ARCADIA-Studio/harness/scenario-reorder-interaction-evidence-20260924/review.md

Scenario reorder session and interaction experiment review

Bounded independent review in C:/ar-scenario-9e8r6t, on the parent's identified base 53817298. No production edits, Cargo, native actions or Gitea operations. This review distinguishes an isolated semantic foundation from an accepted user interaction. Source/test review will follow the writers' frozen handoff; no gate result is assumed.

Initial contract assessment

The experiment is justified as a foundation. harness/scenario-reorder-interaction-20260924.md:7-11 supplies a discriminating noncontiguous selection task, preserved saved coordinates, observable before/after order, subsequent ordinary spacing, equal anchors, offscreen destinations and repeated names. This directly addresses the user's graphical editing and low-cognitive-load requirements (PROJECT_GOAL.md:93-106). The explicit chooser and labelled handle are materially different candidates; passing chooser transformations alone cannot decide between them or satisfy the user's complaint about menu-driven diagram editing.

The exact requested representation plus full Scenario Context/Snapshot/token boundary is appropriate. Whole original typed selection must be admitted before no-op; no selected subset, silent representation switch or pruning is permitted. The App's early admission obligation is correctly distinct from consuming a pure session. Isolating both new modules behind cfg(test) prevents this experiment from silently enabling production group reorder.

Contract questions before production input

1. Retire every admitted terminal outcome. The initial App boundary at interaction line 23 names cancellation, successful/no-op Finish and failed Start, but omits Refused Finish and a failed Document/source commit. A refused current operation can leave all selection/model values unchanged, making duplicate terminal packets a meaningful adversary. Explicitly retire these outcomes too, without changing accepted model/source/history/selection/camera and without touching a newer owner on stale input. This is a missing future-adapter invariant, not a current production defect.
2. Separate baseline presentation admission from candidate commit policy. scenario_layout/presentation.rs:79-85 makes coordinate input available only for Ready, while Fallback retains inspectable automatic geometry and requested Saved identity. A semantic chooser is not coordinate input. Specify whether a Fallback baseline can start each candidate and separately decide how a semantically valid Fallback/Unavailable candidate may finish. A returned command plus status must not be treated as implicit permission to commit. The current test-only foundation may expose both facts while keeping the product decision unresolved.
3. Choose stationary/origin-return semantics for the drag. The required camera/threshold/outside rules do not yet settle whether return to the pressed screen location cancels or selects the nearest semantic destination. A saved press need not be nearest its own anchor, particularly with close/crossed rows. Define and test either behavior before adapter acceptance; do not infer an origin-return no-op from the planner's selected-anchor no-op rule.

These points were sent to the parent. They do not prevent publishing an explicitly incomplete test-only session/slot experiment. Native success still requires users to identify the exact parent/anchor and final semantic order despite preserved authored positions, then perform a normal spacing operation without accidental semantic edits. Repeated long names need a usable visible disambiguator; internal IDs alone do not establish this. A bounded searchable list is an experiment to evaluate, not an automatic low-cognitive-load success.

Contract revision and frozen session source review

Re-read the revised interaction specification: it now explicitly retires every admitted terminal Finish including semantic refusal and source-commit failure, separates baseline Fallback admission from candidate commit policy, and leaves stationary/origin-return drag rules as decisions required before enabling an adapter. The initial three contract findings above are therefore resolved as specification clarifications; the product decisions remain openly pending.

Reviewed the writer's frozen behavior/scenario/reorder_session.rs and its five test functions. No concrete unresolved semantic/admission defect found in this isolated session. Session::new checks nonnil document/visit/token, exact generic selection context and requested representation's actual Scenario owner, then admits every original member against the actual presented scene before whole-set planner preparation. The private immutable Project and Snapshot retain selection click order and primary; the planner constructs semantic order independently. Current proposal storage is bounded to one rendered proposal. Refusal replaces the current proposal rather than leaving an earlier valid command armed. finish(self, ...) compares complete Project, Context, Snapshot (including generation) and token before returning a private cached command, and Rust ownership prevents reuse of that session. It neither mutates Document nor proves App early admission or lifetime retirement.

One concrete evaluator weakness was repaired during review: pointer equality to an Option<Preview> field would remain true even if that field were recomputed in place. The final test uses test-only proposal-build instrumentation, checking one build for repeated current Slot, a second for another Slot and a third when returning to the original. This now distinguishes the intended bounded cache behavior.

The tests independently construct the expected complete Project by editing only the literal parent steps, retaining nonempty saved lane/message overrides, metadata and a second saved view. They cover original selection/primary, explicit absence of destination versus selected-anchor no-op, temporal refusal, mixed and visibly cross-parent full sets, foreign/missing visibility, changed Project, epoch/revision/document/visit/token, changed selection order and generation-only primary ABA. Equality with the expected complete Project is stronger than preview/commit agreement alone. The Fallback case starts from authored call/reply geometry already requiring fallback; it establishes baseline Fallback admission and requested Saved identity preservation, not a Ready-to-Fallback transition.

Remaining bounded coverage gaps: no constructed semantically valid candidate yielding Unavailable, no independently exercised Ready-to-Fallback transition, no native feedback, and no App command/history/source transaction or stale-event adapter in this module. Returning a command alongside a degraded status remains information for future policy, not permission to execute it. All new session code is test-only. These omissions must remain explicit and must be addressed where the subsequent adapter's actual policy needs them; they do not justify claiming either interaction accepted. No test execution result is claimed by this reviewer.

