Sync agent instructions from main

AGENTS.md

@@ -0,0 +1,73 @@
+# Agent working agreement
+
+## Working method
+
+- Follow `PROJECT_GOAL.md` and the user's current instructions. Work autonomously within scope. Resolve discoverable questions yourself; record, test, and revise reversible assumptions. Ask only when a consequential decision needs information or authorization not already available. Continue independent useful work while blocked elsewhere.
+- Map unfamiliar domains through primary sources, comparable systems, and real user workflows. Identify underlying needs, valuable concepts, and avoidable friction; evaluate improvements rather than merely reproducing features. Synthesize findings into decisions or experiments, and stop research when another action offers greater value.
+- Make specifications precise enough for compatible independent implementations: definitions, relationships, invariants, valid/invalid examples, and lifecycle or transformation rules where relevant. Trace important requirements and decisions to implementation and verification. Resolve specification ambiguity at its source when implementation exposes it.
+- For consequential uncertain choices, compare materially different candidates against explicit user-derived criteria. Ask independent critics to challenge assumptions and attempt to falsify proposals; refine or replace candidates as evidence warrants. Record the choice, evidence, tradeoffs, rejected approaches, and reasons to revisit it. Use proportionate effort for reversible local choices.
+- Plan milestones that resolve uncertainty or deliver useful capability, with explicit dependencies. Test foundational assumptions before substantial downstream work. At checkpoints, assess progress toward the actual objective and replan when evidence invalidates the strategy or progress stalls.
+- Define observable success and suitable evaluators before repeated improvement: invariants, examples, round trips, transformations, performance checks, realistic user tasks, or explicit review rubrics. Ensure the evaluator measures the intended outcome. For experiments, record the question, expectations, method, result, and implications; isolate exploratory prototypes from production architecture.
+- Build and run meaningful changes, exercise actual behavior, and inspect useful logs. Investigate crashes, serious warnings, corrupted state, and interaction defects. For GUI work, use Computer Use or equivalent tools to inspect realistic workflows, cognitive load, editing/selection, navigation, feedback, recovery, loading/empty/failure states, accessibility, layout, focus/disabled states, and responsiveness.
+- Match independent reviews to the artifact and risks. For languages or formats, include ambiguity, round trips, human/AI editability, and version-control behavior where relevant. Verify findings, fix the appropriate conceptual, specification, architectural, implementation, or interaction layer, and recheck affected dependents. Reuse valid evidence; repeat checks for concrete risks, changes, findings, or required gates. Compilation, screenshots, and worker reports alone do not establish correctness or usability.
+- Favor the simplest maintainable design satisfying known requirements and justified extensibility. Avoid speculative abstraction, unrelated refactoring, and repeating approaches already invalidated by evidence.
+
+## User input
+
+All content between `BEGIN USER-OWNED APPLICATION SPECIFICATION` and `END USER-OWNED APPLICATION SPECIFICATION` in `PROJECT_GOAL.md` belongs to the user. Its headings and structure are unrestricted. Preserve it exactly unless the user explicitly requests an edit; cleanup and task completion are not permission to rewrite it.
+
+Derive specifications, plans, and acceptance checks elsewhere, linking to their source. Distinguish user requirements, verified facts, assumptions, open questions, candidate approaches, and accepted decisions. Interpretations must not silently replace the user's intent. When input changes, reconcile affected work. Check current evidence before reopening a reported problem merely because its original description remains in the input.
+
+## Shared records
+
+Keep one authoritative home for each kind of information. Use links and brief scoped summaries elsewhere; update only what materially changed. Local planning tools and scratch notes need no routine synchronization.
+
+| Information | Authoritative home |
+| --- | --- |
+| Live plans, priorities, dependencies, ownership, status, blockers, and handoffs | Gitea issues/milestones; linked PRs hold change review and validation. |
+| Specifications, architecture, interfaces, and build/run documentation | Established version-controlled project documents. |
+| Durable decisions and reusable evidence | `harness/DECISIONS.md` and relevant topic notes, or existing equivalents. |
+| Navigation and integrated-state checkpoint | `harness/STATE.md`: links, verified code commit/release, capabilities, and material limitations. No live task ledger. |
+| Shared entrypoint | Gitea Wiki: overview and links, without duplicating versioned documentation. |
+| Published deliverables | Gitea releases, tied to source commits and verification. |
+
+Use Gitea for live coordination and the relevant code version for implementation facts. Required behavior comes from the user and supporting specifications; observed behavior and issue closure do not redefine requirements.
