A Project stores schema_version (6), id, alias, name,
+
A Project stores schema_version (7), id, alias, name,
description, and maps named elements, relations, diagrams,
artifact_links, and traces. Each map is keyed by the UUID contained in
its record. Duplicate map keys and mismatching keys/identities are errors.
@@ -730,6 +730,10 @@ lists all additional fields. ref means
String with minimum_length 0 / maximum_length none; none; ""
@@ -869,7 +873,9 @@ work and produces a warning. The System cannot own internal components.
The present Studio profile does not decompose SA Actors.
All relations have a header identity, alias, display name, optional
description (default ""), and required source and target
-references. Their kind is the declaration keyword:
+endpoints. Ordinary endpoints are semantic references; ContextualLink endpoints
+are qualified OccurrenceEndpoint records resolved from its required owner.
+Their kind is the declaration keyword:
Relation catalog
@@ -956,6 +962,10 @@ references. Their kind is the declaration keyword:
Preceding contribution → following contribution in one process/chain
guard string / ""
+
contextual_link
+
Qualified occurrence endpoints resolved from an explicit owner Process/FunctionalChain; section 4.2.1
+
Required owner, source and target OccurrenceEndpoint records, and typed purpose: Precedence, Exchange or CommonWork
+
state_transition
State vertices in one machine, subject to section 4.4
Interaction → FunctionalExchange, or CommunicationMean → BoundaryExchange
Sequence
Process → FunctionalChain, or paired occurrence contributions directly owned by Process / FunctionalChain
@@ -2261,7 +2271,7 @@ deeply nested drafts produce a diagnostic instead of exhausting the parser stack
6.1. Modular source projects
The pure source_project core API compiles a virtual source bundle, containing
entry and a files map from logical paths to UTF-8 strings. Its entry is a
-root-level .arcadia file with the source5 project header above. A project entry
+root-level .arcadia file with the source7 project header above. A project entry
MAY also be include string ";". An included fragment consists only of ordinary
declarations and include statements; it MUST NOT contain another version header,
project wrapper, or project description. Includes MUST occur at document level,
@@ -2324,15 +2334,15 @@ the source index. Columns remain one-based Unicode scalars within the real file;
spans never refer to concatenated or synthetic source.
Single-string parse/lint APIs remain filesystem-free and reject include
statements with an explicit source-bundle requirement. V1/V2 single-file imports
-continue through explicit migration. Modular projects accept source3, source4 and
-source5. Source3 is upgraded as one project, preserving file paths, includes, nested
+continue through explicit migration. Modular projects accept source3 through
+source7. Older bundles are upgraded as one project, preserving file paths, includes, nested
ownership and comments through targeted token edits. Generated allocation
declarations stay in their interface's existing file. Individual include fragments
are not independently migrated. Missing UUIDs stabilize before migration so new
allocation identities are deterministic on subsequent compilation.
An authored source4 bundle upgrades through the strict prose-only baseline
adapter; after any missing UUID stabilization, the version token alone changes
-to 5. Existing prose, comments, includes and nested ownership remain intact.
+to 7. Existing prose, comments, includes and nested ownership remain intact.
Source5 semantic facet comments follow their closed selector identity through
row reordering and reidentification; UUID-looking text does not act as an Id.
@@ -2654,7 +2664,7 @@ defaults without changing any prior identity, name, reference, order, geometry,
artifact or trace field. The original V2 golden source/JSON in
crates/oa-core/tests/fixtures MUST NOT be regenerated from the newer demo;
they verify that every old persistent field survives. Canonical output writes
-the added defaults through the explicit schema-3, schema-4 and schema-5 migrations.
+the added defaults through explicit migration to the current schema 7.
The V2 adapter preserves every original identity, alias, prose, parent,
placement, trace and artifact. Generic ports become Legacy with their original
direction/interface record. Existing FE endpoint IDs remain unchanged. For
@@ -2671,13 +2681,13 @@ IDs, required resolutions, generated endpoint IDs/aliases/owners, and boundary
orientation defaults. REST import, replacement, candidate validation and
project snapshots surface the same report. Opening an old server envelope
preserves its resource ID/revision and bytes; the next explicit edit writes
-schema 5. Model/source exports contain only the canonical model. Migration
+schema 7. Model/source exports contain only the canonical model. Migration
reports are transient response metadata, not persisted model facts.
Admission checks account for generated objects and their references before
-construction. Both the old V2 contract and the resulting V5 graph are
+construction. Both the old V2 contract and the resulting current graph are
validated. Migration itself does not save or increase a stored revision.
Canonical second saves are stable. V1 normalization produces the frozen V2
-model and then uses these same V2-to-3-to-4-to-5 stages.
+model and then uses the same explicit adapters to reach schema 7.
Save validates a snapshot, writes a sibling temporary file, flushes it, and
atomically replaces the destination. Failed serialization or validation must
not truncate a previous file. External concurrent-writer conflict resolution
diff --git a/docs/language.rst b/docs/language.rst
index bfd98d3f..c90fbffa 100644
--- a/docs/language.rst
+++ b/docs/language.rst
@@ -103,6 +103,9 @@ lists all additional fields. ``ref`` means ``@alias``; ``ref?`` also accepts
* - ``oa_exchange_item``, ``sa_exchange_item``
- ``kind``: Information, Material, Energy; ``mechanism``: ExchangeMechanism; ``supertype``: item ref?
- Information; Unspecified; none
+ * - ``oa_exchange_category``, ``sa_exchange_category``
+ - ``family``: Work or Participant; ``exchanges``: same-layer exchange refs
+ - Work; ``[]``; root-level only
* - ``oa_data_type``, ``sa_data_type``
- ``definition``: DataTypeDefinition; ``default``: DataValue?; ``unit``: string
- String with minimum_length 0 / maximum_length none; none; ``""``
@@ -223,7 +226,9 @@ The present Studio profile does not decompose SA Actors.
All relations have a header identity, alias, display name, optional
``description`` (default ``""``), and required ``source`` and ``target``
-references. Their kind is the declaration keyword:
+endpoints. Ordinary endpoints are semantic references; ContextualLink endpoints
+are qualified OccurrenceEndpoint records resolved from its required ``owner``.
+Their kind is the declaration keyword:
.. list-table:: Relation catalog
:header-rows: 1
@@ -286,6 +291,9 @@ references. Their kind is the declaration keyword:
* - ``sequence_link``
- Preceding contribution → following contribution in one process/chain
- ``guard`` string / ""
+ * - ``contextual_link``
+ - Qualified occurrence endpoints resolved from an explicit owner Process/FunctionalChain; section 4.2.1
+ - Required ``owner``, ``source`` and ``target`` OccurrenceEndpoint records, and typed ``purpose``: Precedence, Exchange or CommonWork
* - ``state_transition``
- State vertices in one machine, subject to section 4.4
- ``trigger``, ``guard``, ``effect`` strings / ""; ``transition_kind`` External; ``triggers``, ``effects`` reference lists / []
@@ -1190,7 +1198,7 @@ are invalid.
