ARCADIA-Studio/harness/release-contextual-source-creation-20260911.md

# Contextual prerequisite creation — implementation and evidence, 2026-09-11

Codex-9e8r6t /root/release_audit. Root-authorized bounded slice following `release-contextual-source-creation-plan-20260911.md`; independent review by `/root/behavior_audit`. Focused contract tests, strict lint, matching Windows GUI build and formatting passed. Root native/integration evidence remains separate as stated below. No native input, commits or release acceptance are claimed by this worker.

## Outcome and contract

An engineer can stage a missing semantic source inside a Scenario Lifeline, process/chain Work contribution, or new State machine owner form. Existing-source controls remain host-owned siblings; the external Codex-956atf reference chooser is untouched. Source and consumer names are independent. Participant kinds are explicit; OA Role is available for the appropriate lifeline only, never a machine owner. Semantic parent is shown explicitly, defaults visibly to the layer root where valid, and has a bounded searchable alternative list. MixedLegacy retains existing-source editing but no generic new-source catalog. Qualified Action creation and inferred allocations/capability involvement are excluded.

Option A from the frozen plan was chosen over suspending the form in Architecture (separate history/orphan risk) and multiplying dedicated source-plus-use tools (would not solve an already partially typed parent). Child Use validates/stages the prerequisite without adopting any model/source change. Back or Escape returns to the retained parent; final parent Apply/Create creates only its actively referenced staged dependency plus consumer and optional machine view in one validated transaction. Choosing an existing reference prunes the inactive source from that transaction.

`behavior/source_draft.rs` captures semantic document identity, typed reference scope, original owner, source name/kind/parent, child invocation token and reserved identities. Parent adapters retain their own raw fields, insertion/branch positions and invocation identity. Private preview Projects use existing core predicates; no staged object enters the accepted catalog. The parent planner's typed CreateElement/CreateRelation/reference/SetSteps records are remapped to reserved IDs, with aliases regenerated from those IDs. Machine/view IDs already reserved by the creation planner remain unchanged. Flattened final commands preserve exact command-correlated consumer selection after successful Document execution. Source write rejection retains both raw forms.

Scenario and process empty prompts count semantic children, not rendered/visible nodes. Scenario first actions carry the current canvas Context and recheck semantic emptiness; process reuses its Context-bound Begin at explicit append. Appearance/resize performs no mutation or focus operation. An unavailable pending owner is rendered as a retained-draft repair/cancel view before choosing any other owner.

## Independent criticism incorporated

- New Work adjacent to an Exchange must match its existing endpoint identity. A newly reserved source cannot do so; preserve the captured slot and refuse rather than retargeting the exchange or silently appending.
- Source Use on an unnamed machine now stages its valid owner and returns, allowing the still-empty parent name to be completed without discarding the source.
- Back is token-validated dismissal and remains available with stale/deleted owners or unrelated recovered raw editors; other source actions keep strict guards.
- Recovered incomplete source kinds have a total summary, followed by a normal planning error rather than a panic.
- Old empty-action events are scoped to their original canvas context. Missing-owner forms remain visible and do not fall through to another scenario/process and panic.

## Verification status

- `focused1.log` / `focused1-status.json`: compiler reported missing Clone for topology's private draft copy. The known-failed rustc was explicitly stopped; Cargo exit 101. No tests ran. Topology Draft/Browser/contextual Draft now derive Clone.
- `focused2.log` / `focused2-status.json`: one guide `explain` call had an extra body argument. The known-failed compiler was stopped; Cargo exit 101, no tests ran. Corrected by merging the explanation body. The focused3 compiler then rejected a test calling a private App method; no tests ran. It was corrected to send the real Message::Command route. The successful focused4 gate includes the nested source-parent, unchanged caller-binding warning and no-op Undo/Redo status regressions.
- `focused4.log` / `focused4-status.json`: PASS22/0,653 filtered out,2.04s execution after9m56s build. Test inventory675. Immutable `tests-verified/arcadia-studio-tests.exe` SHA256 `6E677F58458B6122EA1886AAC98882640CD9CF260651FE3ECE62BDDA4BE38CC0` (107061248bytes); sibling manifest and libunwind SHA256 `F45604A12E8BCD839FD86F667C1BE1CC7C4F9DA2B3C69FF381AC708F0E1AE7D4`. Frozen source inputs: `focused4-inputs.json`. Root executed the immutable full suite: PASS 675/675 in 448.33s; `tests-verified/full-desktop.log` and `full-result.json`. This predates the narrow final origin, guide and lint corrections below.
- Tests target exact source/consumer records, OA/SA strict viewpoints, source/consumer names and aliases, reserved-ID recovery/retry, one Undo/Redo and SourceBundle equality, inactive dependency pruning, second System refusal, Role owner refusal, guarded path insertion and exchange-adjacent refusal, raw source-budget failure, owner-first machine staging, modal Escape, dirty editor admission, recovered inner form, bounded footer geometry, stale CTA, malformed recovery and missing-owner rendering.
- Source formatting and scoped whitespace check passed after the guide correction. Final post-review hardening also rechecks recovered typed source scope against the parent adapter; malformed-scope regression passed in focused4. The full675 snapshot passed as above; the matching final GUI/Clippy gates passed below; real native staged creation and minimum-window readability remain root gates. No Linux runtime or release packaging claim follows from this desktop slice.