+
+## Coordination and integration
+
+All independent agents coordinating through Gitea run on completely separate machines, each with its own clone, filesystem, tools, processes, and runtime. Gitea and pushed Git history are the shared communication and delivery channels. Local files (including `harness`), unpushed commits, worktrees, test results, and localhost services are not accessible to peers. Matching branch names or paths do not imply synchronized contents.
+
+1. On starting or resuming, including after compaction, inspect the working branch, local changes, applicable instructions, relevant shared records, and existing implementation. Recover context from authoritative records. Check for newer shared instructions on the actual remote default branch without overwriting local work. Read what is relevant; avoid repeated full-history scans and constant polling.
+2. Search before creating tasks. Claim a meaningful outcome in its Gitea issue with a stable session identity, scope, remote repository/branch, and acceptance criteria. Keep small steps within that task. Recheck after claiming; comments are not atomic locks. Respect existing ownership and resolve overlapping claims before overlapping work.
+3. Independent sessions are peers. Each owns its contribution and delegated work on its own machine. Record one integration/release owner when a milestone needs shared coordination. Use distinct remote work branches, partition files/interfaces, and coordinate changes to shared specifications and documents. Worktrees provide local isolation only; they do not share work between machines.
+4. At meaningful checkpoints or handoffs, record changed results, commit/PR links, verification commands and environment, blockers, and next actions. Identify the tested code version and label uncommitted or unpublished work as local-only. Before asking peers to consume results, push the required code and versioned documentation, including relevant `harness` updates; publish other required artifacts in Gitea and link them. Use repository-relative paths with commit references, reproducible commands, and necessary environment details; local paths and localhost URLs alone are not handoffs. Do not assume another agent is running or has read a message; silence alone does not establish abandonment. Record evidence and preserve existing work when reassigning a task.
+5. Follow project review and merge conventions. Fetch the relevant remote branches and inspect the identified commits before reviewing or integrating another machine's work. Resolve conflicts while preserving others' edits, and verify the combined result locally; report material environment differences. Local instruction-file edits reach peers only after publication and retrieval. Do not overwrite others' work or force-push shared history to resolve coordination problems.
+6. Close work when its acceptance criteria are met and the result is integrated or delivered as appropriate. Mark duplicates and superseded tasks explicitly with replacement links. Then choose further useful unowned work while the requested objective remains incomplete.
+
+Use Gitea MCP for shared coordination. If unavailable, report the failure, buffer necessary handoff information locally, and continue already-owned or clearly non-overlapping work. Reconcile with current Gitea state when access returns; do not claim an ownership update, review, or publication succeeded without confirmation.
+
+## Delegation and reasoning
+
+Use GPT-6 Astra exclusively. Gitea peers are independent remote sessions, not subagents controlled by this session. Spawned subagents use the execution environment actually provided by the agent tools; do not assume they share files, and publish their results before Gitea peers need them. Delegate bounded independent research, design, implementation, or review when it improves progress, judgment, or preserves the parent's context. Give subagents the relevant context, ownership boundaries, result format, and evidence requirements. Use fresh critics when practical. The parent owns synthesis and integration and normally consolidates results into Gitea. Choose concurrency according to useful independent work and available resources, including other sessions; there is no agent-count quota.
+
+Optimize reasoning effort for verified outcomes per cost, including review, retries, and repair:
+
+- Main agent: default to high for planning, synthesis, integration, and acceptance decisions; medium for dispatching a settled plan and routine coordination.
+- Subagents: default to medium for bounded implementation and targeted research; low for straightforward retrieval, mechanical edits, and running established checks; high for complex debugging, correctness review, adversarial analysis, or ambiguous design.
+- Use extra-high selectively for difficult foundational semantic, methodological, formal, or cross-domain decisions. Reserve max for exceptional unresolved problems where additional reasoning is likely to justify its cost. Retain higher settings when evidence supports their value.
