ARCADIA-Studio/harness/release-textual-authoring-design-20260911.md

Text-only systems modeling: current source7 and competing authoring designs

Codex-956atf /root/requirements_delta, 2026-09-11. Bounded language-design investigation for root synthesis and independent criticism. No candidate below is ratified, and this report does not accept the release. Owned files are this report and the isolated harness/experiments/textual-authoring-20260911/ experiment. No production parser, specification, model, GUI or API edits; no Cargo or native application input.

Read the complete current PROJECT_GOAL.md, SHA-256 DD58F75C93D55FE16ED141A23D834898FB6EBC625AE7E7AE379DA552A8312435, AGENTS.md, issue #1 through #117, the empty open-PR list and Wiki Home. The Wiki records an older checkpoint. Coordination is in #112. Codex-9e8r6t /root/palette_finish independently owns the task-based usability audit and narrow documentation corrections (#113/#116); this report concentrates on language coverage, identity, source/API behavior and architecture alternatives. Their separate small-recipe execution is #117. Root owns integration and all release decisions.

Inspected source began at 865cd55; the completed probe ran while HEAD was 80cf197be6f1d400bf0b9c84bf8557f88c895aa6. Root granted a bounded reader lease after its desktop suite, then continued its GUI build. The probe used the completed core artifact identified below and wrote only isolated experiment files. The lease is finished. Source line references identify the inspected local version; the other host's pending documentation corrections can shift them.

1. What the evidence establishes

Source7 can express the current persistent OA/SA model through readable declarations, typed values and explicit references. It already supports useful omission of ordinary defaults, nested ownership, forward references, multiple files and identity-preserving updates. A complete engineering example authored without existing GUI records passes the real core. Calling this merely a JSON export, or claiming that text-only modeling is absent, would be incorrect.

The principal weaknesses are the amount of identity and constructor scaffolding exposed during ordinary work, a project-wide alias namespace even across nested modules, limited source-oriented refactoring/navigation, and the absence of an ordinary local check/stabilize/refactor command-line tool. REST can support a source-only workflow today, but engineers must manage the bundle, returned stable identities and revision protocol. Canonical export makes default values explicit and expands small models substantially; it should not be used as a proxy for the best current authored syntax.

Leading candidate for an experiment: preserve the current authoritative model and exact source envelope, provide a real source-only tooling path, and trial domain-specific syntax that lowers to the existing model with explicit identity and order rules. Compare that approach against a redesigned declaration/namespace language and against separating identity/history metadata. Keeping today's UUID clauses is a conservative trial boundary, not a conclusion that the new low-clutter requirement has been satisfied.

The newly required calculations, quantities and maintained libraries remain separate semantic work. Better spelling for source7 cannot supply their missing behavior; their unratified designs and paired criticism are in the adjacent analysis/library reports. Conversely, adding those concepts with raw implementation-shaped records would deepen the present authoring problem.

2. Complete small example and executable evidence

The complete initial source is alarm-response.arcadia. It has no external includes, libraries, missing GUI-created subjects or unexplained UUID prerequisites. Starting with an empty editor, an engineer can author this file and submit it as one source bundle.

It models a plant operator detecting an alarm and a maintenance team assessing it, explicit responsibility allocation, a pressure-report payload, a capability, a two-contribution operational process and a typed notification scenario. SA adds a console, classification function and chain, an owned state machine, a signal-triggered transition and a reviewed OA/SA refinement. An artifact link identifies procedure evidence, and a saved view places both operational activities. The pressure text is a descriptive annotation under current semantics; it is not an evaluated quantity. The URI is opaque evidence metadata, not a claim that a procedure was fetched.

There are 40 persistent identities: project, 25 elements, 9 relations, one diagram, two placements, one artifact and one trace. The final example produces no structural errors and no engineering warnings. That establishes a complete admissible small source example, not the engineering adequacy of every imaginable alarm system or the usability of its rendered diagram.

Form	UTF-8 bytes	Lines	What was measured
Initially authored, new IDs omitted	4,373	110	Exact initial fixture, already omitting ordinary default fields and nesting owned elements.
Accepted/stabilized	6,053	110	Actual compile_bundle result; 40 explicit UUID clauses inserted, existing source retained.
Canonical single-file export	9,710	344	Actual language::format result from that same model; defaults and flat records emitted.

