of static diagrams need workflow-level reassessment.
-The machine began without the ignored historical toolchain/cache/distributions.
-Local Rust/Cargo 1.98.1 and verified LLVM-MinGW are now installed; dependency
-fetch is pending and no current binary has been built. Native Computer Use is
-available. Isolated Capella activity/lifeline/LOOP creation was saved and checked;
-no Arcadia window is running. Candidate B1/B2/B3 and F1 edits are source-complete,
-formatted and whitespace-clean, but have no fresh compile/test/runtime pass.
-
-Assumption: the selected compact architecture palette remains a promising design,
-pending real authoring evidence. Decision: repair and evaluate it before further
-redesign. Parallel independent audits identify current behavior and semantic gaps
-instead of reimplementing integrated work.
-
-Open questions: which remaining menu-only behavior operations prevent a coherent
-direct workflow; which first-release semantic/parity gaps remain; and how to
-complete current Linux runtime acceptance. Root owns integration and native
-control; worker ownership is disjoint. See `STATE.md` and Gitea #1.
-
-**Superseding user direction:** large horizontal creation buttons were rejected as intrusive and unprofessional. The user explicitly authorized consulting the installed Capella; that consultation has resumed and established actual compact palette, inline rename and explicit activity-allocation behavior. See [Capella 7.1 evidence and selected redesign](release-capella-basic-editing-20260907.md). The current candidate replaces creation/connection rows with one compact expandable palette and an in-place name editor. Native acceptance of the redesigned executable is pending; compactness is not assumed to prove usability. The earlier Escape hold and proposed toolbar-only correction below are superseded.
-
-**Latest evidence:** basic editing full desktop584/584, bins, formatting and strictClippy passed. Native named Entity creation works at100%, but changing pending-toolbar height moves the screen placement22px. User Escape stopped the attempted Undo; native checks are paused again. Code-only toolbar correction proceeds. [Current findings](release-basic-editing-reset-20260907.md). The previous goal turn made concrete progress through implementation, integration gates and a native-discovered defect; this is not a no-progress blocker turn.
-
-**Current steering:** basic diagram authoring and understandable OA/SA transitions come first. The user explicitly reauthorized desktop checks; root resumed the isolated test build and reproduced the reported usability problems. Creation, transition and independent fixture work is underway. No new basic-editing native pass is claimed. See [priority reset](release-basic-editing-reset-20260907.md); older execution priorities and Escape hold are superseded.
-
-Updated 2026-09-07 after source7 Reset/ReadStatus and old6 recovery native passes, OA contextual persistence with rendering open, and reproducible Linux server test deadline evidence. Native Linux core now passed436/0failed/2ignored and its guest shut down cleanly. Old5 full recovery and source7 pending nested-link crash recovery/history/reopen also passed; routing3/3 and full desktop564/564 now pass. Root's private-server/full-server/format/strict-Clippy/bins sequence is running with results pending. [STATE.md](STATE.md) owns current execution/evidence and leases. [PLAN.md](PLAN.md) owns the release plan; [DECISIONS.md](DECISIONS.md) preserves architectural rationale. Full pre-consolidation contents, including superseded requirements interpretations and evidence, remain [archived byte-for-byte](history/2026-09-06-ledgers-before-consolidation/TASK_LEDGER.md).
+User resumed after enabling virtualization and explicitly authorized installing
+Ubuntu26.04 in WSL2. [RESTART_HANDOFF.md](RESTART_HANDOFF.md) is the historical
+pause; STATE.md owns current capacity, compiler and native status.
+User also explicitly permits disk cleanup including caches. Both scoped cache
+deletion commands were rejected before execution; nondeleting compression
+recovered space with all282 generated-binary hashes unchanged. Ordinary Ubuntu
+installation and an initial actual WSL2 root shell passed. Current VirtioProxy
+startups fail before guest execution, and a distinct WslService restart was
+denied by OS permissions. Owner328 remains the newest WSL solution after the
+latest issue check through348; its exact configuration is already applied.
+Five Rust components and60 apt packages are downloaded and hash-verified;
+guest signature verification/install and application acceptance remain pending.
+The user's latest direction pauses Linux work until they notify us that WSL
+networking is resolved. Continue Windows/product work; preserve existing Linux
+configuration, verified inputs and evidence without further setup/checks.
 
 ## Goal and success criteria
 
-The authoritative user objective is `C:\Users\User\.codex\attachments\10b0f701-1743-4de7-9ee1-225920e19649\goal-objective.md`. Deliver a usable, substantially complete OA/SA engineering tool in Rust/Iced on Windows and Linux; equivalent graphical, strict textual/reST and REST workflows; practical artifact traceability; navigable offline guidance; recoverable drafts; reproducible deployment. Completion requires native engineering task evidence and fresh independent end-state review, not implementation or passing tests alone. Later Arcadia layers remain future scope.
+[PROJECT_GOAL.md](../PROJECT_GOAL.md), copied from attachment
+`815ff7b9-73c4-41a2-a809-635ecf8389d6/goal-objective.md`, is authoritative.
+Deliver a usable, substantially complete OA/SA systems modeling product in
+Rust/Iced on Windows and Linux, with equivalent graphical/textual/REST editing,
+strict reST semantics/API, arbitrary development-artifact traceability and
+navigable offline help. Constraints/calculations, quantities/units and reusable
+model libraries and complete uncluttered text-only small/large modeling are
+explicit requirements. Later Arcadia layers remain future
+releases. Completion requires real engineering tasks, sound semantics, relevant
+passing checks and fresh independent cross-disciplinary review.
 
-## Given facts and constraints
+## Given facts
 
-- User prioritizes Capella domain fidelity, useful containment/nesting and explicit typed ports, while avoiding clutter, persistent action overload and awkward navigation. Study real domain workflows rather than mechanically copying Capella classes.
-- Both-layer transitions and reviewed counterpart reconciliation must be intuitive and precise. Behavior/scenario diagrams must be directly editable and preserve selection/camera/task context.
-- Human/AI/Git-friendly modular source, comments/includes, complete graphical/source/API parity and clear rejection are required. One validated model/history boundary must govern every representation.
-- User permits autonomous reversible engineering, experiments, independent agents and authorized native work. Root is the sole native operator in this collaboration. Do not run concurrent shared Cargo writers. No remote push, usage reset, broad target deletion or host restart is implied by current task authorization.
-- User permits isolated Linux work. WSL remains unavailable pending restart; earlier task-local QEMU core and server gates completed and shut down cleanly; the separate source7 core gate also completed and shut down cleanly, as recorded below. The server built and passed real HTTP/restart checks; its full test command timed out during compilation before any test executed. Historical external worktrees/toolchains are not present on this machine.
+- User prioritizes Capella's domain capability and useful visual nesting while
+  rejecting clutter, intrusive creation rows, static behavior diagrams and long
+  homogeneous option lists. Reduce cognitive load in small and large models.
+- Source must be understandable to engineers and AI, work with Git and preserve
+  full parity. OA/SA transitions in both directions must be clear and reviewed.
+- User authorizes autonomous reversible work, research, native Computer Use and
+  parallel agents. Use GPT-6 Astra exclusively with task-appropriate effort.
+- Gitea coordination and shared Wiki updates are required. Identify host and
+  worker consistently and preserve overlapping work. Explicit project messages
+  are authorized; unrelated external messages are not.
+- Updated AGENTS requires runnable versioned milestone prereleases. User
+  issue 1 comment 178 authorizes reusing existing MCP credentials programmatically for
+  Git push and REST asset upload, without printing or committing credentials.
+- Remote AGENTS.md, blob `4b8465c8993107062ad2974c15a958d449530e92`, adds concise
+  harness/Gitea maintenance and preservation of useful historical knowledge
+  (user comment 229). Root's instruction sync `07eb3cd` is integrated;
+  contextual source `df6f595`, CLI publication `d95b1ab` and OA native evidence
+  `c4bad4b` are committed and pushed.
 
 ## Verified facts
 
-- Latest superseding checkpoint: Fit6 and both existing scroll/branch regressions, full desktop570/570, workspace bins, format and strict workspace/all-target Clippy pass. Windows preview565-file ZIP and complete examples are verified; current server56/56 also passed. Native BCC1 OA/SA nested routing and unchanged-source oracles passed, followed by bounded DC50 packaged Fit overview. Earlier pending-build/routing claims below retain their historical scope and are superseded by these exact current results in STATE.md.
+[STATE.md](STATE.md) records exact commits, live leases and scoped verification.
+The current model has one typed core, validated atomic commands and coordinated
+Project/SourceBundle history shared by desktop and REST. Included files share
+one global namespace. Current Constraint expressions are strings; numeric unit
+strings do not convert values or establish dimensional compatibility. There is
+no locally integrated package/version/instance/update contract for cross-project
+libraries; peer implementation is tracked separately below.
 
