ARCADIA-Studio/harness/release-chooser-full-gate-diagnosis-20260911.md

# Chooser full-gate diagnosis — 2026-09-11

Codex-956atf `/root/chooser_gate_debug`. Initial read-only source diagnosis, followed by root's narrow three-file correction lease after the suite reached terminal failure. No compiler, saved-executable, native, WSL, network/VPN, or Git actions. Root remains sole execution/integration owner. Read AGENTS.md, current issue 1 comments through 346, empty open PR inventory, ScenarioFocus20260911 Wiki and prior chooser production review. This report supersedes no historical result.

## Actual evidence

Root identifies source `8895dd2e0f87c0f16085bf4b478b8c0fbed38685` and immutable `.local/scenario-focus-gate-20260911/arcadia_studio-e358a5ed59b1de41.exe`, SHA256 `C9C4210EA36854F20C0DC9F38137CEFE5C3BC9CD19E10E1AD41DCB410CC92D04`. Reviewer independently read the terminal `.local/logs/scenario-focus-full720-20260911.log`: **716 passed, 4 failed, 0 ignored**, 377.91 seconds. Root records log SHA256 `4A765FFAD4B08EC0B9D6B8399CF841E3C776051EA07B4433BB47C8E6BDC4C67F`. Reviewer did not execute it. Three assigned failures are below; scenario fresh-session scroll reset is root-owned and outside this diagnosis.

Paths below are relative to `crates/oa-desktop/src` unless otherwise specified.

## Rationale fixture stops before any widget interaction

Actual failure: `app/reference_authoring/tests/mounted.rs:777`, Option unwrap while finding an SA Exchange occurrence whose operation is `Some`. No rationale field is mounted, clicked, or typed before this failure.

The loaded `harness/fixtures/interface-operation-probe/output/boundary-only.json:188–228` has calls `operation_probe_43` and `operation_probe_44` with no authored operation field. The fixture represents an unselected operation. Existing `semantic_review/source7_tests.rs:285–301` shows the established explicit setup: select call 43, set `OperationUse { allocation: Some(operation_probe_30) }`, then validate via `execute_batch`.

Minimal correction suggestion: prepare an explicitly operation-bearing call using that established setup before the search/reverse-review construction, and assert successful actual operation resolution. Do not merely broaden the search to accept `None`: that would no longer establish the operation-omission premise. Preserve every per-key addressed rationale event, final `Engineering reason`, retained focus, candidate recovery, Inspector raw, SourceBundle and Undo assertion.

Production path to verify after setup: `reference_authoring.rs::reference_overlay` selects modal form ownership; `forms/reference_chooser/widget.rs:282–284` calls `trigger::own_input`; `trigger/focus.rs::exclusive` uses the whole `reference-owning-review-modal` boundary; `semantic_review/row.rs:182` receives `OperationRationale`. The current source boundary preserves sibling inputs; this failing execution neither proves nor disproves that behavior.

## Keyboard return moves an already-visible anchor by one pixel

Actual failure: `app/reference_authoring/tests/mounted.rs:463`, after pointer Open and Escape return, keyboard Open anchor is `Rectangle { x: 0.0, y: 124.79999, width: 300.0, height: 16.0 }`; original expected is identical except `y: 123.79999`. The preparatory actual-scroll assertion, pointer message assertion and first exact pointer anchor equality already passed.

Concrete source defect: `forms/reference_chooser/trigger/focus.rs:185–188` computes `(ancestor.offset + reveal_delta).clamp(0, capacity) - ancestor.offset` even when reveal_delta is zero. The installed Iced 0.14.2 `scrollable.rs:549–559` passes the rounded drawing translation to the operation; `scrollable.rs:1876–1901` rounds each axis. Capacity derives from fractional content minus viewport size. A rounded END offset can exceed that fractional capacity; clamping then creates a negative delta for an already-visible field. Iced `State::scroll` adds that delta to the unrounded underlying absolute offset (`scrollable.rs:1790–1802`), potentially crossing the adjacent pixel boundary. This predicts precisely the observed +1px anchor.

