ARCADIA-Studio/harness/release-allocation-drag-planner-source-20260911.md

Allocation drag planner source handoff — 2026-09-11

Codex-956atf /root/allocation_drag_planner, delegated by root under issue 3 comment 452. This is an isolated source contribution, not integration or native acceptance. Root owns coordination, the compiler lane, review, integration and delivery.

The worktree is C:/Users/User/Documents/Git/ARCADIA-Studio/.local/allocation-drag-worktree-20260911, branch codex/allocation-drag-956atf-20260911, based on abffa4b3f0a859d7439103100f59805804d46e55. Changes are uncommitted. No root-worktree source, core/schema/guide, App/diagram wiring or peer child-work implementation was edited. No Git mutation, Gitea mutation, compiler/test/native execution, Linux/WSL, VPN/network diagnosis or subagent was performed.

Contract and implemented source

Read this worktree's AGENTS.md and PROJECT_GOAL.md, the parent's original design, independent review, and adopted v2 contract. The latter three reports were read in the root worktree. User-owned specification text was not changed.

• allocation_drag.rs is ordinary reusable Rust, independent of Iced and Document mutation. main.rs adds only #[cfg(test)] mod allocation_drag; at root's direction, so the unmounted component is available to real component tests without exposing unused production code or suppressing warnings.
• capture(Project, diagram, work, placement) validates the baseline and retains exact same-kind semantic work records S, leaf provenance L, and active-diagram placements Q. It includes folded and unplaced leaves, direct Allocation identity/metadata, RoleAssignment/RoleRealization records and effective performers. Uniform classification distinguishes Assigned(P), Unassigned and MixedOrUnresolved. Existing core duplicate-placement and cycle validation remains authoritative.
• plan_semantics(Project, Scope, Destination, leaf_to_stable_id_map) rechecks the captured records, refuses composite mixed/unresolved/distributed geometry, composes existing CreateRelation/EditRelation/Delete commands and runs core preparation/validation. Same-effective assignment, including role-only or mixed direct/role provenance, leaves semantics exact. Different performer changes only leaf Allocation sources or creates stable caller-allocated leaf identities. Outward retained roles produce a named refusal explaining fallback performers. No work parent or role record is edited.
• Expected semantics are constructed independently from those commands. An exact whole-Project equality gate rejects both removed records and surviving changed records, including Constraint reference cleanup, artifacts, traces/baselines, SA mapping cascades and general view-option pruning. The only cross-diagram permission is removing a stored route whose own Allocation was intentionally deleted. Core warning diagnostics are retained on the plan.
• place(plan, requested_root_position, PresentationContext) clones presentation only and uses the plan's candidate Project and ViewIndex. Root coordinates snap to the existing ten-unit grid, then one identical delta applies to every Q placement. Routes use translated_routes and the captured accepted Q delta map; one-ended pins and label offsets retain their contract. Target unfold is explicit. No placements are invented. The visible and read-only expanded moved subtree are checked for coherent geometry, unchanged relative footprint, bounded coordinates and introduced/enlarged unrelated-card overlaps. Geometry ancestry is computed before pairwise collision checks; the current check remains quadratic in projected card count, with no large-model performance claim.
• finish(plan, live_project, placement) rejects changed live Project values, recomputes placement and repeats full command preparation and whole-Project equality. It returns an optional stable-ID Batch. None is a snapped no-op. The caller must execute the final Batch once through Document::execute, which remains responsible for source compilation, atomic adoption and history.

Explicit integration boundaries

These structs are data, not clean-input or gesture capabilities. No source/property/behavior-draft, modal/busy, selection, focus, camera, window, revision, document-instance or token checks are implemented here. The App must guard press, preview and release; maintain an input epoch that rejects a retired token even after Undo or a modal returns to equal values; and register/consume ordered native press/release packets. No existing selection helper or apply() is called by this planner. No ordinary gesture has yet been redirected from legacy MoveNode.

The actual frozen target resolver remains required: compatible visible regions, semantic ancestor precedence, incomparable overlap refusal, half-open boundaries, work-card/overlay/control/port/edge occlusion, exclusion of Q and its ghost, and outside-viewport cancellation. The planner only checks that a supplied target placement is the intended performer, was visible in the accepted projection, and its supplied label rectangle lies in that frozen header and viewport. The renderer must show the matching frozen label/outline above the ghost. PresentationContext.viewport must come from the actual captured camera/bounds at zoom; this component cannot prove that transformation or native text legibility. It uses the present canvas's 62-world-unit header band for visibility. Native low-zoom/large-header review is still required.