-- Branch/patch/tree audit established that direct state/scenario/process, data contracts, hosted editing and earlier semantic review are already integrated; no required production transplant was found. [Branch evidence](release-branch-integration-20260906.md).
-- Capella's function input/output exchange endpoints and component Standard/Flow ports are distinct; explicit allocation connects them. Preserve that domain distinction. [Native benchmark](release-capella-workflow-benchmark.md).
-- Source6 introduced participant CommunicationMean, typed explicit transition endpoint decisions, saved exchange categories/view selectors, completeness warnings and presentation duplication; current source7 retains them. Older audit absence claims are superseded; native acceptance remains scoped by reports.
-- Semantic review includes independent scalar/constructor/keyed/order/Child/Incident/artifact facets and multiple source rows. One frozen accepted base, explicit mappings, unique merged candidate slots and one atomic command preserve raw excluded/rejected drafts. Recovery replans; it never restores an unchecked serialized command. [Batch design](release-semantic-batch-foundation-design.md), [artifact contract](release-semantic-artifacts.md).
-- Native Windows artifact MOVE/CREATE/DELETE passed exact complete Save/Undo/Redo oracles, nine first-attempt saves. MOVE invalid raw optional state and CREATE exclusion/reserved identity survived controlled-stop recovery exactly. Destination-only retention is automated evidence, not separately native-applied in that run. [Native report](release-artifacts-native-20260906.md).
-- Native batch, Child/Incident and source-5 checkpoint workflows have scoped exact source/recovery/history evidence. Dense views have persistence/duplicate/hide and bounded readability evidence. Current counts, binaries and remaining cases are in STATE.md; these are not universal usability claims.
-- Native communication means drawing, explicit create/reuse ports and reverse Call/Reply pass independent complete model/source and exact Undo/Redo checks. The reverse navigation/overlapping-placement defect is fixed and reverified against a distinct oracle:10newUUIDs,zero implicit placements, correct Behavior owner and preserved Architecture. [Exact evidence](release-communication-native-20260906.md).
-- Windows semantic108desktop+2core/full527desktop passes remain scoped. Subsequent guide/home and behavior navigation slices passed focused tests/strict Clippy/build; semantic navigation is also natively reverified. Fresh source7 core all-targets433passed/1ignored across44 summaries and server55/55 across4 summaries have recorded exit0. Full desktop561/561 passed263.39s after a real scroll-state regression was fixed with a stable navigation Column; the unchanged test passed. Strict workspace/all-target Clippy and root-observed final format exit0 pass;3 affected semantic tests passed after equivalent lint edits. Subsequent routing3/3 and full desktop564/564 pass; new standalone build and strict/server results remain pending. Logs and exact scope are in STATE.md; do not add affected reruns to full-suite totals.
-- Native Scenario ordered review passed ambiguity rejection, explicit retained-local final order and complete Save/Undo/Redo source oracles at1100×700. Current guide binary passes related-topic heading reset, same-topic search scroll retention and Git auto-selected-topic reset without dirtying the model. Branch/fragment order variants and revised artifact diagnostic rendering remain separate gates. [Native ordered evidence](release-current-native-verification.md), [guide/diagnostic implementation](release-semantic-conflict-diagnostics-20260906.md).
-- Windows user-local GNU/LLVM builds and isolated clean-PATH native launch work. Actual Ubuntu24.04.4/Rust1.90 core/journal tests pass on hashed snapshots. Actual Linux server build and real HTTP modular import/invalidPUT/cleanrestart exact source/model/ETag pass on the older28-source lesson snapshot. Its full server test command timed out during compilation with zero tests executed, then that gate shut down cleanly. The current frozen source7 gate compiled the server in17m10s and passed unit2/2 plus HTTP50/51; the sole504-vs-412 timing assertion failed again alone. Its final persisted-state checks were not reached. Native core436passed/0failed/2ignored and the VM shut down cleanly08:13:56UTC; full desktop/Linux package remain unverified. [Linux evidence](release-linux-validation-options.md).
-- Corrected30-source/37-file teaching project passes minimum-size Home/guide/dirty-source guard, located initial warning, reviewed NameTake and complete exact source/Undo/Redo/reopen checks. The layer/canvas mismatch is corrected and natively reverified. Data/interface/type navigation, saved-view distinctions, invalid-view draft guard and typed state Entry fold/rename/history/reopen pass. The process workspace is cramped at minimum size and artifact navigation required excessive scrolling; targeted source7 UI improvements await native observation. [Native evidence](release-teaching-native-20260906.md).
-- Scope reconciliation established caller-context links into repeated/nested reusable chains (**S1**) and maintained interface-operation selection for parameterless messages (**S2**) as real missing semantics. Their ratified source7 implementation now has fresh full core/server/desktop gates, OpenAPI72 fixtures and strict reST evidence. Old5/6 compatibility and current7 raw recovery tests pass. Root's native Reset and ReadStatus cases passed complete Save/Undo/Redo oracles and reopened with explicit derived allocation30/31. OA First.B persistence/history/reopen passed but rendering is open; old6 recovery passed full30-source/model JSON and exact raw workspace/Ports DTO comparison. Old5 complete raw/accepted recovery, exact repaired30-source save/full-model export pass. Current7 invalid nested draft crash recovery and completed link Save/Undo/Redo/reopen also pass; corrected rendering and remaining native7/Linux workflows remain open. [Native report](release-source7-native-acceptance-20260907.md). [Scope reconciliation](release-scope-reconciliation-20260906.md), [integration decision](release-source7-integration-decision-20260906.md).
+The main basic/transition/history/reopen story passed exact independent model
+and four/six-source checks; supplementary native cases remain. Named creation
+passed 7/8/9-source oracles, one Undo/Redo and byte-exact reopen at actual minimum
+size. Cancellation retained its six-file baseline; SA draft recovery retained
+fields/identities, autofocus and Escape/Save As behavior. The D4D9 blank-canvas
+finding motivated the newer first-action implementation. Detailed historical
+suite and native scopes remain in [STATE.md](STATE.md) and its linked reports.
+Mounted geometry and bounded package passes do not establish full release
+acceptance. This local host has installed Ubuntu26.04 but lacks a currently
+usable guest session, installed build prerequisites or Linux application pass.
 
-## Decisions and candidate designs
+Current grammar supports omitted initial IDs/defaults, lexical ownership, forward
+references and preserved source. The earlier desktop audit found no exposed
+project-wide reference navigation/alias refactor; its Find searched the active
+buffer. The later CLI supplies typed alias rename. The audited process example
+had 128 lines, 14 UUIDs and 31 empty-default lines, while meaningful shorter
+source is possible. Two concise snippets passed 26 real REST requests,
+including identity-only normalization, exact name-only edits, rejected writes and
+restart persistence. Counts and this small trial prove neither improved native
+usability nor large-project performance.
 
-Retain three Rust crates, one typed Project and validated atomic Command. Keep semantic ownership, reference/allocation/order relationships and diagram placement separate. Forms remain a closed typed adapter, not a second metamodel. Persistent additions require model validation, references/deletion, transition, parser/updater, API/schema and reachable graphical editing parity.
+CLI tooling is implemented, integrated and published: semantic source `01b76a1`,
+packaging assembly `a0a48e8`, release integration `27df4a3`. Author 12 tests and
+independent 183 semantic assertions pass; independent clean-package review adds
+156 assertions across 10 processes. This is a bounded source-editing tool, not
+proof of complete large-model language ergonomics.
 
-Semantic reconciliation uses finite typed facets and separate member/presence/order decisions. Compare actual destination slots before constructing the core's complete candidate; two rows never become sequential Apply. Missing identities are not inferred by names. Raw constructor/numeric/keyed/optional drafts survive rejection, exclusion and checkpoint recovery. Artifact Presence means attachment to the reviewed owner; an identified source moved away can delete the destination, whereas a source key of None preserves destination-only membership. No invented tombstone or silent seed acknowledgment.
+GUI/server release 1 and standalone CLI release 2 are published with runnable
+Windows artifacts, full dependency notices and downloaded asset verification.
+Independent archive/source and clean runtime checks pass in their declared scopes.
+See [CLI publication evidence](release-cli-prerelease-published-20260911.md).
+The newer 13-file contextual-source slice is committed/pushed as `df6f595`,
+with its independent oracle and exact raw evidence. It passed focused 23, guide 3, strict
+Clippy, matching GUI build and formatting. The full 675 suite covers only its
+predecessor; no full 676 suite has run. Root launched the exact 52DE82 GUI in
+isolation: Lifeline Save-adoption and Chain direct Create pass complete source,
+one Undo and one Redo. Machine direct Create and one Undo pass; Redo/reopen are
+pending for Redo. An isolated postboot real Open/SA view/Save passed the complete
+machine prediction and exact six-file equality; the app closed normally.
+Later layout/caption source was independently reviewed. Postboot focused3 ran25
+passing tests and one overflowing-fixture assertion failure. The stronger
+test-only fixture is frozen; its execution and new GUI remain pending.
 
-Source updates preserve lexical ownership/comments/includes and exact history. Checkpoint source5/6→7 upgrade admits only the established token/typed migration contract, validates old base fingerprints and resets transient approvals; it does not silently rebase authored drafts. Hosted saves remain explicit and conditional on the resource/ETag; credentials stay in memory.
+Local OA B2 now passes all four Action/State/explicitly bound Reuse/Fragment
+Create, one Undo/Save, one Redo/Save and final OA reopen/Save against independent
+complete model/two-source predictions and original exact identities. SA B2 is
+pending locally. Existing B3 OA wide/minimum and SA minimum return scopes remain
+unchanged; neither these passes nor mounted geometry tests imply broader acceptance.
 
-For Linux journal publication, ordinary rename lost the empty-target ownership invariant in a real ext4 probe. Selected `renameat2(RENAME_NOREPLACE)` through existing locked libc with no fallback; syscall errors fail before model writes. Alternative overwrite fallback was rejected by that falsifier. Windows native no-replace/retry behavior is retained; other OS behavior is explicit. [Contract, alternatives and measured limits](release-linux-journal-publication.md).
+## Assumptions
+- Contextual named creation, remaining-height canvas and local source insertion
+  can reduce actual authoring detours. Native engineer tasks must establish this.
+- A bounded pure calculation/quantity model and pinned library content may fit
+  the existing typed core better than a general-purpose metamodel rewrite.
+  Peer-ratified core staging must still be checked against independent engineering
+  tasks and integrated across all required representations.
+- Existing OA/SA semantics provide a useful foundation; neither their presence
+  nor old acceptance proves full conformance to the updated release objective.
 
-Root selected **F1**, a complete source-6 teaching-project example. Corrected model/replay tests and bounded native onboarding/review/history pass; the full process/scenario/state/data/evidence lesson remains open. **F2**, faithful behavior-canvas SVG export, is deferred: current export scope is architecture-only, not a claim of faithful scenario/process/state export. Record this as an explicit scope decision rather than an accepted behavior-export result.
+## Open questions
 
-Behavior-root transition Apply should focus the explicitly requested counterpart and its nearest behavior owner. Without an explicit destination diagram it must preserve unrelated architecture presentation. Ordinary architecture transitions retain their existing path; explicit destination remains honored. This decision follows the independently reproduced reverse scenario placement/navigation failure, not a semantic change to the core transition.
+- Which precise calculation, quantity-kind/unit and library contracts satisfy
+  practical budgets, reuse and update workflows without ambiguous defaults or
+  implicit execution? How should they migrate and participate in transitions?
+- Which behavior workflows still force cancellation/navigation to create missing
+  context, and which local actions best remove those detours?
+- Which text-only assistance best preserves engineering context and identity:
+  native language services, external-editor services, source recipes or explicit
+  reviewed patch operations? Which grammar changes are actually necessary?
+- Does the new scenario pane remain readable and editable through actual native
+  window sizes, camera changes, nested fragments and reopened caller contexts?
+- Which viable Linux environment can run current GUI/server acceptance? Current
+  VM limitation does not block remaining Windows, semantics or source work.
 