* - Mission
- Operational Mission → System Mission
* - Exchange
- - Interaction relation → FunctionalExchange relation
+ - Interaction → FunctionalExchange, or CommunicationMean → BoundaryExchange
* - Sequence
- Process → FunctionalChain, or paired occurrence contributions directly owned by Process / FunctionalChain
* - Item
diff --git a/docs/scope.md b/docs/scope.md
index 7dc13be6..d5dcf3a4 100644
--- a/docs/scope.md
+++ b/docs/scope.md
@@ -13,7 +13,7 @@ Arcadia Studio implements a systems-engineering workbench spanning Operational A
| States and conditions | Participant-owned state machines, nested regions, states/modes and typed pseudostates, signal/time/change events, trigger/guard/effect transitions, linked entry/do/exit work, availability and constraints |
| Perspectives and evidence | Bidirectional counterpart creation/linking, reviewed descriptive and typed semantic changes, explicit ordered collections and combined multi-source review, many-to-many typed/manual traces, arbitrary artifact URI/revision/fragment references |
| Views and editing | Independent and duplicated diagrams, decomposition/allocation nesting, collapse, pan/zoom/Fit/Arrange, editable connection routes and labels, four-side port positioning, direct interaction/communication/functional/boundary exchange tools, named exchange categories, saved line-kind/category/coverage/context/hide/label settings, contextual menus, SVG export, model explorer and typed properties |
-| Text and storage | `arcadia 6` source projects with relative includes and nested declarations, stable aliases/UUIDs, a source-file tree, per-file drafts and diagnostics, comment-preserving graphical updates, exact model/source Undo/Redo, legacy migration, per-file atomic replacement with interrupted source-save recovery, Home/recents and private unsaved-work checkpoints |
+| Text and storage | `arcadia 7` source projects with relative includes and nested declarations, stable aliases/UUIDs, a source-file tree, per-file drafts and diagnostics, comment-preserving graphical updates, exact model/source Undo/Redo, legacy migration, per-file atomic replacement with interrupted source-save recovery, Home/recents and private unsaved-work checkpoints |
| Automation and hosted editing | Rust REST service for project/source-bundle/query/validation/transaction/transition/artifact workflows; optional desktop catalog/open/publish, explicit conditional Save, server review and local Save as; ETag preconditions, bounded requests and atomic current-revision storage |
Graphical and textual parity applies to the persistent fields of this profile. Diagram placements are model data; camera, selection, source cursor and undo history are session state. Canvas gestures need not match textual operations one for one: typed inspectors and explicit commands expose precise semantics. Full source replacement must repair dependencies in its candidate, while graphical delete/reidentify commands maintain references automatically.
diff --git a/harness/DECISIONS.md b/harness/DECISIONS.md
index f45f7821..7859f950 100644
--- a/harness/DECISIONS.md
+++ b/harness/DECISIONS.md
@@ -211,6 +211,57 @@ Decision: retain same-layer admission for ordinary diagrams, but allow both-laye
Alternatives rejected: filtering every view by its labelled layer loses existing Traceability content; ignoring layer validation everywhere hides mistaken references; serializing temporary GUI filters breaks source/API parity. Revisit if native workflows or cross-layer regression evidence exposes ambiguity. Current implementation is pending integrated tests and native acceptance, not an established release result.
+## Continuous behavior authoring — 2026-09-10
+
+Problem: adding the first Exchange to an empty process changed its interactive
+Graph into an ordered sequence Scene without gesture tools. Scenario non-message
+creation discarded the visible operand and insertion point, defaulting to root
+append. These are verified source paths; new-binary native acceptance is pending.
+
+Select one interactive process renderer. Project legacy ordered adjacency as
+endpoint pairs without fabricated semantic relation IDs. Loading and selecting
+remain read-only. The first topology mutation uses the existing validated batch
+to materialize unaffected adjacency and splice the chosen insertion atomically.
+Reject the alternative of a special 0/1-element renderer exception, which would
+reintroduce the discontinuity at a later element count; also reject automatic
+load-time migration and artificial self-links. Core legacy/explicit semantics
+and the source version are unchanged. Revisit if actual imported-path editing
+cannot preserve ordering, rejection and exact source/Undo behavior.
+
+Scenario Action, State, Reuse and empty Fragment creation capture the clicked
+owner, operand, before-occurrence and optional lifeline before starting the
+existing typed draft. Keep current validation, recovery and atomic history.
+Fragment range wrapping and cross-operand movement require separate explicit
+transactions. Do not infer persisted lifeline geometry from a click: the current
+model does not store horizontal lifeline order. Reused-scenario navigation uses
+bounded transient caller/use context, never an extra model history entry.
+
+Evidence and acceptance: `release-behavior-audit-20260910.md`, Gitea #1, new
+production-pointer regression paths and independent source reviews. Compilation,
+automated execution and native validation are still pending at this decision.
+
+## Typed stored observations — 2026-09-10
+
+Problem: generic trace-baseline Add inserted a UUID string into the closed
+FacetReview list, producing an invalid draft. Hiding Add and routing only to
+current review/reset cannot fulfill the normative contract: historical values
+and references may be valid even when their live definitions no longer exist.
+
+Select an explicit advanced typed history editor over the existing OpenAPI
+TraceBaseline/FacetReview descriptors. They provide the finite shape catalog
+already required for REST parity; final authority remains core typed decoding,
+historical admission and one EditTrace through Document. Preserve invalid raw
+drafts, exact historical UUID text, optional/Observed alternatives and explicit
+constructor selection. Current observations may be copied only by a deliberate
+action. Cache the descriptor and bound recursive rendering; unsupported shapes
+must fail visibly instead of generating an invalid default.
+
+Reject a separate handwritten GUI metamodel or a new duplicate core type-shape
+catalog, and reject raw JSON as the sole graphical editing surface. Revisit if
+descriptor/core consistency or native usability cannot be verified. This choice
+is under implementation; it does not yet close the parity finding in
+`release-end-state-audit-20260910.md`.
+
## Basic canvas authoring — 2026-09-07
The user rejected the large horizontal creation row. Actual installed Capella 7.1
diff --git a/harness/PLAN.md b/harness/PLAN.md
index d46bb43b..183f27dd 100644
--- a/harness/PLAN.md
+++ b/harness/PLAN.md
@@ -1,5 +1,22 @@
# First release execution plan
+## Active execution — 2026-09-10
+
+1. Restore a reproducible local toolchain; repair the interrupted compact palette;
+ verify focused history/draft/placement regressions and the actual native workflow.
+2. Independently reassess current behavior/scenario ergonomics and OA/SA semantic,
+ source/API and documentation completeness. Resolve verified high-impact gaps
+ with bounded changes and cross-representation acceptance criteria.
+3. Complete realistic graphical OA/SA teaching, transition, behavior, recovery and
+ hosted workflows. Exercise minimum and wide layouts, rejected edits and history.
+4. Run current Windows/Linux automated and native acceptance, fresh independent
+ end-state reviews, optimized builds and package verification. Publish accurate
+ build/run evidence and handoff only when the original release criteria hold.
+
+This ordering supersedes historical stopped-session next actions below. Preserve
+their scoped evidence; no test or runtime result transfers to a new binary without
+verification. Root holds the serialized build/native lease; Gitea #1 tracks workers.
+
**Latest refinement:** consult actual installed Capella 7.1, replace the user-rejected horizontal creation/connection rows with a compact contextual palette and inline authoring, independently critique interaction risks, then build and verify the real workflow at wide/minimum sizes. [Benchmark and concrete acceptance](release-capella-basic-editing-20260907.md). Do not ship the rejected toolbar as the usability correction.