Stabilization adds exactly 1,680 characters here: 40 clauses of 42 characters each. That is 38.4% growth over the initially authored text. Canonical export is 2.22 times the initial byte count and 3.13 times its line count. These are representation measurements, not measured task times or proof that fewer characters always improve comprehension. The initial source has 41 reference occurrences, 78 semicolons, 108 brace characters, 10 empty declaration bodies, four none tokens and one empty-list token. Display names and aliases are separately required for every named declaration; the two placement declarations omit display names by design.

The saved canonical result contains 39 empty description fields, 18 none tokens and seven empty-list tokens. Some of those fields represent required reviewed history, so these counts must not be converted into a blanket deletion rule. The authored example intentionally retains the two empty descriptions in its reviewed trace baseline because historical observations and live defaults have different meanings.

Probe scope and reproducibility

probe.rs was compiled directly with Rust 1.98.1, host x86_64-pc-windows-gnullvm, without Cargo. Root designated target/debug/deps/liboa_core-6c8da57367eec642.rlib as the completed suite's core artifact; SHA-256 before and after was D7EFB5F3C423FF8AF13637F53CC481502C7F317BF01E9D072F9EFD64CD954C13. The successful output is probe-output.txt. The temporary executable was removed after use.

Executed assertions and reported diagnostics establish:

1. Initial source7 admission, all 40 expected identities and no warnings; canonical parse equality and canonical idempotence.
2. Recompiling the returned stabilized source preserves the exact model and bundle. Recompiling the original missing-ID source allocates a different project identity.
3. Renaming only a raw declaration alias rejects because its old uses remain unresolved. A prepared SetAlias command keeps the UUID and rewrites every live reference while retaining the attached comment.
4. Reparenting the nested assessment activity to the root through the shared prepared command/updater retains its identity and attached comment. Moving a root participant into an included file preserves the entire model.
5. Omission of a fresh source7 scenario's viewpoint resolves to MixedLegacy. Removing Action.lifeline none and Exchange.message_kind Asynchronous/reply_to none from this fixture leaves the admitted model unchanged.

Actual source snapshots are retained under observed: stabilized, canonical, renamed, reparented, and a split entry plus participant fragment. They are separate experiment outputs, not one bundle containing all six alternatives. The initial fixture SHA-256 is D5E75F60081A7D99B0E10387C5D722064ABBE022A022F376D7BF742AC0D69B0B; the final probe source is F62AD8C55DD06B15F59E7A86AC11A7A77505456BE09F5AA96DB7F681280CC18C.

The probe is deliberately bounded. It did not run HTTP, the native editor, save-journal fault injection, a new language prototype, a performance benchmark or a comprehensive comment-preservation suite. Existing test source supplies additional contract evidence but is not a newly executed result in this report. The first probe had three honest completeness warnings; the final source resolved them with an explicit Flow mechanism, reviewed trace prose and SA chain rather than suppressing validation.

To reproduce after root grants access to a matching built artifact, initialize .local/toolchain/env.ps1, compile the probe with rustc --edition=2024, an explicit --extern oa_core=<matching rlib>, -L dependency=<matching deps directory> and -C linker=clang.exe, then pass the initial fixture path and a new isolated output directory. Do not use a different toolchain's or target's rlib and infer a semantic failure from linker incompatibility. A portable product CLI is a proposed outcome, not this developer-only command.

3. Current semantic-family reachability

The declaration dispatcher is generated from all supported Kind::ALL/layer pairs and all RelationKind::ALL, plus diagrams, placements, artifacts and traces (language.rs:295–330; model.rs:69–109,900–925). The typed resolver then validates closed records (language.rs:1594–1808). Thus the following is a current representational coverage map, not a claim that each authoring task has been timed or independently exercised through all interfaces.

All source paths below are under crates/oa-core/src unless otherwise stated.

