ARCADIA-Studio/harness/release-contextual-source-creation-review-20260911.md

Contextual source creation: independent preimplementation review

Codex-9e8r6t /root/behavior_audit, 2026-09-11. Reviewed the proposed release-contextual-source-creation-plan-20260911.md against committed 4bb4aaf3dc47b9738625b4d3f23ef8c74f286395 desktop contracts and current unchanged core. Read AGENTS, revised PROJECT_GOAL, Gitea issue1 through #138, empty open PR inventory and LocalBehaviorCreation20260911 Wiki. No evolving implementation was read; no production edits, Cargo, direct rustc or native input. These are source-derived integration traps and exact acceptance expectations, not findings against the new implementation. Urgent items were sent directly to its author.

The proposed staged-source transaction is coherent for Lifeline, process Work and new machine owner. Keep qualified Action allocation, new ScenarioUse targets and the external chooser implementation outside this slice. The following existing contracts require explicit handling; a generic wrapper is insufficient.

Ranked material traps

1. P1 — New first-action routes can implicitly commit another editor. In committed app.rs:2326, non-creation starts_form() invokes self.apply(). A new first-lifeline/contribution button routed to the existing Start event, arriving while a valid raw property draft exists, commits that property before opening its form. The explicit Canvas Choose guard does not protect this route. Reject source/property/pending conflicts in the actual new App event path before generic Apply; a disabled button alone cannot guard stale dispatch. Assert accepted snapshot/history and all raw strings unchanged.

2. P1 — Stale scenario owners can panic before transaction validation. scenario.rs's parents() always includes the supplied owner ID, even if that element is absent. A recovered Lifeline draft therefore passes the first destination check in Draft::command, then sources() at line 941 indexes p.elements[&d.owner]. A removed owner can panic before execute_batch gets a chance to reject it. Validate owner existence/kind/layer/viewpoint before candidate rendering and parent planning. Show repair/cancel with both raw drafts retained. Do not interpret a same UUID with changed kind or viewpoint as the unchanged invocation merely because a new source still exists.

3. P2 — Nesting the old process batch loses consumer selection. topology/direct.rs:209 scans only immediate Batch children for a newly created contribution. Batch[CreateSource, Batch(parent_commands)] therefore returns no contribution selection. Core session.rs:386 uses the last selected operation and SetSteps at line 703 selects the process owner. Flatten with preserved command order, or carry the exact prepared command's consumer target through success. Test the actual App selection, including rejection of changed/trailing commands borrowing that target.

4. P2 — Stable source identity does not make the combined plan stable. scenario.rs:1274 still creates a fresh Lifeline via make_element each prepare; topology.rs:476–508 creates fresh occurrence and link UUIDs. Reserve/cache the complete created identity set, including repaired links. With a blank consumer label, source and consumer share a display name: the source already owns its alias in the private preview, so the consumer alias includes its UUID suffix. Replacing only the temporary consumer ID leaves an alias derived from a discarded UUID. All aliases, endpoints, SetSteps, parent references and optional machine/view IDs must use the reserved set. Require full prepared-Command equality across preview/retry/recovery, not merely equality of the source UUID or final object count.

5. P2 — A fresh Work source cannot satisfy every captured insertion. topology.rs:438–449 requires a Work target next to an Exchange contribution to equal that exchange's exact source/target UUID. A newly created Function cannot equal an existing endpoint. The plan's successful “between two contributions” case should use Action→Action. An Exchange-adjacent case must refuse and retain both names and the exact slot; it must not retarget the shared exchange, change a reusable definition, choose a different source or silently append. Keep the existing full compatibility check on the preview.

Semantic constraints that the new source form must expose accurately

validation.rs:92 separates source containment from its use. Activity may be root-owned or owned by Activity; Function by Function; OA Entity/Actor/Role may be roots or children of Entity. Current SA System and SystemActor admit no semantic parent, so a new SA owner is a root even when its machine is nested under it. Neither process, scenario nor lifeline owns new work. A new Lifeline belongs directly to its scenario, never an operand, and does not enter its ordered steps (session.rs:336 attaches Occurrences only).

viewpoint_represents at validation.rs:1262 admits Activity, Function, Entity/Actor/Role, and System/SystemActor for the four explicit viewpoints respectively. Role is valid for an OA participant lifeline but not a machine owner: Kind::is_performer at model.rs:153 excludes Role. SA System uniqueness is a hard project-wide error at validation.rs:238. A second System must refuse, even if named differently; an Actor requires a separate explicit choice.

