ARCADIA-Studio/harness/release-scenario-editing.md

Direct scenario editing — bounded implementation plan

Status: implementation and automated Windows checks passed in the isolated codex/scenario-direct checkout, based on ab661f2. Initial production is d1d8f0b; independent-review fixes are in 7a66607 and e7e37d4. The focused independent recheck reports no remaining medium/high finding. Root-owned Windows/Linux native trials remain pending. This does not complete the release or process/chain work.

Decisions

Extend the existing behavior::Scene; retain its derived lifeline columns and ordered occurrence rows. No model/schema/layout records are added. Lifeline and occurrence UUIDs remain distinct from represented work and global exchanges.

Select mode selects headers, stems, messages and occurrence boxes. A selected occurrence has a reorder handle; dragging it chooses a visible slot in its same parent sequence. It never reparents or changes lifeline columns. A Message tool uses the existing MessageStyle, with Call + correlated reply initially selected. Click-click or drag between represented lifelines captures a highlighted explicit insertion slot (parent, before occurrence or append) and opens the existing typed draft with those endpoints. Exchanges are filtered by layer, viewpoint and the core's represented-endpoint compatibility. Earlier calls retain complete exact-slot validation, cached by document revision, owner, slot and endpoints. Choices use search plus 24-item pages; every final creation still validates the complete ordinary command at the captured insertion slot. No compatible exchange produces an actionable retained draft, not a new global exchange or a silently changed endpoint. Timer remains available as a local tool.

The canvas remains rendered while a bounded, independently scrollable form is open. Values keep the existing qualified-path editor and lifecycle. Final creation uses ordinary CreateElement plus SetSteps in one Batch; paired call/reply are inserted together and undo together. Reordering uses SetSteps within the captured parent. Existing core validation decides reply order, branch dominance, lifetime, phase and endpoint compatibility. Failed preparation/source writes retain drafts.

Transient events capture document/scenario/revision/epoch, and the App validates the current Behavior owner before handling them. Selection does not invalidate a gesture within the same scenario. Escape, unfocus, context/tool change and pending drafts cancel gestures. Scroll, bounds changes and actual window resize also cancel the captured source/slot. Ordered raw pointer events are translated by the actual combined inner/page Scrollable offsets. No geometry is persisted.

Execution bars derive their ends from actual correlated reply positions; separate conditional reply branches render their corresponding spans. Calls without a visible reply use a short explicitly open activation, not a fabricated reply.

Acceptance checks

Production-event tests cover hit priority, click-click/drag, scroll-origin changes, Escape/unfocus/stale contexts and exactly one result per gesture. Planner/App tests cover middle/operand insertion, paired identities, complete SetSteps ordering, same-parent reorder, rejected reply-before-call, unchanged global exchanges, exact source/model Undo, draft retention and bounded exchange/call controls. Run focused and full desktop tests, strict all-target desktop Clippy and optimized build with the dedicated D:/CodexBuilds/Capella2-scenario-target target.

Root native tasks (not yet performed):

1. Draw an existing exchange again into the middle of a scenario as Call+Reply; enter a qualified value, select both occurrences, Undo/Redo, save/reopen.
2. Insert inside an ALT/LOOP operand, reorder within it, reject a reply before its call, and inspect correlated execution bars and preserved occurrence identities.
3. Cancel drawing after scrolling/layout change, retry, retain typed values while navigation is blocked, and open/return from a referenced scenario. Verify at 1440x900 and 1100x700 on Windows and Linux before scoped acceptance.

Initial automated evidence — 2026-09-06 (superseded by review fixes)

Source checkout: D:/CodexBuilds/Capella2-scenario-direct, production commit d1d8f0bbed5aa0112189138a1cc025affe26c09b. Changes are confined to desktop app.rs, behavior.rs and behavior/scenario.rs; no core model, persisted layout or schema changes are included.

All commands used the dedicated D:/CodexBuilds/Capella2-scenario-target target with --locked --offline:

• cargo check -p oa-desktop --all-targets: passed.
• cargo test -p oa-desktop direct_: 19 passed, including 13 new direct-scenario tests and six existing matching tests.
• cargo test -p oa-desktop: final source passed all 274 tests, zero failures or ignored tests. This includes exact source/model Undo, creation and reorder selection, rejected stale contexts, retained failed-write drafts, bounded contextual controls, scroll-origin cancellation and correlated activation spans.
• cargo clippy -p oa-desktop --all-targets -- -D warnings: passed.
• cargo build -p oa-desktop --release: passed.
• git diff --check: passed before the production commit.

Logs are under D:/CodexBuilds/: Capella2-scenario-check.log, Capella2-scenario-direct-tests.log, Capella2-scenario-desktop-final-tests.log, Capella2-scenario-desktop-clippy.log and Capella2-scenario-desktop-release.log.

Windows artifact: D:/CodexBuilds/Capella2-scenario-target/release/arcadia-studio.exe, 20,345,856 bytes, SHA-256 7CC6DCDB7ECC0C6B144137D31DB0BE9BC1555FEFAE6B465DAEABCF52DFE1A166. This artifact has not been native-tested. Widget-tree/event tests do not establish visual usability, scrolling behavior or GPU rendering acceptance; the three native tasks above remain required. Process/chain direct editing remains outside this bounded implementation.