Semantic family	Current text-only path and evidence	Important authoring cost or boundary
OA participants, roles, work, missions and capabilities	oa_entity, oa_actor, oa_role, oa_activity, oa_mission, oa_capability; nested decomposition plus explicit allocation/role/mission/capability relations. docs/language.rst:94–102,210–224,240–290; examples/source-project/oa.arcadia.	Nesting is containment only. Allocation must remain explicit. Global aliases are needed even for locally nested work.
SA boundary, actors, functions and services	sa_system, sa_actor, sa_function, sa_mission, sa_capability, sa_functional_chain; corresponding relations and explicit OA/SA trace. Same declaration catalog and examples/source-project/sa/.	There is at most one System. A function nested inside its performer would be an ownership mistake, not helpful syntax. Source must express functional decomposition separately.
Exchanges, contracts and interfaces	Items, categories, data types/fields, interface allocation, associations, typed ports, communication means, functional/boundary exchanges, exchange/port allocations, interface provision/requirement. docs/language.rst:103–120,149–165,240–263,303–307; examples/release1/oa/types.arcadia and SA types.	type_ref { Named @type; }; and nested typed contracts expose constructor wrappers. Functional exchange endpoints require explicit function and port references. GUI convenience may create several records; raw text must supply their full valid graph.
Process/chain contributions and reuse	steps, Action/Exchange/Control/SequenceReference occurrences, SequenceLink, ContextualLink with owner/reference path/leaf/purpose. docs/language.rst:167–205,548–614; examples/release1/oa/behavior/process_oa_assessment_procedure.arcadia.	Owning an occurrence does not add it to steps; declaration order does not create precedence. A reusable-call path identifies an occurrence instance, not just a named callee or work element. Simplification must preserve those distinctions.
Scenarios, fragments, calls/replies and reuse	Explicit viewpoint/context; lifelines; Exchange/Action/State/Fragment/Branch/ScenarioUse; ordered membership, bindings, operation identity and qualified MessageValues. docs/language.rst:617–743; model.rs:550–589; examples/release1/oa/behavior/scenario_oa_full_scenario.arcadia.	A repeated message needs a new occurrence identity. Nested Branch/Fragment/ScenarioUse constructors plus explicit membership/binding lists are among the most verbose ordinary authoring forms. No syntax sugar may flatten alternatives or erase caller qualification.
State and mode behavior	Machines, regions, all 13 StateKind vertices, events, transitions, state actions and availability. docs/language.rst:130–141,745–873; examples/release1/sa/behavior/state_machine_sa_monitor.arcadia.	Hierarchical nesting already removes most parent repetition. Event constructors and typed/prose action alternatives still require clear guidance. State geometry and transition topology are separate records.
Constraint and value annotations	oa_constraint/sa_constraint, message expressions, entry/exit/do/guard/event strings; existing bounded data defaults. docs/language.rst:142–165,201–205,658–670.	Existing strings are fully editable but not evaluated calculations or unit consistency. The requirements delta and analysis proposal remain authoritative about the missing numerical semantics.
Saved presentation	diagram, node, projection constructors, routes/labels/anchors, view options and categories; docs/language.rst:1009–1176; examples/release1/views/.	Every persistent view field is representable. Typing coordinates is possible, but default overlapping placements do not make a good diagram. Derived camera/selection/viewport data must stay outside the semantic source.
External artifacts	artifact with owner, relation, URI, revision and fragment; language.rs:1778–1788; the complete example above.	Opaque URI/revision strings are usable from text; their existence is not evidence of retrieval, synchronization or file execution.
OA/SA trace and review history	trace, endpoints, kind, prose baseline and typed semantic facets; docs/language.rst:1179–1490; language/semantic_source.rs; harness/fixtures/release1-native/semantic-keyed.arcadia:392–430.	Historical uuid literals may refer to deleted records. Their keys/review observations are meaning-bearing state, not optional comments or live @alias links. Manual history authoring is expressible but burdensome; review APIs can generate the accepted facts.
Whole-document lifecycle and modularity	SourceBundle, explicit includes, source migration, exact updater; docs/language.rst:1645–1885; source_project.rs:286,780; source_files.rs:329,819,1041.	Pure compilation reads supplied files only. Current bundles reject unreachable supplied files; desktop draft buffers may additionally retain detached files before selecting the reachable bundle. No package namespaces or maintained library imports are implied by includes.

