ARCADIA-Studio/harness/DECISIONS.md

Architectural and product decisions

Private mixed syntax boundary — 2026-09-23

Proceed with the reviewed syntax-only slice on tested private source 10d7f334, retaining current root 195ddbb as an ordinary-compatibility reference. Direct comparison found the relevant ordinary syntax/include machinery equal or equivalent; whole-file drift chiefly concerns semantic/editor behavior. A full root merge is not a prerequisite for this private experiment, and neither whole language/updater file may replace the other during eventual integration.

One opaque complete-bundle result borrows the actual original files and owns the shared budget, canonical file table, ordinary occurrence positions and typed unresolved syntax. It supplies no admitted Project, Index or edit authority. Explicit IDs are a staging restriction; missing IDs reject before generation. Retain duplicate syntax occurrences until semantic uniqueness is checked. Ordinary signed numbers require byte adjacency and complete value spans; typed subtraction retains its separate grammar. Bound aggregate syntax storage without silently reinterpreting caller model-record or ordered-step limits. Propagate phase-check failures even where the Budget does not latch them.

The proposal and review define the independent fixtures and rejected shortcuts. Same-pass unresolved syntax is a dependency of later mixed resolution/index/composition, not public source8 activation or a substitute for whole-output admission. Source implementation, fresh review and runtime checks remain required.

Private source composition decision — 2026-09-23

Adopt the opaque validated original-span rename batch as the next private analysis adapter step, with the independent review's clarifications. The original proposal compares this against replacing both ordinary and typed edit representations. The narrow adapter preserves current ordinary compatibility and reduces migration risk; a shared edit AST remains a candidate if structural composition demonstrates a need. Neither sequentially applying producers with stale offsets nor canonical rewriting is acceptable for authored-source preservation.

The immediate patch exports complete borrowed rename records and splits ownership validation from standalone final-output size preflight. It may defer only hypothetical typed-only output sizing; active inherited budget, plan/name storage, qualified namespace, source equality and complete occurrence checks remain mandatory. Standalone rename/apply semantics remain intact. This is private staging, not a complete parse-session or public source8 boundary.

Before production composition, one checked parsed-bundle witness must bind the complete source/entry/file map, ordinary model, typed index, profile and complete target intent. Ordinary syntax-kind replacement currently emits same-start insertion/deletion pairs; explicitly normalize such owned operations with exact trivia oracles before admitting them, keeping cross-producer collisions errors. Gate supported changes by a precise complete-model diff. Compile the actual emitted full bundle, use normal admission, and compare the complete intended Project before installation. Exact untouched bytes are an independent gate. Subtree edits, parameter lifecycle, repaired deletion, reidentity, relocation, missing-ID stabilization, migration/history and checked-save remain required delivery work; passing the private rename slice cannot close those requirements.

The source-pinned proposal/review retain their original local provenance labels. The accepted underlying repair contract is r2 at analysis source 1b1c3e3.

Current continuation decisions — 2026-09-06

• Saving under another source entry basename is destination bookkeeping, not an engineering edit. Adopt an exact current save receipt without adding Undo or clearing Redo; rebase uniform entry names across retained history after collision and compilation checks. Stale receipts cannot redirect newer raw source. Native discovery and eleven focused regression results are in release-save-as-runtime-packaging.md; updated native verification remains required.
• Home Resume returns to the last actual workspace. A saved state diagram opens in Behavior with its dedicated renderer; entering Architecture explicitly remains possible. Constructor choice among UUID-ordered views is not a guarantee that an application starts in Architecture. Tests of architecture placement must enter that workspace explicitly.
• Coverage warnings describe missing engineering context while structural errors remain rejecting. Mission/capability support and work/exchange behavior coverage use actual explicit links and occurrence membership, not inferred performer allocation or descriptive state notes. The shared core diagnostics are exposed equally to source, desktop and REST; see release-coverage-diagnostics-design.md.
• Portable release contents need the selected binary's complete runtime and notice inventory. Adding the gnullvm libunwind DLL resolves its ordinary import, but the application MIT license does not replace linked dependency notices. Archive hashes and clean-PATH launch are separate checks; neither alone establishes full release acceptance.

The following older decisions retain their historical scope. Newer first-release decisions and the normative language contract supersede prototype exclusions.

• One typed model, three Rust crates. oa-core owns semantics, validation, transactions, history, references, language and projection. oa-desktop is an Iced editor; oa-server is an Axum transport/store. A second GUI/text model, event framework or runtime plugin ABI would introduce unnecessary synchronization and extension complexity.
• Bounded OA/SA profile. Typed element bodies determine layer/kind; separate records describe relationships, diagrams, realization traces and artifacts. SA has one System and external Actors; LA/PA deployment and executable simulation are outside V2. The normative reST contract and scope document state exact semantics instead of implying full Capella/SysML conformance.
• Nesting derives from meaning. Semantic containment and leaf allocation feed independent diagram projections. A placement drag changes geometry, never ownership. Shared projection drives canvas, Fit and SVG. Scenario/state graphics project the same behavior records and select them directly; numbered routes lead to full transition details.
• Creation respects its workspace. Architecture creation also places the new element in the current view. Behavior and Data creation preserve existing architecture diagrams; an explicit placement command remains available. The shared creation path enforces this once, while core commands maintain occurrence ownership and sequence order.
• Equivalent editing, explicit drafts. Every persistent field is available in typed property controls and canonical source. Source Apply validates and commits one transaction. Invalid source/property drafts remain editable; separate text/model history avoids ambiguous Undo. The temporary JSON form adapter is closed over typed records, not a second semantic schema.
• Stable identity and readable changes. Globally unique UUIDs and persisted aliases serve distinct purposes. Flat canonical declarations and @alias references reduce Git churn. Exact string controls preserve escaped LF/CR/tab values. Comments/formatting normalize on Apply; a comment-preserving parser and LSP were deferred. V1 migration preserves old IDs and deterministically assigns new view/occurrence UUIDv5 identities.
• Identity updates are ordinary atomic edits. Reference maintenance happens within the validated candidate. Selection and pending canvas gestures follow resulting IDs; editing an already-selected card preserves its draft until release. Placement relocation preserves UUID, geometry and artifact ownership, then focuses its committed diagram and perspective.
• Transitions are reviewed engineering decisions. Canonical OA-to-SA traces support creation/linking in either direction. Preview offers explicit dependencies, System/Actor boundary choices and counterparts. Existing-target reconciliation compares names/descriptions using reviewed baselines, with Keep/Take/merged values. It is not structural synchronization or a claim of lossless phase reversal. Scope follows ownership/reference dependencies, not every incident edge.
• Local and service persistence have distinct concurrency boundaries. Desktop saves compare exact last-read bytes immediately before atomic replacement to detect ordinary external editor/Git changes. Conflicts preserve drafts/files for Save as/reopen; this is not filesystem compare-and-swap. The service persists complete current-model envelopes before publishing revisions, with exclusive directory ownership and ETag preconditions. SQLite, distributed replicas, retained history and retry receipts were unnecessary for the bounded prototype.
• Artifacts remain opaque engineering references. URI/revision/fragment metadata can target any model record. Desktop and API retain it without fetching or executing content. Desktop/hosted transfer uses explicit source import/export; a direct hosted editor requires a separate concrete workflow.
• Native graphics and deployment. Retain Iced WGPU with Windows, X11 and Wayland support. The tested WSLg environment requires Mesa software Vulkan. Separate headless server binaries avoid GUI dependencies. Docker/systemd recipes are documented; actual remote installation is not implied by local verification.
• Evidence governs completion. Original Capella was operated in an isolated example and its useful nesting/navigation/transition patterns informed the UI. Independent reviews, real native workflows and automated invariants complement each other. Platform and feature boundaries remain explicit in validation/scope documents.

