ARCADIA-Studio/harness/release-contextual-source-creation-20260911.md

Contextual prerequisite creation — implementation and evidence, 2026-09-11

Codex-9e8r6t /root/release_audit. Root-authorized bounded slice following release-contextual-source-creation-plan-20260911.md; independent review by /root/behavior_audit. Focused contract tests, strict lint, matching Windows GUI build and formatting passed. Root native/integration evidence remains separate as stated below. No native input, commits or release acceptance are claimed by this worker.

Outcome and contract

An engineer can stage a missing semantic source inside a Scenario Lifeline, process/chain Work contribution, or new State machine owner form. Existing-source controls remain host-owned siblings; the external Codex-956atf reference chooser is untouched. Source and consumer names are independent. Participant kinds are explicit; OA Role is available for the appropriate lifeline only, never a machine owner. Semantic parent is shown explicitly, defaults visibly to the layer root where valid, and has a bounded searchable alternative list. MixedLegacy retains existing-source editing but no generic new-source catalog. Qualified Action creation and inferred allocations/capability involvement are excluded.

Option A from the frozen plan was chosen over suspending the form in Architecture (separate history/orphan risk) and multiplying dedicated source-plus-use tools (would not solve an already partially typed parent). Child Use validates/stages the prerequisite without adopting any model/source change. Back or Escape returns to the retained parent; final parent Apply/Create creates only its actively referenced staged dependency plus consumer and optional machine view in one validated transaction. Choosing an existing reference prunes the inactive source from that transaction.

behavior/source_draft.rs captures semantic document identity, typed reference scope, original owner, source name/kind/parent, child invocation token and reserved identities. Parent adapters retain their own raw fields, insertion/branch positions and invocation identity. Private preview Projects use existing core predicates; no staged object enters the accepted catalog. The parent planner's typed CreateElement/CreateRelation/reference/SetSteps records are remapped to reserved IDs, with aliases regenerated from those IDs. Machine/view IDs already reserved by the creation planner remain unchanged. Flattened final commands preserve exact command-correlated consumer selection after successful Document execution. Source write rejection retains both raw forms.

Scenario and process empty prompts count semantic children, not rendered/visible nodes. Scenario first actions carry the current canvas Context and recheck semantic emptiness; process reuses its Context-bound Begin at explicit append. Appearance/resize performs no mutation or focus operation. An unavailable pending owner is rendered as a retained-draft repair/cancel view before choosing any other owner.

Independent criticism incorporated

• New Work adjacent to an Exchange must match its existing endpoint identity. A newly reserved source cannot do so; preserve the captured slot and refuse rather than retargeting the exchange or silently appending.
• Source Use on an unnamed machine now stages its valid owner and returns, allowing the still-empty parent name to be completed without discarding the source.
• Back is token-validated dismissal and remains available with stale/deleted owners or unrelated recovered raw editors; other source actions keep strict guards.
• Recovered incomplete source kinds have a total summary, followed by a normal planning error rather than a panic.
• Old empty-action events are scoped to their original canvas context. Missing-owner forms remain visible and do not fall through to another scenario/process and panic.

Verification status

• focused1.log / focused1-status.json: compiler reported missing Clone for topology's private draft copy. The known-failed rustc was explicitly stopped; Cargo exit 101. No tests ran. Topology Draft/Browser/contextual Draft now derive Clone.
• focused2.log / focused2-status.json: one guide explain call had an extra body argument. The known-failed compiler was stopped; Cargo exit 101, no tests ran. Corrected by merging the explanation body. The focused3 compiler then rejected a test calling a private App method; no tests ran. It was corrected to send the real Message::Command route. The successful focused4 gate includes the nested source-parent, unchanged caller-binding warning and no-op Undo/Redo status regressions.
• focused4.log / focused4-status.json: PASS22/0,653 filtered out,2.04s execution after9m56s build. Test inventory675. Immutable tests-verified/arcadia-studio-tests.exe SHA256 6E677F58458B6122EA1886AAC98882640CD9CF260651FE3ECE62BDDA4BE38CC0 (107061248bytes); sibling manifest and libunwind SHA256 F45604A12E8BCD839FD86F667C1BE1CC7C4F9DA2B3C69FF381AC708F0E1AE7D4. Frozen source inputs: focused4-inputs.json. Root executed the immutable full suite: PASS 675/675 in 448.33s; tests-verified/full-desktop.log and full-result.json. This predates the narrow final origin, guide and lint corrections below.
• Tests target exact source/consumer records, OA/SA strict viewpoints, source/consumer names and aliases, reserved-ID recovery/retry, one Undo/Redo and SourceBundle equality, inactive dependency pruning, second System refusal, Role owner refusal, guarded path insertion and exchange-adjacent refusal, raw source-budget failure, owner-first machine staging, modal Escape, dirty editor admission, recovered inner form, bounded footer geometry, stale CTA, malformed recovery and missing-owner rendering.
• Source formatting and scoped whitespace check passed after the guide correction. Final post-review hardening also rechecks recovered typed source scope against the parent adapter; malformed-scope regression passed in focused4. The full675 snapshot passed as above; the matching final GUI/Clippy gates passed below; real native staged creation and minimum-window readability remain root gates. No Linux runtime or release packaging claim follows from this desktop slice.

