# Saved selective view core — integration handoff

2026-09-06. Implements the approved closed contract from
`release-selective-views-design.md`; this record does not claim desktop/native
acceptance or freeze source 6 before the integrating checks finish.

## Implemented pure contract

`crates/oa-core/src/view_options.rs` owns `ViewOptions`, all seven persisted
fields and their enums, category/options reference validation, owned `ViewIndex`,
prepared per-view predicates, accumulated omission reasons and exchange labels.
All defaults reproduce ordinary visibility with exchange names. Empty `Only` and
`Any` remain explicit empty selections through serialization and reference cleanup.
Selected categories combine by union within their own family. The two families,
global work coverage and chosen work context then intersect independently.
Participant exchanges, other relations and traces do not acquire work coverage
semantics. Labels use declared item identities; empty item lists say “No items”.

`ViewIndex::new(&Project)` owns the accepted-model facts without a project lifetime;
cache it per accepted revision where useful. `prepare(layer, options)` computes
selected category unions and context reachability once. Each `includes(edge)` or
`reasons(edge, availability)` checks cached facts, never traverses the model.
No filtering helper creates placements, changes geometry or removes routes.

Shared `all_behavior_evidence` / `behavior_evidence` walk explicitly listed owned
occurrences, branch membership and valid same-layer reuse. They do not walk every
semantic descendant or infer work usage from allocations, state actions or a
participant transport. Root-context guards and visited identities bound malformed
cycles. The core owner has replaced diagnostic `included_evidence` with this shared
helper, retaining its structural error gating and existing diagnostics regressions.

## Required integration and evidence boundaries

| Seam | Required behavior / owner |
| --- | --- |
| Model and admission | Core owner adds root-only ExchangeCategory and Diagram.view_options; strict pre-6 formats reject new fields/kinds instead of leaking live enums. |
| Lifecycle | Core owner calls visit_references / retain_references for hidden edges, categories and selected contexts; removing the last member never widens selection to All. |
| Semantic transitions | Category family/member facets require exact mappings; no identity guessing or implicit category membership propagation. Core owner integrating. |
| Projection | Core owner filters drawn edges after deriving automatic port layout from unfiltered eligible edges. Toggle-only edits must preserve nodes, ports, authored routes, nesting and action rows. |
| Omission browser | Pass real projection availability to prepared reasons. Missing endpoints, outside projection and folded internal edges must not be represented as explicit hides. Accurate projection availability belongs in core, not a parallel desktop implementation. |
| UI | Existing normal property draft/Apply/Undo/recovery must carry options. Separate family selectors, explicit empty choice, named identity search, all reasons and restore-hidden controls are needed. Root plus this worker's new forms/view_fields.rs integration. |
| Rendering/parity | Canvas, SVG and REST projection must use the same filter and item-label semantics. Source/project/JSON reopen must preserve settings. Root/core integration. |
| Dense diagrams | Forty exchanges with the same projected endpoints remain a separate readability gate for whether representation-only grouping is needed; these helpers do not claim to solve that visual problem. |

## Focused evaluators

Eight new core tests cover 12 independent family-selector combinations, 15
coverage/context combinations, relation/trace and no-lines selections, immutable
hidden identity through category/label changes, all distinct projection omission
reasons, wrong-family/layer/unknown references, serialization/lifecycle empty modes,
and OA/SA nested/reused/unlisted behavior contributions including a malformed cycle.
The core owner's focused Cargo run passed all eight tests. Integration must
also run the existing coverage diagnostics suite and projection/lifecycle/source
round-trip regressions. Native Apply/Undo/reopen and dense display remain required.

The new `forms/view_fields.rs` now implements the closed property editor using
ordinary `FieldShape` messages, with 24-record searchable pages and named choices.
Search/page position are ephemeral Draft fields, not model facts or recovery data.
Core `projection::edge_availability` records decisions in the actual drawing
pipeline; the desktop combines these with saved filter predicates. Semantic scoped
form browsing is mapped by the semantic UI owner. Desktop compilation and native
acceptance are pending. Existing property materialization may reject an edit while
another raw field is invalid; the raw draft is preserved, and this slice does not
claim independent scoped editing for normal properties.

Independent integration review found that Traceability historically draws both
layers. Applying a declared-layer-only filter would silently remove the other
layer's lines under default options. Root approved the projection-specific fix:
`validate_options_cross_layer` and `prepare_cross_layer` admit hidden edges,
categories and contexts in both layers for Traceability; ordinary views retain
their declared-layer boundary. A ninth pure regression covers both-layer default
lines and mixed category/context/hide selection. The desktop uses the prospective
Diagram so pending projection/layer choices also determine picker eligibility and
omission geometry. This ninth test and two new property Apply/recovery/Undo tests
are compilation-ready for root's integrated run, not included in the earlier eight
passing tests. The two property tests additionally require that changing category
family retains incompatible members until explicitly corrected, rather than
silently dropping engineering membership.