First-release decisions (supersede narrower V2 exclusions below)

• R3 production adopts closed typed per-facet reviews (C), selected after the 11-case proof in b2ab2b1 and independent adversarial review. Each self-tagged fact stores independently reviewed OA/SA typed values; absent facts remain Unreviewed, and NotApplicable distinguishes an absent constructor branch from an absent optional value. This supersedes recursive SemanticValue/string paths and typed-body carrier/mask/order-shadow baselines. Extra finite adapter code is accepted for fewer persisted-state invariants, not as a generic metamodel. Atomic keyed rows, target-only preserving member deltas, independent order, exact constructor groups, explicit mapping resets/canonical target agreement and actual prepared-impact review remain required. Keep the existing Command and transition planner boundaries. Artifact reviews attach to semantic traces. Schema/source5 is explicit, with unchanged data4 compatibility. The authoritative implementation/ownership/evidence contract is release-semantic-review-implementation.md; production implementation and release acceptance are still pending.

• OA/SA semantic scope follows release-semantics-audit.md R1–R6 and actual Capella workflow evidence. Later Arcadia layers remain future work; missing OA/SA reuse, topology, state/data contracts and semantic transition review do not become release limitations.

• Preserve one typed Rust core and atomic validated model commands. Mission/capability links and process topology are independent of containment and diagram placement. Work/chain reuse uses stable reference occurrences rather than copied semantic objects; sequence guards belong to contextual links rather than global exchanges.

• Desktop lint uses one background parser plus the latest queued source version. Accepted model checks are cached separately from draft diagnostics. Stale results cannot enter a different document or overwrite newer edits. The REST service prepares bounded candidates outside its global store lock and rechecks ETags during commit.

• Relationship creation follows the selected engineering concept: directional names, compatible endpoint choices, optional generated relationship names and conditional extension text in the initial dialog. Existing model transactions remain the sole commit path.

• Help is an offline Rust topic registry with search and guarded workspace links. Task navigation is separated from the independently scrolling model explorer so search and perspective controls remain available at minimum window size. Fit uses the actual measured canvas, with a pre-layout fallback, rather than assuming a fixed amount of window chrome.

• Source/schema3 and explicit V2 migration are planned for the expanded release. Current schema2 is an integration checkpoint, not a new compatibility claim. Existing V2 packages remain preserved until final release acceptance.

• R5 state/event contract adopts region-owned entry/exit symbols attached to their containing boundary, independent per-region history, strict transient pseudo routing without event triggers, and preservation of the last removed typed trigger as descriptive text. This supports explicit engineering semantics without an execution engine; exact invariants and migration policy are in release-state-contract.md.

• Git is now explicitly authorized by the user. Establish a source baseline on codex/release1-engineering, then use focused commits at verified milestones. Use Git worktrees for independent writers when their scope can be partitioned; root integrates and owns native UI. Keep target/dist, recovery/store files and credentials outside version control. No remote publication is implied.

• User's hierarchy/port correction supersedes generic graph defaults. Architecture/dataflow/capability content differs by engineering purpose, while containment/allocation and port anchors remain derived from semantic records. The exact correction and remaining port metamodel work are in release-diagram-port-correction.md.

• Adopt release-port-contract.md: function input/output ports declare items; Standard/Flow component ports have separate orientation, interface roles and explicit function-port allocations. Required functional endpoints are generated/reused by one atomic planner. Schema3 migration preserves original generic ports as explicit unresolved contracts and generates only previously missing FE endpoints. This avoids guessing component kind, interface role or splitting stable InOut identities during import.

• Source/schema3 is now implemented. The original V2 comment-normalization decision is superseded for the first-release source-project work: validated bundle updates preserve concrete tokens/comments/whitespace, while explicit canonical export remains available. Desktop bundle editing and experimental nested syntax are separate acceptance gates; neither is implied by the pure-core updater.

• Connection routing is per diagram, keyed by an existing relationship/trace ID. Store ordered pinned points and relative label placement; derive orthogonal elbows in a pure Rust core shared by canvas, picking, Fit and SVG. Typed port anchors never move to improve a route. Bounded automatic routing provides an initial path; manual pins express engineering layout intent. Collapse temporarily suspends authored routing when endpoints are promoted, preserving it for expansion. One pointer gesture commits one atomic command; stale/invalid-draft gestures are rejected.

• Source workspace integration uses one accepted history of compiled source/model snapshots. The existing semantic Session remains for model-only consumers; a shared prepare_command supplies validated candidates and creation selection without committing or generating IDs twice. Desktop source writeback must succeed before adoption. Comment-only accepted edits are real history entries. Drafts and disk baselines stay separate; see release-source-integration.md for the implementation and acceptance contract.

