17 KiB
Scenario renderer bridge: bounded implementation and evaluators
Status: internal implementation candidate, 2026-09-13. Reviewed the frozen layout candidate aed07176 and the complete-anchor experiment. Source symbols below refer to that pinned candidate unless stated otherwise. The initial proposal is retained below; the source-only implementation checkpoint and bounded review now follow. The existing Windows experiment receipt records the separate 23-check result.
Contract versus proposal
The selected storage direction uses a saved Diagram identity distinct from its Scenario owner, sparse Lifeline x and direct occurrence-address send-y values, finite shared coordinate bounds, and checked source/model history. Direct includes the Scenario's own nested Fragment/Branch sequences, but excludes expanded references. Missing endpoint assignments can leave authored coordinates latent. Opening, passive projection and zero motion must not materialize or rewrite coordinates. See the pinned storage direction and candidate contract for status: public codec/version adoption and gesture policy are separate gates.
The proposed bridge is a pure complete-plan resolver, not the experiment's thread-local hook. Build baseline anchors from the actual sequence layout, overlay authored lane centers before deriving headers/messages/lifecycle/activation, and overlay authored message send-y before dependent vertical geometry. Missing overrides retain automatic anchors. Normal inter-lifeline messages have receive-y = send-y; self messages preserve the current +24 receive offset. The legacy self Create/Delete row denotes receive-y, so convert explicitly at that adapter. Determine self identity from effective Lifeline endpoints, including Timer's implicit local receiver, never from equal x coordinates.
These renderer offsets describe the existing bridge, not new schema fields or an independently adopted gesture policy. The bridge must not reorder semantic steps, reparent operands or silently clamp authored coordinates. Collision handling, source-order crossing behavior and the final release gesture remain unadopted.
Next narrow pure-resolver slice
Implement an internal resolver accepting an immutable accepted Project and an explicit derived-or-saved Scenario representation. Return Result<ResolvedScenarioPlan, Vec<GeometryIssue>>; names are internal proposals. The successful plan contains resolved lane centers, separate message send/receive anchors, all automatic non-message anchors needed by the existing Scene, frame bounds, operand/sequence scopes, insertion slots, and full structural bounds with an origin. Preserve semantic IDs and sequence membership. Carry enough representation/owner identity to reject a mismatched caller; document/revision/visit freshness remains the consuming adapter's responsibility.
Avoid a parallel renderer: extract/reuse the actual baseline layout calculations and feed the resolved data into the existing geometry builders. Do not retain ambient TLS or recursively build a Scene whose construction resolves itself. Do not expose partially updated geometry after a resolver error. Classify an unfinished message as latent rather than fabricating an arrow; its stored coordinate remains untouched.
For the first resolver checkpoint, leave production workspace/gesture/navigation dispatch unchanged. Exercise the resolver and a narrow real-Scene construction adapter in tests. That checkpoint proves geometry integration only, not visible persisted editing. The adapter must cover the #21 activation contract below before its output can become production paint. Workspace/camera/usage wiring is the next explicit integration increment, sharing this plan rather than implementing another resolver.
Proposed error presentation for that later increment: return named issues, then let the caller choose one complete automatic fallback scene and visibly report the unsupported authored layout. Do not mix authored arrows with automatic scopes/activations, erase saved overrides, or treat fallback coordinates as new authored intent. This fallback policy is proposed, not yet accepted product behavior.
