# Source7 integration decision — contextual chains and operation messages
Root decision after executable existing-core falsifiers, distinct candidate comparison and independent critiques. These are approved implementation contracts, not a claim that production support exists. Original first-release OA/SA scope remains unchanged.
## Selected representations
S1 uses the new closed ContextualLink relation with an explicit caller owner, endpoint paths of reference **occurrence** IDs and a direct leaf, and distinct Precedence/Exchange/CommonWork purposes. Existing direct SequenceLink bytes and meaning remain unchanged; all-direct new Precedence rejects in favor of the existing constructor. Same global leaf in R1/R2 represents distinct contributions. CommonWork asserts shared work identity, without execution fusion. The [contract/probe](release-chain-assembly-contract-probe-20260906.md) and [independent critique](release-chain-assembly-contract-independent-review-20260906.md) define the admitted cases and required owner/reference-consumer audit.
S2 uses `operation: Option<OperationUse { allocation: Option<Id> }>` on the existing Exchange occurrence. None retains ordinary channel semantics; present/unresolved preserves operation intent; present/selected references the exact InterfaceItemAllocation. Reply stores None and derives operation/provider/signature from its exact Call. A name, unique parameter list, bare item ID or fabricated functional refinement is not a substitute. The [operation contract](release-interface-operation-contract-20260906.md) and [independent critique](release-interface-operation-contract-independent-review-20260906.md) supply the primary evidence and original parameterless falsifier.
Both additions use one schema/source7 change. They must not be shipped as separate incompatible version increments. Preserve source1–6 closed admission, including explicit default/null new fields. Prefer serialization omission of operation=None to preserve existing body bytes, backed by frozen nonempty old5/6 fixtures and exact fingerprint adapters; serde defaults alone are insufficient evidence. Version-token-only source upgrades preserve includes, ownership, comments and raw invalid drafts. Existing transient impact approvals reset; authored review decisions remain raw intent and are replanned. Never restore a serialized executable plan/command. Old5/6 Call/Reply/value/SequenceLink/trace/view-selector checkpoints and combined new7 restore are release gates.
- Admission counts authored path components deterministically. Resolver cache capacity only evicts/skips storage; it never changes validity. Per-request analysis budgets are separate. Depth64 and analysis50000nodes/100000edges must pass scale/cold/warm/eviction tests before acceptance. Integration clarification from independent code review: the ordered-reference budget is existing caller policy, not a new global limit. REST retains50000, desktop source retains500000, and core callers choose ParseLimits explicitly. New path components count in those existing budgets; do not reduce desktop capacity or let caching change admission.
- Normal Delete removes the whole dependent ContextualLink atomically when its owner, path member, leaf or purpose work/exchange is deleted. It never shortens/reinterprets the address or changes purpose. Reidentify visits every typed component. Retargeting that invalidates a surviving link refuses unless an explicit valid repair batch is supplied. Caller ownership controls source placement even when both leaves are external.
- Accept the [contextual analysis contract](release-chain-context-analysis-contract-20260906.md): separate precedence, assembly incidence and coverage projections; qualify nested definitions by occurrence paths; mark synthetic reference boundaries and exclude their arcs from authored cardinality/guards. A qualified advisory may flag R1.B's two incoming authored precedence links, without invalidating the model, forcing a Join, changing standalone P/R2 or claiming execution analysis. Missing/empty/over-budget expansion is explicitly incomplete, never a guessed bypass or complete-looking reachability result. Direct-only historical diagnostics remain unchanged.
- A selected operation requires proof through the **actual concrete Standard component ports** of the Call: receiver Provides, sender Requires a compatible interface exposing that same allocation. Participant containment does not inherit interface roles onto ports. Refuse a selected allocation without this proof; explicit unresolved operation intent remains editable. Resolve inherited allocations through the existing data rules; never substitute a separately allocated same item. Call/Asynchronous transmission and actual reversed-channel direction follow the operation contract.
- Reply derives roles and signature from the Call, then separately validates existing reply correlation/order/reversed participants/channel rules. A separate explicit return channel remains permitted when it carries the selected operation item (or an admitted subtype) and its actual endpoints satisfy the existing channel contract; this check applies even to parameterless/void returns. Do not demand that the Reply receiver provide the operation. Ordinary operation=None replies retain their prior behavior.
- Deleting an operation allocation clears its selection to present/unresolved and preserves still-live value expressions. While signature is unresolved, perform independent live-reference/path checks and report incomplete signature; do not fall back to the whole channel's union as a substituted operation. Item/field deletion uses normal proven-reference cleanup. Reselection validates retained values against the exact new signature and rejects without implicit pruning/defaults.
Integration clarification: this is reference cleanup within an otherwise valid candidate, not an exemption from the established port/channel contract. Existing `workflows.rs` allocation-deletion tests and `ports.rs``port_interface_items` explicitly reject removing the sole interface allocation while a boundary still carries that now-unadmitted item. Keep that refusal atomic and unchanged. A surviving second allocation may admit the channel item, allowing deletion, but the operation MUST stay unresolved rather than select that other identity. Otherwise an explicit repair batch must address every affected carried-item contract, including a separate Reply channel, while preserving still-live unresolved message values. Root rejected downgrading channel errors based on the presence of a scenario; that would make channel validity depend on unrelated occurrence records. State-contract independently reviewed this clarification and found it consistent with whole-candidate validation. Pin both simple-delete and explicit-repair cases in core tests.
- SA→OA operation abstraction requires explicit per-source omission with rationale in the transition preview. Missing/irrelevant/duplicate/wrong-direction decisions reject; Reply derives the Call's abstraction and has no duplicate writable choice. Preserve the source, map remaining facts explicitly and validate the whole target. Technical operation Take into an OA NotApplicable slot is not ordinary cross-layer reference mapping.
## Implementation and acceptance boundary
One core owner coordinates shared model/accessor/validation/reference/source/version/transition/semantic-facet files for both additions. A separate desktop owner consumes shared resolved context for direct canvas editing, forms and visible labels, including readable minimum-size behavior work. A recovery owner consumes the frozen migration contract and tests raw old/new checkpoints. Root integrates reST/OpenAPI/HTTP/example/package changes and actual Windows/Linux engineering tasks. No worker should invent a parallel path/operation resolver.
First core checkpoint must compile and pass the concrete repeated/nested OA/SA and two-parameterless-operation counterexamples, structural negatives, exact source/JSON/history/reidentify/delete/migration oracles, before downstream UI acceptance. Then verify reachable graphical authoring, strict REST examples/rejection, semantic-review composition and exact native Save/Undo/Redo/reopen. Existing source6 native evidence remains scoped to its tested executable; new-version migration and rendering require their own evidence.
Revisit these choices if a concrete valid OA/SA model cannot be represented without inventing engineering facts, a lifecycle/migration counterexample loses authored intent, diagnostics depend on cache/render order, or the working UI cannot expose the identities clearly. Do not add channel-free messages, scenario gates, simulation or later-layer concepts merely as speculative extensions of this work.
