ARCADIA-Studio/harness/release-behavior-canvas-r123-source-20260911.md

Shared behavior canvas phase 1 — R1/R2/R3 source correction freeze

Codex-956atf /root/behavior_canvas_resume, 2026-09-11. Isolated .local/behavior-canvas-worktree-20260911, branch codex/behavior-canvas-20260911, base e511c4153fb5bb484652434340e0e4c7000c93d0. Correction lease: issue 2 comment 377. This answers root's full independent correction review (root harness/release-behavior-canvas-corrections-review-20260911.md) and comment 366.

Source preparation only. All 19 owned Rust paths pass scoped standalone rustfmt formatting/parse check and git diff --check; only ordinary CRLF normalization notices were emitted. No Cargo/rustc, build, renderer/test/native execution, installation, Git mutation or Linux/WSL/VPN work occurred. Root owns independent review, integration and coherent Windows acceptance. Linux remains paused by the user. Prior root passing gates establish other bytes, not this candidate. Previous reports remain unchanged historical records; their superseded correctness claims must be read with the independent R1/R2/R3 review.

R1/R2: stamped toolbar admission

Production palette, Details, Panels, Canvas, Fit and zoom actions now carry Message::BehaviorControl(Intent): the current document/owner/revision/camera lifetime, stable control name and boxed existing action. App validates the live clean input owner and exact lifetime before inspecting a narrow presentation-action whitelist. Only the semantic epoch interval accumulated during that still-valid camera lifetime can be normalized to the current context. The existing exact-context process/scenario adapters then handle the action. The earlier process-only unstamped epoch exception is removed. Domain authoring gestures retain their exact full-context guards; the envelope cannot dispatch arbitrary model/source commands.

Consequently a held camera drag's own ordered Pan can precede its same-batch Fit/tool/panel action in BOTH adapters. External Fit/tool/panel/bounds/caller/chooser/dirty/busy transitions terminate the lifetime and invalidate retained toolbar packets even when semantic context has returned to the same epoch. Reapplying an unchanged Fit or tool also ends the gesture. The existing held-pan Fit pan == ZERO assertions are preserved.

Control no longer emits an earlier press-time ControlFocus Task. Accepted pointer or keyboard activation requests focus after the action, stamped with its resulting lifetime, matching Iced's final-view action execution. Canvas activation requests the viewport directly. F6 entry/exit, Tab/Shift+Tab traversal, Enter/Space activation and Escape exit remain the defined owner-respecting policy. Stable control identity preserves a visible keyboard target through a tool change.

R3: actual runtime UI and guarded focus passes

The mounted helper now retains iced_runtime::user_interface::Cache and uses the installed UserInterface API for input, layout, operations, nested overlays and drawing. It drains every App message from an input batch while collecting immediately ready Task actions, builds the resulting final App view, then executes actions. Output messages become the next update cycle; pending Task streams survive until completion. Widget Chain passes run synchronously against that same UI, including root and nested overlays. Unexpected native actions panic. Production WGPU initialization still uses expect; there are no missing-backend skips. No private gesture/focus state is seeded.

A presentation owner marker wraps the actual App root. Both Collect and its Apply pass independently check the current clean owner and exact camera lifetime before changing focus or palette scroll. This is independent of root's later scenario parent-focus marker. The test deliberately retaining Apply across ownership changes establishes the stronger retained-operation invariant; installed native Iced executes Chain passes synchronously, so no hypothetical native interleaving is claimed.

The picker regression uses public Save(true) and cancellation completion transitions. On Windows it holds/drops the unopened external picker Task, verifies busy admission, and injects SavePath(None); every widget Task is executed. It does not test a native picker dialog. The existing Linux in-app picker path is represented by CancelFile, but was not run and Linux acceptance remains user-deferred.

Prepared regressions, all uncompiled and unexecuted

There are now 17 production App-root mounted tests plus two shared math/input tests. All previous direct-authoring, staged source-child, form identity, geometry, exact source/snapshot and history assertions remain.