This covers all major current semantic families, including the less visible historical and presentation data. The general parse/format contract represents all persistent fields, but it does not prove comfortable authoring. Maintained cross-project library semantics and evaluated analysis remain unimplemented extensions; text/GUI/API designs for them must enter the same coverage matrix before the intended full end state can be accepted.

4. Identity, references, partial edits and source-only workflow

What current identity actually means

Project, elements, relations, views, placements, artifacts and traces share one UUID and alias namespace (docs/language.rst:48–56). Display names may duplicate. An alias is a stored source label, not identity derived from a name. Aliases are ASCII identifiers; strings may carry Unicode and JSON escapes (:1578–1590).

Parser::optional_id allocates a fresh random UUID whenever the clause is absent (language.rs:1226–1228). compile_bundle inserts those IDs and recompiles the actual returned bytes before migration/indexing (source_project.rs:286–300,660–675). A plain language::parse returns a model but no stabilized source bundle. Lint is read-only and addresses raw bytes; accepting lint output does not preserve allocated identities. These distinctions matter to every external editor or AI client.

Operation	Correct current source-only behavior	Failure or cognitive trap
Create from empty input	Author a complete header and declarations with new IDs omitted; compile/import the bundle, adopt its returned stabilized files.	Repeatedly submitting the original missing-ID buffers creates new identities even if names and text look unchanged.
Change a display name	Retain alias and UUID; edit the quoted name.	Recomputing the alias from that name changes references unnecessarily. Trace drift may properly require a later review.
Rename an alias	Change its declaration and all live uses in one complete source candidate, or use the documented SetAlias command and retrieve updated source. The probe verifies both rejection and safe rewrite paths.	Editing only the header does not trigger automatic refactoring during parse. Blind text replacement can corrupt prose, comments and historical values.
Reidentify	Use explicit identity-change commands when retaining original-record provenance is intended.	Raw replacement of a UUID is removal/creation correspondence, not an inferred rename. Same name or alias is insufficient to preserve history/comment ownership through identity swaps.
Add one new declaration to an existing file	Keep established IDs; only new headers may omit them.	Reformatting the whole file without old IDs can replace the entire modeled graph. A safe client must retain the returned source after every accepted change.
Reparent a nested element	Move the declaration into its new valid owner's body or to root, retaining IDs; remove/update an explicit parent if needed. Prepared Reparent performs that relocation with source trivia.	Lexical nesting and an explicit parent cannot disagree. Moving a work element must not silently alter allocation.
Move a declaration between files	Retain IDs and semantic parent; update includes and supply all reachable files atomically. The probe verifies a root participant move.	An include does not create a namespace or implicit owner. Moving a nested declaration to a top-level fragment without an explicit parent changes its model meaning.
Delete a referenced record	Supply a complete repaired candidate or use a typed command with the current deletion policy.	Raw source deletion does not automatically remove every dependent relationship or ordered reference. Structural rejection is correct; copying a GUI gesture's text deletion alone is insufficient.
Work with incomplete input	Keep raw drafts in the external editor; lint without adopting them; submit a structurally valid complete bundle when ready. Explicit permitted holes warn.	Parser admission may stop at the first syntax/conversion error. Partial declaration indexing is not a partially accepted model or per-file transaction.
Preserve review/history	Keep full accepted source plus semantic model snapshots; retain historical uuid forms exactly.	Replacing historical UUID observations with current alias lookup loses facts after deletion or reidentification. Server revision storage is not desktop Undo history.

update_bundle_with_identity_map checks the old compiled index/model/bundle and requires valid correspondence before writing (source_project.rs:780–849). The updater retains omitted defaults, literal spelling, comments between @ and alias, list-entry comments and CRLF/LF choices under defined ownership rules (docs/language.rst:1812–1876). Existing tests target identity swaps, nested cross-file moves, orphan comments, constructors and keyed lists (tests/source_identity_updates.rs:37,81; tests/source_nested_updates.rs:49,77,244,345; tests/source_project.rs:900,966,1030,1097). These are valuable obligations for a new grammar, not incidental old-editor behavior to discard.

Genuine source-only access today

The REST service can import an authored complete SourceBundle through POST /api/v1/projects/import-source-project, retrieve it with GET .../source-project, and accept a conditional complete PUT (docs/api.rst:85–99,164–204; oa-server/src/routes.rs:339,505,519). A client can prepare ordinary text files, encode them as the documented entry/files JSON transport, import, read back stable files, edit, validate and submit using the returned ETag. JSON encoding of transport strings is not intended to be the engineer's modeling notation.