Evidence directory: `.local/contextual-source-20260911/`. Frozen older native/creation/packaging artifacts remain unchanged.


## Final origin and compatibility review

After child Back or switching to an existing source, a previously engaged parent must remain bound to its original semantic Project and exact consumer Element, even when no staged dependency reaches the command. Both Scenario and Work source-event admission and final command planning now compare that captured record against the actual parent draft owner. A valid different owner record cannot impersonate it. Missing-origin legacy recoveries bind only on their first valid, previously unengaged child Open; an already engaged recovery never silently rebinds. Back remains token-only dismissal. The worker found the post-Back/inactive command gap; independent reviewer confirmed it and sharpened the different-valid-owner recovery counterexample.

The additional 23rd focused test covers legacy/current recovery × Back/inactive-source for both Scenario and Work, with a valid unchanged control, exact raw preservation on different-Project rejection, missing-origin rejection and borrowed-valid-owner rejection in final preparation and child Open. This final addition passed in focused5: 23/23 contextual-source tests, 653 filtered out, 0.98s execution after 4m48s compilation. Final test inventory is 676. The same compiled test executable also passed guide-final 3/3 in 0.20s. Exact logs and status JSON are retained; strictClippy2 passed all targets with warnings denied in 4m29s; matching GUI and workspace formatting passed on the same frozen inputs.

`clippy1.log` / `clippy1-status.json` completed with exit101 on three `unnecessary_lazy_evaluations` in the empty Scenario first-action buttons. Those constant event values now use `then_some`. No other strict-lint diagnostic was emitted. The stale guide instruction to cancel and create a missing machine owner in Architecture was removed; sequence guidance now identifies work/exchange contributions accurately. These final changes are outside the full675 artifact.



## Owned source and integration boundary

All following source paths are under `crates/oa-desktop/src/`: `app.rs`, `app/checkpoints.rs`, `behavior.rs`, `behavior/creation.rs`, `behavior/scenario.rs`, `behavior/scenario/workspace.rs`, `behavior/topology.rs`, `behavior/topology/contextual.rs`, `behavior/topology/direct.rs`, `behavior/topology/view.rs`, `guide.rs`, and the new `behavior/source_draft.rs` / `behavior/contextual_source_tests.rs`. The contextual topology draft only gains Clone for private parent copies. Root owns integration/index/commits and native input; no core, server, schema/grammar or externally owned reference chooser changes belong to this implementation.

`focused5-inputs.json` records the frozen Rust/build-input scope and current commit context; `focused5-delta.json` records the seven changed desktop files relative to the passing full675 snapshot. It does not claim the uncommitted desktop source is contained in that commit. Immutable final test/GUI staging includes explicit manifests after all final gates and the unchanged-input check.

## Final frozen handoff

Final gate script completed exit0. `focused5.log` passed23/23 (0.98s), `guide-final.log` passed3/3 (0.20s), `clippy2.log` passed all targets with `-D warnings` (4m29s), `gui-final.log` passed the matching GUI build (6m20s), and `fmt-final.log` / status passed workspace formatting. Every gate has a separate started/finished/exitCode JSON. `stage-final.ps1` rechecked every recorded frozen input hash and refused existing output directories before copying. No source changed during these gates.

| Immutable artifact | SHA-256 | Bytes |
| --- | --- | --- |
| `gui-verified/arcadia-studio.exe` | `52DE82E434B636E18DB02D381842AA6DB84B721CFFD5502063F784F37246ACCE` | 112219136 |
| `tests-final/arcadia-studio-tests.exe` | `405577A35CE643AC022885AF58706D6F8B321224AE6D68E2555FBFAF3D626F38` | 107101696 |
| Both stages' `libunwind.dll` | `F45604A12E8BCD839FD86F667C1BE1CC7C4F9DA2B3C69FF381AC708F0E1AE7D4` | 190976 |

Artifact paths are relative to `.local/contextual-source-20260911/`; each stage has `manifest.json`, linked to `focused5-inputs.json` and the explicit seven-file `focused5-delta.json`. The final executable contains676 tests; the full675 pass belongs to the preserved earlier artifact and is not relabeled as a full final676 execution. Only the affected23 and guide3 were run against the final test executable by this worker. Root can run any broader immutable gate without a Cargo build.

Root received the exact final GUI path/hash for independent staged-source native checks. `/root/palette_finish` received the released compiler lease for its separately authorized locked/offline CLI metadata. This worker performed no native GUI actions, release publication, Linux run, index staging or commits. The source/report ownership listed above is frozen; further source changes require an actual new finding and corresponding evidence scope.