• Existing process/scenario held-middle tests retain Fit==ZERO, now require same-batch pointer activation to focus the resulting control without F6 and the following Tab to focus ZoomOut. Retained camera and toolbar packets are asserted separately across Fit, tool, Details, Panels and resize.
• Existing caller-return tests retain camera restoration/old-delta checks and additionally reject actual pre-call Fit packets after A→B→Back.
• production_process_retained_toolbar_intents_reject_chooser_dirty_and_picker_lifetimes and its scenario counterpart capture actual Fit/tool/Details/Panels/Canvas packets. Real chooser open/Escape, property Field/RevertProperties, and picker cancellation cycles must change lifetime without changing semantic epoch. Replays must preserve presentation, focus, source and history; dirty/busy owners also reject packets while active.
• production_process_keyboard_reveals_and_activates_initially_offscreen_last_tool and its scenario counterpart explicitly require the last tool to start fully below an overflowing palette, then require keyboard reveal of the whole tool, Enter activation and changed visible focus-border pixels. Connect and Fragment activation are asserted through resulting domain presentation state.
• The existing chooser/Review test now observes the newly focused nested search input, absent from root input geometry. Both delayed Collect and retained Apply must preserve it; a retained Apply stays inert after returning to the same clean canvas with a new lifetime. The actual Review field and scroll state must survive both delayed passes. The test states that retained Chain execution is deliberate.

Root filters: canvas_workspace::tests, production_process_, production_scenario_, production_empty_scenario, production_canvas_keyboard, then preserved direct process/scenario/source/raw/history and root parent-focus/chooser gates. These are prepared filters, not results. Pixel assertions establish only the tested visible focus borders when executed; transformed scene clipping, refusal text, native input/accessibility and all popup geometry still require their existing acceptance gates.

Exact scope and later union

This correction changed these ten existing Rust paths relative to comment360:

• crates/oa-desktop/src/app.rs
• crates/oa-desktop/src/app/process_canvas.rs
• crates/oa-desktop/src/behavior/canvas_workspace.rs
• crates/oa-desktop/src/behavior/canvas_workspace/control.rs
• crates/oa-desktop/src/behavior/canvas_workspace/focus.rs
• crates/oa-desktop/src/behavior/canvas_workspace/tests.rs
• crates/oa-desktop/src/behavior/scenario/workspace.rs
• crates/oa-desktop/src/behavior/scenario/workspace/tests.rs
• crates/oa-desktop/src/behavior/topology/view.rs
• crates/oa-desktop/src/behavior/topology/layout_tests.rs

The candidate's total union remains the 19 Rust paths below, plus this new versioned handoff. app/reference_authoring.rs still contains only the previously authorized read-only reference_input_active accessor relative to its isolated baseline; no new chooser changes were made. behavior/form_session.rs remains root's frozen verbatim helper with SHA256 F5027FB3A5A5599A182E7D1A10DBA56DD66EB1F23A4BA4C4A1744C9A6A5B6E61, used by scenario session and process invocation. No new source/core/schema/REST or persisted geometry contract was introduced. Camera/control/focus changes are presentation only; existing constrained semantic commands remain unchanged.

Root must merge its I1/I2 Name session-versus-mount identity, current FormShown payload/sensor, Back/Use/Escape rearm, parent root marker and same-axis focus adjustment, five parent-focus regressions and scenario replacement-scroll regression. Preserve root's current dynamic Id::from(String), chooser Send/'static/compiler corrections and chooser fixes. Also preserve root checkpoint 3c9e6ee's boxed workflow Event::Semantic(Box), Event::semantic constructor and reference_authoring .as_ref() pattern handling. None of those root changes were imported here; do not overwrite root App/scenario/workspace wholesale.

B4 remains ytr83r-owned. Apply pan plus scale to both its clipping rectangles and clipped child text during union; preserve its renderer/lifecycle oracles. Root owns common Wiki/ledgers, commits, releases and all execution. Full phase1 acceptance and issue2 closure are not claimed. Persistent placement/lane arrangement, exact source/reopen coverage, wider process body and endpoint manipulation, fragment wrapping/operand transfer and other phase2 domain work remain outside this bounded correction.

