# Local named behavior creation — 2026-09-10

Codex-9e8r6t `/root/release_audit`. Read the full updated objectives, behavior gap audit finding 2, current core ownership/viewpoint rules, process header, state-view planner and draft/recovery adapters. Packaging stays frozen. Initial isolated preparation has now been integrated through the parent Behavior/App/checkpoint adapters in the root-authorized shared window. Native Studio input remains root-owned.

**Current verification, 2026-09-11:** creation **21/21**, guide **3/3**, broader behavior **166/166**, checkpoints **13/13** pass. Root's immutable full suite passes **653/653**. The subsequent behavior-equivalent history lint correction passes affected history **63/63**, strict Clippy, workspace formatting and a matching GUI rebuild. Independent shared-seam review found no additional blocker; repeated-owner ambiguity was fixed and independently reread. Native acceptance is in progress. The mounted tests use the actual Iced widget tree with the unit renderer; they establish pagination and layout bounds, not native font shaping or whole-window acceptance.

## Engineering task and design decision

An engineer should start a named process, scenario or state machine inside Behavior, with a visible ownership/viewpoint decision, then immediately work on that behavior. Three small alternatives were considered:

| Alternative | Benefit | Cost |
| --- | --- | --- |
| Three permanent creation buttons in every header | One click to a form | Adds permanent competing actions to already dense process/scenario tools. |
| New → three task choices → one focused card | Keeps normal editing compact; only relevant creation decisions appear together | One extra choice click, and the current diagram temporarily gives way to the draft. |
| Multi-page creation wizard | Explains semantics progressively | Separates name, ownership and viewpoint across navigation and increases correction/recovery burden for a small task. |

Selected the second approach. It follows the existing compact workspace pattern without a generic kind catalog. The card's fields scroll, while Create/Cancel remain outside the scroll region. Machine owner and optional scenario context searches show at most six named candidates per page, with alias/kind and selected identity visible. No first match is silently selected. The optional scenario context starts collapsed so name/viewpoint remain the primary decisions; expanding or hiding it retains the authored reference and raw search.

Concurrent native Capella study by `/root/palette_finish` observed OA task links OABD/OAIB/OAS. OAS opens a single name dialog with the viewpoint chosen through the entry link, without a global kind catalog. The project became dirty before accepting the dialog, suggesting a prerequisite capability side effect; this is an observation/inference to be retained in that study's own report. Studio's proposed explicit viewpoint choice serves the same task, with no implicit capability or shared-source creation. This source slice has not been compared against running Studio yet.

## Implemented module contract

`creation::State` owns a serializable raw draft, stable reserved semantic/view/placement UUIDs and a captured document identity. `Event::Open(layer)` presents three task choices; `Choose(Family)` selects a layer-correct Process/Functional chain, Scenario or State machine. A family/layer change while pending refuses until cancellation. `Cancel` clears only the draft and returns no command. `Submit`/`prepare_pending` produce a validated `Command::Batch`; acknowledgement is explicitly separate and must follow successful `Document::execute`.

Names are retained exactly, including meaningful Unicode and whitespace. Blank names refuse. Scenarios require one of the two layer-specific viewpoints; `MixedLegacy` is unavailable for new creation. Current core containment permits Process/Scenario only at layer root; the card states that fact. Optional Scenario context is a separate same-layer reference matching the core's existing context contract. A State machine requires a valid existing same-layer participant owner. Missing sources are never guessed or created by this form.

The first machine view is opt-in. Its geometry comes from the existing `state_edit::create_view` planner, with reserved view/root-placement IDs substituted and the exact expected CreateDiagram+Layout contract checked. The final batch creates only the machine and optional view; it invents no region, state or transition. The module returns `Created { behavior, layer, diagram }` for selection only after commit. Every prepare revalidates current owner/context, document and reserved-ID availability; stale references or source rejection retain all inputs.

The initial ten nested tests covered: OA/SA sequence exact names and root ownership; all four explicit scenario viewpoints/context; both layers' owner validation and opt-in view without implicit states; cancellation and family/layer guards; raw recovery/stale owner/document; rejected source-budget transaction with exact accepted Project/SourceBundle/history preservation; search over 105 owners with same-layer/kind filtering and stale-page clamping; recovery-schema/reserved-identity rejection; command-correlated post-commit selection; and optional-context collapse/recovery retaining raw values. Shared Document tests compare complete Project and SourceBundle before/after Undo, Redo and reopen, preserving IDs rather than rediscovering them.

