# Selective navigation/rename union with the root canvas and palette

Prepared source only, Codex-956atf, root-owned issue 27. The integration worktree is `.local/navigation-palette-union-20260913`, branch `codex/navigation-palette-union-956atf-20260913`, based on `e44f07565cc7599d5c5a15a6b5599b4f5d105718`. No compiler, test, native UI, Gitea write or publication was performed for this candidate. Root's later test-only readonly correction is deliberately left for the integration owner. Peer issue 13 WIP is excluded.

## Source provenance

The actual common Git ancestor of root e44 and peer navigation/rename 208 is `c6d296a7e22c8f126834a1e217b88551634dd5cf`; this preparation therefore imports scoped production deltas instead of replacing the peer tree or merging competing historical records.

1. `cb91525cfd9da7ac15ea1b21b962145c77bb9922`: desktop grapheme-aware shortening and direct `unicode-segmentation = "1.13.3"` dependency. The root lockfile already resolves that version; only oa-desktop's direct dependency list is extended.
2. `7aa007b0777aa182a99f46e90eeb9b2558f3ad2a..46b4f3c0d0f04050ad6d705051ee0199138e47a2`: production crate changes comprising bounded source navigation `fdf756e6a41b1879760e45c2c263bd671b562fe3` and the exact-identity/visual-focus correction `46b4f3c`. Core changes are the bounded tolerant outline and UUID-header-shape APIs, not an analysis schema or codec import.
3. `4db1ef543ced916179194272bf0e65dce73cb107..208268c8aa7f6bc3c2bab6a3c0657358f3f7dc23`: the already-composed navigation/rename production crates and language RST/HTML paragraphs. This includes the mandatory `cbc49a7802fb1bba0dd284fd904c700a0703ae70` preview-scroll correction, mutual modal guards, exact worker slots, captured action envelopes and Details visit rotation; its raw rename commits are not applied twice.
4. `10bd71197285a4ba894e6ed9398d2c5402ab463d`: the exact peer regression correction from `expected.project` to `expected.decoded.project`.

The peer's `harness/experiments/navigation-rename-union-20260912/README.md`, `native-acceptance.md`, import provenance and final source hashes were read at exact 208. They remain evidence for that source. This candidate does not inherit an execution pass from them.

## Composition decisions

The initial navigation patch had conflicts in `app.rs`, `behavior.rs`, `behavior/topology.rs` and `views.rs`; the rename documentation patch had insertion conflicts in `docs/language.{rst,html}`. They were resolved as follows:

- Keep root allocation dispatch and boundary retirement alongside navigation's first-valid-viewport completion. Stale Rename and stale toolbar-owner envelopes reject before either navigation reconciliation or allocation retirement. Passive allocation `KeyboardBoundary`/window-unfocus notifications preserve the pending navigation destination; actual allocation actions still pass through navigation retirement. New passive worker completions and stamped viewport events are recognized by allocation's boundary adapter.
- Keep `keyboard_owner_enabled` separate from busy execution admission, root `focus_pending` and pan/Space keyboard guards, root diagram focus wrappers and the state picker's stable widget slot. A diagram chooser also suspends allocation input ownership. Peer-only panel Focus actions are not imported as an unrelated prerequisite; their two classification arms are omitted from `is_navigation_camera` because those variants do not exist in the root UI.
- Keep typed activations, logical versus clipped correlation, conservative branch termination, no resurrection, lifecycle clearances, palette and guide/backplate/activation/foreground paint order. The behavior renderer gains the label-bounds helper required by actual-Scene navigation, retaining precise-message → activation → label → broad hit priority. Navigation does not create duplicate targets for activation segments.
- Keep root stronger preview boundaries while adding the peer's exact selected preview outline. Keep state selected-row outlines, lifecycle glyph colors and all palette foundation/readonly fixes.
- Keep the architecture allocation sensor/container identity while attaching stamped navigation measurements. Retain explicit `style::source_editor` together with the peer's dynamic editor ID and key binding. Preserve stamped Delete confirmations and the allocation feedback layer.
- Retain all root numeric, allocation, removal, focus, typed activation and lifecycle modules. No user specification or existing evidence is replaced. The readonly test file remains byte-identical to base e44 for the parent's separate fix.

### Correction to the preliminary compatibility audit

The earlier source prediction that port/state-row navigation necessarily leaves an owner placement armed for Delete was incomplete: `reveal_diagram_usage` ends by calling root `refresh_draft`, which normalizes both authoring placement fields for those semantic targets. Peer tests already assert this normalization. **That predicted defect is not established and no selection rewrite was made.** New mounted navigation-to-removal tests protect this actual composition, including confirmation and whole-source/model history.

The parent reviewed the main paint/focus/dispatch composition and identified an additional stale-toolbar seam. The resulting early Scope check and regression are included. This is a source review checkpoint, not runtime acceptance.

## New regression membership, all unrun

Three source/App tests under `app::source_rename::tests::navigation_union_tests::palette_union::`:

- `allocation_keyboard_notification_preserves_navigation_and_first_measurement`
- `stale_rename_begin_cannot_retire_allocation_epoch_or_new_navigation`
- `captured_behavior_toolbar_cannot_retire_a_new_documents_navigation`

They use the peer's actual four-file Unicode/CRLF source fixture, independently delivered lookup completions, captured intent and actual App update path. They check accepted snapshot identity, allocation epoch, exact navigation identity and the first valid viewport. No worker Tasks are polled by these source tests.