• Model navigation uses one cached semantic containment index for both outline and focused browser. Group only roots, preserve full depth, and show allocated work separately. Direct children and paged contextual search replace the flat catalog. The outline uses constant widgets per row; no new virtual-tree framework is introduced.

• Port creation is explicit at the participant: Add port chooses Standard/Flow, then the selected port exposes Connect boundary exchange. Function Input/Output actions remain distinct. Candidate feasibility shares exact core validation with an explicit orientation parameter, avoiding per-choice project cloning and preserving Legacy behavior.

• Recovery state is independent of source diagnostics. Interrupted Save All journals remain discoverable after lint, typing, missing entry files or first-save failure. Recovery validates current bytes against known transaction states; it does not promise atomic multi-file visibility or cross-process filesystem locking. Source/property draft guards prevent one representation from silently replacing pending edits in the other.

• Production source3 nesting expresses semantic element ownership only. Extend the existing parser and source index with real lexical owners/body spans, rather than adopting the experiment's parallel parser. Flat canonical interchange remains valid. Structural writeback composes declaration pieces after ordinary token edits and uses original occurrence provenance through temporary UUID collisions. This preserves independent parent/child moves, authored files, comments and exact history while allowing new children to be emitted inside their owners. Allocation and ordered occurrence membership remain explicit.

• A hosted revision owns the accepted model and stabilized source bundle together. Store one atomic envelope, use the same core writer for commands and previews, and advance the ETag for comment-only edits. Old model-only envelopes acquire deterministic source in memory without a read-time write or revision change. A detached source sidecar would create inconsistent revisions and unsafe restart behavior. Accepted model equality alone is insufficient for a no-op when command provenance deletes/recreates a declaration; this was reproduced and corrected in desktop and REST adapters.

• Contextual actions use a controlled Iced overlay and captured semantic target plus document/revision/view context. Menus reuse existing handlers, and opening a menu does not select/apply another draft. Canvas focus scopes routing keys; Actions is an accessible alternative to right-click. Source files use a folder tree with exact paths and aggregate draft/diagnostic markers.

• Port anchors are per-placement presentation records with four sides and normalized offsets. Automatic sides use port direction and visible peer geometry; explicit anchors do not change owner minimum dimensions. Canvas, routing, Fit and SVG share projected anchors and side normals. Graphical reparent batches old-owner anchor cleanup with semantic reparent; raw source and API remain strict and require explicit repair.

• Direct connections use explicit Select/move and exchange palette tools. Compatible visible endpoints are highlighted; click-click or drag creates one ordinary validated command. Function-card gestures use the existing automatic port planner. Tool invocation, blank-canvas restart, Escape and model/view changes invalidate old gesture contexts. No project clone or whole-model compile occurs per highlighted candidate; final commit still validates the complete model/source change.

• Port identity feedback is a passive stacked Canvas: Iced Frame separation alone does not create GPU layering. The independent native overprint reproduction established the need; input stays with the existing interactive child.

• Each checkout uses a distinct Cargo target directory. A shared-target Linux run reused a different worktree's test executable; only explicitly rebuilt main results count as evidence.

Persisted state workspace and input coordinates (2026-09-06)

State-machine views use the core projection/routing and ordinary Document commands, with a retained behavior owner/view separate from Architecture. Palette gestures create elements plus placements atomically; typed forms remain reachable for Local, Internal and timed transitions. Context menus capture the state diagram so fold, hide and placement properties cannot modify an unrelated Architecture view.

Gesture displacement is measured in ordered window coordinates, not coordinates relative to a canvas whose origin may move when selection changes the toolbar. Viewport notifications fit only on actual size changes. Native testing also showed Iced WGPU places parent meshes after clipped child meshes; backgrounds must share their content clip to avoid hiding vector geometry while leaving text visible.

State camera/tool lifetime follows effective machine and diagram identity, even when selection changes through Catalog or Layer outside Behavior. Reset only on actual context change; preserve same-view return. Independent review reproduced the leak and native Windows/Linux tests verified the correction in316dc55.

• Carried-value property browsing follows one exact record scope at a time, with bounded pages and a separate read-only browser location. Flattened representative paths were proven ambiguous in native recursive/reused data. Browsing does not change the selected field or expression; choosing a field remains an explicit draft edit through the ordinary validated command. No persistent browser schema.

Semantic review proposals and historical admission (2026-09-06)

R3 stores closed, typed, independently reviewed OA/SA facet pairs. Constructor facts store discriminators only; explicit group decisions enumerate and retire their exact branch facts. No persisted recursive value tree, own-record carrier, review mask or order shadow is introduced. The complete contract is release-semantic-review-implementation.md.

Derive every source proposal from the same immutable initial project. Reset old mapping selectors before deriving scopes; compare all desired canonical target slots, including constructor removals, before one materialization. Audit selected values against both that result and the ordinarily prepared project. This prevents sequential last-write wins, even when one source introduces a member another constructor removes. Preserve target-only members during same-target-constructor reconciliation. Artifact attachment and explicit owner changes share the actual artifact's owner slot; child/incident operations similarly share actual parent or endpoint slots. Exact prepared cleanup impacts require explicit acknowledgement and may not contradict a selected Keep/Take.

Artifact metadata is observed by identified record after authorization against its initial attachment. An owner move therefore retains the actual resulting Owner/Name facts, including target-only links; Presence remains owner-relative. New metadata decisions require the current attached owner trace. Historical paired selectors survive disappearance of one side and suppress redundant one-sided projections. A new pairing cannot suppress prior one-sided history without reset.

Current resolution applicability and historical baseline admission are separate. New decisions require a compatible current family and an applicable side; historical typed facts can outlive former constructors/families and deleted references. Their typed reference visitor supports explicit reidentification but does not add live deletion dependencies. Derived linked-definition drift remains bounded and exposes missing review coverage instead of copying a shared definition into every baseline.

Hosted destination identity and bounded independent panes — 2026-09-06

A hosted save binding belongs to one installed document, not the connection dialog. Installing any local source workspace, including invalid repair source, detaches it; a failed or cancelled load does not. Verified regression prevented accidental write to a previously opened server model after repairing local text. Catalog freshness is explicit and scoped to its service; observing a changed bound head invalidates even empty filtered results. Background polling is unnecessary.

Pending process forms use an independent bounded scroll pane with pinned actions, while the diagram retains its own camera/scroll state. Nesting both under the page scroll supplied infinite height and clipped the fields at the supported minimum. Real Iced layout tests verify finite field space; native recheck remains required.