-## Assumptions and open questions
+## Candidate designs and decisions
 
-- Nested source and contextual editors should reduce authoring effort; additional shorthand/grouping must justify grammar or interaction complexity through real tasks. Dense-view path overlap is not itself a failure when every actual identity remains accessible; arbitrary crossing-free layout is not promised.
-- Remaining native variants must establish useful engineering workflows: CM transitions, advanced OA process/SA chain/scenario reuse/fragment/order, typed state actions, compact/Linux/hosted cases, and uncovered saved-view lifecycle combinations. Do not expand or shrink required OA/SA scope merely to fit implementation convenience.
-- Latest diagnostic/reserved-label corrections have independent review and completed semantic/full-desktop/Clippy/build checks; their revised artifact rendering still needs native verification. The historical source6 process3012 closed cleanly. The6BAB source7 native build passed the scoped cases above;11060 and old6 recovery11240 closed cleanly. Old5 recovery/repair/save/model and current7 nested draft recovery/history/reopen pass on that binary. Later routing/hit-priority changes passed3focused/full564 desktop tests; root is running the server/format/strict/build sequence with results pending, and no corrected-render native acceptance is transferred. Exact binary scope is in STATE.md.
-- Historical Linux evidence includes x86_64/glibc2.39/ext4 core/MSRV and server/HTTP runtime. Current455-file snapshot SHA256 `7104946c89b2be7a1a030fdff47cb4405bacf05357d68cf35d181e860f55c279` is frozen; core completed436passes/2ignored before clean VM shutdown08:13:56UTC; its original08:32:43UTC deadline was not reached. The hash-verified cross-built probe executed successfully on Linux, including its Windows macro/build-script build path, but no complete Linux GUI has been built. Syscall failure tests do not establish power-loss durability, network-filesystem behavior or cross-process model CAS. [Current Linux gate](release-source7-linux-gate-20260907.md).
-- Earlier Windows QA packages include runtime/notices and verified archive contents; final accepted-tree optimized distributions and exact provenance/checksums remain a release gate. [Packaging evidence](release-windows-package-review.md).
+- Behavior creation: compact New → three task choices → focused name/owner/
+  viewpoint card, explicit missing inputs, atomic creation and reserved recovery
+  IDs. Implemented, reviewed and scoped native creation/history/reopen passed.
+- Contextual prerequisite creation: stage an explicit typed source inside the
+  current parent draft, then validate/adopt source and consumer atomically. This
+  preserves intent and one-step history; a separate Architecture excursion or
+  early source commit loses those guarantees. Initial Lifeline/process Work/
+  machine-owner adapters and semantic first-action prompts are implemented,
+  reviewed and integrated with focused gates passed; scoped native results are
+  above, with remaining acceptance still open. See the
+  [bounded plan](release-contextual-source-creation-plan-20260911.md).
+- Scenario workspace: compact header, optional Tools/Selection shelves, actual
+  remaining-height canvas/form, pinned actions, independent scrolling and
+  explicit Fit/Focus. Mounted tests support this choice; native proof pending.
+- User issue2/comment250 clarifies that diagram manipulation may respect
+  sequence/domain constraints. Codex-956atf owns a shared canvas-shell redesign;
+  the existing controls and supporting source-card fixes do not close the issue.
+- Quantities/calculations: peer comment 231 records ratified schema 8/local
+  definitions and actual shared analysis/core types under implementation in
+  isolated `codex/analysis-core-20260911`. This is not a local schema admission,
+  evaluator or graphical/source/API parity pass; the local core remains descriptive.
+- Libraries: compare copied source, live references, generic definition/usages
+  and pinned typed packages with explicit mappings and reviewed updates.
+  [Falsification brief](release-library-candidate-review-20260910.md) records
+  identity, dependency, offline and conflict requirements. Refined peer baseline,
+  Case, full-freeze and exact-pin/equivalence contracts are ratified externally;
+  their local integration and executable lifecycle acceptance remain pending.
+- Text authoring: use existing omission/default/identity contracts for concise
+  experiments; compare source navigation/refactoring/patch assistance before
+  grammar redesign. No namespace, hidden identity or omission change ratified.
+- Reference chooser: peer comment 224's corrected focus ownership, nested-scroll
+  reveal and mounted regressions are prepared, not executed. Preserve that
+  ownership and wait for its source/test handoff.
+
+Long-lived decisions remain in [DECISIONS.md](DECISIONS.md). New user scope and
+normative contracts supersede older prototype exclusions.
 
 ## Current strategy
 
-The requested Windows preview and whole-run development summary are delivered; the summary is being refreshed with the confirmed package, full570/570 desktop result and final Fit/strict/build gates. Preview DC50 has bounded native launch/overview evidence, not complete minimum-height/pending-form acceptance. Computer Use stopped on user Escape, so leave live GUI processes untouched and advance independent verification.
+Finish coherent creation gates and test the rebuilt product against independent
+saved-source oracles. Close remaining scenario lifecycle integration boundaries.
+Use the native Capella study and independent criticism to address real authoring
+friction. In parallel, resolve foundational semantic additions and text-only
+authoring through bounded competing designs and executable experiments. Then implement all representations,
+verify real REST and Windows/Linux workflows, build actual optimized packages
+and conduct fresh end-state review. Do not weaken acceptance to match current
+implementation or stop because a narrow technical milestone passed.
 
-Preserve the successful immutable458-file Linux GUI cross-build with the Fit fix, exact ELF/package evidence and released compiler lease. Three subsequent guest boots reached terminal IO-APIC timer panic before any tests; exact-kernel extraction succeeded but automatic approval review denied the proposed transient workaround. All task VMs are stopped. Preserve the denied action and evidence without bypassing review. Its snapshot/run/hashes and actual process status belong in STATE.md and the cross-build report. Preserve the original interrupted runs, cache, native core436/2ignored and failed Linux timed-server fixture. The replacement private HTTP preparation test and full server56 pass on Windows; Linux execution remains required.
-
-Guide steps now name Tools/Selection details/Restore panels and the exact Reply label; formatting, independent label review and a fresh Windows workspace-binary build pass. The user-facing preview retains its original tested bytes. Independent full-model/source purpose oracles compiled and passed both self-checks and preserved baseline cases; complete their native authoring/history steps when control resumes. Complete current native OA/SA teaching, artifact, saved-view, process/scenario and hosted cases once control is available. Retain caller-specific budgets, actual port proof, independent channel validation and exact old5/6 recovery bytes. Final optimized packages, current platform gates and fresh independent end-state review remain open; architecture-only SVG and passing slices do not redefine completion.
+Pre-consolidation content is preserved byte-for-byte in
+[the dated archive](history/2026-09-10-ledgers-before-second-consolidation/TASK_LEDGER.md).