Minimal correction suggestion: zero requested reveal on an axis must produce exactly zero applied delta on that axis; only bound an axis that actually needs revealing. Preserve the exact rectangle equality; adding a tolerance would hide an unintended scroll. Keep existing fresh entry, nested reveal, return-after-scrolling-away and ownership tests.

Needed falsifier: root narrow reproduction logging field bounds, ancestor rounded offset, fractional capacity, dx/dy and applied delta immediately before return. Expected defect signature is dx=dy=0 with a negative nonzero clamp delta at END. After correction, return should leave the scroll unchanged and both pointer/keyboard anchors equal. No runtime instrumentation has yet been applied.

## Paired attachment facet may not be legitimately staged

Actual failure: `app/reference_authoring/tests.rs:439`, first `reference_draft(host,path).unwrap()` in the loop over scalar, constructor group and child attachment. The log lacks the loop mode, active selected facet and errors. No chooser Open occurs in the failing iteration.

Strong source hypothesis: mode 2 constructs `Child { oa: 103, sa: 104 }` and sends Select without staging this pair or establishing 103→104 correspondence. `oa-core/src/semantic/catalog.rs:690–703` derives child pairs from the reference map. Without that mapping, the current catalog has separate unpaired child selectors. Batch Select still invokes refresh (`semantic_review/batch.rs:395–400,584–586`); `semantic_review/row.rs:863–875` replaces selection if its selector is absent from current facts. Later Decide stores the explicit Candidate facet and attachment draft, but does not select it. `row.rs:529–545` correctly rejects a host facet that is not actively selected.

The scalar banked-row reference test passed in the same executable, and `Document::from_project` explicitly proves model equality after source roundtrip, so source normalization loss is unsupported here. The paired-attachment diagnosis still requires actual mode/selection evidence.

Needed falsifier: enrich the failing assertion with mode, requested facet, current selected facet, decisions, state error, candidate roots and candidate draft availability. If mode2/selection mismatch is confirmed, prepare its pair through the actual Attachment Pick/Stage workflow before Select (or establish explicit correspondence through its real workflow), retaining the old-facet rejection and source/history comparisons. Do not relax the production active-facet guard to accept a banked/unselected draft. If another mode fails, re-localize against its actual gate before changing source.

## Handoff

Root granted the narrow lease after reviewing the actual failure evidence. Three files were edited and standalone rustfmt completed exit 0 with edition2024 and skip_children=true:

| File | Frozen correction SHA256 |
| --- | --- |
| `forms/reference_chooser/trigger/focus.rs` | `F1E79F4B03B2F9FD1CDC335054D4AE177DC9E759B6EA3D334B2BCCA39B57191B` |
| `app/reference_authoring/tests/mounted.rs` | `3A43E32BD028D4DF699F905BDBFAA7B99A56D5ADB5EB190AB6E47E14F6D7520C` |
| `app/reference_authoring/tests.rs` | `AAE2D95305DBCA6120DCFBFBF292F138C39015F136F3C85784CA46B0669729B8` |

The production correction guards each zero reveal axis before the capacity clamp. The rationale fixture follows the existing validated EditElement operation-selection setup and additionally proves actual Selected resolution. Mode2 uses the real public ReferenceOa, ReferenceSa and AddReference events to establish103→104 correspondence before selecting its paired Child catalog facet; semantic-review visibility and write guards are unchanged. Candidate fixture failures now include mode/facet/selected/decisions/error diagnostics. Exact anchor, key counts, final rationale, stale-facet rejection, candidate staging, SourceBundle and history expectations were retained.

These are prepared source corrections, not passing execution evidence. Root owns targeted chooser and full-suite reruns and integration with its separate session-scroll correction. Existing scenario parent-focus5/5 and independent canvas/schema8 work remain separate.