Five integration seams and falsifiers
| Seam | Concrete source fact and bounded requirement | Observable evaluator |
|---|---|---|
| Frames, scopes and lifecycle feasibility | behavior.rs::occurrences derives frames/slots/scopes from the traversal cursor. behavior/scenario_lifecycle/render.rs::Rendering::new replaces the root scope with 85..height-20. The complete-plan experiment rejects nested353 because its operand would begin311 above enclosing frame332, and rejects Create50 because actual root lifecycle begins85. Resolve all dependent scopes and slots, preserving named unsupported outcomes; removing a cursor floor alone is insufficient. |
Replay nested353 rejection, admitted380 overlap, Create50/85, and an early event positioned below the final traversal row. Compare real frame headers, insertion slots, lifecycle diagnostics and outlier bounds. Project and source remain exact. |
| Endpoint identity versus geometry | behavior.rs::occurrences compares endpoint x values; behavior/scenario_lifecycle/render.rs::align_messages independently compares sender x and receiver x. Both must use effective Lifeline identity. Equal-x distinct lanes do not become a self loop. A degenerate inter-lifeline arrow requires an explicit geometry issue/representation policy. |
Distinct Lifelines at equal x, reversed lanes, genuine self, Timer without receiver, and both self/inter-lifeline Create/Delete. Assert endpoint coordinates, receive offsets and marker identities. |
| Mandatory #21 adapter | Current behavior.rs::activation_sequence starts from the call row, which denotes send for ordinary/self calls. The complete-plan self610/634 test explicitly excludes this activation defect. Coordinate with the #21 owner and the aadc6396 typed-activation source; consume finalized endpoints/scopes, construct lifecycle and align Create/Delete, then attach typed activation geometry while retaining death clipping and unresolved-call cues. Do not independently overwrite peer activation semantics. |
Self Call send610/receive634 starts the actual activation at634. Move correlated Reply and receiver Delete separately; assert the full nonempty typed activation vector, logical correlation, clipped bounds and no resurrection. |
| Full bounds and representation camera | behavior/scenario/workspace.rs::Presentation::fit_scale consumes Size; Fit has a 0.05 floor. workspace::view keys viewport/camera by semantic owner. Later wiring must use rectangle origin for fit/centering and explicit saved representation identity. Million-unit gaps cannot fit through the existing floor. |
Negative lanes -500/+900 and near-opposite coordinate bounds remain reachable; Fit includes headers/lifecycle geometry. Switching two saved views of one owner rejects prior viewport/camera envelopes even without an intermediate frame. |
| Paint, operation visibility and usage agreement | behavior/scenario/usage.rs::diagram_usages independently constructs an automatic Scene; usages use Surface::Scenario(owner) and reveal repeats that query. label_field_visible independently assumes 32-grapheme shortening. Later wiring must consume the selected representation's resolved geometry and the same measured displayed-prefix result as paint. |
Two saved views yield distinct bounds; Choose revalidates the selected representation; fallback targets use actual fallback bounds; operation suffix membership agrees with paint at destination zoom. |
Pinned source map: Scene, lifecycle rendering, workspace camera, and usage/reveal. Relevant original line anchors at review: behavior.rs 1503-1529 and1704-1709; behavior/scenario_lifecycle/render.rs40-57 and113-150; behavior/scenario/workspace.rs47-100; behavior/scenario/usage.rs7-22 and155-201. Symbol references remain authoritative after edits.
Resolver checkpoint evidence
Retain the experiment's independent numeric expectations and full Project/SourceBundle guards, replacing TLS lifetime checks with explicit plan isolation: resolving view A must not affect view B or an automatic view. Cover None, present-empty and explicit overrides equal to baseline, including signed zero, without model/source/revision/history changes. Include two views of one Scenario, repeated performer/exchange definitions under different appearance IDs, unfinished latent messages, negative x, wide gaps, nested operands, self Call/Reply and Create/Delete. Assert actual geometry, not only plan fields or nonempty counts.
The existing 23-check experiment comprises thirteen complete-anchor checks plus ten earlier floor/lifetime checks. See the complete-plan module, numeric tests, prepared rationale, and adjacent floor/lifetime experiment. Its frame padding/nonshrinking bounds are experimental preferences, not adopted constraints. It does not establish horizontal layout, saved-view camera behavior, measured operation visibility or the #21 typed activation union. The execution receipt reports 23 passed, zero failed/ignored against 4b782a71, with unchanged 574-input manifests. The prepared README's pending-execution wording is historical; that result does not establish this proposed resolver or the later typed-activation union.
No schema extension is required by this resolver proposal. No gesture/navigation rewrite, semantic reordering policy, expanded-reference editing or native acceptance is claimed by the pure-resolver checkpoint. The integration owner coordinates implementation and publication; #21 activation ownership remains an explicit dependency. Pinned peer source is a compatibility input, not evidence that this bridge has been integrated or accepted.