**Current priority (7 September):** the user's usability correction takes precedence over the advanced feature sequence below. Establish contextual named diagram creation, existing-element placement, basic editing and clear layer transitions, then verify them natively. Desktop checks were explicitly reauthorized. See [priority reset and acceptance](release-basic-editing-reset-20260907.md).
diff --git a/harness/STATE.md b/harness/STATE.md
index b92805a1..ac689e82 100644
--- a/harness/STATE.md
+++ b/harness/STATE.md
@@ -1,5 +1,85 @@
# Progress Ledger — first release
+## Active continuation — 2026-09-10
+
+The renewed user request is preserved in `PROJECT_GOAL.md`. Root is integrating
+the first release, prioritizing direct diagram authoring and behavior/scenario
+usability. The checkout began clean at `1797516` on `codex/release1-continuation`.
+Gitea issue #1 and Wiki Home were read; ownership and progress are coordinated there.
+
+- Root owns integration, serialized builds, native Computer Use and these ledgers.
+ `palette_repair` owns architecture authoring and `diagram.rs`; `behavior_audit`
+ and `release_audit` independently inspect ergonomics and release coverage.
+- The recorded palette compilation errors have local corrections pending a fresh
+ build. Earlier 584-test evidence does not cover those corrections.
+- This checkout began without the historical `.local` toolchain/cache/packages.
+ Project-local Rust/Cargo 1.98.1 GNU/LLVM and verified LLVM-MinGW 20260908
+ (clang 23.1.1) are installed. Locked dependencies are being fetched.
+ Host: four logical processors, 8 GiB RAM; builds remain serialized.
+- Computer Use initialized successfully. The renewed request authorizes native
+ evaluation; old session Escape holds and process IDs are historical. No Arcadia
+ or Capella window is currently running.
+- WSL lists no installed distribution. Linux runtime/build acceptance remains an
+ open gate; no historical denied guest workaround is being retried.
+
+**Current branch is `codex/behavior-authoring-20260910`.** A distinct Gitea user
+`Codex-9e8r6t` is running another root/team on a separate environment with the old
+build cache. Our identity is **Codex-956atf**. Gitea #25 and #38 acknowledge the
+scope split: their palette/platform/package and subsequent scenario layout work;
+our process/scenario adapters and typed-history work. We will publish a clearly
+untested coherent snapshot on this distinct branch for their warm-cache checks.
+No shared branch-tip push or merge has occurred here.
+Their reports/results must not be claimed as local validation or overwritten.
+
+Implemented locally, awaiting compilation:
+
+- Palette compile repair, retained inline name after rejected stale Submit,
+ nonfinite click rejection and rename/allocation/history regressions.
+- One interactive process renderer with presentation-only inferred ordered
+ paths; first editing batch preserves adjacency atomically. Independent source
+ review found no confirmed defect. Root added 3+ step/before-first insertion
+ and incompatible imported conversion tests after the reviewer hit model capacity.
+- Scenario Action/State/Reuse/empty Fragment tools capture clicked operand/slot
+ and optional lifeline. Pointer-to-App, recovery, stale-event and history tests
+ are written. A bounded exact caller/use return path and scoped mounted-scroll
+ restoration are implemented with regressions, also untested.
+- Advanced typed stored-history editor uses existing OpenAPI type descriptors;
+ ten focused tests cover typed selectors, historical IDs, invalid raw input,
+ recovery and source/history. Core validation remains authoritative.
+- Normative catalogs now include ExchangeCategory, ContextualLink and both
+ Exchange trace pairs. Manual trace help and scope source version corrected;
+ strict Docutils 0.22.2 HTML regeneration passed.
+
+Reference evidence: actual Capella 7.1 scenario/lifeline/LOOP creation and saved
+XML are recorded in `release-capella-scenario-benchmark-20260910.md`; the isolated
+Capella process closed normally and is absent. This is not Studio acceptance.
+
+Toolchain bootstrap exec session **20812** completed successfully: verified
+LLVM-MinGW 20260908 ZIP SHA256
+`1bcf74d06b724aeecaa6412ca85f5b26fb1da770e7cdcefa9263c9c5c3ad34b6`, extracted
+successfully; stable **1.98.1** GNU/LLVM, rustfmt and Clippy installed.
+`.local/toolchain/env.ps1` configures task-local Cargo/Rustup/PATH and one build
+job. Locked dependency fetch is local exec session **13108**. No build/test pass
+is established; the target cache is still cold.
+
+The coherent candidate passed `cargo fmt --all` and `git diff --check`. It is
+published as an **UNTESTED integration snapshot** so the other host can use its
+warm build cache; publication is not acceptance. Their broader architecture
+palette/Escape repair should be reconciled with our overlapping compile/stale
+repairs while retaining the additional invariant tests. Their measured minimum
+scenario canvas is too small; they own the subsequent layout implementation.
+
+Next: focused `architecture_authoring_tests`,
+`behavior::topology`, `direct_clicked`, caller-navigation and `history_fields::tests`,
+then full relevant gates and a fresh native binary. Root owns all Cargo on this
+host. Worker output or tests existing in source are not passes.
+
+Gitea Actions run16 is queued for both ubuntu-latest and windows-latest with no
+started steps, as are older listed runs. No usable current Linux runner result
+is established and no duplicate dispatch was made. Progress is concrete;
+release acceptance remains incomplete. Older checkpoint paragraphs below retain
+their original revision scope.
+
**Checkpoint publication — 2026-09-10:** the user requested committing all current changes and pushing `codex/release1-continuation` to both `origin` and `gitea`. This is a work-in-progress snapshot. The interrupted palette-focused compilation failed with E0659 (ambiguous `column!` in `app/architecture_authoring/palette.rs:168`) and E0507 (moving the view out of an Arc in `diagram.rs:624`); an unnecessary-pattern-parentheses warning also remains in `architecture_authoring.rs:346`. The prior 584-test pass does not cover this newer palette revision. No Cargo/rustc process or local subagent was active at the publication preflight. Fix these errors and complete automated/native acceptance before packaging the redesign. Gitea coordination starts at issue #1 and the project Wiki; older evidence below retains its original scope.
**Latest priority checkpoint — Capella consultation and redesign:** the user rejected the large creation buttons and explicitly requested consulting the installed Capella. Native control resumed for that consultation in a disposable Capella 7.1 workspace. Actual palette, F2 rename and activity allocation were exercised; saved XML confirms allocation distinct from ownership. The horizontal creation/connection rows are being replaced with a compact expandable palette and inline naming. This supersedes the Escape hold and toolbar-fix proposal below. New implementation, native acceptance and a fresh user build remain pending. [Observed benchmark, alternatives and acceptance criteria](release-capella-basic-editing-20260907.md). The first-release goal remains active.
diff --git a/harness/TASK_LEDGER.md b/harness/TASK_LEDGER.md
index 4cfa5f45..d6080c95 100644
--- a/harness/TASK_LEDGER.md
+++ b/harness/TASK_LEDGER.md
@@ -1,5 +1,33 @@
# Task Ledger — first release
+## Current knowledge — 2026-09-10
+
+Given: the renewed objective in `PROJECT_GOAL.md` requires a feature-complete,
+usable OA/SA first release and prioritizes direct behavior/scenario authoring.
+Graphical/source/REST parity, explicit reST semantics, traceability, offline
+guidance, Windows/Linux acceptance and independent review remain required.
+Older scope deferrals must be checked against this request.
