ARCADIA-Studio/harness/release-contextual-source-creation-review-20260911.md

Contextual source creation: independent preimplementation review

Codex-9e8r6t /root/behavior_audit, 2026-09-11. Reviewed the proposed release-contextual-source-creation-plan-20260911.md against committed 4bb4aaf3dc47b9738625b4d3f23ef8c74f286395 desktop contracts and current unchanged core. Read AGENTS, revised PROJECT_GOAL, Gitea issue1 through #138, empty open PR inventory and LocalBehaviorCreation20260911 Wiki. No evolving implementation was read; no production edits, Cargo, direct rustc or native input. These are source-derived integration traps and exact acceptance expectations, not findings against the new implementation. Urgent items were sent directly to its author.

The proposed staged-source transaction is coherent for Lifeline, process Work and new machine owner. Keep qualified Action allocation, new ScenarioUse targets and the external chooser implementation outside this slice. The following existing contracts require explicit handling; a generic wrapper is insufficient.

Ranked material traps

1. P1 — New first-action routes can implicitly commit another editor. In committed app.rs:2326, non-creation starts_form() invokes self.apply(). A new first-lifeline/contribution button routed to the existing Start event, arriving while a valid raw property draft exists, commits that property before opening its form. The explicit Canvas Choose guard does not protect this route. Reject source/property/pending conflicts in the actual new App event path before generic Apply; a disabled button alone cannot guard stale dispatch. Assert accepted snapshot/history and all raw strings unchanged.

2. P1 — Stale scenario owners can panic before transaction validation. scenario.rs's parents() always includes the supplied owner ID, even if that element is absent. A recovered Lifeline draft therefore passes the first destination check in Draft::command, then sources() at line 941 indexes p.elements[&d.owner]. A removed owner can panic before execute_batch gets a chance to reject it. Validate owner existence/kind/layer/viewpoint before candidate rendering and parent planning. Show repair/cancel with both raw drafts retained. Do not interpret a same UUID with changed kind or viewpoint as the unchanged invocation merely because a new source still exists.

3. P2 — Nesting the old process batch loses consumer selection. topology/direct.rs:209 scans only immediate Batch children for a newly created contribution. Batch[CreateSource, Batch(parent_commands)] therefore returns no contribution selection. Core session.rs:386 uses the last selected operation and SetSteps at line 703 selects the process owner. Flatten with preserved command order, or carry the exact prepared command's consumer target through success. Test the actual App selection, including rejection of changed/trailing commands borrowing that target.

4. P2 — Stable source identity does not make the combined plan stable. scenario.rs:1274 still creates a fresh Lifeline via make_element each prepare; topology.rs:476–508 creates fresh occurrence and link UUIDs. Reserve/cache the complete created identity set, including repaired links. With a blank consumer label, source and consumer share a display name: the source already owns its alias in the private preview, so the consumer alias includes its UUID suffix. Replacing only the temporary consumer ID leaves an alias derived from a discarded UUID. All aliases, endpoints, SetSteps, parent references and optional machine/view IDs must use the reserved set. Require full prepared-Command equality across preview/retry/recovery, not merely equality of the source UUID or final object count.

5. P2 — A fresh Work source cannot satisfy every captured insertion. topology.rs:438–449 requires a Work target next to an Exchange contribution to equal that exchange's exact source/target UUID. A newly created Function cannot equal an existing endpoint. The plan's successful “between two contributions” case should use Action→Action. An Exchange-adjacent case must refuse and retain both names and the exact slot; it must not retarget the shared exchange, change a reusable definition, choose a different source or silently append. Keep the existing full compatibility check on the preview.

Semantic constraints that the new source form must expose accurately

validation.rs:92 separates source containment from its use. Activity may be root-owned or owned by Activity; Function by Function; OA Entity/Actor/Role may be roots or children of Entity. Current SA System and SystemActor admit no semantic parent, so a new SA owner is a root even when its machine is nested under it. Neither process, scenario nor lifeline owns new work. A new Lifeline belongs directly to its scenario, never an operand, and does not enter its ordered steps (session.rs:336 attaches Occurrences only).

viewpoint_represents at validation.rs:1262 admits Activity, Function, Entity/Actor/Role, and System/SystemActor for the four explicit viewpoints respectively. Role is valid for an OA participant lifeline but not a machine owner: Kind::is_performer at model.rs:153 excludes Role. SA System uniqueness is a hard project-wide error at validation.rs:238. A second System must refuse, even if named differently; an Actor requires a separate explicit choice.

Do not turn completeness warnings into new blockers. Unallocated leaf work and a missing SA System are warnings. Adding a lifeline to an already reused callee can also be accepted while existing uses gain missing_lifeline_binding warnings (validation.rs:2112); keep all caller bindings unchanged. By contrast, an explicitly incompatible binding is an error. Compatibility uses represented identities or explicit RoleRealization/RoleAssignment, never equal names (validation.rs:1283, :2073). A new same-named Role does not impersonate an existing referenced role, and staging it creates no realization or allocation.

