ARCADIA-Studio/harness/release-chooser-contextual-integration-review-20260911.md

Chooser and contextual-source integration review — paused checkpoint

Codex-956atf /root/semantics_critic, 2026-09-11. Paused/incomplete at the user's reboot checkpoint. Root supplied combined commit identity c0e66f94e3412b5c3495e96f7934ae94116505c9 (chooser/workspace 7f081ad plus staged-source prerequisites df6f595). This reviewer inspected the working files listed below; no Git command verified their association with that commit. No production edits, Cargo, rustc, native UI, or test execution occurred. Only this new report was written. Gitea issue 1 coordination: #263; existing source review and relevant later fixes were read before this pass.

Two concrete focus gaps were sent to root before the pause. They are source-derived, unexecuted counterexamples, not observed native failures. Their corrections and regression execution remain outstanding; this is not an approval of the complete integration.

I1 — P2: returning from the source child does not restore parent focus

behavior/scenario/workspace.rs:346–358 replaces the parent editor/sensor tree with the source child. The parent-only sensor is at :640–644; its name input is at :362. Initial FormShown consumes form_focus_pending in behavior/scenario.rs:472–475.

Minimal sequence: start a Lifeline form, process its first FormShown, open Create new source, then Back; repeat with a valid source and Use. The child disappears and the parent is newly mounted, but both successful source-event paths leave the consumed flag unchanged (scenario.rs:638–687). App focuses only a closed-to-open source transition (app.rs:2398,2415–2423). The remounted parent's FormShown therefore returns no focus task. Escape returns through source_back() and Task::none() (app.rs:1813–1817, scenario.rs:315–316), with the same missing return intent. The raw parent draft remains intact, but the user returns to an unfocused name field. A recovered child differs: its parent focus flag can still be pending, so recovery alone would be a misleading positive control.

Recommended resolution: create an explicit source-to-parent focus intent for the current parent session and mount, including Back, Use and Escape. Do not rotate semantic/source identities or rewrite raw text to achieve focus. Mount a normal parent, consume initial focus, open the actual child, return by each route, then verify the current parent target and unchanged recovery/project/history. The current workspace test at workspace/tests.rs:217–322 checks first focus and repeated/stale FormShown messages, not these child-return transitions.

I2 — P2: accepted FormShown tasks lose their session guard before execution

app.rs:1401–1408 checks document, scenario, revision and form session before returning operation::focus(scenario::NAME_INPUT). The returned operation carries only the global constant widget ID. It has no current-session or mount check when subsequently operated on the widget tree. The chooser's return path does carry its session/generation/path and checks the current root form owner (app/reference_authoring.rs:181–196, forms/reference_chooser/trigger/focus.rs); merging that path does not protect this separate global operation.

Minimal deterministic acceptance case to run: obtain a valid FormShown task for session S1 without executing its widget action; cancel S1 and start S2; mount S2 with another input focused; now execute the saved S1 action. Both parents expose the same NAME_INPUT, so the stale action can focus S2 despite its different session. Also test S1 task after its child opens and after a Review modal acquires a legitimate input. A target-absent global focus operation can disturb other focusables it traverses. Native event timing is unmeasured; the regression must test the delayed operation itself, not merely reject a stale FormShown before producing a task.

Recommended resolution: validate an exact live parent mount/session at operation execution, including active modal ownership, and keep a missing/replaced target inert. Use that mechanism for I1 as well. Existing workspace/tests.rs:229–253,318–322 validates stale dispatch; :266–295 executes a current task against a generic two-input tree. Neither is the delayed-task falsifier above. This report does not claim a global operation reaches the chooser's separate search input: Popup::operate (widget.rs:252–264) traverses its content, not that separate input.