+
+Verified: the checkout began clean at `1797516`; Gitea contains one active
+continuation issue and no open PR. Current code includes direct behavior editors,
+so old blanket descriptions of static diagrams need workflow-level reassessment.
+The machine began without the ignored historical toolchain/cache/distributions.
+Local Rust/Cargo 1.98.1 and verified LLVM-MinGW are now installed; dependency
+fetch is pending and no current binary has been built. Native Computer Use is
+available. Isolated Capella activity/lifeline/LOOP creation was saved and checked;
+no Arcadia window is running. Candidate B1/B2/B3 and F1 edits are source-complete,
+formatted and whitespace-clean, but have no fresh compile/test/runtime pass.
+
+Assumption: the selected compact architecture palette remains a promising design,
+pending real authoring evidence. Decision: repair and evaluate it before further
+redesign. Parallel independent audits identify current behavior and semantic gaps
+instead of reimplementing integrated work.
+
+Open questions: which remaining menu-only behavior operations prevent a coherent
+direct workflow; which first-release semantic/parity gaps remain; and how to
+complete current Linux runtime acceptance. Root owns integration and native
+control; worker ownership is disjoint. See `STATE.md` and Gitea #1.
+
**Superseding user direction:** large horizontal creation buttons were rejected as intrusive and unprofessional. The user explicitly authorized consulting the installed Capella; that consultation has resumed and established actual compact palette, inline rename and explicit activity-allocation behavior. See [Capella 7.1 evidence and selected redesign](release-capella-basic-editing-20260907.md). The current candidate replaces creation/connection rows with one compact expandable palette and an in-place name editor. Native acceptance of the redesigned executable is pending; compactness is not assumed to prove usability. The earlier Escape hold and proposed toolbar-only correction below are superseded.
**Latest evidence:** basic editing full desktop584/584, bins, formatting and strictClippy passed. Native named Entity creation works at100%, but changing pending-toolbar height moves the screen placement22px. User Escape stopped the attempted Undo; native checks are paused again. Code-only toolbar correction proceeds. [Current findings](release-basic-editing-reset-20260907.md). The previous goal turn made concrete progress through implementation, integration gates and a native-discovered defect; this is not a no-progress blocker turn.
diff --git a/harness/release-behavior-audit-20260910.md b/harness/release-behavior-audit-20260910.md
new file mode 100644
index 00000000..27d59ddb
--- /dev/null
+++ b/harness/release-behavior-audit-20260910.md
@@ -0,0 +1,280 @@
+# Behavior authoring audit — 2026-09-10
+
+Author: Codex-956atf `/root/behavior_audit`. Initial bounded read-only source and
+domain review, followed by root's separately assigned B2 implementation below.
+The audit locations/findings describe the pre-edit snapshot. No Cargo,
+application input, or new runtime acceptance was performed. Read repository
+AGENTS.md, Gitea issue #1 and
+its comments, Wiki Home, and open PR inventory (none). Coordination is in issue
+#1. Source was inspected in the shared continuation checkout while other workers
+handled architecture authoring/builds; HEAD at the final inspection was
+`1797516f460ce27f7bc92e50ea2478ec51dd49b9`.
+
+The current implementation is substantially beyond static behavior diagrams.
+The remaining high-value work is making direct authoring consistent across the
+first process contribution and the non-message scenario tools. Historical
+absence claims in the early semantics audit are superseded by source7 code and
+its scoped evidence.
+
+## Ordered findings
+
+### B1 — A first exchange switches a new process into a less editable surface
+
+**High workflow impact; source-confirmed, fresh native reproduction required.**
+
+An empty Process/FunctionalChain opens the editable topology Graph. Draw its
+first Exchange contribution and it becomes a nonempty exchange-only ordered
+path. `uses_explicit_topology` now returns false, so the view changes to a
+sequence Scene without topology interaction. Tools for drawing contributions,
+connecting, reconnecting, zooming and reordering disappear. A one-contribution
+path has no link to convert, so the user must use Append exchange or separate
+Add work/control/reuse form buttons to return to the graph. Existing multi-step
+ordered paths likewise require the conversion/menu route.
+
+Evidence: `behavior.rs:753` defines the inferred legacy/explicit distinction;
+`behavior/topology/view.rs:89` selects the explicit surface, `:380` begins the
+legacy branch, and `:421` builds `Scene::sequence` without an interaction
+context. `behavior.rs:887` initializes `interaction: None`.
+`app/process_canvas.rs:316` already tests first/second exchange creation and
+exact history, but that test does not assert a continuous editable surface.
+
+**Reproduce:** Create an empty OA process (repeat in SA), choose Exchange and
+click the canvas, select an existing exchange and Create. Try to draw a Work
+contribution or connect from the newly created contribution without entering a
+different workflow. Repeat with an old ordered exchange-only process.
+
+**Bounded next fix:** retain one interactive process surface for empty, single
+and legacy ordered paths. Preserve the legacy implied order; when a pointer
+mutation needs explicit links, include the existing `preserved_order` proposal
+in that same atomic command. Do not invent a self-link merely to force the view
+predicate, and do not migrate a document merely by opening it.
+
+**Acceptance:** first and subsequent contributions remain directly editable;
+opening/selecting remains read-only; OA and SA preserve all old exchange IDs
+and implied order; insertion/connection uses one exact source/model Undo step;
+redo and save/reopen retain the result. Verify the actual viewport and visible
+tools at 1100×700 and a normal desktop size.
+
+### B2 — Most scenario objects still require detached append forms
+
+**High workflow impact; source-confirmed, fresh native evaluation required.**
+
+Scenario canvas tools are only Select and Message. Lifeline, reuse, fragment,
+action and state-observation buttons directly start a form. Every such Start
+sets the parent to the main scenario and the insertion position to append,
+even when an operand is selected. Consequently adding an action at a visible
+operand position or inserting a reference/fragment between existing messages
+requires manually choosing an operand, creating at its end, then reordering.
+Fragments cannot be drawn around a visible sequence range. The semantics and
+generic property editing exist; the missing part is contextual canvas authoring.
+
+Evidence: `behavior/scenario.rs:69` (`CanvasTool`), `:327` (Start initializer),
+`:1436` (form-launch controls), `:1565` (manual destination), `:1777` (fragment
+form). `behavior.rs:1564` handles only message drawing and selected-occurrence
+reordering. Reordering deliberately refuses operand changes at
+`behavior/scenario.rs:636`; this invariant should remain explicit.
+
+The scenario shell also retains three permanent control rows, an outer page
+scroll and a separately scrolled canvas; pending forms add another scroller.
+The canvas is capped at 340 px normally and 190 px while pending (`:1535`),
+unlike the newer process remaining-height layout. This is a source-established
+space allocation; clipping or interaction failure on the current binary is
+not claimed without native observation.
+
+**Reproduce:** In the teaching scenario select an ALT operand and a middle
+message. Add Action or Reuse. The form says Main scenario sequence / append,
+rather than retaining the selected operand and visible insertion point. Try
+the same task by selecting a tool and clicking the intended canvas position.
+
+**Bounded next fix:** extend the existing scenario gesture/Slot adapter for
+Action, State, Reuse and Fragment; capture the exact owner, operand, before-ID
+and optional lifeline before opening its compact contextual editor. Reuse the
+existing core commands, validation, draft recovery and atomic history. Give
+scenario controls the compact, stable remaining-height shell used by processes.