Private recovery and integrated continuation — 2026-09-06

The branch audit selects c091f80 as the integrated production baseline: side-branch state/process/scenario/data/hosted/semantic work is present or patch-equivalent. The stale checkout's duplicate investigation stays in its named stash. New work continues on codex/release1-continuation rather than replacing accepted editors.

Unsaved recovery uses separate per-session, versioned private checkpoints. Store the accepted authored source bundle and raw source/property/behavior/workflow drafts; regenerate validation and command previews on restore. Never serialize credentials, destination handles or reusable executable plans. Restored work is an unsaved copy requiring an explicit destination. Undo history is deliberately not restored: retaining a coherent current model and rejected input is the useful recovery boundary, while persistent history would add a separate migration and storage contract. Exact accepted-source validation precedes replacement of the currently open document.

Checkpoint writes and restoration share workspace admission limits. A failed checkpoint must retain the last usable file. Late completions are scoped to the document ID, and discard/close waits for an outstanding writer before retiring its result. Model-file Save and private recovery remain distinct operations. Native crash/restart and exact21-file Save as evidence is recorded in release-current-native-verification.md; larger recovery/history requirements would justify revisiting these explicit bounds.

Semantic rows and state-view entry — 2026-09-06

Annotation and Binding keys identify independent rows; replacing an existing row preserves its position, an identical Keep does not modify it, removal deletes only that row, and a new row appends. GUI composition and core materialization agree without normalizing untouched records into a different order. Core regressions cover Keep plus an unrelated Header Candidate in both directions and both row families.

A persisted StateMachine diagram has one editing canvas and tool set. Opening or selecting it routes to the existing Behavior workspace, preserving exact diagram identity, selected object and raw property input. Explicit Architecture navigation selects an ordinary view or its empty state. This fixes the native-observed blank state-action header and inappropriate architecture connection tools without adding a second state renderer. Pending drafts remain subject to the existing guards.

OA communication means: selected representation — 2026-09-06

The existing OA Interaction describes activity exchange; ordinary participant communication is a verified first-release gap. Independent representation and adversarial reviews compared a new CommunicationMean, widened BoundaryExchange endpoints and a first-class OA port contract. Select explicit CommunicationMean with OA Entity/Actor endpoints, orientation and carried items, reusing identified ExchangeAllocation links to Interactions. Existing BoundaryExchange keeps its port contract; legacy OA data is preserved without automatic conversion.

This choice matches primary Arcadia/Capella method evidence and avoids inventing technical OA ports. Known actual performer mismatches reject allocation; missing performers are incomplete work, not inferred through role responsibility. Scenario direction must resolve explicit lifelines, and correlated Reply reverses the actual Call direction. OA participant/SA port counterpart choices must be scoped explicitly per exchange rather than corrupting global participant correspondence. See release-oa-communication-design.md and the independent critique for sources, alternatives and falsification tests. This is a representation decision, not an implemented or accepted feature; versioning and view contracts remain to be integrated with it. Revisit if realistic OA workflows demonstrate separately identified operational endpoint contracts that a participant relation cannot carry.

Source6 saved views and cross-layer Traceability — 2026-09-06

Problem: saved selective views need explicit inclusion intent without changing semantic objects, and a Traceability view already displays both OA and SA. Applying ordinary layer filtering to it would silently remove existing counterpart edges.

Decision: retain same-layer admission for ordinary diagrams, but allow both-layer edge, category and work-context references in Traceability. Shared projection and validation choose the cross-layer mode together; selectors expose both layers. Default options preserve prior visibility. Categories are independent Work/Participant families; explicit empty selectors mean none, never a silent reset to All. A document-revision semantic index is reused by canvas projections and invalidated on accepted changes/Undo/Redo. New source6 fields and kinds cannot enter frozen1–5 input contracts.

Alternatives rejected: filtering every view by its labelled layer loses existing Traceability content; ignoring layer validation everywhere hides mistaken references; serializing temporary GUI filters breaks source/API parity. Revisit if native workflows or cross-layer regression evidence exposes ambiguity. Current implementation is pending integrated tests and native acceptance, not an established release result.

Continuous behavior authoring — 2026-09-10

Problem: adding the first Exchange to an empty process changed its interactive Graph into an ordered sequence Scene without gesture tools. Scenario non-message creation discarded the visible operand and insertion point, defaulting to root append. These are verified source paths; new-binary native acceptance is pending.

Select one interactive process renderer. Project legacy ordered adjacency as endpoint pairs without fabricated semantic relation IDs. Loading and selecting remain read-only. The first topology mutation uses the existing validated batch to materialize unaffected adjacency and splice the chosen insertion atomically. Reject the alternative of a special 0/1-element renderer exception, which would reintroduce the discontinuity at a later element count; also reject automatic load-time migration and artificial self-links. Core legacy/explicit semantics and the source version are unchanged. Revisit if actual imported-path editing cannot preserve ordering, rejection and exact source/Undo behavior.

Scenario Action, State, Reuse and empty Fragment creation capture the clicked owner, operand, before-occurrence and optional lifeline before starting the existing typed draft. Keep current validation, recovery and atomic history. Fragment range wrapping and cross-operand movement require separate explicit transactions. Do not infer persisted lifeline geometry from a click: the current model does not store horizontal lifeline order. Reused-scenario navigation uses bounded transient caller/use context, never an extra model history entry.

Evidence and acceptance: release-behavior-audit-20260910.md, Gitea #1, new production-pointer regression paths and independent source reviews. Compilation, automated execution and native validation are still pending at this decision.

Typed stored observations — 2026-09-10

Problem: generic trace-baseline Add inserted a UUID string into the closed FacetReview list, producing an invalid draft. Hiding Add and routing only to current review/reset cannot fulfill the normative contract: historical values and references may be valid even when their live definitions no longer exist.

Select an explicit advanced typed history editor over the existing OpenAPI TraceBaseline/FacetReview descriptors. They provide the finite shape catalog already required for REST parity; final authority remains core typed decoding, historical admission and one EditTrace through Document. Preserve invalid raw drafts, exact historical UUID text, optional/Observed alternatives and explicit constructor selection. Current observations may be copied only by a deliberate action. Cache the descriptor and bound recursive rendering; unsupported shapes must fail visibly instead of generating an invalid default.

