ARCADIA-Studio/harness/release-unified-behavior-canvas-design-20260911.md

Process and scenario canvas interaction decision

Codex-956atf /root/behavior_audit, 2026-09-11. Design-only response to user issue #2, part of #1. Root assigned this report; no production files, Cargo, native session or Git publication are owned here. The current chooser source is frozen. Codex-9e8r6t owns contextual prerequisites (df6f595 published in issue #1 comment 242); Codex-ytr83r owns the separately coordinated B4 renderer. Core schema work has another active owner. This proposal does not silently acquire those files or infer another host's current execution state.

Recommendation and decision boundary

Use one viewport, camera, selection/focus contract and compact contextual palette for architecture, state, process and scenario canvases. Keep a domain-specific scene and semantic gesture adapter behind that shared shell. A process contribution can be positioned freely without changing precedence; a scenario occurrence moves between discrete ordered slots, with its current operand made visible. Both are direct manipulation. Neither requires navigating a Tools shelf, selecting a tiny margin reorder handle, or using a separate list as the primary editor.

The smallest coherent first implementation is a shared viewport/input shell used by both process and scenario, with stable canvas bounds, pan/zoom, full-object selection and drag previews, a side palette and point-anchored editing. Reuse the existing guarded command proposals. This is an independently useful slice, but it does not complete #2 until authored process placement and lifeline arrangement survive Save/reopen and the engineering workflows below pass. Replacing button rows alone would leave the main interaction problem intact.

The persistent view contract needs an explicit core-owner decision. Current ProjectionKind has no process/scenario owner projection; Diagram does already own NodePlacement and routes (oa-core/src/model.rs:1431,1485,1549). Do not hide new layout in descriptions, abuse unrelated architecture views, or leave accepted visual moves in a desktop-only UUID map. Do not independently select a schema version while schema 8 work is in flight.

What the code and recorded native work establish

Surface	Actual implementation	Consequence for this decision
Architecture	diagram.rs:39,319,523,966: Fill viewport, inverse world coordinates, ordered pointer events, whole-node movement, connection/reconnection gestures, pan and wheel zoom. app/architecture_authoring/palette.rs:167 provides a 36/156 px side palette.	Reuse these interaction patterns. Do not copy all App-specific messages or duplicate the architecture renderer. Current wheel zoom is not evidence of cursor-anchored zoom; make that a stated target.
State	behavior/state_view.rs:47,169 mounts a Fill canvas backed by a real diagram; state_canvas.rs:729 has focus, world coordinates, full-vertex drag, blank/middle pan, transition endpoints and keyboard camera movement. state_edit.rs:456 proposes MoveNode.	Graphical movement and semantic transition change are separate operations already demonstrated in this codebase. State still has some horizontal controls and a modal details form; those are not requirements to perpetuate.
Process/chain	behavior/topology/view.rs:62,347,618 mounts a model-sized Canvas inside a two-axis Scrollable, Tools/Selection shelves and a lower half-height form. topology/direct.rs:588,600,615 already supports clicked insertion, connect and reconnect.	It is inaccurate to call the current process image entirely static. The user-facing mismatch is the document/shelf workflow and absent authored placement.
Process movement	topology.rs:892–949 derives 420 px rank columns from links/legacy order. topology/direct.rs:362–381 refuses movement across those columns and issues SetSteps; dragging starts only on the selected handle at :623.	Rank is an automatic layout choice, not a semantic prohibition on visual placement. Free visual movement must not be implemented as reordered semantic steps.
Scenario	behavior.rs:1214,1717,1798 projects rows, lanes, slots, fragments and real hit targets. scenario/workspace.rs:68,206 puts that model-sized scene in a Scrollable, with tool selection in a shelf and Lifeline starting from a separate button.	Preserve real scene semantics and exact clicked-slot capture while changing the host/input contract. Lifeline point placement is a remaining direct-authoring gap.
Scenario order/layout	scenario.rs:935 validates and executes SetSteps within the existing parent. behavior.rs:1230 collects lifelines from children; model.rs:624–634 stores scenario steps and a represented identity but no lane layout. model.rs:582 stores fragment operator/branches, not covered lifelines or arbitrary time coordinates.	Vertical order and operand membership are semantic. Horizontal lane position and row spacing are presentation. Drawing a wider fragment must not invent coverage, lifetime or execution semantics.

These are source observations, not a fresh native acceptance run. The recorded 80cf197 native run passed the four OA clicked-slot creation/history checkpoints, OA reopen, exact caller occurrence/camera return, and SA root Action. It also observed new forms inheriting a prior downward scroll and a captured marker falling below the canvas when the bottom form opened. Root has a separate correction in flight; this design must preserve it until its host is replaced and independently verified. Fit at 21–28% on the minimum window established navigation, not readable editing. The older process teaching observation found the overview unreadable and less than one column visible at 100%; do not mislabel that older binary as a regression in today's source.

