ARCADIA-Studio/harness/experiments/nested-lifecycle-union-20260912/independent-review.md

Independent lifecycle/typed-activation union review

Reviewed f6595ebf66e88ec42c37b5c1a3c014f5e52cb32d in .local/nested-lifecycle-union-20260912, base d61f1f38779ab70a77efcde523ae31c432aefcfd. Read the complete worker handoff, earlier integration contract, actual six-file diff, activation/lifecycle implementations, core lifetime admission, all nine union tests and retained renderer evaluators. The isolated worktree was clean at inspection. No source edits, compiler/tests, UI interaction, integration or Gitea mutation performed; only this requested report was written.

Bounded conclusion: no actionable source defect identified in this union. This supports proceeding to the root-owned combined gates, not accepting a native result. All 17 retained renderer tests and nine union tests remain unrun by this reviewer. The prior root and peer passes do not establish the combined source's behavior.

Contract verification

• Admission remains authoritative. No core files change. oa-core/src/validation.rs:1766 still rejects uses ordered before Create or after Delete, including potentially ordered paths. The ordinary fixture invokes validate_candidate and constructs a Document from the authored bundle (scenario_lifecycle/render_tests.rs:141); it does not silently admit raw projects. Defensive invalid fixtures first assert an actual lifeline_lifetime error (union_tests.rs:247) before calling raw Scene::sequence. The rejected prebirth/postdeath/recreation cases are clearly distinct from the admitted incomplete-endpoint cases. The contribution does not adopt the peer's wider free-editing/schema policy.
• One geometry pipeline. behavior.rs:1399 adds self-Create/Delete clearance before row recording; final height is established at behavior.rs:1327, then lifecycle is built, Create/Delete endpoints aligned, and typed activations laid out. The non-scenario path retains its original guides. render.rs:128 handles only the lifecycle markers it derives; scenario_activation.rs:292 restricts final anchoring to Call/Reply/Asynchronous. A reflective Call still begins at its actual lower receive point (scenario_activation.rs:164); a reflective Reply ends at its send row (:206). No duplicate legacy activation traversal was imported.
• Logical timing survives clipping and missing polylines. scenario_activation.rs:49,367 constructs every recorded Call's correlation before clipping, using its actual receive point or row fallback, then recorded Reply scope/send positions. This avoids reconstructing logical duration from visible pieces and supplies metadata for incomplete calls with no sender line. active_segment's indexed correlation lookup (:441) therefore has an entry for every Call represented by an activation. Reply source anchoring (:310) requires matching call, exact scope, exact Reply ID and visible bottom equal to the actual send y. A call whose first visible piece starts only at later birth cannot move the original Call receive event, because its target requires rect.y == receive_y (:330).
• Clipping and termination are distinct. render.rs:169 intersects only Alive intervals for the exact receiver/scope and discards empty spans. scenario_activation.rs:121 preserves identity and scope for each piece; only a piece reaching the logical terminal retains that finish, while earlier pieces become Finish::Clipped. Delete emits Finish::Terminated(delete_id) and closes traversal (:176). It cannot manufacture a Reply cap or be restarted by a later Create.
• Conditional death preserves uncertainty without resurrection. The branch outcome carries open and may_be_terminated separately (scenario_activation.rs:359); any terminating compatible operand stops definite parent continuation (:235). Sibling traversals receive their own entry and retain their own bars/cues. This implements the explicit conservative root decision recorded in the handoff. It does not assert that a conditional model execution definitely died, change persisted correlation, or weaken validation. A call already answered before a later Delete is no longer open, so the later event does not incorrectly terminate that answered execution.
• Cues and columns remain coherent. Logical unanswered cues are emitted before alive-fragment filtering (scenario_activation.rs:113), retaining wholly invisible unresolved paths. The same chosen column displacement is applied to the call's surviving segments and cues (:85). Visible pieces alone provide active anchors; nested versus crossed containment uses original compatible Reply timings (:451) rather than fragment-edge coincidence. The new nested/crossed falsifier actually changes Reply order and expects different source anchors.
• Painter/hit union preserves the d61 repair. Lifecycle lanes paint before label masks/activations (behavior.rs:2036), masks still precede execution borders, and message paths/arrowheads/text remain foreground. Lifecycle markers paint last (:2197); their exact visible shape also wins first in hit testing (:1661). Headers/cards then precede exact message paths, execution rectangles, label rectangles and broad tolerances. near_sequence_item (:1725) compares broad marker/message distances together, avoiding minimum-zoom marker halos stealing a closer message. It does not move broad tolerance ahead of an exposed execution shoulder. Birth capsules and death Xs retain occurrence identity; lane-header selection retains lifeline identity. Clipped header/capsule text uses screen-space clip bounds and reapplies camera transform inside the child painter (behavior.rs:2159, render.rs:327); this is source-consistent but still needs the actual WGPU/native witness below.