Do not turn completeness warnings into new blockers. Unallocated leaf work and a missing SA System are warnings. Adding a lifeline to an already reused callee can also be accepted while existing uses gain missing_lifeline_binding warnings (validation.rs:2112); keep all caller bindings unchanged. By contrast, an explicitly incompatible binding is an error. Compatibility uses represented identities or explicit RoleRealization/RoleAssignment, never equal names (validation.rs:1283, :2073). A new same-named Role does not impersonate an existing referenced role, and staging it creates no realization or allocation.

Persist authored state and reserve identities, but separate it from runtime canvas generations. Existing behavior recovery deliberately drops viewport and revision tokens (behavior.rs:789); App reset gives a fresh canvas_document. A recovered valid draft must be rebound to that runtime document without reusing stale event invocations. A child invocation token must still reject late Use/Name/Back events after that child was cancelled/reopened. Passive scroll/viewport epoch changes must neither discard input nor count as a semantic context change. New optional recovery fields must preserve older pending forms.

Compact exact acceptance matrix

Use separate fixed symbols for source S, consumer C, child invocation I, new link L, and optional machine/view/placement M/V/N. Only a new cancelled- then-reopened invocation may reserve a new set. Every accepted row compares the complete Project and SourceBundle against the explicit delta; every refused or cancelled row requires exact accepted baseline and raw-draft preservation.

Case	Exact expected result
OA activity lifeline	OperationalActivity scenario; source Assess distress, consumer Assessment role. Exactly Activity S at selected valid work parent/root and Lifeline C under the original scenario with represented=S. Names remain separate, description/body defaults empty, scenario steps unchanged. No allocation, capability involvement, actor, view or placement. Blank consumer label uses the source name; explicit label follows the existing consumer trimming policy, while raw text remains exact during staging.
SA function lifeline	Functional scenario, no existing Function/System. Exactly Function S at root or selected Function parent plus Lifeline C, with fixed represented identity. Missing allocation/System warnings do not cause fallback or automatic participant creation. Wrong-viewpoint source kind refuses.
OA Role and reuse mapping	ParticipantInteraction scenario can create Role S plus Lifeline C; no relationship is inferred. An existing local Actor maps to an existing referenced Role only through its explicit realization. A new same-named Role without that relationship cannot satisfy the old binding. While editing a reused callee, adding C leaves both existing caller-use records byte-for-byte unchanged; missing-binding warnings are expected, not auto-binding or rejection.
SA boundary and new owner kinds	BoundaryInterface permits explicit System/SystemActor, not Function/Role. Empty SA permits one new System; existing System makes another System refuse unchanged. Explicit SystemActor remains valid. Role cannot own a machine. Illegal source-parent choices refuse; source-parent change must not become machine-parent change.
Work at exact Action→Action link	For captured A —(R, guard g)→ B, source S, contribution C: add root/valid-parent work S; C is Action { action:S, lifeline:None } owned by that process. Preserve R's ID/name/alias/guard and change only its target to C; add L: C→B with empty guard; insert C in the captured order. All sibling paths and referenced definitions unchanged. Select C. Repeat preparation/recovery with exactly the same new IDs/aliases.
Work next to Exchange / stale slot	A new UUID cannot equal the captured existing exchange endpoint; refuse without changing it. Also remove/change the captured link or presentation-before ID between staging and Apply: retain both drafts and require an explicit position repair. Never fall back to current selection or append.
Machine before participant	Name machine Rescue modes, opt into first view, stage explicit valid participant Rescue team. Commit exactly participant S + machine M with parent=S; optional view V named Rescue modes · states, StateMachine projection, one placement N, no regions/states/routes. Select/open M/V. Child Back restores prior owner; parent Cancel creates nothing. Re-selecting an existing owner commits no abandoned staged source.
Invocation, recovery and Escape	Parent label, source raw name, search, original reference, viewpoint, slot and IDs survive child opening/Back/recovery. Old invocation I cannot affect a reopened child I2, even with identical names and owner IDs. Restored valid drafts survive the fresh runtime canvas ID; missing owner refuses without panic. Overlay Escape closes the overlay first, then child Back, then parent Cancel. The focused captured-Escape path must follow the same ordering.
Semantic first action and history	With no semantic contributions, first-work action is directly visible; with no lifelines/occurrences, first-lifeline action is visible. An unresolved lifeline (represented=None), offscreen content, ScenarioUse or fragment prevents a false “empty” claim. A lifeline-only scenario gets applicable guidance without inventing an exchange/action allocation. CTA appearance/resize and rejected stale Start leave model/source/history/raw properties unchanged.