During this design, root freshly re-observed the immutable 80cf197 SA caller at native 1100 px width: 63 objects/11 checks, saved and no draft. Root reports a center canvas of about 502×340 px, its own horizontal/vertical scrollbars, and Tools/zoom/current-tool/Lifeline/property controls taking space before the lane headers; Inspector showed general Project fields. This is root-attributed native confirmation of the interaction framing, not this worker's native run or acceptance of changed source. It supports replacing ordinary layout chrome immediately without tying passive camera changes to a schema migration.

The actual Capella 7.1 architecture study observed tool → point creation, F2 naming and distinct represented work/allocation. The scenario study observed Activity point placement with a separate InstanceRole and a dragged LOOP with an operand/start/end records. It did not exercise wrapping existing messages, cross-operand moves, reuse or lifecycle drawing. Adopt its direct gestures and identity distinctions; its selection-induced canvas jump is a recorded problem to avoid. No new Capella use or web-derived semantic assumption is claimed here.

Alternatives considered

Approach	Concrete operation	Assessment
Keep the derived document, decorate it as a canvas	Palette replaces Tools; a node drag still changes steps only within a computed rank; opening details still splits the document height.	Small change, but the clicked position is not an authored visual position and process movement still depends on arbitrary columns. Useful interim repair only; insufficient response to #2.
Universal freeform diagram editor	Every process/scenario box, arrow endpoint and fragment rectangle has unrestricted x/y; order is inferred later or left independent.	Attractive reuse of architecture editing, but creates contradictory scenario order, accidental operand/lifeline reassignment and misleading fragment coverage. Reconciling two competing sources of order would be costly and unsafe. Reject.
Shared canvas shell with domain constraints	Same palette, camera, focus, point creation, full-object selection and drag preview; process movement edits view placement, scenario movement snaps to named semantic slots and lane/header layout.	Recommended. Shared input and rendering infrastructure stays small; each domain retains its existing validation and atomic transaction boundary.

Interaction contract

Stable workspace. Keep the same Fill canvas mounted while arming a tool, selecting an object, typing, showing validation or cancelling. A compact owner/view breadcrumb and camera controls occupy a fixed strip. The side palette is always discoverable, collapsed by default with labels/tooltips and explicitly expandable. Expansion may resize the viewport; other ordinary authoring phases do not. Selection details replace irrelevant general Project fields in the existing Inspector; a small name/reference editor can be anchored at the object. Long structured editing reuses that same Inspector allocation, or an overlaid side drawer if the Inspector is hidden, with bounded scrolling and fixed Apply/Cancel. It must leave a useful part of the canvas visible and must not resize it. There is one draft and one Apply boundary, not a second independent popup copy. Camera input is allowed only outside the editor's bounds; moving the camera updates its anchor or keeps a visible tether, and never changes the captured semantic destination.

Point creation. A selected tool previews exactly what a click will mean. In a process, empty space means an unconnected contribution at that world point; the midpoint of a highlighted path means insertion on that exact path. Node hover must not ambiguously mean either “before” or “inside.” In a scenario, a lifeline tool previews a header at the proposed horizontal position. Action, State, Reuse and Fragment preview a named root/operand slot; Action/State on a lane preselect that lane. Message preview shows source, destination and slot. Use the current typed chooser and prerequisite flow in the anchored editor; no placeholder object is accepted before Enter/Apply. Blank-name defaults may be displayed as suggestions without committing them.

Selection and movement. Clicking a glyph, its label or a connector selects its precise occurrence/placement. Full node bodies initiate movement after a screen-space threshold; small handles remain for explicit connector endpoints and fragment boundaries, not as the only way to reorder. Process movement changes placement only, leaving all links, guards and semantic steps byte-for-byte equivalent. Scenario message/action/state/reuse bodies drag vertically to an explicit insertion line. A fragment header drags the entire fragment subtree as one occurrence. Ordinary drag stays in the current operand; crossing its boundary shows an invalid destination and does not silently reparent. Offer an explicit “Move to operand” operation with an exact destination preview for deliberate cross-operand changes. Lane headers drag horizontally as visual arrangement only; no represented identities, bindings or occurrences change.