+Range wrapping and cross-operand movement need a distinct explicit transaction;
+they should not be silently smuggled into ordinary reorder.
+
+**Acceptance:** create each supported non-message occurrence at the clicked
+root/operand slot; select its semantic identity afterwards; Escape, scroll,
+resize, document change and rejected Apply cannot commit a stale slot; invalid
+draft text survives repair/recovery; Undo/Redo restore complete source bundles.
+Native users must complete an ALT + action + reuse task at 1100×700 without
+losing the target region or searching for offscreen submission controls.
+
+### B3 — Opening a reused scenario does not retain an explicit caller return
+
+**Medium workflow impact; source-confirmed.**
+
+Scenario references have real identity and bindings, and an Open action works.
+However it is placed in the full sequence listing below the canvas and sends
+only `Message::Select(target)`. Selection replaces the active scenario. There
+is no scenario caller stack/Back action to restore the particular use and its
+viewport, unlike process reference navigation. The Connections inspector can
+find users manually; that does not preserve which of several callers was open.
+
+Evidence: `behavior/scenario.rs:1841` / `:1893` (listing/Open),
+`app.rs:961` / `:982` (selection changes active behavior),
+`behavior/scenario.rs:155` (State has no return context). Compare existing
+`behavior/topology/direct.rs:191` (remember/back) and
+`app/process_canvas.rs:161` / `:183` (guarded Open/Back).
+
+**Reproduce:** Open caller A containing two uses of the same scenario, select
+its second use in the canvas, open the definition through the listing, then
+return to that exact use and viewport. The user must reconstruct the return
+through owner selection/Connections.
+
+**Bounded next fix:** selected-reference Open and Back to caller controls with
+document/owner/use identity and viewport context, using the same draft guards
+as process navigation. This is transient navigation state, not model history.
+
+**Acceptance:** A→B→C and two uses of B return in order to the exact initiating
+use; renamed/deleted callers are handled safely; pending invalid edits block
+navigation without loss; no model/source/Undo entry is added by navigation.
+
+### B4 — Create/Delete message semantics are not reflected in lifeline geometry
+
+**Medium visual-semantic impact; source-confirmed.**
+
+The core validates creation/destruction ordering, and message names distinguish
+Create and Delete. The renderer nevertheless draws every lifeline from its
+top header to the bottom of the whole scenario; lifecycle kinds only affect
+the message label. There is no birth anchor or destruction mark, so a reader
+sees the same apparent existence interval for an ordinary participant and one
+that is explicitly created and destroyed during the interaction.
+
+Evidence: `behavior.rs:1016` always builds the full-height lifeline;
+`:1165` selects only a textual message-kind prefix. Core lifecycle coverage is
+in `oa-core/tests/release_scenarios.rs:459` and its loop/branch variants. This
+finding is about visualization, not missing core lifecycle validation.
+
+**Reproduce:** Use a valid root sequence with Create(B), a call/reply involving
+B, and Delete(B). Inspect B before Create and after Delete; its lifeline still
+runs through both regions.
+
+**Bounded next fix:** derive birth/death anchors and a destruction glyph from
+the existing occurrence identities. Handle branch-local lifetime explicitly;
+an event in one ALT operand must not falsely terminate all other alternatives.
+No persistent execution engine is needed.
+
+**Acceptance:** root-sequence Create/Delete, ordinary lifelong participants,
+ALT-specific events and LOOP lifecycle warnings are distinguishable; hit tests
+still return the actual occurrence; direct insertion continues to reject invalid
+before-birth/after-death uses through the shared core boundary.
+
+## Semantics and history findings that must not be reported as missing
+
+- Scenario occurrences and referenced engineering definitions are distinct;
+ repeated exchange uses have distinct names/IDs. Direct Call+Reply creates
+ correlated occurrences in one transaction. Execution bars are derived from
+ correlation and operand boundaries (`behavior.rs:1304`), not persisted proof
+ of simulated execution. `scenario.rs:1026` and direct tests cover the adapter;
+ the earlier scoped native results are in `release-scenario-editing.md`.
+- Source7 already provides caller-qualified process addresses, distinct repeated
+ reference uses, precedence versus exchange/common-work incidence, and explicit
+ interface-operation allocation identity. See `oa-core/src/model.rs:534`,
+ `behavior/topology/contextual.rs`, `scenario_operation_tests.rs`, and
+ `release-source7-native-acceptance-20260907.md`. The original S1/S2 absence
+ findings are stale. Remaining purpose/native cases are acceptance work.
+- Shallow/deep history vertices, scope validation, creation tools and documented
+ semantics already exist (`oa-core/src/state_validation.rs:187`,
+ `oa-core/tests/release_states.rs:466`, `behavior/state_view.rs:111`,
+ `docs/language.rst:860`). Shallow history restores the immediate substate;
+ deep history restores nested configuration. Studio explicitly uses history
+ per Region and does not persist running execution state. The primary Capella
+ metamodel describes the corresponding containing-state behavior; this is a
+ documented profile distinction, not grounds to require a simulator.
+ [CapellaCommon schema](https://raw.githubusercontent.com/eclipse-capella/capella/master/m2/plugins/org.polarsys.capella.core.data.def/model/CapellaCommon.ecore).
+- Capella has distinct start/finish duration constraints and execution objects.
+ Studio's local timer is not an equivalent named duration relation. It does
+ have maintained generic constraints over semantic IDs. This audit did not
+ falsify that alternative for a required user workflow, so it does not reopen
+ a metamodel expansion already assessed in `release-scope-reconciliation-20260906.md`.
+ [Capella Interaction schema](https://raw.githubusercontent.com/eclipse-capella/capella/master/m2/plugins/org.polarsys.capella.core.data.def/model/Interaction.ecore).
+
+## Comparison and next action
+
+The existing native Capella benchmark actually exercised palette→canvas chain
+reference/control/sequence-link creation, a scenario reference region and Open,
+and call/return insertion reusing an existing exchange. It separates observed
+controls from executed actions (`release-capella-workflow-benchmark.md:51–69`).
+These support B1–B3 as engineering-workflow comparisons rather than a demand to
+copy the Eclipse UI. Capella's official overview independently distinguishes
+functional, exchange and interface scenario perspectives, all now represented
+by Studio's typed scenario viewpoints.
+[Official feature overview](https://mbse-capella.org/features.html).
+
+Prioritize B1 and the bounded slot-based part of B2; native-check those exact
+first-use tasks after root's current compilation/runtime gates. B3 is a small
+navigation follow-up. B4 should receive branch-aware visual acceptance. None
+of this report certifies current Windows/Linux behavior or transfers historical
+test/native evidence to a changed executable.
+
+## Authorized B2 implementation follow-up
+
+Root subsequently assigned `behavior.rs`, `behavior/scenario.rs` and only the
+ScenarioCanvas event arm in `app.rs`; Gitea #18 records this ownership under
+Codex-956atf. The separate topology worker owns B1. Current changes:
+
+- A compact selector replaces the three permanent scenario tool rows. Action,
+ Observe state, Reuse and empty Fragment use the same choose-tool/click-position
+ workflow as messages; lifeline creation remains explicit because persistent
+ horizontal placement is outside the existing schema.
+- Press captures the exact root/operand/before identity and an optional clicked
+ lifeline for Action/State. Release opens the existing draft; no model mutation
+ occurs until Create. The selected position remains marked in the pending
+ canvas. Clicking away from a lifeline leaves it unresolved for explicit choice.