For committed names with leading/trailing whitespace, pin source and consumer policies explicitly: current scenario/topology planners trim an explicit consumer label; they do not overwrite it with the selected source's label. Do not claim all committed names remain byte-exact by inspecting only raw recovery.

One Undo must restore the prior Project and reachable SourceBundle, while disk Save may retain newly detached source files. Use the corrected oracle's explicit history origin: disk equals the first committed checkpoint's file map overlaid with expected reachable files; unknown/changed retained bytes fail. Redo/reopen uses original committed role IDs, not newly borrowed replacement UUIDs.

This matrix deliberately excludes qualified Action allocation and new reuse definitions. Those require further explicit semantic intent; they are not required to validate this staged-source slice. The external chooser remains owned separately. Implementation review and native evidence follow only after the author freezes the new source.

Independent implementation review, 2026-09-11

Codex-9e8r6t /root/behavior_audit. Resumed after the author froze the first production candidate. Read issue #1 through #151 and traced the actual App, behavior dispatch, nested draft, recovery, view, and command-selection paths. The author made explicitly identified corrections between the first and second compile windows. This reviewer edited only this report and ran no Cargo, rustc, native input, or implementation tests. The author's first compilation exposed missing Clone derives; no passing runtime result is inferred from that compile.

Five independently derived counterexamples were sent directly to the author and root. All five have corresponding corrections in the second frozen source inspected here. The following is source verification, pending the author's 19-case focused gate and root's native acceptance.

Priority / finding in first candidate	Concrete counterexample and consequence	Correction inspected in second frozen source
P1: missing pending owner can panic while rendering another owner	Recover source draft for scenario A after A is absent, with another same-layer scenario B present. behavior::selected_owner returns pending A, while behavior::view falls back to B. B's workspace calls scenario_context().expect(...), but the context still resolves absent A and is None. Process fallback has the same mismatch. With no other owner, the pending form is hidden behind New instead. Safe sources() and prepare_pending() do not protect this render path.	behavior::view now checks the pending owner's presence/kind/layer before choosing a fallback. It shows the retained consumer name plus current child form or explicit parent Cancel. The child Back remains reachable; it never silently opens B as the pending consumer. New orphan-view tests construct both no-choice and remaining-B cases.
P1: staged recovery completeness was assumed by presentation	Recover selected staged source with source.staged.kind = null, a valid value for its serialized Option<Kind>. Deserialization accepts it; State::label then calls unwrap() and panics in parent view/selection before command validation can return its existing missing-kind error.	source_draft::State::label is now total and displays a missing-kind label. Planning still refuses; raw recovery remains intact. A malformed-kind regression exercises both planning and the label.
P2: owner-first machine creation cannot leave its valid child	New → Machine, leave machine name blank, Create new owner, choose valid kind/name, Use. The source is valid, but the parent handler calls next.command(p) and refuses the blank machine name. Parent edits are locked while the child is open; Back drops the entered owner before the machine can be named.	Machine Use stages the valid prerequisite and checks the actual eligible-owner predicate on its private preview. It does not require an already complete machine. Final Submit still validates the complete batch. The owner-first regression keeps the same source/name while the machine is subsequently named.
P2: footer Back disagrees with Escape on retained stale/dirty recovery	After recovering unrelated dirty source/property text, App rejects every source event, including Back. After deleting/changing the owner, scenario/topology validate the origin before dispatching Back; the helper also compares scope first. The visible Back button refuses although global Escape succeeds through source_back().	Token-only source.dismiss runs before semantic context checks. App exempts only Source(Edit::Back) from other-editor admission. Wrong/old tokens still refuse; Open and Use keep their guards. Added dirty-editor and deleted-owner Back regressions preserve parent/property state.
P2: new empty actions accept a previous owner's event	Capture A's new first-action message, navigate to clean B or another layer, then deliver A's bare Start(owner, tool). That route checks dirtiness and owner existence but carries no context. It can open A; selected_owner prioritizes the resulting pending owner.	Scenario CTAs now use CanvasEvent::First(Context, Tool) through the existing context and dirty guards, with a fresh semantic emptiness check. Process first Work uses its existing context-bound Begin with the explicit default insertion. A new owner/layer-stale CTA regression rejects old context and admits the current one.