Reject a separate handwritten GUI metamodel or a new duplicate core type-shape catalog, and reject raw JSON as the sole graphical editing surface. Revisit if descriptor/core consistency or native usability cannot be verified. This choice is under implementation; it does not yet close the parity finding in release-end-state-audit-20260910.md.

Basic canvas authoring — 2026-09-07

The user rejected the large horizontal creation row. Actual installed Capella 7.1 inspection supports a compact contextual side palette and direct label editing. Select an explicitly expandable palette, tool → point → inline name creation, F2 rename and explicit participant allocation. Keep draft phases from changing canvas geometry; retain atomic commands and guarded recovery. Context-only creation hides the primary action, and a permanently expanded catalogue repeats the original problem. Evidence, alternatives and acceptance criteria. This is a selected design under implementation, not a native acceptance claim.

Behavior transition destination context — 2026-09-06

Native reverse scenario Apply selected a dependency and inserted five overlapping behavior placements into an unrelated architecture view. Core transition correctness did not make that presentation useful. Select the counterpart of the explicit request root and resolve its nearest scenario/process/chain/state owner. Without an explicit destination diagram, keep the exact core candidate and open Behavior; preserve unrelated architecture views. Retain ordinary architecture transition placement and honor explicit diagram choices.

Automatically creating another architecture view would retain the wrong editing workspace and introduce unrequested model state. Merely navigating to Behavior after adding placements would conceal the presentation damage. Both alternatives are rejected. The selected correction retains one source transaction and Undo operation and guards stale canvas events. Revisit if mixed-root requests or realistic explicit destination workflows require a separate user choice; do not infer such a choice from dependency ordering. Test/build/native acceptance is recorded separately in release-behavior-transition-context-20260906.md.

Property baselines and explicit alternative cases — 2026-09-11

Problem: complete independent bindings repeat shared engineering assumptions in every ordinary study case. The user requires practical text-only development and reduced cognitive load for small and large models. Evaluator implementation simplicity alone cannot justify that authoring cost.

Select property-owned base values/formulas and one-level case overrides as the next active-study contract to formalize. Every evaluator caller explicitly requests ModelBaseline or a particular Case identity; no active UI selection, unnamed default case or case-to-case inheritance determines meaning. The baseline is the model's explicit property values, not a mandatory extra record for entering the first value. Inherited formulas read the requested effective case. An explicit Unbound override shadows a known base; clearing an override uses the base.

The executed comparison passed 218 assertions. Twenty cases with20 fixed/two varying inputs used62 binding rows under B versus480 under D, with identical results. Updating one shared assumption required one B binding versus20 D bindings. Reusable predicates eliminated D's threshold-edit disadvantage, so repeated formulas are not the reason for selection.

Retain an explicit complete independent freeze/export for intentionally separate assumptions. It must capture effective values/formulas and the full exact definition environment, including package pins; copying only case rows leaves hidden live dependencies. Captured revisions and per-input origins must make propagation visible. Effective dependency/cycle validation and stale result handling must cover the whole requested context.

Reject compulsory complete cases for ordinary shared-assumption modeling; retain their useful isolation as an explicit independent snapshot. Reject arbitrary inheritance and UI-dependent evaluation. Do not import the tiny experiment interpreter as production architecture. Exact check identity, type/operator algebra, source syntax, library closure/compatibility, transitions and public snapshot formats still require the coordinated precise contract. Current source7 does not implement this decision.

Revisit if complete text/native tasks expose unacceptable hidden propagation, wrong-context edits or inability to preserve reproducible independent studies. The comparison establishes semantic/text maintenance evidence, not human task timings or full quantity/library integration acceptance.

Analysis and library contract convergence — 2026-09-11

Root Codex-956atf read the complete baseline refinement, library refinement, their complete fixtures and independent review. Select the following architecture for production implementation:

• Required property-owned Binding values, explicit ModelBaseline/Case selection, one level of complete-case override maps and shared root checks. Clear removes an override; Unbound masks the base. Inherited formulas evaluate dependencies in the requested context. Pure calculations see only explicit parameters.
• Same-layer property dependencies and case targets, with explicit analysis selection for transitions and exports. Check/case subjects may be absent; architectural containment must not infer their selection. Validate every effective dependency graph, including statically referenced unused branches.
• The refined R6 closed algebra, exact rational R7 literal/AST preservation, affine point/difference distinction and declared-output kind anchoring. Strict expression operands gather actual missing/failure causes; Boolean control flow evaluates only the selected branch. Supported domain failures are distinct from violated predicates and missing values.
• Whole accepted PortableDocument freeze with exact SourceBundle, local definitions, all imported package contents/pins and validated provenance. Replay resolves only that immutable private capture. A result report, shallow case copy or current cache is not a reproducible freeze.
• Exact archive/reference/history identity alongside verified same-origin typed-contract equivalence. Different nominal origins remain distinct. Compatibility supplies a scoped expected/actual field-path and operation correspondence; it never advances a pin or rewrites outside record identities. Keep qualified neutral definitions, immutable mapped layered definitions and ordinary editable pattern instances for the first coherent implementation.
• Explicit source preparation/acceptance with complete version-controlled package/base/map/lineage state, recomputed admission and stale-input rejection. Exact three-way facets retain independent local edits. Mounted OA/SA transfer requires a verified exact target-layer export or an explicitly independent editable local derivative; no relabeling or silent mutation of a mount.

These are architecture decisions, not claims that the proposed schema8 examples are admitted by current source7. Before real consumer integration, enumerate and implement the class-specific canonical contract over all interpretation-bearing fields and use sites, exact transitive archive closure and full source/history boundaries. Retain the frozen120-assertion prototype with its documented C2 threshold-unit coverage gap; production typing must check every operand.

Close independent C1 before evaluator expansion: a request-local, profile-versioned logical work meter must bound dynamic expression visits, calls, list traversal and exact-number work. Static acyclicity/depth/node limits do not bound expanded execution. Cache warmth must not change outcomes; terminal exhaustion stops further traversal and marks collected causes as incomplete. Numeric ceilings and the precise charging table require measured foundation implementation before publishing the profile. The333-node/31-level counterexample and a nearby successful case are mandatory tests across direct/API/frozen replay.