Candidate validation and typed command transactions are available without graphical controls (docs/api.rst:115–120,288–302,445–464). SetAlias/Reparent commands use the same admission and source updater. Transition and semantic-review query/preview/apply endpoints mean text-only clients need not hand-construct every counterpart baseline. The operation still requires an explicit command/decision; ordinary source does not contain executable transition instructions.

The service currently requires an existing project resource for candidate validation, so it is not a standalone offline compiler endpoint. It retains only the current revision, and writes require the captured ETag; a source-only client must retain draft and accepted snapshots itself (docs/api.rst:13–49). /source is canonical model interchange, whereas /source-project preserves authored text. Substituting the former can defeat a client's goal of retaining its files and comments.

The shipped desktop command-line entry has only --write-example before launching Iced (oa-desktop/src/main.rs:36–48). The server binary exposes service configuration, not check/stabilize/refactor commands (oa-server/src/main.rs:31–78). Core has useful filesystem loading/saving and pure APIs, but writing a custom Rust client is not a comfortable systems-engineer workflow. There is no inspected ordinary local language CLI or LSP route providing source-position definition/references/rename. Existing desktop source_navigation.rs is literal per-buffer search and line navigation; model-to-source selection and file-tree navigation are useful but different facilities.

5. Where noise is avoidable, and where explicitness carries meaning

The current source7 file authored above is already much smaller than generated release examples. Across the actual 30 examples/release1 Arcadia files, the summed UTF-8 size is 78,414 bytes with 258 identity clauses, 357 empty-description occurrences, 34 parent none fields, 29 empty lists and 69 none tokens. These lexical counts include historical records; they do not prove that all matching text is redundant. The independent other-host audit in Gitea #113 reports the same 30 files/258 UUID clauses and complementary process/reuse counts. Neither corpus is a performance benchmark.

Four distinct problems should not be conflated:

1. Default-heavy presentation. Empty descriptions, root parent-none fields and ordinary defaults can often be omitted in authored declarations already. Current canonical export intentionally writes them, and graphical creation uses canonical declaration text. A minimal authoring writer could improve newly created material without changing semantics. It must compare against versioned parser defaults, preserve explicitly authored values and retain required historical observations.
2. Structural wrapper noise. body { Action { action @work; lifeline none; }; };, type_ref { Named @type; }; and Fragment/Branch/ScenarioUse records make engineers read metamodel serialization structure. These need a domain-focused surface syntax if an authoring trial finds the wrappers impair work. They are typed constructors today, not embedded arbitrary JSON, but their shape still reflects implementation records.
3. Repeated relationship authoring. A sequence owner has a steps list and separate owned occurrences. Fragment/branch membership and reuse binding maps have related duplication. Some of this can be generated from one explicit authored block, but contribution order, precedence, containment, exchange occurrence and reuse identity must remain distinct. Simply interpreting all nested declarations as an execution order would change semantics.
4. Identity, history and modular context. UUIDs, reviewed fact records and global aliases create cost that ordinary whitespace formatting cannot remove. Moving these facts elsewhere requires an exact portable representation and conflict rules; hiding them in a desktop cache would break the new text-only requirement.

The specification also has concrete inconsistencies, independently checked before any redesign:

Finding	Evidence and current disposition
EBNF version is stale	docs/language.rst:1599 says arcadia 5; its header and actual parser support current 7. The other host owns the correction in #116.
Fresh-source viewpoint default is misleadingly documented as legacy-only	Catalog :123 and scenario discussion :631 frame omission as schema-2 hydration; language.rs:1668–1671 sets MixedLegacy whenever the field is absent. The probe confirms fresh source7 behavior. #116 owns explicit guidance, with no semantic default change ratified.
Constructor-required-field rule overstates current admission	docs/language.rst:157–165,173–176 says supplied constructors require all fields and frames new message-field defaults as schema-2 exceptions. model.rs:550–566 and the probe show fresh source7 accepts omitted Action.lifeline and Exchange.message_kind/reply_to while producing the same values. Root should reconcile the normative rule and actual supported defaults deliberately, preserving accepted source, rather than silently tighten the parser.

