ARCADIA-Studio/harness/experiments/diagram-navigation-gates-20260912/correction-handoff.md

Diagram navigation coverage corrections — handoff, 2026-09-12

Root verification update: Windows desktop execution passed: 894 passed, 0 failed, 1 ignored on source46b4f3c. See the complete result and input evidence. Core-specific checks, strict lint, matching GUI and native acceptance remain separate.

Candidate and ownership

Implemented on branch codex/diagram-coverage-fixes-ytr83r-20260912. Production base is fdf756e6a41b1879760e45c2c263bd671b562fe3; the root's subsequent docs-only commit does not change that production base. Candidate HEAD when this pre-format manifest was captured: f23615ffebdc3ca6872f98b6889ec49bb4e8abda.

All 25 correction inputs were handed back frozen to root for formatting/check/build. No further compiler-input edits by this agent after that signal. Root owns the index, commits, publication, compiler/test gate and native UI verification. This agent did not compile, run tests, run native UI, stage, commit, push or write Gitea. The original diagram-usages checkout was not edited. Historical frozen reviews under harness/experiments/behavior-navigation-review-20260912 and root-owned gate/layout reports were not rewritten.

The formatted correction hashes record the exact 25 production/test/document inputs after root formatting. This portable report describes the source correction; each verification result is stated separately.

Delivered behavior

Qualified preview SequenceLink arrows

GraphNode.preview_links now retains actual relation ID plus qualified source/target endpoints in a PreviewLink record. It uses the existing renderer's filtered direct-source link loop and unchanged preview limits. New Target::ProcessPreviewLink has the same identity, so two callers of one definition give two separate caller targets while the definition retains its ordinary ProcessLink usage. Target names include the caller path.

Painting and query share exact preview tile/arrow geometry. Focus clips the arrow segment against every opaque preview tile plus its border and chooses a visible remaining segment; missing or wholly covered geometry produces no usage. This does not expand nested rendering scope or invent relations for ordered adjacency. Dedicated presentation selection highlights the exact qualified arrow. It does not enter the occurrence authoring context, and App.selected remains the relation ID while the explicitly chosen caller stays the active behavior owner.

Allocation grouping

Saved Allocation projection lookup emits Target::AllocationGrouping { relation, work_placement, performer_placement } only for an actual direct Allocation relation whose visible performer placement occurs on its visible target work's actual visual_parent chain. Traversal follows projected placement IDs with a visited set. Bounds use the projected work's labelled header, capped at 420 by 64. Aggregate-only summaries, hidden/folded endpoints, mere endpoint coincidence and wrong projection do not fabricate grouping usages. An edge-only hidden-edge filter does not erase nesting the painter still displays.

No core model/schema, allocation parent/summary rules, authoring or Delete semantics changed. The peer-approved relation-versus-focus distinction from #3 comments 616/627 is preserved.

Semantic selection and visual focus

App.diagram_navigation_focus holds a separate Focus containing usage, accepted context and semantic selected ID. diagram_focus(surface) validates document, revision, surface and semantic selection. It is independent of gesture epoch. Architecture/state canvas inputs receive marker bounds for painting only; hit testing and edit/Delete capture do not consult the marker.

Ports select the port; allocation grouping selects the Allocation relation; state rows select the StateAction/internal-transition relation. The visual identity retains the exact owner/work/state placement without restoring or overloading selected_node after refresh_draft. State/architecture markers paint outside cached geometry or in the normal draw pass, independently of semantic paint. Camera pan/zoom/fit and accepted viewport changes preserve valid focus. Other user interactions and changed semantic/model/surface context retire it.

Navigation still unconditionally advances canvas_epoch to retire gesture/context tickets even for equal-valued destinations. Deferred first-layout camera tickets remain a separate lifetime. Stale chooser Close/Search/Choose envelopes cannot cancel a newer pending measured reveal. An accepted fresh Open explicitly clears the preceding pending reveal and focus before its epoch change, so closing the new chooser cannot strand a stale pending ticket that blocks viewport updates.

Corrected failed evaluators

Root reported the original frozen gate as 876 passed, 3 failed, 1 ignored. That is evidence for the old frozen source, not this candidate. Its authoritative receipt is root-owned harness/experiments/diagram-navigation-gates-20260912.

1. app::diagram_usages::tests::port_navigation_selects_port_and_exact_visible_owner_without_editing_geometry and diagram_usage::tests::ports_are_found_at_the_visible_owner_and_unplaced_elements_do_not_match_names failed during fixture creation. ElementBody::new intentionally returns None for Kind::Port; ports require an explicit contract and owner. Both fixtures now use ports::make_port with FunctionInput and an accepted CreateElement command. Query checks compare exact projected port/owner and center; App checks semantic port selection, exact visual identity, camera and unchanged authored state. The separate visual-focus fix is justified by inspected refresh_draft, but it was not the cause of these observed unwrap panics.
2. tests::revealing_an_implicit_function_port_unfolds_its_visible_architecture_owner folded one Allocation view but asserted global saved membership was empty. It now checks actual projected absence and saved_usages_for(Some(diagram)) for that view, explicitly requires a positive result elsewhere, then requires scoped positive membership after the legacy authoring reveal unfolds the ancestor. Independent review confirmed the demo's FunctionalDataflow alternate view in oa-core/src/demo.rs:721–727.