Source implementation checkpoint
The closed 68a81c3 Windows gate preserves its focused failure (86 passed, one failed). The corrected 37be410 foundation gate then listed 1,010 tests, passed all 87 focused tests, completed full desktop at 1,007 passed/0 failed/3 ignored and server at 57 passed including the actual Scenario HTTP test, with all 591 captured inputs unchanged. Strict Clippy failed on five collapsible_if findings in scenario_layout.rs; this gate is closed failed and no GUI build ran. The later published workspace integration 46e106c has exact 25-file remote/local source verification only, with no UI compile or runtime acceptance at this checkpoint. A subsequent combined gate must validate the strict correction and UI integration; these foundation results do not transfer strict or GUI acceptance to that source. The paragraphs below retain the earlier source-only checkpoint.
Candidate 68a81c3 contains the pure resolver and actual Scene adapter with 22 prepared tests. It retains the resolved Scene with explicit representation/owner identity, exact render-lane centers, origin-bearing bounds and latent message addresses. It does not wire saved views into workspace, camera, usage or gestures. The source is published and all 13 changed contribution files match remote blobs and sizes; no combined compile or execution is claimed at this checkpoint.
Typed activation import 695685a selectively consumes peer aadc6396, retaining the current label helper and Lane header, and excluding unrelated Remove keyboard wiring. Test correction 20acd32 replaces the old width-eight BoxItem oracle with an exact nonempty typed activation vector and closes the empty-vector loophole in the offset probe. HTTP test bfb4b39 independently constructs expected Scenario layouts through existing transaction, no-op, stale revision, source and restart paths; it is unexecuted at this checkpoint.
The portable source review preserves the rejected snapshot and precise corrections. Returning success after new actual lifetime MissingGeometry is forbidden: final versus automatic lifetime diagnostics catch lost sibling geometry and a dropped following Delete marker without duplicating projector traversal rules. Exact authored send/lane values are primary inputs; reconstructing them from header rectangles or subtract/add deltas loses float bits and can falsely reject a valid Call. Preserve endpoint pairs after lifecycle alignment and before typed activation derivation. A rectangle must retain its origin when width already includes the negative extent. These conclusions do not adopt a new chronology, gesture or codec policy.
Next display policy
For the next workspace increment, use one complete automatic fallback only when a structurally accepted saved representation has a hard geometry failure and its automatic resolution succeeds. Keep requested Saved identity distinct from the Derived geometry provenance, preserve all authored values and show a persistent accessible explanation. Invalid/stale identity or failure of both projections yields an unavailable canvas with inspection/source actions, never an arbitrary owner or unchecked partial renderer. Successful authored geometry with source-order/frame-overlap diagnostics stays authored and receives explanatory notices. Latent messages and semantic completeness warnings remain distinct.
One presentation adapter must supply the actual Scene, origin-bearing bounds, identity and status to paint, hit-testing, usage and reveal. App owns document/revision/view-visit freshness; existing Scenario state owns presentation. Inspection, navigation and guarded semantic/source repair remain available. Coordinate-dependent input is refused in fallback at both controls and event admission, including a held drag released after repair. An explicit repair must never save fallback coordinates implicitly. This is a selected reversible display policy for the next implementation; native feedback, focus, stale input and persistence acceptance remain required.
The workspace acceptance preparation and independent identity review define the next integration checks. Route saved Scenarios through Page::Behavior with explicit representation, semantic owner and a stable view-visit stamp across controls, passive callbacks and Back; restoring a caller restores presentation into a fresh visit. Fit and every zoom transition must use full origin-bearing bounds without a conflicting minimum-scale clamp. Do not enable a saved chooser destination until paint, query and reveal consume the same resolved Scene and representation. These are implementation constraints for the next increment, not implemented or executed workspace support.
The workspace increment retains the current 32-grapheme message labels and heuristic label bands. Widening lanes alone will not reveal long names. Measured-label integration findings keep actual Scene paint/hits/operation membership, finite structural bands and destination font/zoom context together as a separately gated increment; the standalone WGPU experiment does not establish production label acceptance.
The workspace integration source review records the consuming identity/camera/reveal contract and corrected routing falsifiers at46e106c. It distinguishes prepared tests from runtime acceptance; live verification remains in issue20.