The exact numeric foundation is the next bounded core implementation. Ordinary engineering approximations, a complete low-noise text workflow, two-project library maintenance and native/API/source parity remain required release work. An exact-only slice cannot complete the user's first release.

Analysis production staging — 2026-09-11

Root accepts the concrete production integration sequence. Allocate schema8 to the next coherent production analysis integration. Start with the actual Project's neutral definition catalog, three analysis element kinds, typed expressions and a closed Local definition-reference environment. Imported references will be admitted only with the real package environment; no placeholder resolver, guessed pin, implicit type compatibility or competing package format. This stages implementation and does not defer the required maintained libraries.

The first useful gate is the complete persisted/source-authored response budget, shared two-parameter calculation and check: baseline7/4 seconds versus degraded9/4, with explicit request context and the same core result through CLI and REST. Required property fields cannot come from generic factory guesses. Existing descriptive expressions/unit labels retain their exact old meaning and bytes. Freeze older top-level wire DTOs before making definitions required in schema8; reject new fields/constructors in older versions instead of silently dropping them. Global, scoped parameter, imported and historical identities remain distinct.

Implement pure static numeric type helpers once and reuse them for admission and runtime. Validate every effective case graph and unused branch before accepting a candidate; deleting dependencies requires explicit same-batch repair. Numeric domain failure is not a static type failure. Full evaluator traversal and actual C1 input, provenance, terminal incomplete causes and immutable replay are required before claiming evaluated engineering behavior. Until explicit analysis review/ transition facets exist, those entry points must reject unsupported analysis with a clear capability error, including manual-trace paths that could otherwise appear to reconcile headers alone.

Logical expression depth128 must be reconciled with bounded actual JSON/source decoding; do not simply disable recursion limits. Raw byte, decoded string and aggregate literal/graph/case-admission limits are separate from evaluation fuel. Concrete decoder/admission ceilings remain subject to bounded boundary and timing experiments; the implementer must surface those choices before locking the profile. The current local numeric gate runs against frozen root source. New core contract work proceeds in an isolated checkout, preserving root's Cargo/native leases and the other hosts' CLI, staged-source and B4 ownership.

Direct resize geometry — 2026-09-12

Retain eight-handle resizing with fixed opposite edges, one placement edit and exact preview/reopen equality. The executed foundation falsifiers reject unconditional visible-size normalization and a universal preferred floor on inactive dimensions. Preserve inactive authored fields where possible and evaluate actual shared projection; distinguish proven constraints from a search that has not found a feasible candidate. Pure inverse-geometry experiments and native port/handle arbitration remain prerequisites for accepting production interaction. Process/scenario authored layouts retain their separate persistence dependency; the persisted-rectangle slice does not complete that broader need.

Pending analysis/Scenario version composition — 2026-09-13

The isolated schema8 analysis and Scenario layout contributions must share explicit version and resource boundaries before adoption. The source audit pins analysis6216cff and Scenarioaed07176; it does not establish combined execution. Older JSON/source versions must reject the new Diagram layout field by presence, including null, while retaining legal schema7 fields. Typed migration entrances must also reject a current-only payload rather than discard it. Count all stored layout rows and explicit address references together with existing model/analysis usage; visibility does not exempt stored data. Run both analysis and Scenario remap collision checks before any identity/reference mutation. Preserve distinct Scenario row, global definition, scoped parameter and call-site edit identities. The audit specifies failure cases and compatible implementation seams. Public source8, resource calibration, combined save/reopen and interaction acceptance remain separate requirements; neither isolated suite establishes their completion.

Private source cursor and frame accounting — 2026-09-13

The S2a checkpoint uses one raw scanner with separate legacy and typed adapters. Preserve the public legacy token contract, including signed JSON numbers and contextual alias classification. Typed fields borrow one full-file token stream and shared budget, retaining original spans without rescanning field substrings. Declaration, dimension and override braces count toward active syntax frames alongside expression/type delimiters. A successful declaration restores the caller's inherited depth; a failed candidate is discarded. Missing global and scoped parameter IDs remain explicit stabilization metadata, not new random identities assigned on each parse. Public source8 integration must thread the same accounting through the outer project and included files; this private checkpoint does not itself admit a complete version8 source bundle.

Complete mixed Project before typed editing index — 2026-09-23

Choose the private Project-first contract as the next semantic dependency, conditional on acceptance of its frozen syntax prerequisite. Reuse ordinary construction and typed lowering once, then check the complete Project and retain original syntax, the global lowering-site arena and its file ownership for later indexing. Including the typed index now would also change source-view/updater compatibility and several simultaneous allocation phases, while still leaving ordinary occurrence editing incomplete. This split preserves a concrete no-rescan/no-relower continuation and isolates model correctness from later edit authority; it does not narrow the required parity goal.

The independent critique requires a full hand-authored retained-site oracle and a single admission result preserving static usage and every warning. Existing raw architectural diagnostic production is explicitly outside preallocation accounting; new mapped/retained storage must be reserved before copying or retention. Revisit the split if actual ownership work shows sites cannot be retained without duplicated models or repeated parsing. Public source8, mixed editing, checked-save and root reconciliation remain later dependencies, not capabilities delivered by this design decision.

2026-09-24 — preserve mixed bundle authority through index construction

Adopt the mixed typed-index contract: consume the sealed complete-Project witness into a distinct read-only owner and reuse private structural/token verification, with aggregate retained-ledger accounting. A copied verifier would duplicate correction work; reparsing into the old numeric-source Index would discard bundle/profile authority. The independent review resolved storage domain and completeness-proof ambiguities before adoption. This is a bounded implementation decision, not runtime acceptance or full editing parity. Revisit if a concrete verifier invariant prevents reuse or multiple retained owners become necessary; no generic public indexing framework is justified now.

2026-09-24 — index ordinary authored names before rename composition

Adopt the ordinary occurrence successor after source mapping and independent critique. Retain the accepted typed owner and add a physical-token-keyed ordinary map from sealed original positions. This isolates complete coverage/ownership from later edit intent and avoids a new structural path arena or parser. A fused streaming rename planner could save map storage, but would combine two unverified boundaries; revisit after coverage is established and a real consumer demonstrates the benefit. The contract explicitly handles synthetic brace-containing roots, complete reference extents and the existing ordinary depth policy. It grants read-only name-occurrence authority only. Rename composition and complete editing parity remain separate required capabilities.

