ARCADIA-Studio/harness/prerelease37-allocation-seams-20260924.md

Allocation integration seams for prerelease #37

Read-only comparison of actual fetched commits: group/App source 495464e84b5bae8ddad93e9fc69ef353e7f1c884 and drawing/Traceability tip 301126f6098286bf440c1bd1b1ed685753984723; common ancestor b8685416f56e53e30bd11ecf93a54cea10ac8458. Local HEAD was reported by the parent as 57aec979f640ba1b8aa6fcbb7d9e26b29cf51596; this review uses the explicit source commits, not uncommitted files. Existing untracked human-check documents were left untouched. No merge, index/ref/object mutation, build, GUI or Gitea action occurred. A stdout-only three-way merge of temporary file copies was used to identify text conflicts. This is not acceptance of a merged release candidate; the later union tip was not available to this review.

One confirmed textual conflict

The branches modify five common code files. A three-way text check found one conflicting hunk in app.rs, App::update_inner, Message::Menu(Event::Invoke) (group line2412; drawing line2294). architecture_authoring/tests.rs, guide.rs, model_menu.rs and views.rs merge textually. Peer changes no diagram.rs canvas code.

Owner956 must compose the Menu hunk in this order after the existing menu token/context and pending-edit guards:

1. Preserve the group's early dispatch for Message::DiagramSelection and captured Process TopologyCanvas actions. Calling select(menu.request.object) first would collapse/rebind exact typed membership or navigate away from a qualified Process use before the intended selection action.
2. For the remaining actions, preserve drawing's narrowly scoped show_in_mixed_view branch (drawing app.rs:2319): Traceability PlaceSelected sets selected/clears attachment/refreshes draft without ordinary cross-layer navigation; otherwise use select. Dropping it makes Show in this diagram operate on the preferred same-layer view instead of the validated captured mixed view.
3. Preserve group's State-vs-architecture placement routing (behavior.diagram.placement with selected_node=None on Behavior canvas; otherwise selected_node=request.placement) and reconcile_multiselect, followed by the existing bend/action dispatch.

Choosing either conflict side wholesale loses a verified invariant. The combined behavior is directly exercised by existing group/context-menu/State tests and drawing's model_menu_traceability_tests plus traceability_navigation_tests; neither branch's separate pass proves that composition.

Concrete lifecycle gap to check on the union

Both input families share App::update. At group app.rs:1442, allocation_before(&message) runs before edit_connection; app/allocation_drag.rs:686 retires Allocation state for every Message::Connection, and State::retire at608 clears active token, preview and Arrange arm while advancing its epoch. Only later does App::edit_connection (group4611; drawing4481) reject a stale Event::Endpoint(captured, id) or an absent drawing session. There is no Connection envelope among the earlier stale-admission guards (source_input_envelope accepts unrelated messages).

Consequently, a delayed endpoint from a canceled drawing session can retire a newer group drag/Arrange arm even though it cannot create a relation. This is a source-demonstrated ordering risk already present in the compared branches, not a merge-marker conflict or a newly demonstrated native failure. Drawing's allocation_cancel_navigation_stale_context_and_pending_edits_preserve_model preserves a newer drawing session under old endpoints; group's navigation_union::assert_stale_noop preserves newer group ownership for other stale packet families. Neither inspected test covers this cross-family case. The focused integration check is: cancel drawing, establish a fresh live Allocation group press/Arrange state, deliver the old Endpoint, and require unchanged token/epoch/arm/preview/Document. If fixed, reject stale/non-owned drawing endpoint packets before shared retirement while still letting a current intentional tool change retire old drag ownership.

Compatible seams that must not be conflated

Canvas dispatch already separates modes: diagram/multiselect.rs::group_input (group85, guard158) declines new group input while a connection session exists; allocation_input_owner (636) also requires no connection session. DiagramCanvas::update then routes the physical endpoint click to Connection before normal Allocation movement. Keep these guards; no replacement canvas architecture is needed to add the tool.

Drawing's connection_tool::Tool::{can_connect,command,available_in} (peer76/126/185) creates one new Allocation relation for compatible unallocated leaf work, preserves authored placements and view filters, and requires projections containing both performer/work categories. Group assignment deliberately retargets existing Allocation relation bodies while moving the selected closure and pins. Do not substitute either operation's planner for the other. The palette's new available_in call replaces an exhaustive four-tool match; retain it with the new enum variant.

Drawing's mixed Traceability endpoint branch in edit_connection intentionally bypasses ordinary select for the visible opposite-layer performer, and temporarily aligns self.layer to the captured diagram before execute, restoring it on failure. Keep that captured-view behavior together with group's outer multiselect reconciliation. The existing allocation_mixed_view_keeps_captured_canvas_for_opposite_layer_pairs tests exact view/camera/source history and rejects opposite-owner-layer targets; preserve those assertions on the actual union. Actual group/native results remain evidence for495464e, not automatic acceptance of drawing or the merged candidate.

Parent readback of the selected candidate

The release owner subsequently published candidate 6ae75fb2ccaae16c29004444815ddeaeab2e75ac. Full-branch transport stalled, so this session retrieved named files through Gitea's contents API at that explicit commit, verifying returned size and Git blob SHA-1 before inspection. This is scoped source inspection, not a local candidate checkout, combined compilation or package acceptance.

Candidate app.rs blob 646b0415a156b3a4e8074847c5b2dadfea24b27c preserves the required Menu::Invoke composition: exact group/Process early dispatch, captured mixed-view placement, State-versus-Architecture placement assignment, and final selection reconciliation. Candidate app/allocation_drag.rs blob b6c329496c1c935defee6f6cd85c281c3556e4a2 is byte-identical to the accepted495464e adapter. The old Endpoint/Restart admission still occurs after shared retirement in this candidate, confirming the identified gap applies to the selected integration source.

The narrow contribution adds early admission for both captured drawing packet types. A packet must match the current route context and an extant session with that exact context before shared state changes. Choose/Begin remain intentional tool boundaries, and a current Restart retains its existing reset behavior. The regression distinguishes missing session, wrong captured context, wrong live context while captured/session agree, and wrong retained session while captured/live agree. OA/SA canceled-drawing-to-Arrange tests require unchanged ownership, preview, selection and exact source, then complete the surviving action with literal model/history expectations. A positive drawing path verifies current Choose/Begin, Restart and a completed connection. The admission report distinguishes this contribution's validation from combined-source acceptance and records the subsequently identified Route context/selected-edge correction.