ARCADIA-Studio/harness/release-scenario-focus-review-20260911.md

Scenario parent-focus correction — independent source review

Codex-956atf /root/focus_review, 2026-09-11. No unresolved material source finding in the bounded I1/I2 correction. Runtime acceptance remains pending. This reviews the working patch over HEAD 8d55d2d2eb05aed826b96a917cf776e1d8c3b690, frozen with author scenario_focus_fix, including the final test-only strengthening below. The pre-reboot integration review remains unchanged history. See the implementation handoff.

Read AGENTS, current Gitea issue 1 coordination, empty open PR inventory, BehaviorAuthoring20260911 and ContextualSourceDrafts20260911 Wiki pages. Review ownership was posted at issue 1/comment 302. Only this new report was written. No production edits, Cargo, rustc, rustfmt, tests, renderer creation, native UI, install or commit occurred. git diff --check passed for tracked working changes; it is not compilation or runtime evidence.

Findings and resolution

I1, previous P2 — correction supported by source. scenario.rs:317, :490, :669 and :710 now request a fresh parent mount on successful Escape/Back/Use return. This changes only form_mount and form_focus_pending; form_session remains stable. Source staging and its existing admission/validation are retained. In workspace.rs:362 the Name ID includes the current stamp; at :642 the parent-only sensor is keyed by mount, while editor_panel remains keyed by editing session. The child still replaces the parent branch. An ordinary parent whose initial focus has already been consumed can therefore publish a fresh FormShown after the child returns. Raw semantic identities are not rotated to obtain focus.

I2, previous P2 — correction supported by source. App::view (app.rs:1029) wraps the final reference/hosted content with the scenario owner marker. scenario_focus_owner (:1387) computes the live document/scenario/revision/session/mount stamp and excludes busy, hosted, workflow, architecture, model-menu, file-prompt, deletion and pending-confirmation ownership. The marker is published from the current view on every operation traversal, rather than retained widget state. FormShown checks the context and consumes the exact mount before constructing the guarded task (:1410). Geometry epoch is deliberately absent from the stamp, so a same-mount viewport notification does not invalidate first focus.

focus.rs:84–119 collects without changing any focusable or scrollable. A mismatched owner or missing exact Name target ends with Outcome::None. Only a valid target yields Apply, initially invalid; Apply rechecks the current root owner before changing focus or scroll (:129–145). Thus a saved S1 action operated after replacement, child opening, same-session remount, document/owner/revision change or modal ownership change cannot act on S2 or clear another field. The scoped Name ID also prevents the former global-ID collision.

R1, P2 test weakness — corrected during review, execution pending. The initial reveal test scrolled to 1000 and asserted only a final offset at most 64. Without proving actual overflow, that sequence could pass with a broken reveal. Author changed the production viewport to 1100×700, requires measured pre-focus offset greater than 64, and measures the Name's effective bounds inside the actual form viewport afterward (workspace/tests.rs:217). Existing raw/history assertions remain. No claim is made that this stronger fixture has passed; missing overflow will now fail explicitly. Author also added a direct chained-Apply owner-change falsifier (:602) after review feedback.

Prepared regression scope

Five scenario_form_focus_* tests are present in workspace/tests.rs; four use the production headless renderer and actual App::view. Backend creation uses expect, with no absent-renderer/GPU skip. Tests remain under the existing debug-test module gate.

• The current-focus test retains stale-dispatch, repeated-dispatch, busy/hosted, epoch-only-change, raw snapshot, accepted-Project pointer and history assertions; it now executes the operation chain on the mounted production view and checks real reveal geometry.
• The return test (:507) first runs and consumes ordinary initial focus, mounts and focuses the actual source Name, then uses Back, valid Use and Escape independently. It checks stable session, changed mount, retained raw name/invocation/owner/slot/source-origin fields, focused parent, unchanged accepted Project/source bundle/history, and an unchanged returned recovery snapshot after focus. Use intentionally stages its source; the focus step must preserve that resulting snapshot.
• The saved-action matrix (:553) extracts S1's actual Widget action before eight live-state changes: replacement session, open source child, real Review candidate modal, document token, document revision, owner, same-session source-return mount, and hosted visibility. It operates on the rebuilt current App::view, preserving the focused child/Review or other actual input, source bundle, recovery state and Undo/Redo availability. This exercises delayed execution, not merely rejection of stale FormShown messages.
• The chained-Apply test (:602) successfully collects on the current parent, saves its Chain result, mounts/focuses a real Review candidate, and applies the saved operation there. It requires unchanged focus, recovery/source and history.
• Missing exact target (:626) deliberately uses a small generic marker/input tree with a valid stamp and an unrelated focused input. This is a narrow missing-target test, not claimed to mount the entire App.

focus_action extracts the first Widget action without waiting for task-stream completion while that action retains the channel. The execution helper follows Outcome::Chain. This matches the relevant synchronous chain behavior in the locally read Iced 0.14 runtime; no event-loop execution is claimed.