2026-09-24 — gate mixed rename intent against the complete desired model

Adopt the mixed rename planning contract after source mapping and independent criticism. Consume the complete authored owner, immutably borrow desired Project, and retain only changed-name and physical edit maps. Exhaustive shallow alias exceptions avoid Project clones, generic diff machinery and duplicate legacy batches. Final namespaces are checked simultaneously, so swaps work and collisions with unchanged names reject.

Existing whole-model PartialEq semantics define non-name equivalence, including signed-zero equivalence across geometry, scalar and historical carriers. Original non-name source bytes remain exact. The allocating iterative Expr comparator requires a conservative E scratch reservation; independent type-graph and frontier analysis bounds E by the retained original expression arena, including all four root families. Revisit if new Expr carriers appear or conservative headroom demonstrably blocks useful cases.

Deliberate later output parsing must preserve exact inherited per-snapshot policy with separately reported new usage and aggregate live-storage accounting. An independent fresh ledger must not hide retained output or old state. Execution ownership/readmission seams remain separate required implementation; this decision does not label a read-only plan as accepted rewritten source.

2026-09-24 — carry output storage through actual verification

The execution source map identifies the next boundary: output buffers already coexist with parsing, so adding a retained-output baseline only at resolution checks too late. Preserve the exact per-snapshot Limits and ProjectLimits, explicitly drop consumed old auxiliary state, and carry surviving output storage through verification. The final comparison must include aliases and parameter names; the planning gate deliberately omits them and cannot establish accepted rewritten output.

We considered authenticating exact output bytes, then reserving a conservative parser envelope derived from the unchanged syntax topology. The independent feasibility investigation found useful partial bounds but no complete safe, useful aggregate formula. Finishing it would duplicate parser lifecycle knowledge across expression tasks, name sets, projection buffers, string decoding and include traversal. Select explicit carried storage accounting at actual growth/handoff seams for the next bounded design instead. Revisit an envelope only if a small, stable source-derived proof demonstrates useful caps; do not use unexplained byte or node multipliers. This chooses a direction, not an implemented execution API.

The domain audit keeps the declared metric explicit: logical auxiliary slots/text are distinct from model/serde/raw-validator heap, allocator capacity and process RSS. The exploratory allocation inventory is not a requirement to meter all heap usage. The successor contract must reconcile that domain before selecting growth hooks or claiming an aggregate pre-allocation guarantee.

2026-09-25 — preserve parser compatibility while carrying live storage

Adopt the private carried-phase prerequisite. Keep legacy parser checkpoints unchanged; an explicit carried path checks the combined syntax and retained storage at the declared phase boundaries, including when its carried baseline is zero. An opaque guard binds the actual bundle, exact policy and retained owner through parsing and resolution. Seed the existing resolver ledger once, without charging live storage as new parse work.

New continuation constructors remain fixture-only until the actual output producer and consumed-owner transition exist. The narrow owning fixture contains only the bundle, so its carried count is F map entries, zero lower occurrences and all source/key/entry UTF-8 bytes. This is a phase-accounting prerequisite, not fulfillment or waiver of stronger parser producer timing requirements for final output acceptance. It grants no editing authority.

Runtime review of the first carried-phase candidate exposed a stack overflow in an unchanged legacy 128 KiB control during numeric parsing. Remove duplicated policy from the retained guard: the consumed input transfers exact policy into the Budget and syntax limits, while a small guard retains the backing owner. This changes representation without new heap storage or weaker tests. Prefer this to boxing policy or introducing an external policy-owner lifetime. The debugger identifies the active parsing path; it does not prove a sole cause or establish that the representation repair passes before it is actually tested.

2026-09-25 — separate owned emission from accepted rewritten output

The emission contract consumes the validated plan. A no-op returns its original owner; changed emission reserves the complete output map and UTF-8 storage while the old plan is live, then copies each file once in original edit coordinates. It drops old auxiliary ownership before constructing the private pending result. Exact policies and the desired whole Project survive, but no parse, adoption, save or public editing authority is granted. Reject any borrowed carried owner on the changed path: dropping a guard cannot free the externally owned allocation. A future owning transition must consume that allocation or account for its continued lifetime explicitly.

The source-bound Windows evidence preserves an initial full-run stack abort and the successful repair. Split the existing iterative binding driver's prefix and continuation operations rather than changing arithmetic, increasing stack sizes, boxing state or weakening tests. Independent review establishes mechanical equivalence; actual rebuilt prologues and unchanged runtime controls support the bounded stack reduction. This does not close the older, separately unrerun full-pipeline setup limitation.

Final acceptance still requires parsing and resolving actual output bytes, complete Project equality under justified scratch bounds, explicit parser producer timing and an owner retaining the accepted bundle. Original expression counts alone do not bound an arbitrary faulty output. Logical auxiliary usage continues to exclude the established model/serde/validator and allocator domains; no process-wide memory guarantee follows from this private milestone.

2026-09-25 — reserve named syntax text at its producer

The text producer contract selects a separate private route bound to actual carried authority. Reserve raw quoted payload P before the existing decoder, then transfer decoded D and release P-D. This avoids a duplicate decoder while deliberately allowing conservative escaped-input refusal on the new route. Preserve legacy/phase-only diagnostics. Count simultaneous key/reference copies and all consumed UUID spellings; drop temporary strings before refund. Borrow the ordinary declaration-kind word. Keep small scalar state, transfer retained text once into the resolver ledger, and independently reconcile it against the existing syntax inventory.

The verified Windows packet records six new passes, unchanged prior outcomes, initial lint repair and the single framework-hint difference in one inherited failure log. Preserve the original checker refusal and narrow named-byte amendment instead of weakening general comparison. Compiler prologue observations and existing stack controls bound evidence only; this adds no universal heap or stack guarantee. Entry/metadata growth timing and the remaining scratch inventory require their own explicit decision before actual emitted-output acceptance can be enabled.

2026-09-25 — strengthen the existing retained-entry metric at named producers

The entry producer contract preserves U's declared grammar events and the conservative M inventory. A new explicit route checks C+U+M before selected growth; old routes retain their timing. Prefer grammar scalar counts plus a prepaid projector quota to another unmetered AST-counting frontier. Seven-slot declaration envelopes already include synthetic bodies; actual nested fields/values contribute separately. Quota consumption neither recharges nor refunds M, and independent lengths/metadata must reconcile. No saturating correction may create a successful witness.