Frozen source fingerprints

Ordered manifest SHA256: 9EBEC63D5D8B2595FB3867E63E7C6A26C4B04DFA1C7644B840E6FA001A2F0692. Canonical manifest bytes are each table path, one ASCII space, its uppercase SHA256 and one LF, in this order, UTF-8. These are raw isolated working-file hashes; root integration will produce a separate union identity.

Path	SHA256
crates/oa-desktop/src/app.rs	F059158240FBD41491C65D7BDDE318B0089A6DFED2688A741172535154078236
crates/oa-desktop/src/app/process_canvas.rs	8B80661A021E2F9F8E83BD9B0858D707F067C2E42CB180A3CDFA59A1467B3DF9
crates/oa-desktop/src/app/reference_authoring.rs	CFD96F4A38754C5FDA1B176B342162B7BFA7BFE0DCAE2A8309953A40395D92BF
crates/oa-desktop/src/behavior.rs	A35D03A1A63BB8FD6D2E5D394CC41AB93A6F306F05BDD89353C6B79503F92E64
crates/oa-desktop/src/behavior/canvas_workspace.rs	096D667C4C8EE3732D52668A9562C665F2D9A192ABDA4E5487FCAD7621C8DBFD
crates/oa-desktop/src/behavior/canvas_workspace/viewport.rs	AF1C7C1E802D1207EE6C7BD66B703811A250D7B56511512AF6C0945C776E68A7
crates/oa-desktop/src/behavior/canvas_workspace/control.rs	851AF1E9B155D6D0D079D9164C5616FADC33E961391A6604A43EABF5158957B3
crates/oa-desktop/src/behavior/canvas_workspace/focus.rs	CC58CB3838F546150D22FE4DD83A3FFD52504C279FEBAEB8D0B4A6A3B8A73950
crates/oa-desktop/src/behavior/canvas_workspace/tests.rs	0272F78DAA97FAB75E971F1548A3E224C2F2D0A4D9D603DB90DBEB9F6D673C1E
crates/oa-desktop/src/behavior/form_session.rs	F5027FB3A5A5599A182E7D1A10DBA56DD66EB1F23A4BA4C4A1744C9A6A5B6E61
crates/oa-desktop/src/behavior/scenario.rs	59F859B246C3186AC5B156B46AEE3A0DDC38F79C1CF332C4FB03092214A43A93
crates/oa-desktop/src/behavior/scenario/workspace.rs	FED77DDF304FD831CC163F6B8079BB6C17AC755BF141A5D30D5E64C04CBD9677
crates/oa-desktop/src/behavior/scenario/workspace/tests.rs	851772CE7C1DA0479DA7D6FB16EF17038653B43DB3B8EDF5E88605AAE4830C89
crates/oa-desktop/src/behavior/topology.rs	5723E51A7DA4EB224D51C1659EBBFA4DC8B11557BC8BF70F6E3E1649BAD24449
crates/oa-desktop/src/behavior/topology/view.rs	B2D502C11426BFFB8763515F2A56AA4C9F8E203BB36D65EB34F81C123FC406A6
crates/oa-desktop/src/behavior/topology/direct.rs	6102219487A0717C66190153C435B5B05226D156C59C7EAAB649249ADEF73644
crates/oa-desktop/src/behavior/topology/direct_tests.rs	D3CD44477BDEB31256BA52AA70383CEFC9805A8B172271D357884C95DDEF11D8
crates/oa-desktop/src/behavior/topology/layout_tests.rs	39D9C28201EC1B044EAE848B09AB276FF7FCF9F69FE6B5E39A6863F56A0111CE
crates/oa-desktop/src/behavior/topology/contextual.rs	5D0AC5B3E258FC70987A00EDE1E603681D99746596F2FCC46AD2B3667D65203A