Evaluation added and static evidence

• App tests cover exact Allocation relation/work marker, state row marker through draft refresh, port semantic/visual separation, repeated caller-arrow selection and distinct cameras, same-value epoch retirement, stale Close/Search before first measurement, accepted replacement Open/Close followed by viewport, camera marker persistence, and stale retarget/document/revision rejection. Existing authored-state assertions retain Project, SourceBundle, revision, dirty and history checks.
• Topology tests now recognize actual painted preview arrows; additional tests independently locate the first-row gap, exclude opaque tiles for reverse/cross-row lines, reject hidden/proxy endpoints, preserve caller-specific expansion, and exclude deeper links even when nested tiles are expanded.
• diagram_usage/coverage_tests.rs was authored independently by /root/diagram_membership_map: eight validated-fixture tests cover exact grouping/header identity, nested summaries, folds/missing endpoints, collapsed leaf and edge-filter semantics, alternate projection behavior, distinct saved placements, and aggregate/role-derived nesting without direct relations.
• git diff --check passed on the frozen correction inputs. A static inventory found no DiagramCanvas/StateCanvas constructors missing the new explicit field or struct-update default. These are static checks, not Rust compilation or behavior execution.
• Independent final source review found no remaining material issue after correcting the misplaced initial paint insertion and stale-envelope/deferred-camera cancellation. Review explicitly checked exact preview identity/wiring, active caller preservation, semantic selection separation, camera lifetimes and the three fixture corrections. No new native/build evidence was claimed.

Root's remaining gates and limits

Run formatting and cargo check -p oa-desktop --tests first, then the required project test/lint gates on the identified candidate. Focused filters include diagram_usage, diagram_usages, behavior::topology::usages, and revealing_an_implicit_function_port_unfolds_its_visible_architecture_owner. Root chooses the established Windows runner/environment; this report makes no assumptions about independent peers' compiler/native hardware.

Inspect real repeated-call arrow navigation, reverse/cross-row focus, allocated work grouping, ports and state rows after measured first layout. Verify pan/zoom preserves the chosen marker, stale chooser events do not redirect/cancel it, and later semantic actions still refer to the relation/port rather than the visually focused work/owner. Parallel preview relations may share existing geometry; this correction preserves their separate IDs and selected stroke without redesigning routing. Deeper nested links remain excluded unless the renderer actually paints them. No claim of full #14/#17 or whole-application acceptance is made before root's gates and native workflow review.

Exact modified inputs

Six existing canvas fixture/helper paths changed only to supply navigation_focus: None for the new presentation field. All other purposes are described above; root-owned reports/docs-only changes are excluded from this list and hash manifest.

• crates/oa-desktop/src/app.rs
• crates/oa-desktop/src/app/architecture_authoring/tests.rs
• crates/oa-desktop/src/app/architecture_authoring_tests.rs
• crates/oa-desktop/src/app/diagram_reveal.rs
• crates/oa-desktop/src/app/diagram_usages.rs
• crates/oa-desktop/src/app/diagram_usages/tests.rs
• crates/oa-desktop/src/behavior/state_canvas.rs
• crates/oa-desktop/src/behavior/state_view.rs
• crates/oa-desktop/src/behavior/topology.rs
• crates/oa-desktop/src/behavior/topology/usages.rs
• crates/oa-desktop/src/behavior/topology/usages/tests.rs
• crates/oa-desktop/src/behavior/topology/view.rs
• crates/oa-desktop/src/diagram.rs
• crates/oa-desktop/src/diagram/lifecycle_tests.rs
• crates/oa-desktop/src/diagram/pointer_tests.rs
• crates/oa-desktop/src/diagram/port_hit_tests.rs
• crates/oa-desktop/src/diagram/port_labels.rs
• crates/oa-desktop/src/diagram_usage.rs
• crates/oa-desktop/src/diagram_usage/coverage_tests.rs
• crates/oa-desktop/src/diagram_usage/tests.rs
• crates/oa-desktop/src/guide.rs
• crates/oa-desktop/src/tests.rs
• crates/oa-desktop/src/views.rs
• docs/language.html
• docs/language.rst

Root compilation result

After formatting, cargo check -p oa-desktop --tests --locked --offline completed successfully on Windows (4m09s reported). Output and receipt apply to the formatted 25-file correction manifest. The command began at f23615f with these changes uncommitted; they were committed while the unchanged compiler inputs were being checked. This is a successful test compilation check, not test execution or native acceptance.