+
+Allocate by task difficulty and consequences, not role or length alone. Start higher when a clearly difficult decision has expensive downstream consequences. Escalate for concrete reasoning difficulties; resolve missing evidence or unclear requirements at their source. Set subagent effort explicitly through supported controls to avoid unintended inheritance. Do not claim an unapplied change or alter global configuration merely to enforce these preferences.
+
+## Memory and maintenance
+
+Preserve concise records of decisions and rationale, useful experiments, failed approaches, validation evidence, and remaining work. Link substantial evidence rather than copying logs into indexes. Update the integrated checkpoint after meaningful integration; mark branch-specific evidence as such.
+
+Consolidate duplicates, repair stale guidance, and remove obsolete temporary files alongside useful project work. Before removing material, check references, active ownership, and ongoing use; preserve unique knowledge and update affected links. Prefer closing, superseding, or archiving history over deletion. User input is excluded from autonomous cleanup.
+
+If legacy local task ledgers or plans duplicate Gitea, migrate their live content once into existing or appropriately scoped issues, preserve useful decisions/evidence, and mark the old records superseded. Record the migration so later sessions do not repeat it. Do not create empty documents or maintain records for ceremony.
+
+## Delivery
+
+Publish versioned Gitea releases at meaningful working milestones; mark unfinished versions as prereleases. Check existing releases/tags and coordinate one owner and version before publishing. Build from an identified integrated commit and verify the packaged result and launch steps.
+
+Include runnable builds or appropriate artifacts, concise release notes, build/run/deployment instructions as applicable, known limitations, tested platforms, and verification evidence. Confirm publication and artifact availability. Use existing authorized API access or project tooling when MCP lacks a needed release/upload operation. Do not silently replace published versions with different contents.

PROJECT_GOAL.md

@@ -0,0 +1,111 @@
+# Project goal
+
+## Objective
+
+Take the existing project to the complete, coherent, usable, and verified outcome defined by the user input below. Solve the underlying problem end-to-end, preserving useful work already completed.
+
+Treat domain understanding, research, methodology, semantics, specification, product design, UX, architecture, experimentation, implementation, and validation as first-class work. Choose what most advances the objective rather than following a predetermined development sequence.
+
+Follow `AGENTS.md` for execution, coordination, record ownership, and delivery. Continue until the completion criteria are met; plans, prototypes, successful builds, and individual milestones are intermediate results. Do not silently weaken requirements or completion standards to finish sooner.
+
+## Completion criteria
+
+Apply these criteria to the scope requested by the user:
+
+- Required capabilities address the intended problem and support realistic user workflows.
+- Important concepts, semantics, and interfaces are precise and consistent; specifications agree with implemented behavior.
+- Consequential decisions have evidence and rationale. Major assumptions have been validated, explicitly accepted, or isolated without compromising required behavior.
+- The result builds, runs, and operates on the required platforms. Relevant tests and evaluators pass; integrations, edge cases, and failure states have been exercised against the actual result.
+- User-facing behavior and usability have been exercised directly, using representative data and workflows.
+- A fresh independent review covers requirements, domain/semantic consistency, usability, architecture, correctness, regressions, runtime behavior, documentation, and remaining risks. Valid material findings are addressed, blocking and high-impact issues resolved, and affected behavior reverified; no known blocker or high-severity defect remains.
+- Deliverables are maintainable, appropriately extensible, documented, and published as required by `AGENTS.md`. Obsolete scaffolding is removed; documentation and shared state accurately describe the result. Another engineer or agent can reproduce the verification and continue the work.
+
+If required work or verification is blocked, record the specific gap and continue independent useful work without claiming completion.
+
+## Final handoff
+
+Link the delivered result and summarize capabilities, discoveries, architecture and decisions, relevant rejected approaches, verification and independent review, remaining limitations, and exact build/run/deployment/verification instructions. Refer to authoritative records instead of repeating the project history.
+
+## USER-OWNED APPLICATION SPECIFICATION
+
+The block below accepts all project-specific requirements, context, priorities, and feedback, with any headings or organization the user chooses.