## Review while shared compilation is frozen

Four integration risks were identified before wiring. First, `apply_behavior` and direct Behavior Submit each execute and acknowledge; duplicated selection handling can diverge, while merely reading reserved IDs in generic App::execute can redirect an unrelated command. Added `creation.created_by(&Project, &Command)` which compares the complete deterministic prepared batch, including scenario body and all subsequent operations; unrelated or altered commands return no target. The shared execute path should use that helper, then select/open only on success and before syncing. Second, checkpoint restore currently infers a layer only through an existing selected or pending-owner element. A new rootless SA behavior instead requires its recorded `pending_layer`, without syncing away simultaneously recovered raw property/source text. Third, captured Escape is filtered globally; add a creation-only captured-Escape subscription, letting the ordinary route handle uncaptured events once. Fourth, always exposing the optional context list made six irrelevant choices compete with mandatory name/viewpoint; the section is now opt-in and retains its values when hidden.

Further native Capella findings from the separate worker reinforce occurrence/source separation: named Functional chain creation was followed by a separate Functional Chain Description diagram action; its Function palette involved an existing function through a filtered picker, with no create-source option in that observed picker. Combining a named chain with its ready workspace is the intended Studio improvement. Additional shared-source creation remains a separately explicit operation.

The preparation-stage review preceded source integration. Its command-correlation and captured Escape findings are addressed in the integrated code and tests described below; native UI acceptance remains pending.

## Exact integration boundary

Root accepted the following shared-file boundary; it is now implemented after the focused layout gate:

1. Declare `pub(crate) mod creation` in `behavior.rs`; add `State.creation` and `Event::Creation(creation::Event)` plus outer recovery `RecoveryKind::Creation`. Extend capture/restore, `has_pending`, prepare and successful acknowledgement. Keep creation `pending_layer` distinct from `pending_owner`: a new behavior is not an existing owner and must not drive the old selected-owner fallback.
2. Add New to the compact owner header and the empty Behavior view. If the creation card exists, render it before existing selected-owner lookup; map its local `Element<Event>` to `Message::Behavior(Event::Creation(...))`. Focus `creation::NAME_INPUT` when a family is chosen, including a restored named draft.
3. In App, guard creation start explicitly against raw source/property/other-behavior drafts. **Do not use the current generic starts-form `self.apply()` path**, which can silently commit a different editor's valid draft. The layout worker independently identified and is repairing the analogous scenario-tool defect.
4. In the common execute path, correlate `creation.created_by(self.project(), &command)` before document execution. Only after successful execution, set layer, selected semantic behavior, `behavior.active_owner` and optional `behavior.diagram.diagram`, then sync. Both direct Submit and `apply_behavior` acknowledge afterward. Failure must retain raw fields and prior accepted state; unrelated commands must never select reserved creation IDs.
5. Handle first Escape for this creation card even when a text input consumes keyboard events, using a narrowly scoped captured-Escape route. Escape must create nothing, not apply another draft. Keep other behavior form semantics unchanged.
6. Restore the creation draft's layer/name focus without creating anything, alongside existing behavior recovery. Add App-level tests for empty-project New → create/open, explicit all-draft guards, selection after commit, captured Escape, reserved IDs through recovery, source failure retention, and opening a lesson while a draft exists. Then compile/focused tests and run native Create/Undo/Redo/save/reopen at normal/minimum window sizes.

No diagram/scenario-view files are owned by this work. Native behavior acceptance, broad release integration and task ledgers remain root-controlled.

## 2026-09-11 integration in progress

Read the full new objective `C:/Users/User/.codex/attachments/815ff7b9-73c4-41a2-a809-635ecf8389d6/goal-objective.md`, including the strengthened uncluttered text-only modeling requirement. The source creation uses the existing typed core/Document transactions, so names, ownership and explicit viewpoints are exercised through exact textual SourceBundle and JSON command round trips rather than separate graphical semantics.

Root released the shared source window and sole Cargo lease after the corrected scenario 53/53 gate. State/Event/recovery/header, App command correlation and draft guards, checkpoint layer/name focus and captured Escape are now wired. The independent command-boundary finding changed `created_by` to `created_by(&Project, &Command)`: it compares the complete deterministic prepared batch before execution, caches its target, and applies selection only after success. This also refuses valid changed scenario viewpoints/contexts and creation batches followed by rename/delete. The captured-only subscription is active only during creation and emits ordinary `Message::Escape`, preserving existing file/confirmation/hosted/workflow/menu overlay priority.

Twelve planner/Document/mounted-layout tests and six App tests are prepared. The new mounted test lays out actual creation widgets at 500×320, 500×570 and 1050×570, checks the field scroll region and footer bounds, and counts six rendered candidate containers among 105 long-name owners. A focused text-input test sends actual captured Iced Escape through file and pending-confirmation overlays, requiring the first Escape to close the overlay while retaining the draft and the second to cancel only creation. Native typography and whole-window acceptance remain separate gates.