This last inconsistency matters directly to authoring counts: a reader following the general specification may type more fields than the implementation needs. It also shows why a new syntax must have executable normative examples and versioned default rules instead of relying on implicit Serde behavior.

Larger-model needs

All includes and nested declarations share one global alias namespace (docs/language.rst:1692–1696,1759–1762). There is no current package-level scope or import alias resolution. Engineers must invent globally unique labels such as oa_left_controller_pressure even when the file tree already communicates much of that context. Splitting a project into files reduces local display size; it does not provide scoped names, cross-file reference navigation or independently compilable semantic modules.

Core bundles allow 256 files, depth 32 and 1,024 include edges by default. Desktop policy permits 64 MiB/100,000 graph objects/250,000 records/500,000 ordered references; REST currently limits model/source-bundle JSON to 8 MiB and 5,000 graph objects/20,000 records/50,000 ordered references (oa-desktop/src/source_workspace.rs:9–18; docs/api.rst:137–153). These different capacity policies must be visible in a large-model workflow. A model that opens locally may not fit the hosted service. Neither raising the cap nor claiming core has an unlimited parse entry establishes responsive editing.

SysML 2.0 distinguishes namespaces, owned/non-owned memberships, imports and qualified names rather than equating a physical file with semantic scope. That is a useful candidate vocabulary for Studio's unresolved naming design; importing the entire SysML metamodel is not required by this evidence. OMG SysML 2.0, §7.5 and §8.2.2.5

A Studio namespace choice must define whether scope is a model record or an authoring-only name environment; how it relates to current globally stored aliases; how moving a declaration affects references; what happens on local/imported name collision; and how GUI/REST display and rename the same identity. Secretly encoding qualified source names into generated global aliases would merely move the mismatch unless both representations and their mapping are specified.

6. Materially different candidates

Ratings are provisional judgments, not user-test measurements. Low implementation cost alone cannot win against the user's full authoring requirement.

Candidate	Small-model effort	Large-model context	Identity/comment/history continuity	Main failure mode	Provisional treatment
A. Current grammar with an authoring writer, source CLI and semantic navigation/refactoring	Removes generated defaults; allows ordinary editors to check, stabilize and rename safely. Existing short declarations remain.	Better tools and file navigation, but still global aliases and constructor/list burden.	Strongest reuse of current invariants and updater.	Mistaking tooling and hidden/folded UUIDs for a sufficiently clear language.	Useful baseline and immediate vertical infrastructure; insufficient alone if the measured wrapper/context burden persists.
B. Domain-specific syntax over the same authoritative model, with an explicit CST-to-model mapping	Can replace constructor wrappers and duplicated membership with coherent domain statements/blocks.	Reuse syntax and selective qualified references can improve context, but namespace policy still requires a decision.	Existing UUIDs and model commands remain; updater must preserve the chosen syntax and each generated record's stable identity.	Sugar becomes a one-way macro that canonicalizes after GUI edits or recreates hidden occurrence/link IDs.	Leading bounded experiment, paired with A's real source-only tools. Must lose if lossless bidirectional mapping is too fragile.
C. Redesigned declarative grammar with explicit semantic namespaces and integrated domain notation	Potentially most coherent whole-model authoring rather than accumulated keywords.	Can supply real local/imported naming and domain modules.	Highest migration cost; must map every accepted record, historical fact, source comment and ID, and preserve raw invalid drafts with their original language context.	Large new language designed before identity, library and analysis semantics are settled; coercing current ownership into namespace ownership.	Serious competitor for the full end state; require one complete alternative model and adversarial migration prototype before selection.
D. Separate engineering text from explicit portable identity/layout/history management modules	The ordinary model file can become much cleaner.	Management data can be localized, but cross-file consistency and conflict review become essential.	Possible only if all modules are version-controlled, portable, typed and atomically admitted; no ambient cache or hidden database authority.	Renaming/moving text breaks sidecar identity, Git conflicts silently remap records, or text-only users must manually rebuild baselines.	Evaluate independently from surface grammar. Could complement B/C, but does not get assumed merely because the sample looks cleaner.