Independent-review fixes and final automated evidence — 2026-09-06

Production commit: 7a666076bfcfd1f2258d2f5508328db5adf40825, same isolated checkout and dedicated target. Only the three previously owned desktop source files changed. No core/source/schema or process/chain features were added.

The new event regressions failed on the prior implementation: a bounds shift kept the first click's source/slot armed, and a held drag could still publish its old slot after the bounds changed. Both now cancel. After scrolling, resizing or clipping changes, the next click starts a fresh gesture. App tests also verify unchanged-size notifications retain context, actual resize invalidates it, and scrolling preserves property/source history and the pending behavior form.

Local Iced inspection established that Scrollable translates its supplied cursor but leaves raw CursorMoved coordinates and the canvas layout unchanged. The existing inner and outer scrollables now have a local, passive observer which reads their actual translation through Widget::operate. Ordinary on_scroll cannot report initial/remounted state or passive content-size clamping. The observer forwards layout, drawing, overlays and event capture, and publishes only changed translations or document/owner context. Reporting before child input makes a result using an old slot stale before App processes it; reporting after input captures wheel/scrollbar changes. The real Iced Scrollable test uses its debug null renderer and verifies 0 → 180 wheel offset → 50 passive clamp → 180 on expansion → 0 after remount, with no repeated messages on unchanged redraws.

The reported ALT fixture also failed before the fix: a root Call, Reply then Action in operand one, another Reply in operand two, and a third operand without a Reply. Derived execution geometry now splits at operand boundaries, stops each returned operand at its own correlated Reply, leaves its following Action outside that segment, and marks the reply-free operand open. It does not imply chronology between alternative operands or add persistent execution records.

Picker measurement on the same Windows debug target:

Probe	Before	After
500 compatible exchange choices	7.87 s	1.46 ms
Same choices after one name edit	8.14 s	1.48 ms
100 exact-slot earlier calls, initial validation	not measured	595 ms
Those calls after name/value/search/page edits	not measured	34–39 µs

The exchange list no longer clones and validates the entire project per candidate. Final Apply still rejects a Delete inserted before a later Call on that lifeline; the new regression confirms appending that same Delete succeeds. Reply choices retain exact validation, invalidate for changed slot/document/revision/endpoints, and do not lose their cached eligibility while expressions are being typed. These are bounded picker measurements, not complete native-frame timings.

Final checks (--locked --offline): 27 focused matching tests passed; all 282 desktop tests passed, zero failures/ignored tests; strict desktop all-target Clippy passed; optimized desktop build passed; git diff --check passed. Clippy requested one test-only nested-if cleanup, which was applied before the final clean Clippy/build.

Logs under D:/CodexBuilds/: Capella2-scenario-review-before-tests.log, Capella2-scenario-alt-before.log, Capella2-scenario-scroll-observer-tests.log, Capella2-scenario-review-desktop-tests.log, Capella2-scenario-review-clippy.log, Capella2-scenario-review-release.log.

Current Windows binary: D:/CodexBuilds/Capella2-scenario-target/release/arcadia-studio.exe, 20,349,952 bytes, SHA-256 1AE729097F267DE596AE0970D3A62AE06C0C89CE2FDE70DF980AD785A0E0A8E6. It supersedes the initial artifact above. Native acceptance is still pending. Root should repeat the three primary native tasks, including inner/outer wheel and scrollbar cancellation at a middle slot, resize/remount/clamp recovery, and the three-operand ALT fixture. The broader release objective remains incomplete.

Final passive-scroll save correction — 2026-09-06

Production e7e37d485d842731d270781bd4e60a323fe4cdba addresses the focused review's remaining App lifecycle finding. During an async save, Iced can change its scroll position while App's busy gate rejects ordinary messages. The observer had already recorded its report, so dropping that notice left App's offset stale after save completion. The new regression failed before the fix: App retained offset (0, 0) instead of (25, 140).

App now dispatches only the passive Scrolled event before interaction gates. Its existing handler still validates document, scenario and revision. Mutation input remains gated. The test checks current offsets and cancellation epoch while busy, rejects an old-document observation, delivers a successful Saved receipt, then uses production Canvas pointer events to create the intended sender/receiver/slot draft without a model or source-history mutation.

The independent reviewer rechecked this exact production change and regression; no remaining medium/high finding was reported in the focused review. Final full desktop tests pass 283/283, strict all-target desktop Clippy passes, optimized desktop build passes, and git diff --check passes. Logs under D:/CodexBuilds are Capella2-scenario-busy-scroll-before.log, Capella2-scenario-busy-scroll-after.log, Capella2-scenario-busy-scroll-desktop-tests.log, Capella2-scenario-busy-scroll-clippy.log and Capella2-scenario-busy-scroll-release.log.

Latest Windows artifact, superseding both builds above: D:/CodexBuilds/Capella2-scenario-target/release/arcadia-studio.exe, 20,349,952 bytes, SHA-256 CEEB8E277DFC47C0D55DA43F903FCA45AFBF902AFA418B3924375910D699373A. Native acceptance is pending. Include scrolling while saving in the root's native recovery task before accepting the direct scenario milestone.