+
+<!-- BEGIN USER-OWNED APPLICATION SPECIFICATION -->
+## Application specification
+
+### General description
+
+Create a modern clone of ARCADIA Capella using Rust Iced framework. It should be cross platform (supporting Windows and Linux at least). Use Rust exclusively (wherever possible & practical).
+
+Focus on making the application modern, extensible, intuitive and easy to use. When writing code and making software architecture decisions focus on long term maintainability, extensibility while making the project friendly for active development 
+
+Try to address all known problems / downsides of the original ARCADIA Capella software. 
+
+Version 1 MVP in the form of working Operational Analysis layer is done.
+Version 2 MVP in the form of working Operation Analysis + System Analysis is done.
+You should make the 1st release version of the project with fully feature complete Operation Analysis + System Architecture, according to this application specification.
+Remaining ARCADIA layers will be added in future releases.
+
+Transitioning of model elements between layers (in both directions) should be easy and intuitive.
+
+Keep in mind that the target audience for the application are system engineers. And you should satisfy their needs and use cases
+
+The application should be a general systems modeling tool, like ARCADIA Capella or SysML v2
+
+You should implement most of the ARCADIA semantics, while adressing original ARCADIA Capella problems / downsides 
+
+The original ARCADIA Capella UI is very bloated, clunky, unintuitive and hard to use. In addition, it lacks a number of quality of life features. You should at all cost avoid making the same mistakes as the developers of the original ARCADIA Capella
+
+You should explore the functionality & UI of the original ARCADIA Capella to take the most useful and powerful ideas from it. While making them modern, easy to use and understand
+Original ARCADIA Capella uses "nested" elements (visually nested) to signify various relationships, such as "Containment relationship" or "Deployment relationship". Instead of using visually noisy arrows / graph edges. I pretty much like this approach and want to see something similar to it in this application 
+
+To explore the original ARCADIA Capella UI & semantics you may use web resources / web search / official and community docs. Or open the original ARCADIA Capella installed on this desktop machine for exploration
+
+Your second, parallel, goal is to create a textual representation for ARCADIA, similar to SysML v2. So a user can either edit a system model using UI (graphical representation) or text. Both graphical and textual representations should be fully equivalent and have full parity. You may take inspiration from SysML v2. Both graphical and textual representations should have one overarching, concrete, unambiguous spec in reST format, similar to SysML v2 strictness
+The application should support both forms of editing 
+The textual representation should be easily editable and understandble for both humans and AI 
+The textual representation should be easily handled by version control tools such as Git 
+The underlying semantics of the textual / graphical representation should support traceability of various development artifacts (for example - code, CAD files, electrical schematics, Docx files and anything in between)
+The textual representation editor should have syntax highlighting and linting
+
+The project should also have a backend server / service that you can deploy. The backend server purpose is to give programmatic access to stored system models. So, there also should be a clear REST API for querying, editing and working with models. The purpose of the REST API is to allow automation, scripting and AI-driven workflows 
+An example could be - writing custom plugins for various domain specific software (version control software, CAD software etc...) to establish traceability between development artifacts and a system model 
+
+The desktop application should contain built-in guide / help / tutorial with clear and concise info on modeling concepts, underlying semantics, common modeling scenarios and application features / how to use the app. It should be easy to navigate and explore
+
+@Computer 
+
+### Semantic model / metamodel
+
+Requirements:
+- Textual notation.
+- Graphical notation.
+- Constraints and calculations.
+- Quantities and units.
+- State and behavior modeling.
+- Reusable model libraries.
+- Strong, standardized specification.
+- Strong, standardized API.
+
+#### Textual notation
+
+Requirements:
+- Should not have visual noise and clutter.
+- Should have means to reduce cognitive load when developing system models.
+- Should be easily editable by humans. And AI agents.
+- System engineers should be able to easily develop system models (both big and small) using textual notation only.
+
+### UI
+
+The focus should be on reducing system engineer's cognitive load when creating / working with a system model. Regardless of the model size (big or small).
+
+Long, homogeneous lists in the UI that require user to scroll far or search for a desired option for too long - is a bad design.