The caller computes requested root position from the original placement plus ordered pointer motion in the captured transform, preserving press offset and the existing three-screen-pixel drag threshold. Cache a SemanticPlan by document/revision, token, scope/provenance, mode and destination. Reuse it across pointer motion, changing only placement. Include snapped delta, target unfold and frozen geometry identity in the placement cache. All candidate drawing, ports, routes and feedback must use plan.project() and plan.index() with placement.diagram/placement.view; the accepted semantic index is insufficient after a destination change.

Mixed-layout convergence, deliberate role exit and dependency repair remain named refused continuations. The component implements no packing, automatic Fit, generic impact/draft framework or UI approval flow.

Verification authored and actual evidence

allocation_drag/tests.rs contains 24 unexecuted tests against actual OA/SA Project, projection/ViewIndex, prepare_command and Document APIs. They cover:

• Incoming/reassign/outgoing allocation identity and metadata, unchanged parents/elements, exact active placement, inactive diagrams, source comments, source compile/reopen and one-step exact Project/SourceBundle Undo/Redo.
• Same-effective role-only and uniform mixed direct/role no-ops; explicit different performer and retained advisory role warnings; unresolved/ambiguous-role explicit targets; truthful outward role fallback refusal.
• Uniform first/second/grandchild work, folded placements, an unplaced leaf, stable per-leaf IDs, no parent Allocation, manual port anchor and existing functional-port preservation, both-ended route translation, one-ended pins/labels and other-diagram preservation.
• Mixed P/x/y refusal for both semantic and Arrange only operations; changed first-child Allocation and RoleAssignment provenance; same snapped point with different semantic target candidate/index; exact snapped no-op without losing Redo.
• A surviving Constraint mutation after core-valid Allocation deletion, artifact/manual-trace cascade, deferred SA PortAllocation/ExchangeAllocation cascade, unrequested view-option pruning and allowed own-edge route cleanup across diagrams. OA communication incompleteness remains advisory.
• Explicit collapsed-target unfold, mismatched/fabricated/clipped target labels, new/enlarged and folded-subtree collisions, preexisting nonenlarged overlap, bounds/header refusal, missing/reused IDs and duplicate placements.
• Document source-budget refusal preserving exact Project/SourceBundle/history/revision, followed by a stable-identity retry with adequate source budget.

Actual checks: root-authorized task-local rustfmt.exe --edition 2024 --config skip_children=true completed successfully on the three owned Rust files (syntax parsing and formatting only), and git diff --check found no tracked whitespace errors. No compiler, Cargo command, unit test or native workflow was run by this agent; no test pass or semantic/runtime acceptance is claimed. The tests and fixtures need root's compiler lane and independent review, then mounted/native acceptance from the v2 contract before this slice can be claimed.

Root can run the targeted component suite using the repository's configured desktop test environment with a test filter allocation_drag::tests; inspect the exact integrated source and relevant existing regression gates. No full test command is prescribed here because root owns the active toolchain/runtime configuration and sole compiler lane.

Adversarial-review coverage addendum

Root reported no actionable defect from the independent source review and requested three missing regression groups. Only the test file and this addendum changed. Five new OA/SA tests bring the total to 29, all unexecuted by this agent; the original 39,035-byte test-file prefix retains SHA256 C1C78CECD8628EAA66172356110E2FF47A7B824D53B8D05CE9196EE8D6AB9D24.

• Moving only x from uniform P(x,y) changes the exact intended Allocation and x placement, preserves y and stored routes/other diagrams, and projects changed ancestor grouping. A roomy ancestor placement allows reassignment and outward return to P; an overlapping regrouped ancestor refuses despite valid candidate semantics.
• A populated collapsed target admits insertion into available space while preserving all existing target placements and a nested collapsed work group. Covering existing content refuses. Separately, opening the target to expose an already-authored hidden overlap refuses even when the incoming card has room: the conservative first slice rejects newly exposed confusion as well as relocation collisions.
• Valid StateAction and Availability relations under A's lifecycle cause the real state_owner_context error after A→B reallocation. Tests check core diagnostics, planner refusal, and atomic Document rejection preserving Project, SourceBundle, revision, Undo and Redo. The inspected validator permits missing effective performer in this context; the tests explicitly accept outward semantic removal rather than inventing a prohibition.

Task-local rustfmt parsed/formatted only the modified test file successfully. No compilation, test/runtime/native execution or Git/index work occurred during this addendum. allocation_drag.rs and main.rs remain frozen at their original hashes; root still owns execution and acceptance.