+- Existing context, scroll/bounds, Escape and pending-edit guards apply to this
+ new press variant. The draft adapter validates slot and lifeline ownership
+ before starting. Existing command admission handles the complete semantics;
+ no separate model, schema, fragment wrapping or cross-operand reorder was added.
+- Added `direct_clicked` tests: real Scene callbacks through App for all four
+ tools, root and nested slots, on/off-lifeline clicks, exact full source/model
+ Undo/Redo; invalid/cross-scenario capture, all context dimensions, scroll
+ invalidation, incomplete raw-draft recovery/repair; all four tools against
+ nine pointer cancellation cases. These tests are written, not yet run.
+- Applied root's coordinated process-header predicate change so every
+ Process/FunctionalChain uses the compact header with the topology worker's
+ unified renderer. The semantic legacy/explicit predicate is unchanged.
+
+Whitespace verification passed for this worker's source changes. Another worker
+read the clicked-slot adapter and reported no confirmed blocker, while requesting
+the now-added off-lifeline/cancellation cases. Formatting/build/tests await root's
+toolchain and serialized Cargo lease. No native pass is claimed: test actual
+root/operand selection, current tool visibility, pending marker/viewport and
+Create/Cancel reachability at 1100×700 and normal size, including crash recovery,
+save/reopen and exact Undo/Redo. B2's larger remaining-height shell, fragment
+range wrapping and B4 lifecycle rendering are not part of this bounded
+implementation. B3 followed as the separately assigned slice below.
+
+## B3 implementation follow-up — candidate ready, execution pending
+
+The selected ScenarioUse exposes **Open definition**; the target scenario exposes
+**Back to caller**. Detailed sequence-list Open uses the same guarded adapter.
+Navigation retains document, caller scenario, exact use occurrence, target,
+selected tool and independent canvas/page offsets in at most 32 transient frames.
+Nested A → B → C and distinct uses of B return to their initiating occurrence.
+Renaming retains identity; deleted or repointed uses are rejected on return.
+Property, source and behavior drafts block both directions without applying them.
+
+The existing scroll observer restores only its matching document/scenario/token,
+directly in the mounted root Scrollable. It observes natural viewport clamping,
+consumes a request once and sends a correlated receipt to the App. It does not
+use a delayed global scroll task or traverse into nested scrollables. This adds
+one passive Restored variant beside the existing Scrolled early App handler; all
+other App changes remain in ScenarioCanvas. Caller navigation is neither model
+content nor recovery data and creates no model/source/history command.
+
+Added regressions cover nested and distinct-use App navigation, exact unchanged
+model/source/revision/history, invalid pending drafts, four stale context axes,
+non-use targets, renamed/deleted/repointed caller references, and real mounted
+Scrollable → App flow for both scroll areas including clamping, subsequent wheel
+input, repeated receipts and changed page. Foreign document/owner and process
+views reject restoration. These tests have not run yet; root will format and
+compile the coherent candidate before acceptance.
+
+Native acceptance remains: select a root or operand reference, Open definition,
+open a second reference there, return twice and inspect exact selected occurrence,
+tool and both scroll positions. Repeat from the detailed list with two uses of
+one target, a resized window and an invalid draft. Verify no dirty/history change
+from navigation. The separate remaining-height layout slice must retain these
+events and observer restoration when moving the scenario workspace.
diff --git a/harness/release-capella-scenario-benchmark-20260910.md b/harness/release-capella-scenario-benchmark-20260910.md
new file mode 100644
index 00000000..bffe0870
--- /dev/null
+++ b/harness/release-capella-scenario-benchmark-20260910.md
@@ -0,0 +1,44 @@
+# Native Capella scenario benchmark — 2026-09-10
+
+Codex-956atf /root used the installed Capella 7.1 executable through Computer
+Use in an isolated `.local/capella-reference-20260910` workspace. The generated
+project is `Behavior workflow benchmark`; no existing user model was opened.
+This evaluates reference-product behavior, not the current Studio binary.
+
+At the observed 1010×760 window size:
+
+- Operational Analysis → Define Operational Activities and describe Interactions
+ exposes creation of activity breakdown, interaction and activity-scenario views.
+ The scenario workflow created `[OAS] Response workflow` and its capability.
+- The right scenario palette exposes Activity, Activities, Interaction,
+ Interaction with return branch, Reference, LOOP and Operand. Activity is a
+ direct point-placement tool: clicking the canvas created a represented activity
+ and a lifeline. The lifeline is a separate InstanceRole, not the work definition.
+- Selecting LOOP and dragging a region across the lifeline created a visible
+ combined fragment. Its tooltip explains the repeated scenario part and covered
+ lifelines. The actual drag created one operand and explicit start/end records.
+- Selecting the new object expanded formatting/context controls and moved the
+ canvas vertically. Preserve direct interaction and coverage meaning in Studio
+ without copying this unstable canvas origin or the clipped palette labels.
+
+Ctrl+S saved the model, and the saved XML independently confirms:
+
+| Record | Identity / relationship |
+|---|---|
+| Activity | `04b58488-e33b-4693-ae8d-6f830cbc0cf3` |
+| Scenario | `49f702e0-1e0d-45c2-a0e8-e40545ce5b6c`, kind INTERACTION |
+| InstanceRole | `29115069-194d-4c1a-ac2c-ee86486a04fb`, represents the Activity |
+| LOOP | `1b4a102e-4c20-4e92-bd4f-71e6b677d2fa` |
+| Operand | `ac05a0af-60d1-48f2-9548-17214d3ebdc1`, covers the InstanceRole |
+| Fragment interval | start `8d988d2b-c191-46b2-8c92-1ff1e62251cb`, end `a8c26302-a5bb-49c0-8e7c-d2fe8026fe1a` |
+
+These observations support scenario tool/point authoring and explicit occurrence
+versus definition identity. They do not demonstrate wrapping existing messages,
+cross-operand movement, lifecycle drawing or successful scenario reuse; those
+operations were not exercised. Studio's current clicked-slot improvement creates
+an empty typed fragment using its existing occurrence/branch model. Persisted
+horizontal lifeline arrangement and drag-range wrapping need separate design and
+acceptance if adopted; this benchmark does not silently introduce either.
+
+After saving, Alt+F4 requested a clean Capella close. Root checks process absence
+before reclaiming memory for compilation; no forced termination was used.
diff --git a/harness/release-end-state-audit-20260910.md b/harness/release-end-state-audit-20260910.md
new file mode 100644
index 00000000..e5250da1
--- /dev/null
+++ b/harness/release-end-state-audit-20260910.md
@@ -0,0 +1,88 @@
+# Independent release end-state audit — 2026-09-10
+
+Reviewer: **Codex /root/release_audit**. Base HEAD `1797516f460ce27f7bc92e50ea2478ec51dd49b9`; concurrent palette/integration work is excluded from acceptance. Read PROJECT_GOAL.md, the supplied request, AGENTS.md, Gitea issue #1/comments, Wiki Home and the empty open-PR inventory before auditing. Coordination is recorded in issue #1.
+
+**Verdict: first-release completion is not supported yet.** Current source supplies substantial OA/SA semantics and shared source/GUI/REST infrastructure. The earlier missing communication means, selective views, coverage diagnostics, contextual assembly and operation identity are implemented; historical absence findings must not be repeated as current defects. A concrete trace-inspector defect remains below, and current native/platform/package acceptance is still incomplete.