The source changes address the reported mechanisms. Their tests are authored regressions, not independently executed evidence in this review. In particular, constructing an orphan view prevents the identified expect panic but does not by itself prove its footer can be clicked at the minimum native window size.

The unchanged core contracts are used correctly in the inspected paths:

• App form start/source admission checks raw source and property dirtiness without calling generic Apply. Source/parent submission retains the existing dirty guard. Model-menu and modal Escape precedence is resolved before child Back, then parent cancellation. Raw edits and form rendering create no accepted model/history operation.
• Source commands keep source name, semantic parent, kind, layer, document, and exact captured consumer/parent identity distinct from the consumer. Existing validation admits Role only where appropriate, enforces System uniqueness, and preserves allowed completeness warnings. No allocation, role realization, reuse binding, or shared exchange retargeting is inferred.
• For an actively selected staged source, the helper previews the source, prepares the original consumer, remaps every new element/relation identity and typed reference plus SetSteps to the reserved set, then forms one flat validated batch. Recomputed aliases use the reserved IDs rather than an abandoned temporary UUID. Machine/view/placement identities remain reserved by the existing creation planner. This review does not claim that the older non-staged planners reserve their IDs across separate preparations.
• App compares the complete prepared staged command before assigning its consumer selection, and assigns it only after Document::execute succeeds. Parent acknowledgement follows success. Choosing an existing reference makes the staged source inactive: preview/combine omit it, so it is not published. Parent Cancel drops the entire pending state.
• Captured process link identity/endpoints and presentation-before slot remain validated. Work insertion preserves the existing guarded link and adds the new successor link; a fresh source next to an existing Exchange still cannot impersonate the required endpoint and refuses with raw input retained.
• New empty guidance counts semantic Lifeline/Occurrence/contribution records, rather than rendered positions. An unresolved lifeline is still a lifeline; ScenarioUse, fragment, and offscreen content do not become empty merely because of presentation. Existing scenario canvas/scroll slots remain in the surrounding workspace tree while the explicit child form occupies its form pane.

The author deliberately made explicit staged-consumer names exact, including leading/trailing whitespace; source names are also exact, and a blank consumer continues to default to its chosen source name. This supersedes the earlier matrix's inherited trimming expectation for active staged-source consumers. The older existing-reference consumer path still has its pre-existing trim policy. Native/oracle expectations must distinguish those paths and must not borrow an observed output name to define the expected model.

Second frozen source fingerprints captured at approximately 11:39 UTC:

File	SHA-256
crates/oa-desktop/src/app.rs	81E0AA21A93126D716E628B3EBD440201AB19D6B578E2585F5E500072244D58B
crates/oa-desktop/src/behavior.rs	A0E595F17F254002F1FBD7984EEB679320DAB042CA310C38D8916F0055713780
crates/oa-desktop/src/behavior/source_draft.rs	32057E30C0526FA674D463F47C4EAC7C0F391B1F4C5060757981A3CBED16C6AE
crates/oa-desktop/src/behavior/scenario.rs	759805631BE9E8526DACFB959D91C76CA1A2A40F47F8645BCEB0E0C15B77E326
crates/oa-desktop/src/behavior/topology.rs	8E1C65AFE4C7C097F683B33A6DF237219F48AFD1E81F81329B07612F4D6994CC
crates/oa-desktop/src/behavior/creation.rs	BE75840293E84FCAE90DC6D17CCD6630A586B389FB189ADF73D1E9B046CE3DE2
crates/oa-desktop/src/behavior/contextual_source_tests.rs	242B68E0DFF14E57E1F510EA3DEA95ED1B2ADCDABFD24C9F493FC871CB50F049

No additional implementation blocker was found in this bounded review. Required evidence still includes terminal focused checks and native minimum/wide form authoring, plus independent complete model/source comparison for actual source/consumer creation and Undo/Redo/reopen. The earlier explicit detached-file retention rule remains unchanged. No native result, full-suite result, or release completion is claimed here.