harness/behavior-creation-contract.rs

@@ -0,0 +1,676 @@
+//! Independent native creation oracle; no desktop producer is imported.
+//! self-check BASE | check STAGE BASE ACTUAL ROLES | same EXPECTED ACTUAL [UNDO_FROM]
+use oa_core::{source_project::*, *};
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    fs,
+    path::Path,
+};
+
+const PROCESS: &str = "Coordinate rescue";
+const SCENARIO: &str = "Rescue coordination conversation";
+const MACHINE: &str = "Rescue team operating modes";
+const VIEW: &str = "Rescue team operating modes · states";
+const CAPABILITY: u128 = 0xb451c00000004000800000000000001f;
+const OWNER: u128 = 0xc062944912094b50afacf558a9a0fc7f;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
+enum Stage {
+    Baseline,
+    Process,
+    Scenario,
+    Machine,
+}
+impl Stage {
+    fn parse(value: &str) -> Self {
+        match value {
+            "baseline" => Self::Baseline,
+            "process" => Self::Process,
+            "scenario" => Self::Scenario,
+            "machine" => Self::Machine,
+            _ => panic!("Stage must be baseline, process, scenario or machine"),
+        }
+    }
+    fn additions(self) -> usize {
+        match self {
+            Self::Baseline => 0,
+            Self::Process => 1,
+            Self::Scenario => 2,
+            Self::Machine => 3,
+        }
+    }
+}
+
+type DiskSources = BTreeMap<String, Vec<u8>>;
+
+fn source_paths(root: &Path, here: &Path, paths: &mut DiskSources) {
+    for entry in fs::read_dir(here).unwrap() {
+        let entry = entry.unwrap();
+        let kind = entry.file_type().unwrap();
+        assert!(
+            !kind.is_symlink(),
+            "Native checkpoint must contain ordinary files"
+        );
+        if kind.is_dir() {
+            source_paths(root, &entry.path(), paths);
+        } else if entry.path().extension().is_some_and(|ext| ext == "arcadia") {
+            assert!(kind.is_file());
+            paths.insert(
+                entry
+                    .path()
+                    .strip_prefix(root)
+                    .unwrap()
+                    .to_str()
+                    .unwrap()
+                    .replace('\\', "/"),
+                fs::read(entry.path()).unwrap(),
+            );
+        }
+    }
+}
+fn load_checkpoint(entry: &Path) -> (CompiledSourceProject, DiskSources) {
+    let files = source_files::load_project(entry, ProjectLimits::default()).unwrap();
+    let raw = files.reachable_bundle();
+    let compiled = compile_bundle(&raw, ProjectLimits::default()).unwrap();
+    assert_eq!(
+        compiled.bundle, raw,
+        "No migration, normalization or implicit identity insertion"
+    );
+    execute_batch(&compiled.decoded.project, &[]).unwrap();
+    let mut disk = BTreeMap::new();
+    let root = entry.parent().unwrap();
+    source_paths(root, root, &mut disk);
+    (compiled, disk)
+}
+fn predicted_disk(reachable: &SourceBundle, undo_from: Option<&DiskSources>) -> DiskSources {
+    // Saving Undo writes the restored reachable files and deliberately keeps
+    // detached files from the previously saved checkpoint. Never infer their
+    // bytes from the actual Undo directory: its explicit origin is the oracle.
+    let mut expected = undo_from.cloned().unwrap_or_default();
+    expected.extend(
+        reachable
+            .files
+            .iter()
+            .map(|(path, source)| (path.clone(), source.as_bytes().to_vec())),
+    );
+    expected
+}
+fn load(entry: &Path) -> CompiledSourceProject {
+    let (compiled, disk) = load_checkpoint(entry);
+    assert_eq!(
+        disk,
+        predicted_disk(&compiled.bundle, None),
+        "Ordinary checkpoints must contain exactly their reachable source files; retained Undo files require an explicit origin"
+    );
+    compiled
+}
+fn fnv1a(bytes: &[u8]) -> u64 {
+    bytes.iter().fold(0xcbf29ce484222325, |hash, byte| {
+        (hash ^ u64::from(*byte)).wrapping_mul(0x100000001b3)
+    })
+}
+fn pinned_baseline(base: &CompiledSourceProject) -> bool {
+    // Fixed byte fingerprints of the root-preserved transition/reopen input,
+    // recorded before any creation. SHA-256 provenance is in the fixture README.
+    let pins = [
+        ("project.arcadia", 4844, 0x450c6ffd8225af32),
+        ("rationale.arcadia", 57, 0xf87e3c2e303f9b62),
+        ("traceability.arcadia", 395, 0xb47992dbdacab344),
+        ("oa/participants.arcadia", 403, 0x1e109eef81968b5f),
+        (
+            "oa/activities/activity_assess_incident.arcadia",
+            376,
+            0x0e67e533db3cff78,
+        ),
+        ("sa/participants.arcadia", 124, 0xcadb35025aea18cc),
+    ];
+    base.bundle.entry == "project.arcadia"
+        && base.bundle.files.len() == pins.len()
+        && pins.iter().all(|(path, length, hash)| {
+            base.bundle
+                .files
+                .get(*path)
+                .is_some_and(|text| text.len() == *length && fnv1a(text.as_bytes()) == *hash)
+        })
+}
+fn baseline(entry: &Path) -> CompiledSourceProject {
+    let base = load(entry);
+    assert!(
+        pinned_baseline(&base),
+        "The six-file baseline differs from the frozen pre-creation input"
+    );
+    let p = &base.decoded.project;
+    assert_eq!(
+        (
+            p.elements.len(),
+            p.relations.len(),
+            p.diagrams.len(),
+            p.traces.len()
+        ),
+        (10, 2, 4, 1)
+    );
+    let context = &p.elements[&Id::from_u128(CAPABILITY)];
+    assert_eq!(
+        (
+            context.name.as_str(),
+            context.kind(),
+            context.layer(),
+            context.parent
+        ),
+        ("Rescue capability", Kind::Capability, Layer::Oa, None)
+    );
+    let owner = &p.elements[&Id::from_u128(OWNER)];
+    assert_eq!(
+        (
+            owner.name.as_str(),
+            owner.kind(),
+            owner.layer(),
+            owner.parent
+        ),
+        ("Rescue team", Kind::SystemActor, Layer::Sa, None)
+    );
+    for name in [PROCESS, SCENARIO, MACHINE] {
+        assert!(
+            !p.elements.values().any(|e| e.name == name),
+            "Baseline already contains requested creation"
+        );
+    }
+    base
+}
+
+struct Roles<'a> {
+    actual: &'a Project,
+    baseline: &'a Project,
+    used: BTreeSet<Id>,
+}
+impl Roles<'_> {
+    fn fresh(&mut self, choices: Vec<Id>, role: &str) -> Id {
+        assert_eq!(
+            choices.len(),
+            1,
+            "Exactly one literal identity role required: {role}"
+        );
+        let id = choices[0];
+        assert_eq!(id.get_version_num(), 4, "{role} must be a fresh UUIDv4");
+        assert!(
+            !self.baseline.contains(id),
+            "{role} reuses a baseline identity"
+        );
+        assert!(self.used.insert(id), "{role} reuses another fresh role");
+        id
+    }
+    fn element(&mut self, kind: Kind, layer: Layer, name: &str) -> Id {
+        self.fresh(
+            self.actual
+                .elements
+                .values()
+                .filter(|e| e.kind() == kind && e.layer() == layer && e.name == name)
+                .map(|e| e.id)
+                .collect(),
+            name,
+        )
+    }
+    fn view(&mut self, machine: Id) -> Id {
+        self.fresh(
+            self.actual
+                .diagrams
+                .values()
+                .filter(|d| {
+                    d.layer == Layer::Sa
+                        && d.name == VIEW
+                        && d.projection == ProjectionKind::StateMachine { machine }
+                })
+                .map(|d| d.id)
+                .collect(),
+            VIEW,
+        )
+    }
+    fn node(&mut self, diagram: Id, machine: Id) -> Id {
+        self.fresh(
+            self.actual.diagrams[&diagram]
+                .nodes
+                .values()
+                .filter(|node| node.element == machine)
+                .map(|node| node.id)
+                .collect(),
+            "new machine's exact view placement",
+        )
+    }
+}
+fn element(p: &Project, id: Id, name: &str, parent: Option<Id>, body: ElementBody) -> Element {
+    Element {
+        id,
+        alias: p.fresh_alias(name, "behavior", id),
+        name: name.into(),
+        description: String::new(),
+        parent,
+        body,
+    }
+}
+fn advance(base: &mut CompiledSourceProject, commands: Vec<Command>) {
+    let project = execute_batch(&base.decoded.project, &[Command::Batch(commands)]).unwrap();
+    *base = update_bundle(base, &project, ProjectLimits::default()).unwrap();
+}
+fn predict(base: &CompiledSourceProject, stage: Stage, carrier: &Project) -> CompiledSourceProject {
+    let mut result = base.clone();
+    let mut roles = Roles {
+        actual: carrier,
+        baseline: &base.decoded.project,
+        used: BTreeSet::new(),
+    };
+    if stage >= Stage::Process {
+        let id = roles.element(Kind::Process, Layer::Oa, PROCESS);
+        let record = element(
+            &result.decoded.project,
+            id,
+            PROCESS,
+            None,
+            ElementBody::Oa(OaBody::Process { steps: vec![] }),
+        );
+        advance(&mut result, vec![Command::CreateElement(record)]);
+    }
+    if stage >= Stage::Scenario {
+        let id = roles.element(Kind::Scenario, Layer::Oa, SCENARIO);
+        let record = element(
+            &result.decoded.project,
+            id,
+            SCENARIO,
+            None,
+            ElementBody::shared_in(
+                Layer::Oa,
+                SharedBody::Scenario {
+                    viewpoint: ScenarioViewpoint::ParticipantInteraction,
+                    context: Some(Id::from_u128(CAPABILITY)),
+                    precondition: String::new(),
+                    postcondition: String::new(),
+                    steps: vec![],
+                },
+            ),
+        );
+        advance(&mut result, vec![Command::CreateElement(record)]);
+    }
+    if stage == Stage::Machine {
+        let machine = roles.element(Kind::StateMachine, Layer::Sa, MACHINE);
+        let diagram = roles.view(machine);
+        let placement = roles.node(diagram, machine);
+        let record = element(
+            &result.decoded.project,
+            machine,
+            MACHINE,
+            Some(Id::from_u128(OWNER)),
+            ElementBody::shared_in(Layer::Sa, SharedBody::StateMachine),
+        );
+        let p = execute_batch(
+            &result.decoded.project,
+            &[Command::CreateElement(record.clone())],
+        )
+        .unwrap();
+        // Published first-view contract, independently constructed: one root,
+        // default options, no routes/regions/states. Shared core Layout owns the
+        // final geometry; no observed geometry or desktop planner is consulted.
+        let view = Diagram {
+            id: diagram,
+            alias: p.fresh_alias(VIEW, "state_view", diagram),
+            name: VIEW.into(),
+            description: String::new(),
+            layer: Layer::Sa,
+            projection: ProjectionKind::StateMachine { machine },
+            routes: vec![],
+            view_options: Default::default(),
+            nodes: BTreeMap::from([(
+                placement,
+                NodePlacement {
+                    id: placement,
+                    alias: p.fresh_alias(&format!("{MACHINE} placement"), "placement", placement),
+                    element: machine,
+                    position: Position { x: 60., y: 60. },
+                    size: Size {
+                        width: 336.,
+                        height: 104.,
+                    },
+                    collapsed: false,
+                    port_anchors: vec![],
+                },
+            )]),
+        };
+        advance(
+            &mut result,
+            vec![
+                Command::CreateElement(record),
+                Command::CreateDiagram(view),
+                Command::Layout(diagram),
+            ],
+        );
+    }
+    let p = &result.decoded.project;
+    assert_eq!(
+        p.elements.len(),
+        base.decoded.project.elements.len() + stage.additions()
+    );
+    assert_eq!(
+        p.diagrams.len(),
+        base.decoded.project.diagrams.len() + usize::from(stage == Stage::Machine)
+    );
+    assert_eq!(p.relations, base.decoded.project.relations);
+    assert_eq!(p.traces, base.decoded.project.traces);
+    result
+}
+fn equal(left: &CompiledSourceProject, right: &CompiledSourceProject) -> bool {
+    left.decoded.project == right.decoded.project && left.bundle == right.bundle
+}
+fn assert_equal(expected: &CompiledSourceProject, actual: &CompiledSourceProject) {
+    assert_eq!(
+        actual.decoded.project, expected.decoded.project,
+        "Complete Project differs from independent prediction"
+    );
+    assert_eq!(
+        actual.bundle, expected.bundle,
+        "Complete SourceBundle differs, including comments and all included bytes"
+    );
+}
+fn test_id(n: u128) -> Id {
+    Id::from_u128(0xc4ea7100000040008000000000000000 + n)
+}
+fn false_carrier(base: &Project) -> Project {
+    let mut p = base.clone();
+    for (n, kind, layer, name) in [
+        (1, Kind::Process, Layer::Oa, PROCESS),
+        (2, Kind::Scenario, Layer::Oa, SCENARIO),
+        (3, Kind::StateMachine, Layer::Sa, MACHINE),
+    ] {
+        p.elements.insert(
+            test_id(n),
+            Element {
+                id: test_id(n),
+                alias: format!("false_alias_{n}"),
+                name: name.into(),
+                description: "Must never be copied".into(),
+                parent: None,
+                body: ElementBody::new(kind, layer).unwrap(),
+            },
+        );
+    }
+    p.diagrams.insert(
+        test_id(4),
+        Diagram {
+            id: test_id(4),
+            alias: "false_view_alias".into(),
+            name: VIEW.into(),
+            description: "False view description".into(),
+            layer: Layer::Sa,
+            projection: ProjectionKind::StateMachine {
+                machine: test_id(3),
+            },
+            routes: vec![],
+            view_options: Default::default(),
+            nodes: BTreeMap::from([(
+                test_id(5),
+                NodePlacement {
+                    id: test_id(5),
+                    alias: "false_node_alias".into(),
+                    element: test_id(3),
+                    position: Position {
+                        x: 9999.,
+                        y: -9999.,
+                    },
+                    size: Size {
+                        width: 1.,
+                        height: 1.,
+                    },
+                    collapsed: true,
+                    port_anchors: vec![],
+                },
+            )]),
+        },
+    );
+    p
+}
+fn self_check(base: &CompiledSourceProject) {
+    let original = base.clone();
+    let carrier = false_carrier(&base.decoded.project);
+    assert_equal(base, &predict(base, Stage::Baseline, &carrier));
+    for stage in [Stage::Process, Stage::Scenario, Stage::Machine] {
+        let expected = predict(base, stage, &carrier);
+        assert_equal(&expected, &predict(base, stage, &expected.decoded.project));
+        let parsed = compile_bundle(&expected.bundle, ProjectLimits::default()).unwrap();
+        assert_equal(&expected, &parsed);
+        let mut altered = expected.clone();
+        altered
+            .decoded
+            .project
+            .elements
+            .get_mut(&test_id(1))
+            .unwrap()
+            .description = "Unrequested metadata".into();
+        assert!(!equal(&expected, &altered));
+        let mut altered = expected.clone();
+        altered
+            .decoded
+            .project
+            .elements
+            .get_mut(&Id::from_u128(CAPABILITY))
+            .unwrap()
+            .name = "Changed unrelated baseline".into();
+        assert!(!equal(&expected, &altered));
+        let mut changed_source = expected.bundle.clone();
+        changed_source
+            .files
+            .get_mut("rationale.arcadia")
+            .unwrap()
+            .push_str("// Extra comment\n");
+        let altered = compile_bundle(&changed_source, ProjectLimits::default()).unwrap();
+        assert_eq!(altered.decoded.project, expected.decoded.project);
+        assert!(
+            !equal(&expected, &altered),
+            "Identical semantics do not excuse changed source bytes"
+        );
+        if stage >= Stage::Scenario {
+            let mut altered = expected.clone();
+            *altered
+                .decoded
+                .project
+                .elements
+                .get_mut(&test_id(2))
+                .unwrap()
+                .shared_mut()
+                .unwrap() = SharedBody::Scenario {
+                viewpoint: ScenarioViewpoint::OperationalActivity,
+                context: None,
+                precondition: String::new(),
+                postcondition: String::new(),
+                steps: vec![],
+            };
+            assert!(!equal(&expected, &altered));
+        }
+        if stage == Stage::Machine {
+            assert_ne!(
+                expected.decoded.project, carrier,
+                "Never adopt role-carrier metadata/geometry"
+            );
+            assert_eq!(
+                expected.decoded.project.elements[&test_id(3)].parent,
+                Some(Id::from_u128(OWNER))
+            );
+            let view = &expected.decoded.project.diagrams[&test_id(4)];
+            assert_eq!(view.nodes.len(), 1);
+            let node = &view.nodes[&test_id(5)];
+            println!(
+                "PREDICT first view: {VIEW}; machine-root position {:?}, size {:?}; {} exact source files",
+                node.position,
+                node.size,
+                expected.bundle.files.len()
+            );
+            let mut altered = expected.clone();
+            altered
+                .decoded
+                .project
+                .diagrams
+                .get_mut(&test_id(4))
+                .unwrap()
+                .nodes
+                .get_mut(&test_id(5))
+                .unwrap()
+                .position
+                .x += 1.;
+            assert!(!equal(&expected, &altered));
+            let mut altered = expected.clone();
+            let extra = element(
+                &altered.decoded.project,
+                test_id(6),
+                "Unrequested region",
+                Some(test_id(3)),
+                ElementBody::shared_in(Layer::Sa, SharedBody::Region),
+            );
+            altered.decoded.project.elements.insert(extra.id, extra);
+            assert!(!equal(&expected, &altered), "Reject extra semantic objects");
+            let mut altered = expected.clone();
+            altered
+                .bundle
+                .files
+                .insert("unrequested.arcadia".into(), "// Extra file\n".into());
+            assert!(!equal(&expected, &altered));
+        }
+        println!(
+            "PASS self-check {stage:?}: full source fixed point; false metadata, unrelated edits and source-only drift rejected"
+        );
+    }
+    let mut altered_base = base.clone();
+    altered_base
+        .bundle
+        .files
+        .get_mut("rationale.arcadia")
+        .unwrap()
+        .push(' ');
+    assert!(
+        !pinned_baseline(&altered_base),
+        "Reject an altered baseline before use"
+    );
+    assert_equal(&original, base);
+    let before = predict(base, Stage::Scenario, &carrier);
+    let created = predict(base, Stage::Machine, &carrier);
+    let origin = predicted_disk(&created.bundle, None);
+    let detached: Vec<_> = created
+        .bundle
+        .files
+        .keys()
+        .filter(|path| !before.bundle.files.contains_key(*path))
+        .cloned()
+        .collect();
+    assert_eq!(
+        detached.len(),
+        1,
+        "A machine creation adds one source module"
+    );
+    // Independently simulate the saver's observable result: restored reachable
+    // bytes plus the one new module left on disk by the prior creation.
+    let mut retained = predicted_disk(&before.bundle, None);
+    retained.insert(
+        detached[0].clone(),
+        created.bundle.files[&detached[0]].as_bytes().to_vec(),
+    );
+    assert_eq!(
+        retained[&detached[0]], origin[&detached[0]],
+        "Retained bytes must come from the exact created checkpoint"
+    );
+    assert_ne!(
+        retained,
+        predicted_disk(&before.bundle, None),
+        "Ordinary comparison must not accept detached history files"
+    );
+    assert_eq!(
+        retained,
+        predicted_disk(&before.bundle, Some(&origin)),
+        "Explicit Undo origin permits only the expected retained bytes"
+    );
+    let mut unknown = retained.clone();
+    unknown.insert("unknown.arcadia".into(), b"// Unclaimed file\n".to_vec());
+    assert_ne!(
+        unknown,
+        predicted_disk(&before.bundle, Some(&origin)),
+        "Reject unknown detached files"
+    );
+    let mut changed = retained.clone();
+    changed.get_mut(&detached[0]).unwrap().push(b' ');
+    assert_ne!(
+        changed,
+        predicted_disk(&before.bundle, Some(&origin)),
+        "Reject changed detached bytes"
+    );
+    let mut missing = retained.clone();
+    missing.remove(&detached[0]);
+    assert_ne!(
+        missing,
+        predicted_disk(&before.bundle, Some(&origin)),
+        "The retained file set is exact, not optional"
+    );
+    let mut reachable_drift = retained.clone();
+    reachable_drift
+        .get_mut("rationale.arcadia")
+        .unwrap()
+        .push(b' ');
+    assert_ne!(
+        reachable_drift,
+        predicted_disk(&before.bundle, Some(&origin)),
+        "An Undo exemption cannot hide reachable-source changes"
+    );
+    println!(
+        "PASS explicit Undo disk contract: known detached retention accepted; unknown, changed, missing and reachable drift rejected"
+    );
+    println!("PASS baseline retained unchanged; no native acceptance claimed");
+}
+fn main() {
+    assert_eq!(SCHEMA_VERSION, 7);
+    let args: Vec<_> = std::env::args().collect();
+    match args.get(1).map(String::as_str) {
+        Some("self-check") => {
+            assert_eq!(args.len(), 3, "self-check BASELINE_ENTRY");
+            self_check(&baseline(Path::new(&args[2])));
+        }
+        Some("check") => {
+            assert_eq!(
+                args.len(),
+                6,
+                "check baseline|process|scenario|machine BASELINE_ENTRY ACTUAL_ENTRY ROLE_ENTRY"
+            );
+            let stage = Stage::parse(&args[2]);
+            let base = baseline(Path::new(&args[3]));
+            let actual = load(Path::new(&args[4]));
+            let carrier = load(Path::new(&args[5]));
+            let expected = predict(&base, stage, &carrier.decoded.project);
+            assert_equal(&expected, &actual);
+            println!(
+                "PASS {stage:?}: complete Project + {} exact source files; only fresh literal-role UUIDs borrowed",
+                actual.bundle.files.len()
+            );
+        }
+        Some("same") => {
+            assert!(
+                matches!(args.len(), 4 | 5),
+                "same EXPECTED_CHECKPOINT ACTUAL_CHECKPOINT [UNDO_FROM_CHECKPOINT]"
+            );
+            let expected = load(Path::new(&args[2]));
+            let (actual, disk) = load_checkpoint(Path::new(&args[3]));
+            assert_equal(&expected, &actual);
+            let origin = args.get(4).map(|entry| {
+                // The first committed checkpoint is itself exact. This keeps
+                // arbitrary pre-existing detached files out of the exception.
+                let committed = load(Path::new(entry));
+                predicted_disk(&committed.bundle, None)
+            });
+            assert_eq!(
+                disk,
+                predicted_disk(&expected.bundle, origin.as_ref()),
+                "Disk source files differ from the exact checkpoint plus explicitly proven retained Undo files"
+            );
+            println!(
+                "PASS exact checkpoint identity/model/{}-file SourceBundle equality; {} exact disk files ({} known retained)",
+                actual.bundle.files.len(),
+                disk.len(),
+                disk.len() - actual.bundle.files.len()
+            );
+        }
+        _ => panic!(
+            "self-check BASE | check STAGE BASE ACTUAL ROLES | same EXPECTED ACTUAL [UNDO_FROM]"
+        ),
+    }
+}