+
+This was read-only implementation/specification inspection. No Cargo, native automation, deployment or runtime test ran. Test names below identify evaluators that exist, not fresh passing results. Root owns current builds/runtime and the separate behavior audit owns process/scenario ergonomics.
+
+## Requirements matrix
+
+| User outcome | Current source evidence | Acceptance assessment |
+|---|---|---|
+| Rust/Iced desktop on Windows and Linux | Three Rust crates; desktop Cargo.toml selects Iced 0.14, WGPU, X11 and Wayland. README gives native build paths. | Implemented architecture; current Windows palette rebuild/native acceptance and current Linux runtime remain gates. An ELF cross-build is not a Linux GUI trial. |
+| Useful OA and SA engineering semantics | model.rs has operational roles/activities/missions/processes, system boundary/functions/chains, typed data/interfaces/ports, states, scenarios, constraints and 25 relation kinds. validation.rs, ports.rs and data.rs enforce common rules. | No new fundamental absence established outside the separate behavior audit. Do not infer full Capella conformance. LA/PA and execution remain outside the user's current layer scope. |
+| Equivalent persistent graphical/text models | Project, validated Command boundary, source_project updater and desktop Document couple accepted source to the same model. forms.rs exposes typed records; dedicated workflows handle richer constructs. | Strong implementation coverage; **F1 exposes a broken typed-history inspector path**. `every_demo_record_has_a_lossless_graphical_draft` checks existing demo values, not every exposed constructor/add operation. |
+| Strict, unambiguous reST contract | docs/language.rst defines grammar, identity, invariants, lifecycle, migration and graphical obligations; docs/api.rst specifies REST. | Substantial contract; **F2 catalog inconsistencies** need correction. Source/header and package documentation should agree at final freeze. |
+| Human/AI/Git-friendly source with highlighting and lint | Modular includes, nested declarations, stable aliases/UUIDs, source-preserving updates and exact source history; highlight.rs adapts core tokenizer; source_workspace/source_navigation retain and locate drafts. | Implemented, with source7 source/lifecycle tests. No new text-loss counterexample found in this bounded audit. LSP, completion and semantic Git merge were not explicit requirements. |
+| Easy bidirectional OA/SA transition | transitions.rs maps dependencies/counterparts in either direction; semantic review supports scalar, constructor, keyed/ordered, attached and artifact decisions. Communication boundary ports and technical-operation omission are explicit. | Core/API paths and tests exist; actual complete engineering transition and revision/history workflows still require their remaining native cases. **F2 help wording misstates Manual-trace behavior.** |
+| Trace arbitrary development artifacts | ArtifactLink stores owner/relation/URI/revision/fragment; shared identity/reference maintenance, forms and searchable traceability inventory; server artifact/trace queries plus ordinary transactions. | Required reference model is present. No artifact fetching, executable adapter or plugin ABI is necessary to establish this requirement. Native final-tree evidence must include save/reopen and a cross-tool REST edit. |
+| Deployable service and clear REST for automation | routes.rs exposes project/model/source-bundle, lists/query/validation, commands, transitions and semantic review; store persists coupled representations with ETags. Dockerfile and systemd recipe exist. | Source7 HTTP test explicitly exercises instance/operation edits, parity and restart. Current Linux server suite and exact release build/deployment verification remain outstanding; recipes do not prove deployed execution. |
+| Intuitive nested diagrams and consistent editing | Distinct semantic ownership, allocation and placement; independent saved views, ports/routes, filters and duplication; current compact palette under repair. | Cannot accept from source. Root's native authoring evidence and separate behavior audit must cover selection, draft/cancel/history and wide/minimum size. |
+| Built-in concise navigable guide | guide.rs has searchable topics, related links, destination links and worked source7/transition/evidence material; bundled teaching source exists. | Implemented; guide still contains older control wording. Remaining complete teaching workflow and current control-label/native checks must close. |
+
+## Material findings
+
+### F1 — P2: the trace-history inspector offers an Add action that cannot create a valid fact
+
+The generic trace inspector recursively displays `baseline.semantic.facets`. Its array control always offers **+ Add** (`crates/oa-desktop/src/forms.rs:1916–1930`). `Message::FieldArray` forwards directly to `Draft::array` (`app.rs:1720`). `edit_array` has special constructors for bindings, values, routes, waypoints and port anchors, but none for facets: its fallback appends the nil UUID **string** (`forms.rs:622–650`). `SemanticBaseline.facets` instead requires `Vec` (`crates/oa-core/src/semantic/types.rs:258`), a closed typed enum. `Draft::command` deserializes the trace as-is (`forms.rs:600`). The generated draft therefore cannot become a valid EditTrace.
+
+Small reproduction for root's serialized test gate: select a trace with `baseline.semantic = Some(SemanticBaseline::default())`, call `Draft::from_project`, then `array("/baseline/semantic/facets", None, 0)` and `command()`. The Add produces a UUID rather than a facet; command must reject. Removing the bad row or reverting recovers the draft, so this is not an established stored-data corruption finding.
+
+The specialized semantic-review workflow can create reviewed current observations and reset exact history; that does not make this separate advertised Add control valid. Optional semantic history is also omitted when absent, so the ordinary inspector cannot initialize it through that path. The normative obligation explicitly includes typed trace baselines (`docs/language.rst:1959–1963`).
+
+**Next action:** choose one coherent history-editing surface. Replace the generic invalid constructors with an intentional typed workflow, or route the inspector to the existing review/reset tools while defining which history operations they support. Verify all displayed history controls against absent, empty and nonempty histories, including historical references whose live objects were deleted. Do not claim that a generic recursive form proves full constructor parity.
+
+### F2 — P2: the normative catalogs and guide give inconsistent transition information
+
+- `docs/language.rst:1192–1193` lists Exchange traces only as Interaction → FunctionalExchange, although its communication section (`:341`) and `transitions.rs::exchange_counterparts` admit CommunicationMean → BoundaryExchange. The reference table should describe both admitted pairs.
+- The same document's element catalog (`:94–145`) omits ExchangeCategory, and the relation catalog (`:232–303`) omits ContextualLink. Both have detailed definitions later, so their semantics are implemented/documented rather than absent; the purported catalogs are incomplete entry points for an independent implementation.
+- `guide.rs:658` says a Manual trace records correspondence “without propagating properties.” Existing-counterpart transition logic finds any endpoint-matching trace and applies reviewed name/description changes without a Manual-kind exemption (`transitions.rs:1055–1153`). Explicit Capability ↔ Mission Manual mappings are deliberately supported (`language.rst:1218`). Clarify that ordinary edits never synchronize automatically, while an explicit supported review can propagate selected properties; do not imply Manual is a no-update policy.
+- `docs/scope.md:16` still labels the implemented source profile `arcadia 6`; core/schema and the normative contract are version 7. README also retains older review labels and pending claims that newer scoped STATE evidence supersedes. Existing guide Activity/Function steps (`guide.rs:265`) describe the older Create-toolbar workflow while palette work is actively changing that surface.
+
+**Next action:** synchronize the tables, scope and task instructions against the accepted controls; regenerate the checked-in HTML from corrected reST and rerun the existing strict documentation/OpenAPI checks. Do not change transition semantics merely to match stale wording.