A and B are materially different: A changes authoring tools and generated output without new syntax; B changes where an engineer states semantic facts and therefore requires a new lossless parser/updater mapping. C changes the overall naming/declaration model. D changes the location and authority of persistent identity/history metadata. Combining selected parts must be justified by the same complete workflow, not by accumulating every feature.

Identity alternatives that must be tested explicitly

Identity mechanism	Benefit	Non-negotiable problem to solve
Current inline UUID clauses	Self-contained and stable through rename/move; exact existing model/API compatibility.	Visually long; initial missing-ID buffers must be replaced by stabilized output. Folding cannot be the sole means of understanding ordinary text.
Short stable authoring anchors with an explicit UUID map	References and headers can be shorter while public model UUIDs survive.	Define map authority, duplicate/absent anchors, merge conflicts, copy/fork, reidentify and baseline references. Anchor allocation cannot depend on current file position or display name.
Separate identity management module keyed by a stable declared anchor	Keeps normal engineering declarations compact and portable metadata explicit.	Ordinary rename/move must keep the anchor/map coherent without invisible GUI state; partial commits and hand edits need precise diagnostics. An alias-only map is not rename-stable.
IDs derived from names, file paths, AST positions or full content	Looks convenient for a fresh example.	Routine rename/move/edit changes identity and destroys required continuity. Reject as the durable identity mechanism unless an independent stable anchor is introduced, which returns to another candidate.

None of the alternatives may reinterpret historical UUID observations as live aliases. A management module also cannot store only a hash of a required old baseline if the actual old facts are needed for review or library updates. Exact data and corresponding source must travel in the portable model envelope.

7. Preferred experiment and its falsifiers

Trial B against A and one representative C/D form, retaining current UUID identity and the current model for the first prototype. Keep parser language version and semantic schema version conceptually distinct: a syntax-only form need not pretend that its mathematical or Arcadia semantics changed. The repository currently couples them through Project.schema_version; separating them is itself a public-format decision, not an implementation shortcut.

Current bundle migration already stabilizes missing IDs first, then upgrades valid older source using targeted token changes, preserving file placement, nesting and comments (source_project.rs:286–300; source_project/source_migration.rs:4–105). Earlier readers explicitly reject later fields rather than silently absorbing new semantics. A new grammar must retain frozen source7 interpretation, including its actual default behavior, and provide an explicit migration report and reviewable diff for accepted documents. Invalid raw drafts cannot be semantically migrated as if they were valid ASTs: retain their exact bytes and original language context beside the accepted snapshot. Desktop recovery already distinguishes clean accepted buffers from dirty/unapplied ones (oa-desktop/src/source_workspace.rs:34–48). A successful accepted-source migration must not erase such a draft, rewrite a historical observation into a live reference, or regenerate occurrence identities from new syntax order.

For example, a proposed, currently invalid process authoring block could be:

oa_process triage "Alarm triage" id "...existing process UUID..." {
    contributions {
        action detect_once "Detect this alarm" id "...existing occurrence UUID..." do @detect_alarm;
        action assess_once "Assess this alarm" id "...existing occurrence UUID..." do @assess_alarm;
    }
}
sequence_link assessment_after_detection "Assess after detecting" id "...existing link UUID..." {
    source @detect_once; target @assess_once;
}

This spelling is not a promise of a finished grammar. In the candidate, each action explicitly owns one ordinary Action occurrence with the displayed identity and derives the process's ordered steps membership from block order. The existing SequenceLink remains explicit: contribution order is not an invented execution edge. The block cannot coexist with a conflicting steps field; it cannot absorb independently owned callee contributions, silently create a reuse clone, or allocate fresh IDs on every parse. The three UUID placeholders deliberately expose the unresolved real header cost; they must be replaced by actual accepted IDs in a measured prototype.

A message/fragment/reuse form needs similarly explicit ownership, occurrence identity, viewpoint and bindings. A blanket send A -> B shortcut is inadequate if it conflates work exchanges, participant boundaries, operation allocations, receiver lifelines and repeated occurrences. A data-field shorthand needs exact optionality/multiplicity/type/default semantics. A state-transition shorthand must preserve trigger alternatives, local/internal/external kind, typed work effects and descriptive text. These are required next representatives, not assumed consequences of implementing contributions.