harness/experiments/analysis-context-20260911/README.md

@@ -0,0 +1,29 @@
+# Analysis context experiment
+
+This standalone Rust program compares explicit baseline/override studies (B) with complete independent case bindings (D). It is an isolated experiment, **not Studio syntax or a production model implementation**. Its expression language is deliberately limited to integer magnitudes in milliseconds, addition/sum, comparison, missing inputs and pure reusable functions.
+
+The source owns the fixture generator, parser, explicit context resolver, dependency-cycle check, evaluator, frozen-snapshot operation, provenance observations and line-diff counter. All comparisons use the same 20 fixed inputs, 2 varying inputs and 20 named cases. The formula/check variants are either inline or factored into reusable pure definitions.
+
+From the repository root, using the installed local toolchain:
+
+```powershell
+. .local/toolchain/env.ps1
+New-Item -ItemType Directory -Force .local/analysis-context-20260911 | Out-Null
+rustc --edition=2024 -D warnings -C linker=clang.exe harness/experiments/analysis-context-20260911/main.rs -o .local/analysis-context-20260911/analysis-context.exe
+if ($LASTEXITCODE -ne 0) { throw 'Experiment compilation failed' }
+& .local/analysis-context-20260911/analysis-context.exe harness/experiments/analysis-context-20260911/generated
+if ($LASTEXITCODE -ne 0) { throw 'Experiment assertions failed' }
+```
+
+The program overwrites its named generated fixtures/results in the output directory. It does not invoke Cargo, modify `target`, or import Studio modules. `EVIDENCE.json` was recorded separately after the verified run and contains exact compiler, program/executable/result hashes and every generated source fixture hash. Rerunning after editing the program requires refreshing that evidence rather than trusting the old manifest.
+
+- [Results](generated/RESULTS.md): executed counts and assertions.
+- [Evidence](generated/EVIDENCE.json): final run identity and 29 fixture hashes.
+- [B with factored calculations](generated/B-factored.study) and [D equivalent](generated/D-factored.study).
+- [B case provenance](generated/B-factored-provenance.md).
+- [Frozen B case](generated/B-factored-frozen-case20.study): complete independent snapshot, copied definitions and explicit captured row origins.
+- [Interpretation and limitations](../../release-analysis-context-experiment-20260911.md).
+
+The small dialect has explicit `study B/D revision`, a shared property catalog, optional pure `function` declarations, an explicit named `baseline` for B, and named cases declaring either `base engineering` or `independent`. `missing` is an entire binding hole. Removing a B override resolves the baseline; removing a required D row rejects. Function parameters cannot capture project properties. No case-to-case inheritance or implicit selected/default case exists.
+
+Generated studies do not have OA/SA subjects, UUID identity, quantity kinds, persistent source editing, JSON/REST, library import resolution or native UI integration. The experiment compares context semantics and the actual emitted text size/edit count, not human completion time or end-to-end product conformance.

harness/experiments/analysis-context-20260911/generated/B-factored-cleared-override.study