Scroll, chooser and integration boundaries

Compared behavior/scenario/focus.rs with forms/reference_chooser/trigger/focus.rs. Both translate bounds by accumulated ancestor offsets, restore traversal state when leaving ancestors, calculate reveal from inner to outer scrollables, clamp shifts to content capacity, and apply shifts by traversal index. Local Iced Scrollable::operate reports its translation before traversing content, matching that calculation. Scenario Apply focuses the exact stamped Name; chooser focus has separate form scope/relative navigation/modal policy. Their root marker types are distinct. No concrete sign, ancestor-scope or retained-child conflict was found in this readback; native pixels and broader nested-scroll behavior remain execution work.

The production test helper calls App::view's widget operation traversal. It does not invoke Iced UserInterface's additional overlay traversal. reference_chooser::Popup::operate (widget.rs:252) traverses its content, while its separate search input belongs to the overlay operation (:484). This report does not claim generic content traversal reaches that separate input. Existing child-open focus tasks and other focus systems were not redesigned or exhaustively audited.

Root owns scoped formatting, compilation, all five focus gates, related workspace/chooser/contextual-source tests, broader checks, matching GUI and native acceptance. Canvas integration must preserve the outer live owner marker, stamped Name, parent-only mount sensor and session/mount distinction. Root/author should link this review from their shared Wiki evidence; source review alone does not close the release or replace the frozen pre-reboot report.

Reviewed byte fingerprints

SHA-256, actual pre-format freeze. Paths are relative to crates/oa-desktop/src. Formatting or further changes require fresh gate provenance.

File	SHA-256
app.rs	4B700DBC6F8C0E8258B0F409C0B8F28266838F66ADAEABBEACE6B37E6DCAF736
behavior/scenario.rs	6E26E0EDD44D11D473B67E9DFE634185D77AE080E26776E9F55230D587ABA083
behavior/scenario/workspace.rs	D58CD2EA3F4603801BBD268906141076C5F70A83FB87A102B19A8806B083DEAE
behavior/scenario/focus.rs	48E1F227527E66CF0B56D75B23E05A1F4F89C3D0681760BE471D3E31362F2FBA
behavior/scenario/workspace/tests.rs	CBA10D3A5C2EC0DF9E5FA67EA2B2570412DACE45BBD1D351431CC1579970C56D
forms/reference_chooser/trigger/focus.rs	D489FA00F445BC603B3326CAD8721E2B608456ECF543954538904BF188C6C5FA
forms/reference_chooser/widget.rs	D66CC17AF7A48BB8598BE683F084BB08FA7AF7304F9636F0A1BEA94C5CF6C727

Independent follow-up — 2026-09-11, 15:34 UTC

Codex-956atf /root/focus_review. No material new issue found in root's explicit session-reset wrapper and zero-reveal-axis correction. This follows actual failures discovered after the preceding review; that historical source review did not establish installed-Iced key replacement or detect its fractional-capacity corner case. The preceding text and fingerprints are preserved unchanged (pre-append report SHA256 36F77578FA73998736EDE16098B91A697678E3696806F37E7178785FBA0B5BD9).

Read current Gitea issue 1 through comment359, empty open PRs, ScenarioFocus20260911 Wiki, the chooser diagnosis, current diff and installed Iced sources. Root assigned frozen working corrections over 8895dd2e0f87c0f16085bf4b478b8c0fbed38685; root committed those corrections during review as 80f25882143d977ca4984691740c3a7ffd45aedd (fix(forms): reset replacement sessions and preserve visible scroll). Reviewed bytes stayed equal to the saved gate manifest. This reviewer only appended this report; no production edits, compilation, test/native execution, Git mutation, network diagnostics or WSL/Linux work. Linux checking/builds remain deferred by the user's instruction.