Final staged-source delta review, 2026-09-11

Codex-9e8r6t /root/behavior_audit. Reviewed only the changes after the recorded second freeze: compact consumer captions, explicit creation summaries, recovered typed-scope validation, nested semantic-parent and callee/caller regressions, guide correction, and App Undo/Redo result handling. Read the final author gate and current Gitea decisions through #178. No production edits, Cargo, rustc or native input; root retains the immutable full-suite run and native acceptance.

The source inspected in this pass matched all ten corresponding entries in .local/contextual-source-20260911/focused4-inputs.json: App, behavior, source draft, scenario, scenario workspace, topology, topology view, creation, contextual-source tests and guide. This identifies the precise compiled source without presenting the earlier second-freeze fingerprints as current.

Concrete corrections identified at the final boundary

1. P2 — The State machine guide still directs the user out of the new flow. At guide.rs:547, the first step says to cancel and create a missing owner in Architecture; the immediately following new step describes Create new owner with the retained machine draft. The old sentence would unnecessarily lose the user's pending setup and hides the new supported route. Sent directly to the author/root; the author removed it after the Clippy source freeze and this reviewer confirmed the source readback. The guide's previously rejected explain argument count is already corrected in the passing focused4 source.

2. P2 — The source origin must survive inactive dependency planning. The author identified this additional case before review closure, and this reviewer independently confirmed its actual code path. Start a Lifeline or Work form with a valid existing target, open Create new source, then Back. source.engaged remains true, but there is no editing/active staged source. check_scope and preview therefore pass without a source-side document check. Parent Draft::command at scenario.rs:1350/topology.rs:582 then reaches its ordinary consumer planner against a different Project.id with the same owner and target UUIDs. The captured source_origin is checked only while handling Source events. Use followed by reselecting an existing source has the same inactive-dependency mechanism. This is a concrete preparation-boundary failure; no claim is made that ordinary file navigation preserves the form through its existing App reset.

   The narrow proposed correction checks captured document plus exact owner at final command preparation whenever source creation has been engaged, keeping token-only Back and cancellation available. Regression must begin with a valid existing target, prove baseline preparation succeeds, then refuse the other document while retaining all raw fields. A compatibility edge was sent separately: old recovered forms legitimately have source_origin=None and unengaged default source state. Their first successful source Open should bind the current origin; an already engaged missing/mismatched origin must never be silently rebound. The author implemented these document/legacy controls after the source freeze, with a valid-target Scenario/Work × Back/inactive × ordinary/legacy regression matrix. That later source is not covered by focused4 and no new execution is claimed here.

   One final owner-binding detail remains at this handoff. The initial new guard compares the captured owner with p.elements.get(&owner.id). A recovered origin can contain another valid, unchanged same-layer owner B while the parent draft still targets A. That lookup validates B against itself; the otherwise valid consumer planner still operates on A. Compare the captured owner record with p.elements.get(&self.owner) in final planning and p.elements.get(&d.owner) in Source-event admission, or explicitly require the two IDs to agree. The simplest negative control replaces only the serialized origin's owner record with B, leaving the valid target/slot and actual draft owner A unchanged. This avoids a false rejection caused by an unrelated invalid Scenario parent slot. This reviewer sent that independently derived detail to author/root; final strengthened source readback is pending.