Bounded checks completed before pause

• The merge keeps source child versus parent branches separate; only the parent receives the scenario FormShown sensor. Parent editor scrolling is keyed by its form session (workspace.rs:746–763). Parent scroll/focus retention across child remount was not executed.
• Behavior::has_pending includes the contextual parent drafts; the reference chooser's availability guard excludes pending behavior (behavior.rs:948–956, app/reference_authoring.rs:68–89). Chooser browsing returns without a setter/planner (reference_authoring.rs:140–143), and exact host/document/revision/generation checks remain visible. This is a bounded readback, not a repeat of the full earlier chooser audit.
• Scenario and Work Source admission and final preparation compare the captured owner with the actual parent's owner ID and Project identity (scenario.rs:655–672,1392–1409; topology.rs:202–219,595–609). Token-only Back stays available before semantic validation. The unavailable-owner card precedes the ordinary workspace and preserves repair/cancel (behavior.rs:1036–1067). The full existing 23-case source audit was not duplicated.
• All discovered created_selection callsites supply the Project. App obtains the override before Document::execute and uses it only after success (app.rs:856–884). Active staged source selection requires exact prepared-command equality (scenario.rs:514–535, topology/direct.rs:209–230). The source combiner flattens the parent batch before reserving created identities (source_draft.rs:256–285). No runtime selection/Undo/Redo assertion is claimed.
• Source events stage through private parent clones; Use does not return a model command. Explicit parent submission executes and acknowledges only success (app.rs:2403–2413). Local Save intentionally calls apply_behavior first (:3049–3056); its raw-editor guard remains at :892–914. Thus Save after Use is an adoption path, not a valid staged-only unchanged-model observation, consistent with Gitea #248.
• The .gitattributes preservation entries and behavior module declarations were read; the guide contains contextual source creation and the retained direct scenario/state gestures. No additional concrete conflict loss was found before this pause.

Known later changes are separate: short-host source layout correction (#2/249) and staged machine-owner caption correction (#1/259). They are not claimed present or newly discovered here. In particular the caption handoff is later than imported df6f595. Old 52DE82 native evidence and old focused test artifacts cannot establish the new combined source's behavior. Root owns the combined build, 23 contextual-source tests, 14 chooser host tests, workspace gates and native acceptance; their terminal status was not established by this reviewer.

Inspected source fingerprints

SHA-256 of actual bytes observed during this pass; paths below the desktop source root unless stated otherwise. Later fixes require new fingerprints and their own evidence.

File	SHA-256
app.rs	38CE0EDBB7AFDE0DBBE03213B8273FFE669C5AA5C4A1A4927A904F0BF52ED587
app/reference_authoring.rs	A97F75640001048A12703CEF5A2D3140B0AEDFDB526B94B057C965C8B56361B4
behavior.rs	2D1EEFC9F86FB2696C3EBCBB944FDE0C4C960346460DE84B8172794D59286843
behavior/scenario.rs	FB807B8A2FBC5EB6E80E09D106A6BC0DF9F600F37E3E19793CA62EBBAC5BC256
behavior/scenario/workspace.rs	D8C13898890AB9A60A9826BEB5C968289462ED895A9F965CDC6C51275F6DB478
behavior/scenario/workspace/tests.rs	57562288182114C3DD085B85895B657EC2BEC5DD818912C51F6F93DE4B3EC0B9
behavior/source_draft.rs	08190823090BD8B0305809099ABADCC0DE431175F7044F1D5ABDCEDA52612EE1
behavior/creation.rs	33AE9AAF4BA90DE9432870CC8E99708EF39E3638AE8283A9253C333785C91299
behavior/topology.rs	D06B2F0FC39B4814E94200297E148F1D4D97E04CB167766030AC9DF18689E3B0
behavior/topology/direct.rs	413AA2009EE4CBA0941836B43E41F16A04C8FC8568B6E92DB5BB08516E95C287
forms/reference_chooser/trigger.rs	AFEDD3DECB9CA0FD80ED83F778CEF6F6E00AC9CE229079FEEDC7B95799B0BBAB
forms/reference_chooser/trigger/focus.rs	D489FA00F445BC603B3326CAD8721E2B608456ECF543954538904BF188C6C5FA
forms/reference_chooser/widget.rs	D66CC17AF7A48BB8598BE683F084BB08FA7AF7304F9636F0A1BEA94C5CF6C727
semantic_review/batch.rs	8301432527A027F1A0252F0192E0A56863CB92F7ABD2337A6AC3AEC9129B720F
guide.rs	EE57F8847FF1692AC566D19A66CAA7BB77AD49B5F4E30C562B93117C59BC2671
repository .gitattributes	0FC674218171AE324CE259C328856F0F60AF5C63360701D866DB3128FE001231

Post-reboot continuation: root decides/implements the two bounded focus corrections; independently read back the corrected source and run the delayed-task/child-return gates through root's sole compiler lease, then finish the remaining mounted/modal/scroll integration acceptance. This report stays frozen as the pre-reboot checkpoint.