ARCADIA-Studio/harness/release-process-editing.md

# Direct process / functional-chain editing

Status: implementation and automated Windows verification passed on 2026-09-06 in `codex/process-direct`, based on
1bf8ebc in `D:/CodexBuilds/Capella2-scenario-direct`; dedicated target remains
`D:/CodexBuilds/Capella2-scenario-target`. The prior scenario branch is retained.
No native acceptance is claimed; root owns Windows/Linux native operation.

## Decisions and observable outcome

An engineer can involve existing work/exchanges more than once, draw guarded
sequence links and controls, insert on a selected path, reconnect its endpoint,
inspect/reuse a subprocess, and undo/save/reopen with contextual identities intact.
Extend the existing derived topology graph and ordinary typed drafts. No core
schema, persisted geometry, source grammar or REST route is added.

Palette tools capture document/owner/revision/epoch and a specific contribution,
link or presentation slot. Canvas click-click and drag connect local occurrence
IDs. A link insertion preserves the captured link UUID, alias, description and
guard on the upstream segment, creates the downstream segment and new occurrence,
and updates `steps` in one validated Batch. Membership/presentation order remains
separate from SequenceLink topology. Incomplete control guards/cardinalities are
warnings, as in the core. Reconnection retains the link's authored properties.

Select always means the local occurrence/relation. Shared source navigation uses
explicit Open; reusable previews expand without copying or reparenting source
contributions. Inner preview endpoints are not caller-owned endpoints. Capella's
richer cross-reference hierarchy linking is an unresolved semantic extension,
not implied by this milestone. Existing explicit legacy-path conversion remains.

Keep canvas and bounded draft independently scrollable, use searchable paged
contextual choices, and default to readable zoom with explicit Fit and scrolling.
Transient drawing cancels on context, tool, bounds, scroll, resize or focus changes;
form inputs survive failed validation/source updates. Reuse passive scroll
observations including async-save delivery. Commit through Document::execute,
acknowledging and selecting the created occurrence only after model/source success.

## Ownership and verification

Own `behavior/topology.rs` and local tests, with narrow `behavior.rs` and `app.rs`
routing/lifecycle changes. Do not change DATA/Linux/semantic checkouts or perform
native input. Verify production pointer events, planners, App and model/source:

1. OA/SA repeated work/exchange involvement preserves shared records.
2. Alternative/parallel/loop creation, guards and incomplete warnings.
3. Specific guarded-link insertion preserves metadata; incompatible adjacency rejects.
4. Reconnect/delete/Undo/Redo retain unrelated paths and exact source.
5. Repeated subprocess reuse, explicit navigation, expansion and recursive rejection.
6. Legacy conversion and presentation reorder independent of explicit topology.
7. Dirty/source-failure/stale/scroll-save/resize/Escape/focus lifetimes retain drafts.
8. Nested source save/reopen and ordinary serialized command/model parity.

Run focused invariants, all desktop tests, strict all-target desktop Clippy and
optimized desktop build with --locked --offline and the dedicated target. Record
actual evidence and remaining native tasks before freezing. Root independently
reviews and native-tests the freeze; full-release completeness remains separate.

## Original implementation freeze and actual evidence — 2026-09-06

Production is `7a1e12bc7c18c5693de688f054293bacd095f4d8` (`7a1e12b`).
The prior `codex/scenario-direct` branch remains at its original head. Production
changes are confined to desktop topology and its local direct/view/test modules,
App process routing, the existing passive-scroll observer and one updated passive
lifecycle regression. `scenario.rs` and scenario message-label construction are
unchanged, allowing the root's separate DATA native fixes to merge independently.

The palette now draws work/exchange/reuse/control contributions and sequence links
with click-click or drag. Selected link endpoint handles reconnect by identity;
selected contribution handles reorder peers within one derived path column.
Source navigation is explicit. Expanded reference previews expose all directly
owned source contributions without copying them or making inner endpoints local.
Every picker has search and 24-item pages. Active tools have distinct styling.
Create/Cancel are outside the form's internal scroller. The canvas stays visible
while forms are pending. New occurrence selection is restored after the final
SetSteps command, and successful edits reveal it in the graph.

The 100% default and manual 50% zoom floor keep authoring legible. Explicit Fit
may produce a small overview; choosing a drawing tool leaves that overview at
100%. No positions are persisted. A source-only exchange sequence retains its
legacy linear meaning: two or more entries have explicit Convert. The original
one-exchange fallback offered only Work/Control/Reuse; independent review found
that this blocked exchange-only continuation. The correction is recorded below.
Disconnected exchange-only topology cannot be represented by the accepted
contract; the editor does not introduce an invisible mode flag.

The new App resize regression initially failed because existing window handling
only invalidated scenario contexts; it now invalidates process contexts too.
Passive viewport and both scroll reports are accepted before busy/modal gates,
validated by document/owner/revision, and cannot apply properties or discard a
behavior draft. The shared observer distinguishes its scenario/process delivery.
A separate captured-link probe failed because two existing parallel guards had
the same hit target. Distinct derived routes now make each relation selectable;
source/target/UUID/guard remain unchanged. The failing probe is saved alongside
the passing final suite as `process-parallel-selection-before.log`.