@@ -0,0 +1,107 @@
+study B revision 1
+properties fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02, total, budget
+function budget_formula(result) = le(result, 22000)
+function total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02) = sum(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+baseline engineering revision 1
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 750
+  varying02 = 1000
+end
+case case01 base engineering
+end
+case case02 base engineering
+  varying01 = 800
+  varying02 = 1025
+end
+case case03 base engineering
+  varying01 = 850
+  varying02 = 1050
+end
+case case04 base engineering
+  varying01 = 900
+  varying02 = 1075
+end
+case case05 base engineering
+  varying01 = 950
+  varying02 = 1100
+end
+case case06 base engineering
+  varying01 = 1000
+  varying02 = 1125
+end
+case case07 base engineering
+  varying01 = 1050
+  varying02 = 1150
+end
+case case08 base engineering
+  varying01 = 1100
+  varying02 = 1175
+end
+case case09 base engineering
+  varying01 = 1150
+  varying02 = 1200
+end
+case case10 base engineering
+  varying01 = 1200
+  varying02 = 1225
+end
+case case11 base engineering
+  varying01 = 1250
+  varying02 = 1250
+end
+case case12 base engineering
+  varying01 = 1300
+  varying02 = 1275
+end
+case case13 base engineering
+  varying01 = 1350
+  varying02 = 1300
+end
+case case14 base engineering
+  varying01 = 1400
+  varying02 = 1325
+end
+case case15 base engineering
+  varying01 = 1450
+  varying02 = 1350
+end
+case case16 base engineering
+  varying01 = 1500
+  varying02 = 1375
+end
+case case17 base engineering
+  varying01 = 1550
+  varying02 = 1400
+end
+case case18 base engineering
+  varying01 = 1600
+  varying02 = 1425
+end
+case case19 base engineering
+  varying01 = 1650
+  varying02 = 1450
+end
+case case20 base engineering
+  varying02 = 1475
+end

harness/experiments/analysis-context-20260911/generated/B-factored-cycle.rejected-study

@@ -0,0 +1,108 @@
+study B revision 1
+properties fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02, total, budget
+function budget_formula(result) = le(result, 22000)
+function total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02) = sum(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+baseline engineering revision 1
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 750
+  varying02 = 1000
+end
+case case01 base engineering
+end
+case case02 base engineering
+  varying01 = 800
+  varying02 = 1025
+end
+case case03 base engineering
+  varying01 = 850
+  varying02 = 1050
+end
+case case04 base engineering
+  varying01 = 900
+  varying02 = 1075
+end
+case case05 base engineering
+  varying01 = 950
+  varying02 = 1100
+end
+case case06 base engineering
+  varying01 = 1000
+  varying02 = 1125
+end
+case case07 base engineering
+  varying01 = 1050
+  varying02 = 1150
+end
+case case08 base engineering
+  varying01 = 1100
+  varying02 = 1175
+end
+case case09 base engineering
+  varying01 = 1150
+  varying02 = 1200
+end
+case case10 base engineering
+  varying01 = 1200
+  varying02 = 1225
+end
+case case11 base engineering
+  varying01 = 1250
+  varying02 = 1250
+end
+case case12 base engineering
+  varying01 = 1300
+  varying02 = 1275
+end
+case case13 base engineering
+  varying01 = 1350
+  varying02 = 1300
+end
+case case14 base engineering
+  varying01 = 1400
+  varying02 = 1325
+end
+case case15 base engineering
+  varying01 = 1450
+  varying02 = 1350
+end
+case case16 base engineering
+  varying01 = 1500
+  varying02 = 1375
+end
+case case17 base engineering
+  varying01 = 1550
+  varying02 = 1400
+end
+case case18 base engineering
+  varying01 = 1600
+  varying02 = 1425
+end
+case case19 base engineering
+  varying01 = 1650
+  varying02 = 1450
+end
+case case20 base engineering
+  varying01 = total
+  varying02 = 1475
+end

harness/experiments/analysis-context-20260911/generated/B-factored-fixed-all.study

@@ -0,0 +1,108 @@
+study B revision 2
+properties fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02, total, budget
+function budget_formula(result) = le(result, 22000)
+function total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02) = sum(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+baseline engineering revision 2
+  budget = budget_formula(total)
+  fixed01 = 1200
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 750
+  varying02 = 1000
+end
+case case01 base engineering
+end
+case case02 base engineering
+  varying01 = 800
+  varying02 = 1025
+end
+case case03 base engineering
+  varying01 = 850
+  varying02 = 1050
+end
+case case04 base engineering
+  varying01 = 900
+  varying02 = 1075
+end
+case case05 base engineering
+  varying01 = 950
+  varying02 = 1100
+end
+case case06 base engineering
+  varying01 = 1000
+  varying02 = 1125
+end
+case case07 base engineering
+  varying01 = 1050
+  varying02 = 1150
+end
+case case08 base engineering
+  varying01 = 1100
+  varying02 = 1175
+end
+case case09 base engineering
+  varying01 = 1150
+  varying02 = 1200
+end
+case case10 base engineering
+  varying01 = 1200
+  varying02 = 1225
+end
+case case11 base engineering
+  varying01 = 1250
+  varying02 = 1250
+end
+case case12 base engineering
+  varying01 = 1300
+  varying02 = 1275
+end
+case case13 base engineering
+  varying01 = 1350
+  varying02 = 1300
+end
+case case14 base engineering
+  varying01 = 1400
+  varying02 = 1325
+end
+case case15 base engineering
+  varying01 = 1450
+  varying02 = 1350
+end
+case case16 base engineering
+  varying01 = 1500
+  varying02 = 1375
+end
+case case17 base engineering
+  varying01 = 1550
+  varying02 = 1400
+end
+case case18 base engineering
+  varying01 = 1600
+  varying02 = 1425
+end
+case case19 base engineering
+  varying01 = 1650
+  varying02 = 1450
+end
+case case20 base engineering
+  varying01 = 1700
+  varying02 = 1475
+end

harness/experiments/analysis-context-20260911/generated/B-factored-frozen-case20.study

@@ -0,0 +1,55 @@
+study D revision 1
+origin B:case20:document1:engineering@1
+captured budget = baseline:engineering@1 via case20
+captured fixed01 = baseline:engineering@1 via case20
+captured fixed02 = baseline:engineering@1 via case20
+captured fixed03 = baseline:engineering@1 via case20
+captured fixed04 = baseline:engineering@1 via case20
+captured fixed05 = baseline:engineering@1 via case20
+captured fixed06 = baseline:engineering@1 via case20
+captured fixed07 = baseline:engineering@1 via case20
+captured fixed08 = baseline:engineering@1 via case20
+captured fixed09 = baseline:engineering@1 via case20
+captured fixed10 = baseline:engineering@1 via case20
+captured fixed11 = baseline:engineering@1 via case20
+captured fixed12 = baseline:engineering@1 via case20
+captured fixed13 = baseline:engineering@1 via case20
+captured fixed14 = baseline:engineering@1 via case20
+captured fixed15 = baseline:engineering@1 via case20
+captured fixed16 = baseline:engineering@1 via case20
+captured fixed17 = baseline:engineering@1 via case20
+captured fixed18 = baseline:engineering@1 via case20
+captured fixed19 = baseline:engineering@1 via case20
+captured fixed20 = baseline:engineering@1 via case20
+captured total = baseline:engineering@1 via case20
+captured varying01 = case:case20
+captured varying02 = case:case20
+properties fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02, total, budget
+function budget_formula(result) = le(result, 22000)
+function total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02) = sum(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+case case20 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1700
+  varying02 = 1475
+end

harness/experiments/analysis-context-20260911/generated/B-factored-missing.study

@@ -0,0 +1,108 @@
+study B revision 1
+properties fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02, total, budget
+function budget_formula(result) = le(result, 22000)
+function total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02) = sum(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+baseline engineering revision 1
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 750
+  varying02 = 1000
+end
+case case01 base engineering
+end
+case case02 base engineering
+  varying01 = 800
+  varying02 = 1025
+end
+case case03 base engineering
+  varying01 = 850
+  varying02 = 1050
+end
+case case04 base engineering
+  varying01 = 900
+  varying02 = 1075
+end
+case case05 base engineering
+  varying01 = 950
+  varying02 = 1100
+end
+case case06 base engineering
+  varying01 = 1000
+  varying02 = 1125
+end
+case case07 base engineering
+  varying01 = 1050
+  varying02 = 1150
+end
+case case08 base engineering
+  varying01 = 1100
+  varying02 = 1175
+end
+case case09 base engineering
+  varying01 = 1150
+  varying02 = 1200
+end
+case case10 base engineering
+  varying01 = 1200
+  varying02 = 1225
+end
+case case11 base engineering
+  varying01 = 1250
+  varying02 = 1250
+end
+case case12 base engineering
+  varying01 = 1300
+  varying02 = 1275
+end
+case case13 base engineering
+  varying01 = 1350
+  varying02 = 1300
+end
+case case14 base engineering
+  varying01 = 1400
+  varying02 = 1325
+end
+case case15 base engineering
+  varying01 = 1450
+  varying02 = 1350
+end
+case case16 base engineering
+  varying01 = 1500
+  varying02 = 1375
+end
+case case17 base engineering
+  varying01 = 1550
+  varying02 = 1400
+end
+case case18 base engineering
+  varying01 = 1600
+  varying02 = 1425
+end
+case case19 base engineering
+  varying01 = 1650
+  varying02 = 1450
+end
+case case20 base engineering
+  varying01 = missing
+  varying02 = 1475
+end

harness/experiments/analysis-context-20260911/generated/B-factored-provenance.md

@@ -0,0 +1,31 @@
+# B-factored: case20 evaluation
+
+Value: Bool(false)
+Document revision: 1
+
+- budget: baseline:engineering@1 via case20
+- fixed01: baseline:engineering@1 via case20
+- fixed02: baseline:engineering@1 via case20
+- fixed03: baseline:engineering@1 via case20
+- fixed04: baseline:engineering@1 via case20
+- fixed05: baseline:engineering@1 via case20
+- fixed06: baseline:engineering@1 via case20
+- fixed07: baseline:engineering@1 via case20
+- fixed08: baseline:engineering@1 via case20
+- fixed09: baseline:engineering@1 via case20
+- fixed10: baseline:engineering@1 via case20
+- fixed11: baseline:engineering@1 via case20
+- fixed12: baseline:engineering@1 via case20
+- fixed13: baseline:engineering@1 via case20
+- fixed14: baseline:engineering@1 via case20
+- fixed15: baseline:engineering@1 via case20
+- fixed16: baseline:engineering@1 via case20
+- fixed17: baseline:engineering@1 via case20
+- fixed18: baseline:engineering@1 via case20
+- fixed19: baseline:engineering@1 via case20
+- fixed20: baseline:engineering@1 via case20
+- total: baseline:engineering@1 via case20
+- varying01: case:case20
+- varying02: case:case20
+
+Rejected cycle: case20: cycle: budget -> total -> varying01 -> total

harness/experiments/analysis-context-20260911/generated/B-factored-threshold.study