Connections and nesting. The same click-click and press-drag-release connection grammar applies. Process sequence edges retain their relation ID and guard on reconnection; assembly incidence stays distinct from precedence. A scenario message is an occurrence with message kind/correlation/value/operation fields, not a new sequence link. Reconnecting its endpoint must validate the whole proposed occurrence (and correlated reply constraints) while preserving all unrelated fields; do not silently retarget a call's reply. Fragment tool drag selects a contiguous range of whole siblings within one sequence; wrapping moves those identities into a new operand and replaces their original interval with one fragment in a single transaction. Zero-range click creates the existing empty typed fragment. ALT/PAR provide explicit operand creation/guards at the fragment, and each empty operand has a visible insertion target. A range that slices a child fragment or crosses parents is rejected with visible boundaries. Horizontal drag extent does not assert stored semantic coverage; the frame encloses the required lanes using derived geometry. Lifecycle/activation rendering consumes the separately owned B4 projection unchanged.

Camera and keyboard. Use the same transform for draw, hit, overlays and handles: screen = viewport_origin + pan + zoom * world. Middle-drag or Space-drag pans; blank left-drag follows the architecture/state default when no creation/range tool owns it. Wheel zoom and explicit +/−/100%/Fit work only over the focused canvas; pointer zoom keeps the world point under the cursor stationary. Fit is an explicit navigation action and does not re-run merely because selection/editor contents change. Keyboard focus is visible; palette and canvas can be reached from the application without pointer input. F2 renames the selected occurrence; Enter edits it; an explicit Open definition command plus Back restores the exact caller use and camera. Arrow keys follow the current state-canvas camera convention; an explicit modified Move command provides nudge/reorder without confusing navigation and model writes. Delete targets the local occurrence/placement, with the existing impact UI for semantic deletion; deleting a process/scenario use never substitutes deletion of its reusable definition. Remove from view is separately labelled where supported. Text fields own their own editing keys.

Cancel, history and recovery. Escape cancels the active gesture/editor before changing the selected tool. Press snapshots contain document instance, semantic owner, view, revision, tool/gesture epoch and exact occurrence/path/slot; release validates them again. Mode/owner/revision changes, hidden release or window deactivation cannot commit a stale gesture. A successful semantic or authored-layout drag yields one command/history entry on release; pointer movement and camera movement yield none. Preserve accepted Project/source, raw invalid inputs and captured context across recovery; validate restored destination identities before submission. Camera/selection may be restored as transient presentation, but recovery must retain the application's existing explicit limitation that Undo history is not resumed from a recovery snapshot.

Persistent presentation and semantic boundaries

Propose owner-bound process and scenario diagram projections through the existing Diagram/placement/source machinery, subject to core-owner review. For an imported model with no view, show a derived canvas immediately; materialize the first authored view together with its first layout edit. Merely opening, panning, fitting or inspecting must not dirty source. Use deterministic automatic placement for items lacking authored positions. Explicit Auto arrange is one undoable layout operation; adding a link does not unexpectedly overwrite hand placement.

• Process local contributions use placements of their occurrence IDs. Position/size/routes are graphical; topology links determine engineering precedence. Legacy ordered paths retain their admitted meaning; displaying or moving them must not trigger conversion. The existing preserved_order conversion remains part of an explicit semantic editing transaction where required, with the original ordered source restored by Undo.
• Scenario lifeline headers use placements of lifeline IDs, with x/width determining visual arrangement. Do not reorder Scenario.steps to reorder lanes. Time rows continue to derive from steps and operand nesting. If manual vertical spacing is later needed, define a view-only minimum-gap contract; arbitrary y is not required for the first complete workflow.
• Reused process previews retain the qualified OccurrenceEndpoint.references + occurrence identity. Local use-block layout may be edited; nested definition previews are derived/read-only until opened. Do not key two different uses' nested selections or placements by a bare definition occurrence UUID.
• A new view contract must include shared core validation, identity/reference/deletion handling, source grammar and exact round-trip tests, REST command/schema exposure and historical compatibility. Reuse NodePlacement only where its fields have a defined meaning; do not invent a partial desktop-only alternative. Source authors must be able to create the same views/layout without the GUI.

Minimum complete workflows and falsifiers

Run the same tasks in OA and SA at 1100×700 client and a wider window, recording actual viewport/input bounds and preserved before/after snapshots. Existing independent semantic oracles remain authoritative; new visual-layout expectations must be fixed before native execution.