Actual commands used `--locked --offline` and the dedicated scenario target:

- Full desktop tests: **303 passed**, zero failed/ignored. Seventeen new process
  tests exercise production pointer sequences, exact guarded-link insertion,
  duplicate-link selection, same-owner reorder, source failure/drafts, busy save
  scrolling, dirty source/properties, real resize, reusable-source Open/Back,
  bounded widget trees and nested multi-file source/serialized-command parity.
- Strict all-target desktop Clippy: **passed** (`-D warnings`).
- Independent existing core suites `release_topology`, `process_diagnostics` and
  `source_nested_updates`: **19 passed**. These cover complete alternative,
  parallel and loop topology; two-direction transition closure; deletion and
  reidentification; legacy sequences and exact nested source ownership/history.
- Optimized desktop build: **passed**. Owned sources were formatted with Rustfmt
  edition 2024; `git diff --check` passed before the production commit.

The source/JSON commands and core invariants are unchanged. These tests do not
claim a new actual HTTP transport trial or native acceptance.

Frozen Windows directory:
`D:/CodexBuilds/Capella2-scenario-target/freeze-process-7a1e12b`.
It contains the binary, manifest and five verification/probe logs. Binary size:
20409856 bytes. SHA-256:
`701ECE6CD329A1CBE50D4DAEBFCE33AD7A93E6906295E74C3290653706F8455A`.
The frozen copy was hash-compared with the release target binary.

## Independent-review correction — exchange-only continuation

Production follow-up is `8bc564b4b2c3b6d12eb61fc09aec7f129f6e45b7` (`8bc564b`).
Independent review found a real dead end: after the first Exchange was created in
an empty process/chain, the accepted model classified it as an ordered exchange
path. There was no path to convert and the fallback omitted another Exchange.

Ordered paths now offer **Append exchange…**, including a single contribution.
The form names the captured final contribution and explains that Create adds an
explicit sequence link. Its contextual picker accepts exchanges whose source
matches the preceding exchange's target. Create emits one existing validated
Batch: new exchange occurrence, preceding-to-new SequenceLink and SetSteps;
existing implied links in longer ordered paths are materialized in that same
transaction. The second contribution therefore restores the direct topology
palette without inventing disconnected topology, global exchanges or a mode flag.
Source reuse, same-owner endpoints and the cross-reference semantic boundary remain.

Two new regressions both exercise OA and SA. The App regression starts with an
empty owner, creates its first exchange, invokes the actual Append event and
creates its second exchange. It verifies exactly one link, two distinct occurrence
IDs, unchanged shared records, one history entry per Create, exact model/source
Undo/Redo and source reopen. The independent proposal regression preserves a
multi-entry ordered path, rejects an incompatible exchange without losing its
form, and validates the serialized ordinary Batch through core execution.

Focused regressions: **2 passed**. Full desktop tests: **305 passed**, zero
failed/ignored. Strict all-target desktop Clippy: **passed** (`-D warnings`).
Commands used `--locked --offline` and the same dedicated target. The final full
suite took 10.75 seconds; Clippy took 4.96 seconds. Production changes are confined
to `topology/direct.rs`, `topology/view.rs`, local tests and `app/process_canvas.rs`.
No native input or new actual HTTP transport trial was performed.

Updated optimized build: **passed** in 38.80 seconds. Current frozen Windows
artifact, manifest and three verification logs are in
`D:/CodexBuilds/Capella2-scenario-target/freeze-process-8bc564b`.
Binary size: 20430336 bytes; SHA-256:
`8BD5C84DF0F4E333C1955E6E9299F431081912E1A504ED13355E0BFA70F8B8BD`.
The frozen copy was hash-compared with the release target binary. The prior
`freeze-process-7a1e12b` remains available as historical evidence.

## Root-owned native acceptance still required

At 1440x900 and 1100x700 on Windows and Linux, operate the actual application:

1. Start an OA process and SA chain, involve matching existing work/exchanges,
   repeat a shared source with a distinct contextual name, and draw links with
   both click-click and drag. Inspect source identity and contextual properties.
2. Draw Choice/Merge alternatives and Fork/Join parallel paths; enter `ready` and
   `else`, create a loop repeat/exit, and inspect incomplete warnings. Insert an
   exchange/control on an existing guarded path, reconnect an endpoint and reject
   an incompatible target; confirm the original path metadata and other branch.
3. Reuse a subprocess twice, select its body without navigation, expand one local
   reference and inspect the count, Open the shared source, then Back to its caller.
   Reorder peer contributions and verify links are unchanged; cross-column movement
   is rejected with the existing topology explanation.
4. Test Fit/100%, inner and outer wheel/scrollbar changes, resize, Escape and
   unfocus during an armed or held gesture. Verify no stale endpoint/slot commits.
   Confirm Create/Cancel remains accessible while a long form is open, search/page
   changes retain its values, navigation is guarded and save-time scrolling recovers.
5. Start an empty owner, add its first exchange, use Append exchange for its second,
   and verify the visible link/direct palette. Also append/convert a legacy multi-exchange path.
   Undo/Redo the conversion and direct edits, save/reopen a nested source project,
   then inspect the same occurrence/link IDs, guards and shared source records.

No native/UI input was performed in this task. Cross-reference inner-chain linking
remains an explicit unresolved semantic extension; this milestone does not claim
full Capella functional-chain equivalence or complete the first release.