Evaluator strength and limits

The nine union evaluators are useful and substantially discriminating: actual Document admission; exact Call/Reply receive/send alignment; explicit typed finish/column identities; deletion versus Reply; retained incomplete repair cards; invisible-path cues; missing sender polylines; rejected-data clipping; conditional death with a 26-unit unaffected sibling; and nested-versus-crossed anchoring. The latter two are independent semantic expectations, not snapshots of the old rectangle allocator.

The retained 17 renderer tests cover visible root extents, exact interval/marker coordinates, conditional/repeated/parallel scopes, marker and message hit priority at 5%/10%, self-event clearance, edit/Undo/Redo source restoration, and header/capsule clip bounds under pan/zoom. The width-8 anonymous-box adaptation now queries typed activation identity (render_tests.rs:509); the branch-death test retains its independent lifetime/sibling/open-cue assertions. Header names remain the actual root lane names. No evidence that a failing peer assertion was simply discarded was found in the reviewed source.

Two limits matter to the acceptance decision:

1. union_tests.rs:15 reuses production alive_spans to assert every visible segment is covered. That is a consistency check, not an independent proof that the lifetime projection is correct. It is adequately supplemented here by exact expected endpoints/scopes and retained explicit interval tests; do not report that helper alone as the lifecycle oracle.
2. Pan/zoom clip tests verify numeric bounds, and the Program test (render_tests.rs:906) exercises event-coordinate conversion and published identity, not final pixels. The row-offset test (union_tests.rs:442) verifies translation, full scene reparse equivalence and unchanged Document source/history, but does not prove arbitrary authored placement or pointer editing. The existing d61 WGPU activation-border evaluator is retained, yet its prior pass must be rerun on the union. None of these source inspections establishes a new native rendering pass.

Remaining native acceptance cases

Run the combined lifecycle, activation, atomic graphical Call/Reply and required desktop/strict gates first. Then inspect a source-identified packaged build with:

1. OA and SA delayed Create → nested C1/C2 → R2/R1 → Delete. At 100%, Fit and a small window, inspect both selected/unselected execution shoulders, arrowheads at bar edges, Create capsule, Delete X, and label-backplate continuity. Select each exposed shoulder and marker; confirm the corresponding Inspector identity.
2. Self-Create/Delete after an Action alongside self-Call/Reply. Confirm the 16-unit clearance is visible, the lifecycle receive row and lower self-Call receive row remain distinct, and selecting captions/capsules/Xs does not target an adjacent card or message. Include right-to-left Create for capsule-edge/arrowhead layering.
3. Long Latin and wide Unicode lane titles/details and birth names, with positive/negative pan at 50%, 100% and 200%, including clips at viewport edges. Text must stay inside its intended box/capsule without clipping the entire header, covering arrows, or detaching from its hit target.
4. Admitted incomplete post-death Reply and an admitted unresolved operand. Verify a repairable card and unanswered/uncertainty cue remain, with no false visible execution or Reply anchor. Do not author the defensive rejected fixtures through the GUI or describe their raw Scene projection as an admitted workflow.
5. At minimum zoom, exact marker/header/ordinary-message and exposed activation hits retain identity despite broad halos. Contrast/min-scale detail readability stays with issue #26; this review does not excuse missing geometry as a palette problem or claim tiny text is readable.

Parent owns synthesis and import. No change requested before the combined gates on source grounds from this bounded review.