@@ -0,0 +1,108 @@
+study B revision 2
+properties fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02, total, budget
+function budget_formula(result) = le(result, 22500)
+function total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02) = sum(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+baseline engineering revision 1
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 750
+  varying02 = 1000
+end
+case case01 base engineering
+end
+case case02 base engineering
+  varying01 = 800
+  varying02 = 1025
+end
+case case03 base engineering
+  varying01 = 850
+  varying02 = 1050
+end
+case case04 base engineering
+  varying01 = 900
+  varying02 = 1075
+end
+case case05 base engineering
+  varying01 = 950
+  varying02 = 1100
+end
+case case06 base engineering
+  varying01 = 1000
+  varying02 = 1125
+end
+case case07 base engineering
+  varying01 = 1050
+  varying02 = 1150
+end
+case case08 base engineering
+  varying01 = 1100
+  varying02 = 1175
+end
+case case09 base engineering
+  varying01 = 1150
+  varying02 = 1200
+end
+case case10 base engineering
+  varying01 = 1200
+  varying02 = 1225
+end
+case case11 base engineering
+  varying01 = 1250
+  varying02 = 1250
+end
+case case12 base engineering
+  varying01 = 1300
+  varying02 = 1275
+end
+case case13 base engineering
+  varying01 = 1350
+  varying02 = 1300
+end
+case case14 base engineering
+  varying01 = 1400
+  varying02 = 1325
+end
+case case15 base engineering
+  varying01 = 1450
+  varying02 = 1350
+end
+case case16 base engineering
+  varying01 = 1500
+  varying02 = 1375
+end
+case case17 base engineering
+  varying01 = 1550
+  varying02 = 1400
+end
+case case18 base engineering
+  varying01 = 1600
+  varying02 = 1425
+end
+case case19 base engineering
+  varying01 = 1650
+  varying02 = 1450
+end
+case case20 base engineering
+  varying01 = 1700
+  varying02 = 1475
+end

harness/experiments/analysis-context-20260911/generated/B-factored.study

@@ -0,0 +1,108 @@
+study B revision 1
+properties fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02, total, budget
+function budget_formula(result) = le(result, 22000)
+function total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02) = sum(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+baseline engineering revision 1
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 750
+  varying02 = 1000
+end
+case case01 base engineering
+end
+case case02 base engineering
+  varying01 = 800
+  varying02 = 1025
+end
+case case03 base engineering
+  varying01 = 850
+  varying02 = 1050
+end
+case case04 base engineering
+  varying01 = 900
+  varying02 = 1075
+end
+case case05 base engineering
+  varying01 = 950
+  varying02 = 1100
+end
+case case06 base engineering
+  varying01 = 1000
+  varying02 = 1125
+end
+case case07 base engineering
+  varying01 = 1050
+  varying02 = 1150
+end
+case case08 base engineering
+  varying01 = 1100
+  varying02 = 1175
+end
+case case09 base engineering
+  varying01 = 1150
+  varying02 = 1200
+end
+case case10 base engineering
+  varying01 = 1200
+  varying02 = 1225
+end
+case case11 base engineering
+  varying01 = 1250
+  varying02 = 1250
+end
+case case12 base engineering
+  varying01 = 1300
+  varying02 = 1275
+end
+case case13 base engineering
+  varying01 = 1350
+  varying02 = 1300
+end
+case case14 base engineering
+  varying01 = 1400
+  varying02 = 1325
+end
+case case15 base engineering
+  varying01 = 1450
+  varying02 = 1350
+end
+case case16 base engineering
+  varying01 = 1500
+  varying02 = 1375
+end
+case case17 base engineering
+  varying01 = 1550
+  varying02 = 1400
+end
+case case18 base engineering
+  varying01 = 1600
+  varying02 = 1425
+end
+case case19 base engineering
+  varying01 = 1650
+  varying02 = 1450
+end
+case case20 base engineering
+  varying01 = 1700
+  varying02 = 1475
+end

harness/experiments/analysis-context-20260911/generated/B-inline-cleared-override.study

@@ -0,0 +1,105 @@
+study B revision 1
+properties fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02, total, budget
+baseline engineering revision 1
+  budget = le(total, 22000)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = sum(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 750
+  varying02 = 1000
+end
+case case01 base engineering
+end
+case case02 base engineering
+  varying01 = 800
+  varying02 = 1025
+end
+case case03 base engineering
+  varying01 = 850
+  varying02 = 1050
+end
+case case04 base engineering
+  varying01 = 900
+  varying02 = 1075
+end
+case case05 base engineering
+  varying01 = 950
+  varying02 = 1100
+end
+case case06 base engineering
+  varying01 = 1000
+  varying02 = 1125
+end
+case case07 base engineering
+  varying01 = 1050
+  varying02 = 1150
+end
+case case08 base engineering
+  varying01 = 1100
+  varying02 = 1175
+end
+case case09 base engineering
+  varying01 = 1150
+  varying02 = 1200
+end
+case case10 base engineering
+  varying01 = 1200
+  varying02 = 1225
+end
+case case11 base engineering
+  varying01 = 1250
+  varying02 = 1250
+end
+case case12 base engineering
+  varying01 = 1300
+  varying02 = 1275
+end
+case case13 base engineering
+  varying01 = 1350
+  varying02 = 1300
+end
+case case14 base engineering
+  varying01 = 1400
+  varying02 = 1325
+end
+case case15 base engineering
+  varying01 = 1450
+  varying02 = 1350
+end
+case case16 base engineering
+  varying01 = 1500
+  varying02 = 1375
+end
+case case17 base engineering
+  varying01 = 1550
+  varying02 = 1400
+end
+case case18 base engineering
+  varying01 = 1600
+  varying02 = 1425
+end
+case case19 base engineering
+  varying01 = 1650
+  varying02 = 1450
+end
+case case20 base engineering
+  varying02 = 1475
+end

harness/experiments/analysis-context-20260911/generated/B-inline-cycle.rejected-study

@@ -0,0 +1,106 @@
+study B revision 1
+properties fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02, total, budget
+baseline engineering revision 1
+  budget = le(total, 22000)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = sum(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 750
+  varying02 = 1000
+end
+case case01 base engineering
+end
+case case02 base engineering
+  varying01 = 800
+  varying02 = 1025
+end
+case case03 base engineering
+  varying01 = 850
+  varying02 = 1050
+end
+case case04 base engineering
+  varying01 = 900
+  varying02 = 1075
+end
+case case05 base engineering
+  varying01 = 950
+  varying02 = 1100
+end
+case case06 base engineering
+  varying01 = 1000
+  varying02 = 1125
+end
+case case07 base engineering
+  varying01 = 1050
+  varying02 = 1150
+end
+case case08 base engineering
+  varying01 = 1100
+  varying02 = 1175
+end
+case case09 base engineering
+  varying01 = 1150
+  varying02 = 1200
+end
+case case10 base engineering
+  varying01 = 1200
+  varying02 = 1225
+end
+case case11 base engineering
+  varying01 = 1250
+  varying02 = 1250
+end
+case case12 base engineering
+  varying01 = 1300
+  varying02 = 1275
+end
+case case13 base engineering
+  varying01 = 1350
+  varying02 = 1300
+end
+case case14 base engineering
+  varying01 = 1400
+  varying02 = 1325
+end
+case case15 base engineering
+  varying01 = 1450
+  varying02 = 1350
+end
+case case16 base engineering
+  varying01 = 1500
+  varying02 = 1375
+end
+case case17 base engineering
+  varying01 = 1550
+  varying02 = 1400
+end
+case case18 base engineering
+  varying01 = 1600
+  varying02 = 1425
+end
+case case19 base engineering
+  varying01 = 1650
+  varying02 = 1450
+end
+case case20 base engineering
+  varying01 = total
+  varying02 = 1475
+end

harness/experiments/analysis-context-20260911/generated/B-inline-fixed-all.study

@@ -0,0 +1,106 @@
+study B revision 2
+properties fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02, total, budget
+baseline engineering revision 2
+  budget = le(total, 22000)
+  fixed01 = 1200
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = sum(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 750
+  varying02 = 1000
+end
+case case01 base engineering
+end
+case case02 base engineering
+  varying01 = 800
+  varying02 = 1025
+end
+case case03 base engineering
+  varying01 = 850
+  varying02 = 1050
+end
+case case04 base engineering
+  varying01 = 900
+  varying02 = 1075
+end
+case case05 base engineering
+  varying01 = 950
+  varying02 = 1100
+end
+case case06 base engineering
+  varying01 = 1000
+  varying02 = 1125
+end
+case case07 base engineering
+  varying01 = 1050
+  varying02 = 1150
+end
+case case08 base engineering
+  varying01 = 1100
+  varying02 = 1175
+end
+case case09 base engineering
+  varying01 = 1150
+  varying02 = 1200
+end
+case case10 base engineering
+  varying01 = 1200
+  varying02 = 1225
+end
+case case11 base engineering
+  varying01 = 1250
+  varying02 = 1250
+end
+case case12 base engineering
+  varying01 = 1300
+  varying02 = 1275
+end
+case case13 base engineering
+  varying01 = 1350
+  varying02 = 1300
+end
+case case14 base engineering
+  varying01 = 1400
+  varying02 = 1325
+end
+case case15 base engineering
+  varying01 = 1450
+  varying02 = 1350
+end
+case case16 base engineering
+  varying01 = 1500
+  varying02 = 1375
+end
+case case17 base engineering
+  varying01 = 1550
+  varying02 = 1400
+end
+case case18 base engineering
+  varying01 = 1600
+  varying02 = 1425
+end
+case case19 base engineering
+  varying01 = 1650
+  varying02 = 1450
+end
+case case20 base engineering
+  varying01 = 1700
+  varying02 = 1475
+end

harness/experiments/analysis-context-20260911/generated/B-inline-frozen-case20.study