+
+## Active issues / current guidance
+
+Right now, the behavior & scenarios UI is hard to use. It contains static / uneditable diagrams, which is highly dubious. In addition, user workflow with the behavior & scenarios UI differ significantly from the other UIs - you can't edit diagrams and instead suppose to click on menus for model development 
+
+--- 
+
+The current project state is nowhere near the usability of the original ARCADIA Capella (despite its downfalls) or its functionality / semantics. You should focus on that by studying original ARCADIA Capella very closely and implementing its features in a modern, ergonomic and easy to use way
+<!-- END USER-OWNED APPLICATION SPECIFICATION -->

crates/oa-desktop/src/app.rs

@@ -642,7 +642,7 @@ impl App {
         if !self.project().contains(id) {
             return;
         }
-        let previous_owner = crate::behavior::selected_owner(self);
+        let previous_state_view = self.state_view_identity();
         self.selected = id;
         self.selected_node = None;
         if let Some(layer) = self.project().layer_of(id)
@@ -656,10 +656,11 @@ impl App {
             && let Some(owner) = crate::behavior::selected_behavior(self.project(), id)
         {
             self.behavior.active_owner = Some(owner);
-            if previous_owner != Some(owner) {
-                self.behavior.diagram = Default::default();
-                self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
-            }
+        }
+        if self.reset_state_view_after_navigation(previous_state_view)
+            && self.page == Page::Behavior
+        {
+            self.canvas_epoch = self.canvas_epoch.wrapping_add(1);
         }
         self.refresh_draft();
     }
@@ -1200,13 +1201,14 @@ impl App {
             Message::Page(page) => {
                 if page != Page::Text || !self.draft_dirty() || self.apply() {
                     if page == Page::Behavior && self.page != Page::Behavior {
+                        let previous_state_view = self.state_view_identity();
                         if let Some(owner) =
                             crate::behavior::selected_behavior(self.project(), self.selected)
                         {
                             self.behavior.active_owner = Some(owner);
                         }
                         self.behavior.active_owner = crate::behavior::selected_owner(self);
-                        self.behavior.diagram.fit = true;
+                        self.reset_state_view_after_navigation(previous_state_view);
                     }
                     self.page = page;
                     self.selected_node = if page == Page::Behavior {
@@ -1360,6 +1362,7 @@ impl App {
             }
             Message::Layer(layer) => {
                 if self.apply() {
+                    let previous_state_view = self.state_view_identity();
                     self.layer = layer;
                     self.create_kind = if layer == Layer::Oa {
                         Kind::Activity
@@ -1375,6 +1378,8 @@ impl App {
                         .map(|d| d.id);
                     self.selected = self.project().id;
                     self.selected_node = None;
+                    self.behavior.active_owner = crate::behavior::selected_owner(self);
+                    self.reset_state_view_after_navigation(previous_state_view);
                     self.refresh_draft();
                     self.fit();
                 }

crates/oa-desktop/src/app/state_diagram.rs

@@ -6,12 +6,35 @@ use crate::behavior::{
 };
 
 impl App {
+    /// The behavior view resolved independently of the current page. Capture
+    /// this before selection/layer changes, while it still identifies the view
+    /// whose camera and tool are retained during navigation.
