ARCADIA-Studio/harness/release-selective-views-critique-20260906.md

# Selective views candidate: independent bounded critique

Read-only review of `release-selective-views-design.md`, current core projection,
port layout, coverage traversal and schema admission. No implementation or native
acceptance is claimed. The closed persisted-options design is viable; freeze the
following meanings before schema6 implementation.

Primary evidence supports distinct work/participant category membership, not a
particular filtering UI: Capella's [FunctionalAnalysis schema](https://raw.githubusercontent.com/eclipse-capella/capella/master/m2/plugins/org.polarsys.capella.core.data.def/model/FunctionalAnalysis.ecore)
has `ExchangeCategory.exchanges: FunctionalExchange` and
`ComponentExchangeCategory.exchanges: ComponentExchange` (lines461–493,2879–2910).
The [official Arcadia Q&A](https://mbse-capella.org/arcadia-qna.html), questions15–16,
describes presentation synthesis, simple/multiple categories and context-specific
dataflow usage. It explicitly distinguishes existing simple categories from
hierarchical categories. A single typed Studio record with a family discriminator
is compatible with those needs; hierarchy is not required merely to copy Capella.

## Findings and decisions needed

| Priority | Concrete gap / falsifier | Recommended bounded contract |
|---|---|---|
| P1 | One `categories: Any(ids)` plus “when the constraint applies to that family” is ambiguous. Select only a Work category in a mixed architecture: Participant edges might either disappear or remain. `Any([])` has no family from which to infer applicability. | Persist independent Work and Participant selectors, each `All` or `Any(ids)`. Require selected category IDs to match that family/layer. `All` includes uncategorized exchanges; `Any` admits only membership in at least one selected category, so `Any([])` admits none of that family. Other family and non-exchange edges remain independent. Show family-specific counts/labels. |
| P1 | Global `InBehavior` does not answer “show exchanges used by Process P”, even with correct diagnostic reachability. Two processes with disjoint exchanges both pass the global filter. | Expose global “Used in any behavior” separately from an explicit selected Process/Chain/Scenario scope. Refactor the shared traversal to accept root IDs; union selected roots and their valid included reuse. Define selected scope with no IDs as empty evidence, and define its complement only over same-layer Work exchanges. Do not infer context from performer, state actions or transport allocation. |
| P1 | Filtering before the existing port-layout call can move ports and alter edge attachment geometry even without a layout command. `projection.rs:438` passes rendered edges to `port_layout::layout`; `port_layout.rs:163–230` derives automatic facing/sides from those peers. Hide one of two opposite peers to reproduce. | Compute baseline eligible edges and automatic port geometry first; apply visibility filters to the drawable edge set afterward, or explicitly preserve equivalent baseline peer input. Retain manual anchors/routes verbatim. Test automatic and manual ports while hide/category/coverage options toggle; no unintended owner resize or anchor flip. |
| P1 gate | Forty same-direction exchanges between one promoted pair in one selected category still produce forty lines. A sparse three-exchange fixture cannot establish the required readability benefit. | Run a dense40 same-pair task before declaring category complexity management complete. If users cannot count/find/select a requested member reliably at normal zoom, add summary presentation for compatible endpoint pair/orientation/family, with actual member IDs and count. Membership overlap must partition deterministically without duplicates. Keep summaries non-semantic and support drilling into actual edges. |
| P2 | “No relationships” is inaccurate if the filter only affects arrows. Allocation nesting, interface-item rows and internal state/action rows still express relationships; current `projection.rs:337–349` excludes several of these from edges entirely. | Label the control “Relationship lines” / “No relationship lines”; scope options to actual graph edges. Do not erase allocation nesting or typed state rows. Either restrict the first controls to architecture diagrams or explicitly explain ignored options for dedicated state views. |

## Lifecycle and schema constraints

Accept legacy OA BoundaryExchange as Participant-category members when those
records are already valid in the current compatibility model. This avoids making
legacy user diagrams unfilterable and does not reinterpret them as CommunicationMean.
New OA authoring should prefer the separately agreed CommunicationMean contract.
Wrong-family/wrong-layer members reject atomically; no silent conversion of ports,
items, allocation, direction or endpoint ownership. A family change with incompatible
members must be an explicit combined edit or rejected, never clear members silently.

The source6 boundary needs a frozen v5 diagram/body vocabulary and an audit of
all older envelopes. In particular, `migration_v4.rs:50–67` currently embeds live
Element/Relation/Diagram types because those were unchanged in schema5. Adding
current category bodies/options without closing that seam would let schema4 files
admit future constructs. Probe v4 and v5 JSON and text containing each new field/
variant: rejection must precede mutation; legitimate old files must preserve default
projection, placement IDs and routes exactly after migration. Preserve unknown-value
rejection, source lexical edits, source-bundle locations and REST restart round trips.

Deleting a selected category must retain `Any([])` for its own family and preserve
the other selector. Deleting a member exchange must prune memberships, hidden IDs
and only its routes, with exact Undo restoring all three. Reidentification must
visit category members, both selectors, context roots, hidden edge/trace IDs and
route references. A remove-and-recreate exchange has a new identity and must not
inherit a dead hide reference. Empty categories and same-name categories remain
distinct real records; inspectors/pickers should show family and identity context.

## Minimum acceptance additions

1. Mixed Work/Participant/uncategorized/non-exchange fixture: verify every family
   selector's All/Any(empty)/Any(overlap) truth table under kind/hide intersections.
2. Two disjoint processes plus shared reused scenario: global and selected-context
   filters differ exactly; unlisted owned occurrences do not count. A behavior edit
   changes visible edges without editing saved options/history. Deleting the last
   chosen context remains an explicit empty selection, not global scope.
3. Forty parallel same-pair members, overlapping categories, one hidden member and
   folded endpoints: perform readable count/find/select/export; test summary member
   partition if required. Restore a filtered member without widening other filters.
4. Toggle options on routed typed SA exchanges with opposite peers: compare owner
   geometry, automatic/manual anchors, saved waypoints and independent second view.
5. Duplicate view produces new diagram/placement IDs while retaining semantic IDs,
   options, routes and no accidental model transition. Native/SVG/REST projection
   and label text must agree, including empty Items labels.
6. Source/API rejection, v4/v5 admission, deletion/Undo/Redo/ID swap and restart
   preserve exact semantics and source provenance. Pending raw drafts keep current
   guards; a filter panel must not bypass them.

The shared traversal is currently private `validation/coverage.rs::included_evidence`
and starts from every behavior container. Reuse a pure explicit-root evidence helper
for both diagnostics and projection, rather than duplicate its semantics. Avoid
using missing warning codes as a coverage oracle: structural-error gating suppresses
diagnostics, and non-leaf exchange warnings intentionally suppress uncovered ones.

The dense readability gate and context-specific workflow are required evidence;
category hierarchy, arbitrary queries and transport coverage inference are not
justified additions for this bounded first contract.