Two compilation attempts exposed local import/test typing errors, corrected without changing product semantics. The first executable gate passed 18/19: one new test incorrectly dispatched property `Message::Apply`, which deliberately refuses a pending behavior form. It now dispatches the actual generic Behavior Submit route and retains all machine/view/history assertions. A stale previous-layer New event now refuses without replacing any pending raw draft.

Final focused verification passed **20/20**, 632 filtered, after 40.34 s compilation and 0.28 s execution (`focused-tests-4.log`, `focused-tests-4-status.json`). Broader behavior passed **166/166**, 486 filtered, in 13.35 s (`behavior-tests.log`, status JSON); checkpoints passed **13/13**, 639 filtered, in 2.26 s (`checkpoint-tests.log`, status JSON). All paths are beneath `.local/behavior-creation-20260911/`. The current total is 12 planner/Document/mounted tests and eight App tests. All earlier failure logs remain retained.

Frozen test handoff: `tests-candidate/arcadia-studio-tests.exe`, 105,347,072 bytes, SHA256 `30FCD4E8258512064FD30B64C4F0249067A0318CE2ABDC6BB4D49504591E0000`. Sibling `libunwind.dll` is 190,976 bytes, SHA256 `F45604A12E8BCD839FD86F667C1BE1CC7C4F9DA2B3C69FF381AC708F0E1AE7D4`. `manifest.json` records actual source input hashes and the uncommitted integration boundary, including the scenario Sensor correction. Root owns full 652-test execution and native acceptance. GUI/strict Clippy are pending independent-review triage.

## Final source and artifact checkpoint

The initial candidate above is superseded by the following explicit snapshots; none was overwritten.

Ergonomics review found that name/kind/alias alone did not identify repeated nested participants, while a collapsed scenario context lost even kind/alias. Candidates now show a name line and a second line containing kind, alias, layer and ancestor path; search includes that context. Selected and collapsed references retain the same distinguishing information. The new North/South station Pump regression proves search discrimination and the exact created machine owner. The reviewer independently confirmed this correction; long native text wrapping remains a runtime gate. Missing-owner creation still requires canceling and creating the participant in Architecture, a documented separate workflow limitation.

The in-app Chains, Scenarios, States and Recovery guide topics now describe the actual named New flow, explicit viewpoints/root semantics, searched machine owner, optional first view, raw-draft guards, Escape and recovery. The final creation filter passes **21/21** in 0.31 s and guide **3/3** in 0.06 s (`focused-final` and `guide-tests` logs/status).

Root executed the frozen `tests-final/arcadia-studio-tests.exe`: **653/653 passed** in 362.83 s. It is 105,356,288 bytes, SHA256 `864B0FE89D0DC33F19D8414531501CB4D9DC5E7527B925A16E74ACA0E1197E86`; source manifest and `full-desktop.log` / `full-result.json` are siblings. These results are root-executed evidence, independently read back here.

Strict Clippy then identified one existing `collapsible_if` in `forms/history_fields.rs:582`. Root authorized its equivalent let-chain spelling. The conditional lookup, action and evaluation order are unchanged. Afterward **strict Clippy with all targets and -D warnings passed**, **cargo fmt --all -- --check passed**, **history filter 63/63 passed** in 15.67 s, and the matching GUI rebuilt in 19.86 s. Logs/status are `clippy-final`, `fmt-final`, `history-final` and `gui-lint-final` beneath `.local/behavior-creation-20260911/`. No duplicate full suite was run after this approved lint-only change.

Final immutable GUI: `.local/behavior-creation-20260911/gui-verified/arcadia-studio.exe`, 111,163,904 bytes, SHA256 `D4D9C2BD937E301FF1009D7CB93A34EE5AA6DFC837FF7E87D468C85371B20C31`. Its sibling runtime DLL has the hash above. `manifest.json` records exact current input hashes and verifies that the only difference from the passing full-suite source snapshot is that history let-chain. Earlier `gui-final` (SHA `40CF0506AE29298D3CB958DD9BBD7312EFFFF3716BDC2D99DFFDFBE63EF43F23`) is preserved as the pre-lint build, not the final native handoff.

Owned source files for integration: `behavior/creation.rs`, `behavior/creation/tests.rs`, `behavior/creation/app_tests.rs`, parent `behavior.rs`, `app.rs`, `app/checkpoints.rs`, `guide.rs`, and the approved narrow `forms/history_fields.rs` lint correction, all under `crates/oa-desktop/src/`. This report is the only owned harness narrative. Independent reports, root ledgers and native/oracle evidence retain their separate owners. No commits, pushes, index staging or native input were performed by this worker. Cargo writer lease was explicitly released after all terminal gates; palette_finish owns native cancellation/focus/long-label QA and root owns actual creation/oracle/save/reopen acceptance.