+    pub(super) fn state_view_identity(&self) -> (Option<Id>, Option<Id>) {
+        let owner = behavior::selected_owner(self);
+        let diagram = owner.and_then(|owner| behavior::state_view::diagram(self, owner));
+        (owner, diagram)
+    }
+
+    pub(super) fn reset_state_view_after_navigation(
+        &mut self,
+        previous: (Option<Id>, Option<Id>),
+    ) -> bool {
+        let current = self.state_view_identity();
+        if current == previous {
+            return false;
+        }
+        self.behavior.diagram = behavior::state_view::State {
+            diagram: current.1,
+            ..Default::default()
+        };
+        true
+    }
+
     pub fn state_context(&self) -> Option<Context> {
         if self.page != Page::Behavior {
             return None;
         }
-        let owner = behavior::selected_owner(self)?;
-        let diagram = behavior::state_view::diagram(self, owner)?;
+        let diagram = self.state_view_identity().1?;
         Some(Context {
             document: self.canvas_document,
             diagram,

crates/oa-desktop/src/app/state_diagram_tests.rs

@@ -89,6 +89,232 @@ fn assert_source_model_agree(app: &App) {
     assert!(!app.source_dirty());
 }
 
+struct NavigationFixture {
+    app: App,
+    machine_a: Id,
+    diagram_a: Id,
+    state_a: Id,
+    transition_a: Id,
+    root_event: Id,
+    machine_b: Id,
+    diagram_b: Id,
+    state_b: Id,
+}
+
+fn navigation_fixture(layer_b: Layer) -> NavigationFixture {
+    let mut project = Project::empty();
+    let mut machine = |layer, name| {
+        let machine = project
+            .add_element(Kind::StateMachine, layer, name, None)
+            .unwrap();
+        let region = project
+            .add_element(Kind::Region, layer, "Main", Some(machine))
+            .unwrap();
+        let state = project
+            .add_element(Kind::State, layer, "Ready", Some(region))
+            .unwrap();
+        (machine, state)
+    };
+    let (machine_a, state_a) = machine(Layer::Sa, "Machine A");
+    let (machine_b, state_b) = machine(layer_b, "Machine B");
+    let root_event = project
+        .add_element(Kind::Event, Layer::Sa, "External event", None)
+        .unwrap();
+    let transition_a = project.relate(RelationKind::StateTransition, "Repeat", state_a, state_a);
+    let plan_a = state_edit::create_view(&project, machine_a).unwrap();
+    project = prepare_command(&project, &plan_a.command).unwrap().project;
+    let plan_b = state_edit::create_view(&project, machine_b).unwrap();
+    project = prepare_command(&project, &plan_b.command).unwrap().project;
+    let mut app = App::with_project(project);
+    send(&mut app, Message::Select(state_a));
+    send(&mut app, Message::Page(Page::Behavior));
+    send(
+        &mut app,
+        Message::BehaviorDiagram(Choice {
+            id: plan_a.diagram,
+            label: "A view".into(),
+        }),
+    );
+    let context = app.state_context().unwrap();
+    event(
+        &mut app,
+        Event::Viewport(context, iced::Size::new(820., 540.)),
+    );
+    event(&mut app, Event::Zoom(context, 0.65));
+    event(
+        &mut app,
+        Event::Pan(context, iced::Vector::new(-1_400., -800.)),
+    );
+    event(
+        &mut app,
+        Event::Choose(Tool::Reconnect {
+            relation: transition_a,
+            endpoint: Endpoint::Target,
+        }),
+    );
+    assert_eq!(app.state_context().unwrap().diagram, plan_a.diagram);
+    assert!(!app.behavior.diagram.fit);
+    NavigationFixture {
+        app,
+        machine_a,
+        diagram_a: plan_a.diagram,
+        state_a,
+        transition_a,
+        root_event,
+        machine_b,
+        diagram_b: plan_b.diagram,
+        state_b,
+    }
+}
+
+fn assert_switched_state_view(f: &mut NavigationFixture) {
+    assert_eq!(behavior::selected_owner(&f.app), Some(f.machine_b));
+    assert_eq!(f.app.state_context().unwrap().diagram, f.diagram_b);
+    let defaults = behavior::state_view::State::default();
+    let state = &f.app.behavior.diagram;
+    assert_eq!(state.diagram, Some(f.diagram_b));
+    assert_eq!(
+        state.tool,
+        Tool::Select,
+        "Reconnect from A must not be armed in B"
+    );
+    assert_eq!(state.pan, defaults.pan);
+    assert_eq!(state.zoom, defaults.zoom);
+    assert!(state.fit);
+    assert!(
+        state.viewport.is_none(),