Workflow	Required result and falsifier
Empty process/chain	Create/open an empty owner, arm Work, click a visible point, choose existing work or invoke its owned “create prerequisite” flow, name, Apply. One local contribution appears at that point; no unrelated allocation or definition replacement. Cancel leaves every accepted source byte unchanged. A forced trip through a Tools shelf or an offscreen form fails the workflow.
Process structure	Place a second work, control and exchange/reuse, connect two paths, name a guard, reconnect a chosen endpoint and insert on one of two separately guarded links. Verify exact relation IDs, endpoint/guard retention and no accidental link picked by proximity alone. Move a node across former rank columns; only the view placement changes. Repeat on legacy ordered input, preserving original source on Undo.
Empty scenario	Create each supported viewpoint, place two lifelines by canvas points, select represented objects with context, reorder headers and Save/reopen. Both IDs and visual order persist; scenario steps and representations do not change merely from lane drag. New source creation uses the incoming contextual prerequisite adapter, not a second implementation.
Message and action	Draw source-to-target by both gesture styles; create Action/State at a clicked root and nested-operand slot; edit values/operation and a call/reply where admitted. Compare full body fields and exact before-anchor, parent, sender/receiver, correlation and values. Invalid endpoint edits retain the original occurrence and the editable raw attempt.
Nested control	Create empty ALT/PAR/LOOP/OPT, add an operand at its boundary, insert into an empty nested operand, wrap a contiguous existing range, move a whole fragment and explicitly transfer an occurrence to a chosen operand. Verify parent lists, branches, moved IDs and all untouched siblings. Cross-parent drag and partial-subtree wrapping must visibly refuse before any command. Width alone must not change modeled lane participation.
Reuse navigation	A→B→C and Back twice, then open the second distinct A→B use. Return selects the exact initiating occurrence, restores the owner/view and camera once, and allows subsequent camera input without snapping back. Renamed uses remain valid; deleted/retargeted uses and document reload invalidate old returns safely.
Camera and access	At 50/100/200% and nonzero pan, glyph/label/endpoint hits, click-create, drag and popup anchors agree. Include negative world coordinates, edges, resize and coalesced pointer events. At minimum size, palette, name/first field, required values and Apply/Cancel are reachable with visible focus; Tab reveals offscreen fields. Fit is not used as a substitute for legible 100% editing.
Cancel/history/recovery	Escape at every phase; release after pan/tool/owner/revision change; valid and invalid source/property/behavior drafts; delete/Undo/Redo; pending recovery. Accepted model plus complete SourceBundle must match saved pre/Undo/Redo snapshots exactly, including identities and comments. Layout edits have their own exact one-step expectation; camera/selection/search have none. Restored raw invalid values must remain raw and unapplied.
Prerequisites and long lists	With no compatible definition, invoke the already-owned staged prerequisite flow in captured canvas context. Create work/exchange/participant only after an explicit choice; no automatic allocation or reassignment. For 1000 repeated names, query and selection show kind/layer/containment/alias and bounded results, preserve the clicked destination, and do not apply while searching. Historical UUID text stays outside live-reference choosing.

Mounted tests must feed actual ordered key/pointer batches through the root Iced view, not directly set an internal drag state. Independent App tests assert complete commands, source and raw drafts. Native Windows and supported Linux work remain separate gates, including real-font wrapping, keyboard ownership, touchpad input, popup geometry and usable latency. Screen-reader semantics of custom Canvas glyphs are not established by pointer/keyboard tests: retain a synchronized, keyboard-accessible outline as an alternate representation and measure platform accessibility before claiming it. The outline is optional access, not a required step for ordinary canvas editing.

Proposed implementation partitions

1. Shared shell experiment for both behavior scenes (desktop lease). New small canvas_workspace camera/focus/gesture-context primitives and palette host; adapt process topology/view.rs,direct.rs and scenario workspace.rs,behavior.rs to Fill viewport/world coordinates. Use existing Draft and Command adapters. Capture absolute point/slot/path in typed events, present their one existing editor as an anchored surface, retain App pending guards and exact caller-return context. Replace lower split-form and Tools-shelf dependence only after both scenes pass mounted origin/geometry/stale-event and minimum native workflows. Do not require an immediate rewrite of architecture/state or build a generic graph semantic framework.
2. Authored view/placement contract (core + source + REST owner lease). Ratify owner-bound projections and placement rules above with schema owner, migrate/import absent views, validate/delete/reference them and add independent exact source fixtures. Then process creation/movement and scenario lane placement use those shared commands. This is necessary before claiming persistent direct canvas editing complete; no fake desktop persistence in partition 1.
3. Domain manipulation completion (separate bounded desktop/core command lease). Full-object process drag with view placement; scenario slot drag, message endpoint edit, range-wrap and explicit operand transfer. oa-core/src/session.rs:67,81,82 already exposes Reparent, SetSteps and MoveNode; reuse those commands where their final batch validates, adding a core helper only to centralize genuine shared semantics. Preserve explicit before/after lists and original IDs in wrapping/transfer tests; do not infer their correctness from the final drawing. Keep B4 rendering and incoming prerequisite drafts intact. Acceptance is the workflow matrix, not the number of tools moved into a palette.

Root should ratify the interaction and persistent-view boundary with the independent critic before assigning these production leases. This report is ready for that decision; it records no implementation or new execution pass.