Required implementation laws for any selected form:

• Parsing and lowering produce the same complete Project as the explicit current form, including all IDs, list order, views, artifacts and historical facts.
• Missing identities normalize once into the accepted portable source. Repeated admission is inert. All generated persistent records have explicit stable source identity; position-based IDs or unrecorded macro expansions fail.
• GUI/REST edits update the original selected notation, preserving unaffected token bytes and comments. A parser that can import the new form but an updater that rewrites it into canonical source7 fails bidirectionality.
• Source locations identify the actual authoring token responsible for each lowered property/reference. There are no synthetic error spans into an invisible expansion.
• A reference edit can preserve comments and historical facts even when two model records share a source construct. Constructor changes, reorder, nested move, UUID swap, delete/reuse and removal of an optional field have specified trivia ownership.
• A full accepted source bundle and model share one atomic admission/history/revision boundary. Invalid drafts remain drafts. Applying a semantic command cannot silently resolve an unrelated source draft.

The main falsifiers are concrete: two repeated uses of one work item receive the same occurrence identity; moving a nested declaration changes its performer; reordering a contribution block invents SequenceLinks; GUI Rename destroys the authored short syntax or comments; changing a file alias remaps historical facts; or a source-only update requires opening a GUI form. Any one invalidates that candidate until its representation changes.

8. Minimum vertical slice and full end-state obligations

The first coherent production slice should make one complete OA/SA model developable and maintainable through ordinary text tools, while establishing reusable lossless language infrastructure. It should not consist only of a new keyword.

1. Publish an exact source-only check/stabilize/refactor path. A local CLI over existing core/source-files APIs is the strongest initial candidate: read an explicit root file, diagnose raw bytes, write accepted stabilization only on request, preserve external-change detection, and expose explicit semantic alias rename/reparent with a reviewable file diff. Reuse the same protocol in an editor/LSP adapter later; do not make a network service mandatory for local modeling.
2. Reconcile the proven current version/default documentation inconsistencies with executable fixtures. Respect the other host's ownership of EBNF/MixedLegacy corrections. Specify constructor omissions by version and keep existing accepted source meaningful.
3. Implement one lossless domain-syntax representative only after the comparison: operational process/SA chain contributions plus their ordering and existing explicit relationships, with the complete alarm model retained. Extend the syntax-to-model location/update mechanism so a later scenario/data/analysis form does not require another ad hoc text-rewrite subsystem.
4. Drive initial creation, display-name and alias rename, reparent, duplicate-name reference selection, file split/move, raw invalid edit and repair, counterpart review and an ordinary graphical edit through that same model. Preserve full models and exact unrelated source bytes; use API ETags and desktop accepted history where appropriate. A text-only engineer must not need to manufacture private Rust enums or edit GUI-only metadata.
5. Compare the real initial and stabilized A/B/C/D texts, including all identity/history management modules. Measure completion and error recovery on the small model and on a generated large model with repeated local names, nested reuse, multiple files and 5,000 graph objects under the service cap. Also characterize the desktop's larger declared policy separately; do not extrapolate service measurements to 100,000 objects.

For that comparison record source bytes, required fact entry, edited lines for a one-record change, wrong-reference/ownership/order errors, completion time, diagnostic locality and measured parse/lint/apply latency. Include an engineer and an independent AI client working only from the published contract. Count total portable source, not just the pretty primary file. Establish hardware and practical latency thresholds before judging outcomes; no performance number is supplied by this report.

The broader release still requires a coherent notation for every current family in section 3 plus the selected calculation/quantity/library semantics, a deliberate naming/namespace decision for large models, practical source navigation/refactoring and accurate reST/API contracts. It must carry exact library pins and update bases, support real calculation results and formal constraints, and preserve graphic/text/API equivalence. Intermediate compatibility forms can be retained when explicit, but an unbounded collection of implementation-shaped escape hatches cannot stand in for the requested usable text-only language.

Root should record the candidate comparison, selected identity/default/namespace policies and migration obligations before major parser work. The current evidence justifies a complete source-only workflow and a focused bidirectional syntax experiment; it does not yet justify a wholesale rewrite, a hidden sidecar, or a claim that current source7 already meets the new usability end state.