Session reset and I1/I2 preservation

behavior/form_session.rs:37 stores an editing-session Id in its own typed widget state. If that Id changes, it updates the retained identity and constructs fresh child Trees. With the same Id, ordinary child diff retains compatible widget state. In scenario/workspace.rs:757 this wraps only the scenario-form scrollable and its fields; the footer and sibling canvas remain outside. Size, layout, operation, events, draw, mouse and overlay forwarding retain that child's behavior. The current child has Fill width/height, matching the removed one-child keyed column's layout contract.

The concrete pre-fix sequence is still the original regression: scroll form to700 and canvas to(137,850), edit raw Name and rebuild the same session, then Cancel→Start without a closed render. The saved full log independently reads retained form700 versus expected0. Installed iced_widget::keyed::Column::diff delegates to iced_core::widget::tree::diff_children_custom_with_search; with equal child counts, that helper diffs the existing child instead of constructing a replacement despite the changed key. The explicit wrapper removes that dependency. workspace/tests.rs is unchanged from8895: it still requires same-session700, replacement0, unchanged canvas(137,850), fresh recovery session, exact raw Name, same accepted-Project pointer and no Undo.

The focus session/mount distinction remains intact: workspace.rs:642–646 passes the session to the editor and keys the outer parent sensor by mount. Source Back/Use/Escape still changes the presentation mount and pending intent without rotating the editing session or raw semantic identities. app.rs and scenario.rs have no delta from8895. Stamped Name targeting, live outer owner marker, Collect's missing-target rejection and Apply's owner recheck remain unchanged. The wrapper forwards operations to its child without adding a competing owner marker or hiding a scroll ancestor.

Zero-axis correction

scenario/focus.rs:249–261 now returns exactly zero delta independently for each axis whose reveal request is zero. Nonzero axes retain the existing bounded reveal calculation, inner-to-outer traversal and guarded Apply. This is the same narrow correction as the reviewed chooser path, with no relaxed geometry assertion or ownership check.

Installed Iced rounds the translation reported to operations, while capacity remains fractional. For an already-visible target with rounded offset101 and capacity100.6, the old zero-reveal expression yields−0.4; the new branch yields0. Previously that artificial delta could change the underlying offset and its next drawn pixel. If one axis needs revealing and the other does not, only the needed axis receives a delta. An entirely visible target adds no scroll shift. This source reasoning supports the correction; no new numeric or runtime experiment was run by this reviewer.

Independently read execution evidence and frozen inputs

Read the saved logs under .local/chooser-correction-gate-20260911/: chooser 14 passed/0 failed/0 ignored,64.11s; scenario workspace 18 passed/0 failed/0 ignored,4.89s. The18 include the unchanged replacement-session regression and all five I1/I2 tests. These are root's executions, independently inspected here; they are not additional test runs. The earlier complete gate remains716/4,377.91s in its preserved log. This follow-up makes no full-rerun, native GUI or Linux acceptance claim.

Independently hashed the saved binary as 05811E18E4FF3495EECFD585947234906F27F7709B7E583F0362477EF1A943C3 and512-input manifest as 985C06A3B9926C9096F97D59DDE57CE3494F2FE06008BB9F46FBD5578126B4BB. All seven checked current inputs (the four root correction paths below, workspace tests, App and scenario state) match that manifest. This is a scoped input comparison, not an independent reconstruction of all512 entries. The three chooser-owned corrections remain covered by their separate diagnosis/review and root's gate.

Corrected/retained input below crates/oa-desktop/src	SHA256
behavior/form_session.rs	F5027FB3A5A5599A182E7D1A10DBA56DD66EB1F23A4BA4C4A1744C9A6A5B6E61
behavior.rs	94AE865C35BA6E5BA3EB77A0F77B795933A86801AE68E68E395A5E1E5E0EE6ED
behavior/scenario/workspace.rs	D338C612058FB9AE82A6ED016A334042898D4CBFC2A8524BA22F7718AA91B03E
behavior/scenario/focus.rs	73A9EA10AD7312086081B8688396A21AB4251C9FAECC2DF6D984B702F3963533
Unchanged behavior/scenario/workspace/tests.rs	457150FDA4B92EAC416A82819DFBA147C7F2F1400F71F092B7A8CD085ABAECFD

Root retains full-suite/native acceptance and the later canvas/process union. Reusing this helper there must preserve each editor's actual session/invocation identity; this review does not establish acceptance of that isolated candidate. The earlier limitation concerning the chooser's separate overlay search input remains unchanged.