@@ -0,0 +1,53 @@
+study D revision 1
+origin B:case20:document1:engineering@1
+captured budget = baseline:engineering@1 via case20
+captured fixed01 = baseline:engineering@1 via case20
+captured fixed02 = baseline:engineering@1 via case20
+captured fixed03 = baseline:engineering@1 via case20
+captured fixed04 = baseline:engineering@1 via case20
+captured fixed05 = baseline:engineering@1 via case20
+captured fixed06 = baseline:engineering@1 via case20
+captured fixed07 = baseline:engineering@1 via case20
+captured fixed08 = baseline:engineering@1 via case20
+captured fixed09 = baseline:engineering@1 via case20
+captured fixed10 = baseline:engineering@1 via case20
+captured fixed11 = baseline:engineering@1 via case20
+captured fixed12 = baseline:engineering@1 via case20
+captured fixed13 = baseline:engineering@1 via case20
+captured fixed14 = baseline:engineering@1 via case20
+captured fixed15 = baseline:engineering@1 via case20
+captured fixed16 = baseline:engineering@1 via case20
+captured fixed17 = baseline:engineering@1 via case20
+captured fixed18 = baseline:engineering@1 via case20
+captured fixed19 = baseline:engineering@1 via case20
+captured fixed20 = baseline:engineering@1 via case20
+captured total = baseline:engineering@1 via case20
+captured varying01 = case:case20
+captured varying02 = case:case20
+properties fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02, total, budget
+case case20 independent
+  budget = le(total, 22000)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = sum(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1700
+  varying02 = 1475
+end

harness/experiments/analysis-context-20260911/generated/B-inline-missing.study

@@ -0,0 +1,106 @@
+study B revision 1
+properties fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02, total, budget
+baseline engineering revision 1
+  budget = le(total, 22000)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = sum(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 750
+  varying02 = 1000
+end
+case case01 base engineering
+end
+case case02 base engineering
+  varying01 = 800
+  varying02 = 1025
+end
+case case03 base engineering
+  varying01 = 850
+  varying02 = 1050
+end
+case case04 base engineering
+  varying01 = 900
+  varying02 = 1075
+end
+case case05 base engineering
+  varying01 = 950
+  varying02 = 1100
+end
+case case06 base engineering
+  varying01 = 1000
+  varying02 = 1125
+end
+case case07 base engineering
+  varying01 = 1050
+  varying02 = 1150
+end
+case case08 base engineering
+  varying01 = 1100
+  varying02 = 1175
+end
+case case09 base engineering
+  varying01 = 1150
+  varying02 = 1200
+end
+case case10 base engineering
+  varying01 = 1200
+  varying02 = 1225
+end
+case case11 base engineering
+  varying01 = 1250
+  varying02 = 1250
+end
+case case12 base engineering
+  varying01 = 1300
+  varying02 = 1275
+end
+case case13 base engineering
+  varying01 = 1350
+  varying02 = 1300
+end
+case case14 base engineering
+  varying01 = 1400
+  varying02 = 1325
+end
+case case15 base engineering
+  varying01 = 1450
+  varying02 = 1350
+end
+case case16 base engineering
+  varying01 = 1500
+  varying02 = 1375
+end
+case case17 base engineering
+  varying01 = 1550
+  varying02 = 1400
+end
+case case18 base engineering
+  varying01 = 1600
+  varying02 = 1425
+end
+case case19 base engineering
+  varying01 = 1650
+  varying02 = 1450
+end
+case case20 base engineering
+  varying01 = missing
+  varying02 = 1475
+end

harness/experiments/analysis-context-20260911/generated/B-inline-provenance.md

@@ -0,0 +1,31 @@
+# B-inline: case20 evaluation
+
+Value: Bool(false)
+Document revision: 1
+
+- budget: baseline:engineering@1 via case20
+- fixed01: baseline:engineering@1 via case20
+- fixed02: baseline:engineering@1 via case20
+- fixed03: baseline:engineering@1 via case20
+- fixed04: baseline:engineering@1 via case20
+- fixed05: baseline:engineering@1 via case20
+- fixed06: baseline:engineering@1 via case20
+- fixed07: baseline:engineering@1 via case20
+- fixed08: baseline:engineering@1 via case20
+- fixed09: baseline:engineering@1 via case20
+- fixed10: baseline:engineering@1 via case20
+- fixed11: baseline:engineering@1 via case20
+- fixed12: baseline:engineering@1 via case20
+- fixed13: baseline:engineering@1 via case20
+- fixed14: baseline:engineering@1 via case20
+- fixed15: baseline:engineering@1 via case20
+- fixed16: baseline:engineering@1 via case20
+- fixed17: baseline:engineering@1 via case20
+- fixed18: baseline:engineering@1 via case20
+- fixed19: baseline:engineering@1 via case20
+- fixed20: baseline:engineering@1 via case20
+- total: baseline:engineering@1 via case20
+- varying01: case:case20
+- varying02: case:case20
+
+Rejected cycle: case20: cycle: budget -> total -> varying01 -> total

harness/experiments/analysis-context-20260911/generated/B-inline-threshold.study

@@ -0,0 +1,106 @@
+study B revision 2
+properties fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02, total, budget
+baseline engineering revision 2
+  budget = le(total, 22500)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = sum(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 750
+  varying02 = 1000
+end
+case case01 base engineering
+end
+case case02 base engineering
+  varying01 = 800
+  varying02 = 1025
+end
+case case03 base engineering
+  varying01 = 850
+  varying02 = 1050
+end
+case case04 base engineering
+  varying01 = 900
+  varying02 = 1075
+end
+case case05 base engineering
+  varying01 = 950
+  varying02 = 1100
+end
+case case06 base engineering
+  varying01 = 1000
+  varying02 = 1125
+end
+case case07 base engineering
+  varying01 = 1050
+  varying02 = 1150
+end
+case case08 base engineering
+  varying01 = 1100
+  varying02 = 1175
+end
+case case09 base engineering
+  varying01 = 1150
+  varying02 = 1200
+end
+case case10 base engineering
+  varying01 = 1200
+  varying02 = 1225
+end
+case case11 base engineering
+  varying01 = 1250
+  varying02 = 1250
+end
+case case12 base engineering
+  varying01 = 1300
+  varying02 = 1275
+end
+case case13 base engineering
+  varying01 = 1350
+  varying02 = 1300
+end
+case case14 base engineering
+  varying01 = 1400
+  varying02 = 1325
+end
+case case15 base engineering
+  varying01 = 1450
+  varying02 = 1350
+end
+case case16 base engineering
+  varying01 = 1500
+  varying02 = 1375
+end
+case case17 base engineering
+  varying01 = 1550
+  varying02 = 1400
+end
+case case18 base engineering
+  varying01 = 1600
+  varying02 = 1425
+end
+case case19 base engineering
+  varying01 = 1650
+  varying02 = 1450
+end
+case case20 base engineering
+  varying01 = 1700
+  varying02 = 1475
+end

harness/experiments/analysis-context-20260911/generated/B-inline.study

@@ -0,0 +1,106 @@
+study B revision 1
+properties fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02, total, budget
+baseline engineering revision 1
+  budget = le(total, 22000)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = sum(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 750
+  varying02 = 1000
+end
+case case01 base engineering
+end
+case case02 base engineering
+  varying01 = 800
+  varying02 = 1025
+end
+case case03 base engineering
+  varying01 = 850
+  varying02 = 1050
+end
+case case04 base engineering
+  varying01 = 900
+  varying02 = 1075
+end
+case case05 base engineering
+  varying01 = 950
+  varying02 = 1100
+end
+case case06 base engineering
+  varying01 = 1000
+  varying02 = 1125
+end
+case case07 base engineering
+  varying01 = 1050
+  varying02 = 1150
+end
+case case08 base engineering
+  varying01 = 1100
+  varying02 = 1175
+end
+case case09 base engineering
+  varying01 = 1150
+  varying02 = 1200
+end
+case case10 base engineering
+  varying01 = 1200
+  varying02 = 1225
+end
+case case11 base engineering
+  varying01 = 1250
+  varying02 = 1250
+end
+case case12 base engineering
+  varying01 = 1300
+  varying02 = 1275
+end
+case case13 base engineering
+  varying01 = 1350
+  varying02 = 1300
+end
+case case14 base engineering
+  varying01 = 1400
+  varying02 = 1325
+end
+case case15 base engineering
+  varying01 = 1450
+  varying02 = 1350
+end
+case case16 base engineering
+  varying01 = 1500
+  varying02 = 1375
+end
+case case17 base engineering
+  varying01 = 1550
+  varying02 = 1400
+end
+case case18 base engineering
+  varying01 = 1600
+  varying02 = 1425
+end
+case case19 base engineering
+  varying01 = 1650
+  varying02 = 1450
+end
+case case20 base engineering
+  varying01 = 1700
+  varying02 = 1475
+end

harness/experiments/analysis-context-20260911/generated/D-factored-cycle.rejected-study

@@ -0,0 +1,524 @@
+study D revision 1
+properties fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02, total, budget
+function budget_formula(result) = le(result, 22000)
+function total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02) = sum(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+case case01 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 750
+  varying02 = 1000
+end
+case case02 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 800
+  varying02 = 1025
+end
+case case03 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 850
+  varying02 = 1050
+end
+case case04 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 900
+  varying02 = 1075
+end
+case case05 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 950
+  varying02 = 1100
+end
+case case06 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1000
+  varying02 = 1125
+end
+case case07 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1050
+  varying02 = 1150
+end
+case case08 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1100
+  varying02 = 1175
+end
+case case09 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1150
+  varying02 = 1200
+end
+case case10 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1200
+  varying02 = 1225
+end
+case case11 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1250
+  varying02 = 1250
+end
+case case12 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1300
+  varying02 = 1275
+end
+case case13 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1350
+  varying02 = 1300
+end
+case case14 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1400
+  varying02 = 1325
+end
+case case15 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1450
+  varying02 = 1350
+end
+case case16 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1500
+  varying02 = 1375
+end
+case case17 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1550
+  varying02 = 1400
+end
+case case18 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1600
+  varying02 = 1425
+end
+case case19 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1650
+  varying02 = 1450
+end
+case case20 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = total
+  varying02 = 1475
+end

harness/experiments/analysis-context-20260911/generated/D-factored-deleted-row.rejected-study

@@ -0,0 +1,523 @@
+study D revision 1
+properties fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02, total, budget
+function budget_formula(result) = le(result, 22000)
+function total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02) = sum(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+case case01 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 750
+  varying02 = 1000
+end
+case case02 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 800
+  varying02 = 1025
+end
+case case03 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 850
+  varying02 = 1050
+end
+case case04 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 900
+  varying02 = 1075
+end
+case case05 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 950
+  varying02 = 1100
+end
+case case06 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1000
+  varying02 = 1125
+end
+case case07 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1050
+  varying02 = 1150
+end
+case case08 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1100
+  varying02 = 1175
+end
+case case09 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1150
+  varying02 = 1200
+end
+case case10 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1200
+  varying02 = 1225
+end
+case case11 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1250
+  varying02 = 1250
+end
+case case12 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1300
+  varying02 = 1275
+end
+case case13 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1350
+  varying02 = 1300
+end
+case case14 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1400
+  varying02 = 1325
+end
+case case15 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1450
+  varying02 = 1350
+end
+case case16 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1500
+  varying02 = 1375
+end
+case case17 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1550
+  varying02 = 1400
+end
+case case18 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1600
+  varying02 = 1425
+end
+case case19 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying01 = 1650
+  varying02 = 1450
+end
+case case20 independent
+  budget = budget_formula(total)
+  fixed01 = 1000
+  fixed02 = 1000
+  fixed03 = 1000
+  fixed04 = 1000
+  fixed05 = 1000
+  fixed06 = 1000
+  fixed07 = 1000
+  fixed08 = 1000
+  fixed09 = 1000
+  fixed10 = 1000
+  fixed11 = 1000
+  fixed12 = 1000
+  fixed13 = 1000
+  fixed14 = 1000
+  fixed15 = 1000
+  fixed16 = 1000
+  fixed17 = 1000
+  fixed18 = 1000
+  fixed19 = 1000
+  fixed20 = 1000
+  total = total_formula(fixed01, fixed02, fixed03, fixed04, fixed05, fixed06, fixed07, fixed08, fixed09, fixed10, fixed11, fixed12, fixed13, fixed14, fixed15, fixed16, fixed17, fixed18, fixed19, fixed20, varying01, varying02)
+  varying02 = 1475
+end