Frozen slot experiment and final pre-gate assessment

Reviewed all four reorder_slot_experiments.rs tests against actual Scene::slot_at (behavior.rs:1855), which chooses the global nearest Y before checking parent identity. The experiments resolve actual Saved presentation and assert Ready rather than assuming authored coordinates rendered. Their exact_change oracle (reorder_slot_experiments.rs:102) alters only the independently specified literal parent order, compares the complete Project, and round-trips source. No concrete fixture/oracle flaw found statically.

The crossed case (:142) distinguishes semantic order from the actual A/C/D/B screen order while checking each before-anchor remains reachable. The equal-Y case (:161) demonstrates the B/C tie winner and compares two distinct literal semantic outcomes: exact before-C versus the nearest picker returning before-B. The close case (:189) explicitly retains continuous reachability and limits its negative result to integer-pixel samples at a fixed camera; it does not establish platform pointer quantization. The offscreen case (:207) fixes scale one, pan zero and a 600-pixel viewport, and separately proves reachability outside that viewport. Neither justifies a claim that scrolling/zooming can never reach the destination.

These are geometry/planner experiments, not an implemented chooser or drag handle. They make unchanged nearest-Y input an insufficient universal equivalent of exact semantic destinations, but do not select the final interaction. Nested invalid-nearer destinations, repeated long names, twenty-sibling display, keyboard reachability, discoverability, feedback, Ready-to-degraded candidate transitions and a built App lifetime adapter remain outside these four cases. The chooser could still fail the user's direct graphical editing requirement; a handle could add a bounded disambiguator or operation-local order preview. Compare the resulting workflows before acceptance.

Also reviewed the parent's final temporal test enhancement: it first caches a valid changed order, then chooses the temporally invalid before-call destination and requires Finish to refuse. This meaningfully guards against executing an earlier valid proposal after a later refusal.

Final static conclusion: no unresolved material defect found in the bounded test-only foundation. The specification findings and cache-test weakness were addressed as recorded above. Nine new test functions (five session, four slot experiments) await the parent's gate; this review ran no Cargo and claims no passing test/native result. Review file is stable for handoff.

Closed gate and decision audit at cae7a222

Read the actual closed receipts and logs for reorder-interaction-test-1, reorder-interaction-format-1 and, now closed, reorder-interaction-clippy-1 at cae7a22297d09810c412dbdf4ce5d8a28164b247. All three report exit 0 and unchanged 814 inputs. Independently rehashed each retained input map, input ZIP and raw stdout/stderr against its receipt, counted all 814 ZIP members, and checked each source-proof receipt's commit/count and exact input-map/result bindings. This confirms receipt consistency; this audit does not claim to rerun the complete Git blob comparison.

The actual test log has exactly 22 named passing tests: five new session tests, four new slot experiments and thirteen existing tests, with zero failed, zero ignored and 1,573 filtered. Both formatting and strict cargo clippy -p oa-desktop --all-targets --message-format=json -- -D warnings are successful closed runs at that same source. No additional Cargo was run by this reviewer.

Re-read the interaction document's Executed result/decision section and the policy's new geometric-versus-semantic input clarification. No material overclaim found. Actual Ready equal-Y geometry supplies a concrete counterexample to unchanged nearest-Y input being the sole complete semantic destination mechanism; changing only the deterministic tie winner leaves another identity unreachable. This supports the negative decision while leaving chooser, order strip and explicit drag disambiguation open. The text correctly limits the close-slot result to integer samples and the offscreen result to a fixed camera, and explicitly withholds App/native/keyboard/large-list acceptance. The passing filter is not described as a complete Scenario or desktop suite. A final portable package audit remains separate from these closed-run checks.

Final portable package audit

Ran harness/scenario-reorder-interaction-evidence-20260924/checks/verify.py successfully: 3 runs, 0 recorded failures, 27 logical files, 23 stored ZIP members, 1 deduplicated source capsule pair and 3 source proofs. Independently checked the exact ZIP inventory and every member hash, all 24 raw run/logical files byte-for-byte against .local/scenario-group-gates, and all external files.json pins. Archive evidence.zip is 3,244,466 bytes, SHA256 b713a5c8c03f4cb4f4a6884bde7eb081fca00d1f5ebf85427ce14bc03acae166. No integrity mismatch found.

The checks README and manifest kind retain historical Scenario-selection helper naming. At audit time a root package index had not yet been written; parent was asked to explain those reused names and actual reorder run inventory there, preserving the pinned helper bytes. This is delivery clarity, not an evidence defect. The portable verifier checks historical proofs and archive consistency without re-executing source, binaries or Git comparisons. The tested source remains cae7a222; subsequent record edits are not relabelled as having executed those 22 tests. No native interaction or accepted chooser/handle is implied. This review is stable for delivery copy.

Final delivery clarification: read the newly written root evidence README. It now lists all three actual reorder runs, exact commands/environment, archive identity, reused historical names and the distinction between prior preparation notes and executed results. The delivery-clarity note above is resolved; no material overclaim found. File remains stable for copy.