Two mounted tests under `app::diagram_removal_tests::navigation_union::`:

- `port_navigation_then_canvas_delete_preserves_owner_and_restores_exact_history`
- `state_row_navigation_then_canvas_delete_preserves_work_and_restores_exact_history`

They complete the real usage query, mount the production App tree, focus the real canvas with its public widget operation, capture actual Delete and Shift-Delete intents, cancel once, confirm the exact semantic target, compare the result with the core Delete command, and Undo to the full original Project/SourceBundle. They neither seed private canvas focus nor fabricate a removal intent.

The published navigation union's original six App tests and four retained-widget preview-scroll tests remain. The broader `navigation_union_tests::` prefix now contains **nine** tests because of the three nested additions; the new `palette_union::` filter alone selects three. The removal union filter selects two. Keep original coverage, source navigation/query/outline, alias-rename/document, diagram usage/reveal, root allocation/removal/focus, style and activation/lifecycle suites in the combined gates.

## Performed checks and remaining acceptance

Only source inspection, bounded formatting and whitespace checks are performed here. Rustfmt `1.9.0-stable (48a229ceae 2026-09-01)` was invoked with edition 2024 and `skip_children=true` on the 67 changed/new Rust paths, excluding the root readonly test. The first unqualified formatter attempt did not launch because the executable was absent from this shell PATH; its stale shell exit value is explicitly corrected in the ignored receipt. The second attempt uses the resolved toolchain from the parent's absolute `.local/toolchain/env.ps1`. Ignored import patches and formatting receipts are retained at `.local/navigation-import` in this worktree.

No `cargo`, `rustc`, test binary or GUI was run. Compile/lint correctness, new test outcomes, timing and actual native usability remain open. The integration owner should run focused new filters first, retain existing grouped/full/strict gates and build the matching executable. The parent's e44 results do not validate this union.

Native acceptance retains the peer's six-file `examples/source-project` oracle: rename the second `@assess_report` reference to `assess_report_union`, exactly six alias-token changes in two files, no disk change before Save, immediate editor selection/typing and text Undo, navigation without model history, complete model Undo/Redo, then Save/reopen equality. Also exercise actual overflowing preview/Details return, modal exclusivity, source syntax selection, canvas focus/Delete after navigation, exact port/state-row and repeated-placement targets, nested activation shoulders/lifecycle boundaries, and passive event timing. Use deterministic race tests for held operations; screenshots alone do not establish ordering. Linux remains deferred.

## Independent-review correction after 4e51, source only

The independent review of `4e51d68973da52cf057fab4983b9f112400b802c` identified an actual dispatch-order defect: old source, chooser and allocation envelopes reached shared reveal/allocation boundaries before their handlers rejected them. The follow-up shares those existing admission checks with the outer App boundary. SourceSymbols retains session/path checks; Find-close retains context/instance/open/availability checks and maps to the legacy Close only inside the checked handler. DiagramUsage retains exact Open document/revision/subject checks and all seven panel-token checks. Cancel, Preview and Release retain the active gesture token check; Refused retains its epoch check. Worker completion handlers and their exact occupied-slot release remain unchanged.

Rejected Press packets still run their existing feedback handler, before shared boundaries, so an old stamp can explain the changed view without consuming a newer destination. Current gestures, current chooser actions and current Find-close remain active. Current-token chooser model-refresh recovery is retained; this change does not require a matching panel revision before its existing refresh handler can run. No selection rewrite or broader event classification is introduced.

The exact test-only peer correction `a49b0ec7ac4538a372139175386a881645c1a59e` was inspected and applied: two collapsed conditions and one range containment expression in `app/diagram_usages/tests.rs` and `behavior/scenario/usage/tests.rs`. A source sweep also supplies the newly required `navigation_focus: None` in the root allocation test canvas and the production dirty-point-only canvas in `allocation_input.rs`. The latter is used only for the dirty-work hit check, not painted.

Four further tests under `app::source_rename::tests::navigation_union_tests::palette_union::`, all unrun:

- `captured_old_source_query_and_find_close_preserve_the_new_destination`
- `current_source_query_and_checked_find_close_remain_live`
- `captured_old_chooser_context_and_every_token_variant_are_inert`
- `current_chooser_open_and_close_keep_their_boundary_and_worker_semantics`

They capture actual prior owners/tokens and check complete navigation, allocation epoch, source interaction, status and accepted snapshot retention; each rejected navigation case then completes the valid pending viewport. Positive controls exercise current source query/Find-close and current chooser boundaries, including close while its worker slot remains occupied and exact completion release.

Two further tests under `app::allocation_drag::tests::navigation_union::`, all unrun:

- `stale_gesture_packets_preserve_navigation_and_a_new_live_cancel_still_works`
- `old_chooser_envelopes_preserve_a_current_canvas_gesture`

They capture Press through the actual DiagramCanvas event path, navigate through the actual chooser, preserve camera/selection/focus/pending measurement and the newer active gesture across stale packets, retain invalid-Press feedback, and exercise current Cancel and current chooser retirement. They do not seed private active gesture state. The resulting `palette_union::` filter contains seven tests, its enclosing `navigation_union_tests::` contains thirteen, the separate removal union still contains two, and the new allocation union contains two. The four existing preview-scroll tests are retained.

Only bounded rustfmt and whitespace/source checks are performed for this follow-up; the ignored formatting receipt is `.local/navigation-import/stale-envelope-format.json`. All new tests, compilation, strict lint and native acceptance remain unrun here. Root readonly, typed activation/lifecycle and paint implementations are untouched by this follow-up. The integration owner must execute the combined source gates; neither source review nor peer-only passes establishes union acceptance.