Persist authored state and reserve identities, but separate it from runtime canvas generations. Existing behavior recovery deliberately drops viewport and revision tokens (behavior.rs:789); App reset gives a fresh canvas_document. A recovered valid draft must be rebound to that runtime document without reusing stale event invocations. A child invocation token must still reject late Use/Name/Back events after that child was cancelled/reopened. Passive scroll/viewport epoch changes must neither discard input nor count as a semantic context change. New optional recovery fields must preserve older pending forms.

Compact exact acceptance matrix

Use separate fixed symbols for source S, consumer C, child invocation I, new link L, and optional machine/view/placement M/V/N. Only a new cancelled- then-reopened invocation may reserve a new set. Every accepted row compares the complete Project and SourceBundle against the explicit delta; every refused or cancelled row requires exact accepted baseline and raw-draft preservation.

Case	Exact expected result
OA activity lifeline	OperationalActivity scenario; source Assess distress, consumer Assessment role. Exactly Activity S at selected valid work parent/root and Lifeline C under the original scenario with represented=S. Names remain separate, description/body defaults empty, scenario steps unchanged. No allocation, capability involvement, actor, view or placement. Blank consumer label uses the source name; explicit label follows the existing consumer trimming policy, while raw text remains exact during staging.
SA function lifeline	Functional scenario, no existing Function/System. Exactly Function S at root or selected Function parent plus Lifeline C, with fixed represented identity. Missing allocation/System warnings do not cause fallback or automatic participant creation. Wrong-viewpoint source kind refuses.
OA Role and reuse mapping	ParticipantInteraction scenario can create Role S plus Lifeline C; no relationship is inferred. An existing local Actor maps to an existing referenced Role only through its explicit realization. A new same-named Role without that relationship cannot satisfy the old binding. While editing a reused callee, adding C leaves both existing caller-use records byte-for-byte unchanged; missing-binding warnings are expected, not auto-binding or rejection.
SA boundary and new owner kinds	BoundaryInterface permits explicit System/SystemActor, not Function/Role. Empty SA permits one new System; existing System makes another System refuse unchanged. Explicit SystemActor remains valid. Role cannot own a machine. Illegal source-parent choices refuse; source-parent change must not become machine-parent change.
Work at exact Action→Action link	For captured A —(R, guard g)→ B, source S, contribution C: add root/valid-parent work S; C is Action { action:S, lifeline:None } owned by that process. Preserve R's ID/name/alias/guard and change only its target to C; add L: C→B with empty guard; insert C in the captured order. All sibling paths and referenced definitions unchanged. Select C. Repeat preparation/recovery with exactly the same new IDs/aliases.
Work next to Exchange / stale slot	A new UUID cannot equal the captured existing exchange endpoint; refuse without changing it. Also remove/change the captured link or presentation-before ID between staging and Apply: retain both drafts and require an explicit position repair. Never fall back to current selection or append.
Machine before participant	Name machine Rescue modes, opt into first view, stage explicit valid participant Rescue team. Commit exactly participant S + machine M with parent=S; optional view V named Rescue modes · states, StateMachine projection, one placement N, no regions/states/routes. Select/open M/V. Child Back restores prior owner; parent Cancel creates nothing. Re-selecting an existing owner commits no abandoned staged source.
Invocation, recovery and Escape	Parent label, source raw name, search, original reference, viewpoint, slot and IDs survive child opening/Back/recovery. Old invocation I cannot affect a reopened child I2, even with identical names and owner IDs. Restored valid drafts survive the fresh runtime canvas ID; missing owner refuses without panic. Overlay Escape closes the overlay first, then child Back, then parent Cancel. The focused captured-Escape path must follow the same ordering.
Semantic first action and history	With no semantic contributions, first-work action is directly visible; with no lifelines/occurrences, first-lifeline action is visible. An unresolved lifeline (represented=None), offscreen content, ScenarioUse or fragment prevents a false “empty” claim. A lifeline-only scenario gets applicable guidance without inventing an exchange/action allocation. CTA appearance/resize and rejected stale Start leave model/source/history/raw properties unchanged.

For committed names with leading/trailing whitespace, pin source and consumer policies explicitly: current scenario/topology planners trim an explicit consumer label; they do not overwrite it with the selected source's label. Do not claim all committed names remain byte-exact by inspecting only raw recovery.

One Undo must restore the prior Project and reachable SourceBundle, while disk Save may retain newly detached source files. Use the corrected oracle's explicit history origin: disk equals the first committed checkpoint's file map overlaid with expected reachable files; unknown/changed retained bytes fail. Redo/reopen uses original committed role IDs, not newly borrowed replacement UUIDs.

This matrix deliberately excludes qualified Action allocation and new reuse definitions. Those require further explicit semantic intent; they are not required to validate this staged-source slice. The external chooser remains owned separately. Implementation review and native evidence follow only after the author freezes the new source.