+
+### F3 — P1 release gate: current platform, deployment and full-workflow evidence is incomplete
+
+`harness/STATE.md` explicitly records a frozen Linux GUI cross-build with no actual Linux GUI runtime (`:57`), an earlier Linux server HTTP 50/51 result with a subsequently corrected evaluator (`:44`), and pending native purpose/teaching/hosted/compact cases. The Windows development preview (`:46`) predates current palette changes and is not the optimized final release. README correctly calls final suites, optimized/MSRV builds and current packages outstanding (`:156`). Root's new checks may supersede particular rows after this audit.
+
+This is missing release evidence, not proof that Linux, REST or the implemented workflows are broken. It still prevents meeting the user's explicit build/launch, real-workflow, current-platform and final-review criteria. The Docker builder pins Rust 1.90 while normal rust-toolchain.toml selects stable; final compatibility must be checked against the actual locked tree and intended package, rather than inferred from a different frozen snapshot.
+
+**Next action:** finish the current Windows authoring slice, then freeze one candidate revision for appropriate complete tests, strict checks, optimized desktop/server builds, current Linux runtime and representative cross-representation/REST restart cases. Assemble packages from that accepted tree and verify examples, reST/HTML/OpenAPI, notices, runtime dependencies, clean launch and checksums. Respect prior runtime/approval boundaries; a stopped guest or denied workaround is not successful acceptance.
+
+## Highest-value completion sequence
+
+1. Reproduce and correct F1; retain focused failure/repair evidence. Finish root's current palette compile/native gate and address the separate behavior audit's verified findings.
+2. Close the already documented complete teaching story: OA responsibility/communication → reviewed SA contribution and interfaces → behavior/degraded state → artifact evidence → source edit → conditional REST edit/reload and stale-write rejection → save/reopen/history. Use exact whole-model and authored-source comparisons, not screen appearance alone.
+3. Correct F2 and prune misleading current-status wording without deleting historical evidence. Keep the normative contract explicit about intentional asymmetry: semantic ownership versus allocation, OA abstraction versus SA technical ports, and reviewed counterpart differences.
+4. Complete F3 on a frozen candidate and obtain fresh independent runtime/UX plus final requirements review. No additional broad metamodel subsystem is justified by this audit alone.
+
+At the end of the initial audit, only this report had been written. The subsequently authorized F1 implementation is recorded below; no fresh runtime/test pass is claimed here.
+
+## Bounded F1 remediation recommendation
+
+Root requested a decision on generated review history versus arbitrary facet constructors after receiving this audit.
+
+**Use the existing semantic-review/history surface, with a distinct typed stored-observation editor.** Removing generic Add and routing to inspection/reset safely removes the immediate trap, but inspection/reset alone does not discharge the current parity contract. Section 5.1 deliberately admits historical observations independently of current object applicability, including references whose live objects are gone; section 8 explicitly requires graphical editing of trace baselines. A workflow that can only acknowledge current live facts cannot express every admitted source-authored historical value. Changing the spec to declare those properties uneditable would narrow the requested equivalence.
+
+The bounded implementation need not build another reconciliation engine:
+
+- Choose a closed facet selector and its exact typed row keys, using the existing shared catalog. Never append an arbitrary default FacetReview.
+- Edit canonical OA and SA Observed branches with their selector-specific types. NotApplicable, Value(none), and absence of the facet remain distinct. Current observations can be presented as a deliberate starting choice, not silently acknowledged on Add.
+- Keep stored-observation editing separate from Keep/Take/live candidate edits. It changes the trace history only and must say so. Existing inspect/reset remains the ordinary workflow.
+- Historical UUID input must retain deleted identities and allow syntactically valid exact keys; live-object-only pickers are insufficient. Use the existing historical validator, not live-reference applicability, for historical admission.
+- Stage a complete typed candidate; validate and apply one EditTrace through the existing Document/source/history boundary. An incomplete selector, key or observation keeps Apply disabled or fails with a located editable draft. Source writeback and Undo/Redo remain shared.
+
+Acceptance should cover absent history, an empty facet list, one scalar, one optional value, NotApplicable, a keyed attachment/artifact observation with deleted UUIDs, changing an observation's constructor, duplicate/overlapping-invalid history, and exact source/JSON Save/Undo/Redo. Prove the original nil-UUID Add cannot occur. This is a finite history-authoring slice over existing types, not a new metamodel or automatic synchronization feature.
+
+## F1 implementation candidate — Codex-956atf /root/release_audit
+
+Root authorized the bounded implementation in `crates/oa-desktop/src/forms.rs`, `forms/history_fields.rs`, and `forms/history_fields/tests.rs`. No core API or app handler was changed. The trace inspector replaces its recursive baseline form with a collapsed **Edit stored history (advanced)** surface. It initializes absent prose/semantic baselines, chooses a facet family and leaf explicitly, edits keyed selectors and both typed observations, and removes/reorders rows. Optional values, NotApplicable, booleans, integers/reals, enum and compound constructors, exact strings and historical UUIDs are separate controls. Current counterpart observations are an explicit opt-in action using `capture_facet`; the editor changes no counterpart.
+
+**Design decision:** reuse the existing checked-in OpenAPI TraceBaseline/FacetReview descriptor as finite historical field-shape metadata, cached once. This already documents the admitted serialized constructors, so using it here avoids a second manually maintained semantic catalog or new core metadata API. This is not an all-product REST-schema form generator. The supported local refs, oneOf/anyOf, fixed objects, arrays and primitive shapes are bounded by depth 32; list rendering pages 12 rows. Unsupported metadata produces a visible unavailable-field message. The real Rust types and `validate_semantic_baseline` remain authoritative for admission; the descriptor supplies no replacement validator.
+
+**Deliberate draft behavior:** a newly chosen facet has both observations NotApplicable and cannot be committed until the engineer supplies an admitted observation. New UUID slots are empty, never a made-up nil identity. Historical typed Add replaces the generic UUID-array fallback. Scoped shape/list events preserve unrelated incomplete inputs. Constructor caches follow row movement/removal and recovery; exact-string mode also converts inactive textual buffers transactionally. Replacing or clearing a whole history subtree discards its inactive constructor buffers so later new facts cannot revive old data. Ordinary Apply remains the existing EditTrace/Document/source transaction.
+
+Ten targeted tests are present. They cover absent/empty/existing history; descriptor-derived complete witnesses for every offered scalar/keyed fact against actual FacetReview deserialization and historical validation; rejected NA/NA and duplicates with unchanged Document snapshots; deleted UUID keys/observations; numeric limits and invalid raw repair; compound values and constructor switching; TypeRef's nested primitive picker; exact Unicode/quoted strings and literal keys; cache relocation/recovery; clear/recreate isolation; source/JSON round-trip and exact one-step Undo/Redo including retained source comments.
+
+**Verification status:** `git diff --check` passes for the candidate (an unrelated generated HTML line-ending warning is present). No Cargo, rustfmt, native GUI or integration suite was run by this worker; root owns the serialized build/toolchain lease. F1 is therefore a ready source candidate, not an accepted fix yet. Root should run targeted history tests, the relevant desktop suite and strict lint, then exercise expanded history controls at normal/minimum width, typed Add/repair, paging, apply/reopen and Undo in the actual desktop. F2 and shared decision/wiki synthesis remain root-owned. F3 remains open.