Confirmed scope of the other deltas

• New outer consumer captions call views::short with 60 characters, or 80 in the orphan card. That helper collapses whitespace and truncates presentation; it does not rewrite raw draft names. The source fields still have their own remaining-height scroller and a separate Back/Use footer. Active-source summaries describe the actual source+lifeline/work/machine transaction, with the first machine view explicitly conditional. No view call adopts a model command. Native minimum-window readability is not inferred from this trace.
• source.check_scope is called before preview in all three parent planners. A selected staged source or current child with the wrong typed consumer scope is rejected; an inactive staged source remains excluded. The malformed-kind regression now also falsifies a Machine scope inside a Lifeline draft.
• The nested-parent test uses a real OA Activity parent, refuses an Entity as work ownership, stages exactly one child Activity, then changes the captured parent's kind and proves private preview refuses without changing the raw source state. The implementation validates both the exact parent snapshot and current can_parent predicate. This is not a test of every parent family.
• The callee regression has one existing ScenarioUse with an empty binding list. Adding a new Activity-backed callee lifeline preserves every original element, relation and diagram and produces the expected missing_lifeline_binding warning on that use. Its shared history helper checks model/source Undo, Redo and fresh source reconstruction. This is useful evidence for allowing an incomplete caller; it is not a claim of independently testing multiple callers with nonempty Role mappings.
• App Undo/Redo now uses the actual boolean returned by Document, calls sync only for a history step, and reports Nothing to undo/redo when appropriate. Its test exercises both an empty history and a real rename through the public Message::Command path. Existing apply() guards for pending behavior/source remain in front; the existing property-Apply behavior is unchanged. No claim that all Undo/Redo requests are inherently free of property application is introduced.

CLI documentation cross-check

docs/source-cli.md and README's explicit cargo run --locked -p oa-cli --bin arcadia -- check examples/text-first/project.arcadia example match the final CLI adapter. The example's execution was already verified by root and was not repeated here. The page correctly separates aliases from display names, previews from explicit per-invocation writes, changed-file reports from unchanged captured dependencies, pending recovery from automatic recovery, and source3–7 migration from canonical formatting or detached-file deletion. Root accepted and applied two precision additions during this review: Unicode scalar columns, and written:false not implying guaranteed rollback. Readback confirmed both. No new CLI implementation issue or saved-plan/digest requirement was raised.

Evidence status

Read the author's terminal focused4.log/status: 22 passed, 0 failed, 653 filtered, 2.04 seconds test execution, exit 0 at 11:59:25 UTC. The matched immutable test executable is SHA-256 6E677F58458B6122EA1886AAC98882640CD9CF260651FE3ECE62BDDA4BE38CC0, inventory 675. The full suite was running under root at review time; it is not reported passed here. Guide/source-origin corrections above are later deltas and require their own coherent source/test evidence, including the final owner-binding detail. Current source-input manifest, focused logs, and author's revised implementation report remain the build evidence authority; this reviewer executed no desktop tests or native workflow.

Final source readback closure

The author froze the strengthened source and root requested a short final readback. No remaining material source finding in this bounded delta review. This closes the pending owner-binding detail above; it does not assert that the new source has completed its later compiled/native gates.

All four guards now compare the captured owner record against the actual parent draft's d.owner/self.owner, in addition to the document identity. The 23rd regression includes ordinary/legacy × Back/inactive-existing variants for both Scenario and Work. Each has a valid existing-target control, wrong-document and null-origin refusal, and a borrowed full record from another valid same-layer owner. The latter must fail both final preparation and Source Open while the entire raw recovery snapshot remains unchanged. This is the exact falsifier requested in the preceding handoff, not an unrelated invalid-parent failure.

For an old unengaged draft, first Source Open creates its missing origin only in a private clone; the clone replaces the parent only after source admission succeeds. It cannot rebind an already engaged missing/mismatched origin. Back is still dismissed by its token before those semantic guards, and parent Cancel remains available. The old guide sentence is absent and the retained-owner creation instruction is present.

Readback hashes match the author's final freeze:

File	SHA-256
behavior/scenario.rs	D12A4B1CAA61C08F69C4D2A64BD15568C4B7158DEA91AAC5A52A58A35ADB863C
behavior/topology.rs	D06B2F0FC39B4814E94200297E148F1D4D97E04CB167766030AC9DF18689E3B0
behavior/contextual_source_tests.rs	5F05318A6533503B9D6FEBF1EC4DD7256F192394BC1B952A7904C8175BD8DDAE
guide.rs	47EEB3CC0A48D5712720096015A08387CD354FB91559B0BD6FA106B5CAC6292C

Paths in this last table are under crates/oa-desktop/src/. Root subsequently reported the earlier immutable 675-test artifact passed 675/675 in 448.33 seconds (Gitea #185). That artifact predates these final corrections. The author's focused5, matching GUI/lint and root's native/source oracle remain the appropriate next evidence; no Cargo, rustc, native input or production change was performed by this reviewer during closure.