Windows evidence preserves both precompile latch fixes, the syntax-cap versus counting-scratch evaluator correction and the initial test-only Debug-bound compile failure. All six new tests pass with unchanged inherited dispositions and strict Clippy. Additional scalar state changes compiler frames, so old stack controls and actual prologues remain evidence requirements; a logical slot is not a native stack byte. Remaining independently bounded parser scratch requires an explicit scope decision, not an inferred universal heap-metering requirement.

2026-09-25 — accept actual emitted bytes into one owning result

The acceptance contract selects a shared borrow of the complete sealed PendingRename as carried authority, rather than bare counters, duplicated policy or a new heap wrapper. Compile-time covariance permits the short verification borrow. Use both selected parser producer modes, complete resolution/admission and full actual-left Project PartialEq; reserve the actual expression arena count, not original provenance.

Move the actual model and mapped warnings with the accepted source. This preserves diagnostic/source identity without reparsing or substituting the desired model. Warnings already occupy the resolver ledger: exhaustively count their surviving inventory without charging twice, verify final O+W as a bounded subset while all verification owners remain live, then drop syntax/guards and move the bundle. No mutable extraction, history installation or repeated carried edit is implied.

Retain independently bounded traversal/delimiter/Pratt/duplicate-name scratch as an explicit separate domain. File/source-byte bounds do not tightly bound copied path bytes. This selected logical accounting is not universal heap accounting. The finite Windows evidence checks exact inherited limits, real returned models/warnings, lifetime and stack behavior. Preserve the initial two incorrect empty-warning expectations and their independent full-warning correction. A raw build-target path spelling difference requires only a named exact-pair checker amendment, not weakened failure or source comparison. All earlier outcomes remain preserved; public integration is next.

2026-09-25 — restore ordinary schema8 compatibility before mixed adoption

Current formatters already emit schema8, while the ordinary reader previously rejected it. Admit that version through the existing ordinary grammar and model validation, preserving migration, complete source indexes, identity stabilization, updates and checked saves. Keep typed and long analysis-constructor refusals; ordinary acceptance does not qualify missing typed formatting or mixed editing. The contract and independent comparison reject replacing compile_bundle with an incomplete read-only index.

Windows evidence exercises the previously blocked nested/transaction workflows, complete ordinary OA/SA and historical trace round trips, relevant integration tests and actual read-only CLI commands. Preserve the initial example-trace assumption failure, four obsolete private header-rejection assertions and the historical JSON oracle's missing empty definitions catalog. Correct their expectations explicitly while retaining whole-model and typed-refusal checks; two test renames have exact inventory maps.

Reuse the source-identical core, other integration and CLI evidence after the last three-line migration-test correction. Verify the entire successor diff and every other declared input, rerun the affected target plus all-target Clippy/format, and identify each tested code version. No Linux, GUI or release qualification follows from these core/CLI results. Publication remains blocked by server disk exhaustion.

2026-09-25 — expose complete mixed validation through a borrowed read-only result

Select language::check_mixed_bundle with an opaque non-Clone result borrowing the caller's complete explicit-ID SourceBundle. Retain the real resolved owner and return immutable Project/warning views; do not substitute a bare model or an incomplete editable index. The contract records alternatives, policy and bounds. Fresh input selects both existing producer modes with zero carried ownership, followed by complete resolution and admission under the exact caller policy. Internal entry ceilings remain separate from final-model record limits.

Promote only the required parser/resolver dependency cone to production; private index/edit machinery stays test-only. Normal-library tests are required because the production Parser layout changes even when ordinary callers select no mixed mode. That build exposed a missed semantic-row initializer, fixed at its source; two actual compiler warnings received narrow cfg/import corrections.

Windows evidence at bab6f96 checks complete independently authored OA/SA models, exact warnings and refusals, source conservation, constructor policy, source lifetimes, prior workflows and actual ordinary CLI behavior. All 299 core and 75 selected integration cases pass. Rustdoc's two compile-fail runtime names append a suffix absent from its listing: preserve the recorder refusal and reconcile exactly those two names against the successful three-case raw run. No generic name normalization or rerun is needed.

This developer-facing API does not enable mixed file discovery in the CLI or graphical editing. Add those through explicit subsequent contracts, retaining filesystem safety and complete model/index ownership. Do not route a nominal mixed check through the ordinary loader, which currently rejects typed syntax and constructs editable compilation. Source/evidence were subsequently published after server storage recovery (issue7 comment1333); no release or Linux qualification follows.

2026-09-25 — separate mixed CLI discovery from editable ordinary loading

Expose arcadia check-mixed ROOT [--json] through a closed read-only dispatch and opaque mixed source snapshot. Reuse the real parser and existing disk checks, but do not construct or expose an ordinary editable index for typed input. The contract specifies explicit identities, source8, report fields, original locations and exit behavior.

Share one discovery Budget/ModelCounts across included files and reserve the file metadata before parsing. Retain producer counters conservatively after each temporary syntax unit drops. This is cumulative discovery reservation, not a claim about live allocations. Drop that phase before complete semantic validation under a fresh budget with the original caller policy. Clamp the source-byte ceiling before disk reads. Stop on the first located mixed parsing failure so a span-only budget latch cannot be attributed to a later sibling; retain final filesystem and pending-journal checks.

Evidence at f10490b1 checks whole independent OA/SA models, exact reports and bytes, cumulative limits, ordinary migrations/saves and finite stack controls. New public disk and CLI tests passed initially; two old CLI assertions still expected schema7. Correct only their exact migration/header expectations, retaining the immutable fixture, all40 identities and full-text/model/fixed-point checks. Alias the test process Command import to remove the observed warning. Preserve those original outcomes.

Independent review also found the actual alarm include_str fixture missing from the inherited recorder's input recipe. Add that precise path before final gates (567 inputs); keep the six initial 566-input receipts and their omission caveat. Final source-bound checks pass 302 core,98 integrations,3 docs, strict core/CLI Clippy and5 direct CLI runs. Formatting remains the same inherited failure. Publication recovered without changing the existing release; mixed editing, application adoption and Linux qualification remain separate work.