Evidence directory: .local/contextual-source-20260911/. Frozen older native/creation/packaging artifacts remain unchanged.

Final origin and compatibility review

After child Back or switching to an existing source, a previously engaged parent must remain bound to its original semantic Project and exact consumer Element, even when no staged dependency reaches the command. Both Scenario and Work source-event admission and final command planning now compare that captured record against the actual parent draft owner. A valid different owner record cannot impersonate it. Missing-origin legacy recoveries bind only on their first valid, previously unengaged child Open; an already engaged recovery never silently rebinds. Back remains token-only dismissal. The worker found the post-Back/inactive command gap; independent reviewer confirmed it and sharpened the different-valid-owner recovery counterexample.

The additional 23rd focused test covers legacy/current recovery × Back/inactive-source for both Scenario and Work, with a valid unchanged control, exact raw preservation on different-Project rejection, missing-origin rejection and borrowed-valid-owner rejection in final preparation and child Open. This final addition passed in focused5: 23/23 contextual-source tests, 653 filtered out, 0.98s execution after 4m48s compilation. Final test inventory is 676. The same compiled test executable also passed guide-final 3/3 in 0.20s. Exact logs and status JSON are retained; strictClippy2 passed all targets with warnings denied in 4m29s; matching GUI and workspace formatting passed on the same frozen inputs.

clippy1.log / clippy1-status.json completed with exit101 on three unnecessary_lazy_evaluations in the empty Scenario first-action buttons. Those constant event values now use then_some. No other strict-lint diagnostic was emitted. The stale guide instruction to cancel and create a missing machine owner in Architecture was removed; sequence guidance now identifies work/exchange contributions accurately. These final changes are outside the full675 artifact.

Owned source and integration boundary

All following source paths are under crates/oa-desktop/src/: app.rs, app/checkpoints.rs, behavior.rs, behavior/creation.rs, behavior/scenario.rs, behavior/scenario/workspace.rs, behavior/topology.rs, behavior/topology/contextual.rs, behavior/topology/direct.rs, behavior/topology/view.rs, guide.rs, and the new behavior/source_draft.rs / behavior/contextual_source_tests.rs. The contextual topology draft only gains Clone for private parent copies. Root owns integration/index/commits and native input; no core, server, schema/grammar or externally owned reference chooser changes belong to this implementation.

focused5-inputs.json records the frozen Rust/build-input scope and current commit context; focused5-delta.json records the seven changed desktop files relative to the passing full675 snapshot. It does not claim the uncommitted desktop source is contained in that commit. Immutable final test/GUI staging includes explicit manifests after all final gates and the unchanged-input check.

Final frozen handoff

Final gate script completed exit0. focused5.log passed23/23 (0.98s), guide-final.log passed3/3 (0.20s), clippy2.log passed all targets with -D warnings (4m29s), gui-final.log passed the matching GUI build (6m20s), and fmt-final.log / status passed workspace formatting. Every gate has a separate started/finished/exitCode JSON. stage-final.ps1 rechecked every recorded frozen input hash and refused existing output directories before copying. No source changed during these gates.

Immutable artifact	SHA-256	Bytes
gui-verified/arcadia-studio.exe	52DE82E434B636E18DB02D381842AA6DB84B721CFFD5502063F784F37246ACCE	112219136
tests-final/arcadia-studio-tests.exe	405577A35CE643AC022885AF58706D6F8B321224AE6D68E2555FBFAF3D626F38	107101696
Both stages' libunwind.dll	F45604A12E8BCD839FD86F667C1BE1CC7C4F9DA2B3C69FF381AC708F0E1AE7D4	190976

Artifact paths are relative to .local/contextual-source-20260911/; each stage has manifest.json, linked to focused5-inputs.json and the explicit seven-file focused5-delta.json. The final executable contains676 tests; the full675 pass belongs to the preserved earlier artifact and is not relabeled as a full final676 execution. Only the affected23 and guide3 were run against the final test executable by this worker. Root can run any broader immutable gate without a Cargo build.

Root received the exact final GUI path/hash for independent staged-source native checks. /root/palette_finish received the released compiler lease for its separately authorized locked/offline CLI metadata. This worker performed no native GUI actions, release publication, Linux run, index staging or commits. The source/report ownership listed above is frozen; further source changes require an actual new finding and corresponding evidence scope.