+        "B needs its own first viewport measurement"
+    );
+    assert!(state.placement.is_none());
+    let context = f.app.state_context().unwrap();
+    event(
+        &mut f.app,
+        Event::Viewport(context, iced::Size::new(820., 540.)),
+    );
+    assert!(
+        f.app.behavior.diagram.pan != defaults.pan || f.app.behavior.diagram.zoom != defaults.zoom,
+        "The unchanged widget size still fits a newly selected view"
+    );
+}
+
+fn catalog_selects_another_machine(layer_b: Layer) {
+    let mut f = navigation_fixture(layer_b);
+    let before = f.app.document.snapshot();
+    send(&mut f.app, Message::Page(Page::Catalog));
+    send(&mut f.app, Message::Select(f.state_b));
+    assert_eq!(f.app.layer, layer_b);
+    send(&mut f.app, Message::Page(Page::Behavior));
+    assert_switched_state_view(&mut f);
+    assert!(Arc::ptr_eq(&before, &f.app.document.snapshot()));
+    assert_source_model_agree(&f.app);
+}
+
+#[test]
+fn state_navigation_catalog_selection_of_another_machine_resets_camera_and_tool() {
+    catalog_selects_another_machine(Layer::Sa);
+}
+
+#[test]
+fn state_navigation_catalog_selection_across_layers_resets_camera_and_tool() {
+    catalog_selects_another_machine(Layer::Oa);
+}
+
+#[test]
+fn state_navigation_layer_change_resets_the_new_machine_at_the_same_viewport_size() {
+    let mut f = navigation_fixture(Layer::Oa);
+    let before = f.app.document.snapshot();
+    send(&mut f.app, Message::Layer(Layer::Oa));
+    assert_switched_state_view(&mut f);
+    assert!(Arc::ptr_eq(&before, &f.app.document.snapshot()));
+    assert_source_model_agree(&f.app);
+}
+
+#[test]
+fn state_navigation_return_to_the_same_view_preserves_camera_tool_and_fit_mode() {
+    for fit in [false, true] {
+        let mut f = navigation_fixture(Layer::Sa);
+        if fit {
+            let context = f.app.state_context().unwrap();
+            event(&mut f.app, Event::Fit(context));
+        }
+        let state = &f.app.behavior.diagram;
+        let retained = (
+            state.diagram,
+            state.pan,
+            state.zoom,
+            state.tool,
+            state.fit,
+            state.viewport,
+        );
+        let before = f.app.document.snapshot();
+        send(&mut f.app, Message::Page(Page::Catalog));
+        send(&mut f.app, Message::Select(f.state_a));
+        send(&mut f.app, Message::Page(Page::Behavior));
+        let context = f.app.state_context().unwrap();
+        event(
+            &mut f.app,
+            Event::Viewport(context, iced::Size::new(820., 540.)),
+        );
+        assert_eq!(behavior::selected_owner(&f.app), Some(f.machine_a));
+        assert_eq!(context.diagram, f.diagram_a);
+        let state = &f.app.behavior.diagram;
+        assert_eq!(
+            (
+                state.diagram,
+                state.pan,
+                state.zoom,
+                state.tool,
+                state.fit,
+                state.viewport
+            ),
+            retained
+        );
+        assert_eq!(
+            state.tool,
+            Tool::Reconnect {
+                relation: f.transition_a,
+                endpoint: Endpoint::Target
+            }
+        );
+        assert!(Arc::ptr_eq(&before, &f.app.document.snapshot()));
+    }
+}
+
+#[test]
+fn state_navigation_root_event_and_same_layer_keep_the_current_camera_and_tool() {
+    let mut f = navigation_fixture(Layer::Sa);
+    let state = &f.app.behavior.diagram;
+    let retained = (
+        state.diagram,
+        state.pan,
+        state.zoom,
+        state.tool,
+        state.fit,
+        state.viewport,
+    );
+    let before = f.app.document.snapshot();
+    send(&mut f.app, Message::Select(f.root_event));
+    assert_eq!(f.app.selected, f.root_event);
+    send(&mut f.app, Message::Page(Page::Catalog));
+    send(&mut f.app, Message::Page(Page::Behavior));
+    send(&mut f.app, Message::Layer(Layer::Sa));
+    assert_eq!(behavior::selected_owner(&f.app), Some(f.machine_a));
+    assert_eq!(f.app.state_context().unwrap().diagram, f.diagram_a);
+    let state = &f.app.behavior.diagram;
+    assert_eq!(
+        (
+            state.diagram,
+            state.pan,
+            state.zoom,
+            state.tool,
+            state.fit,
+            state.viewport
+        ),
+        retained
+    );
+    assert!(Arc::ptr_eq(&before, &f.app.document.snapshot()));
+}
+
 #[test]
 fn create_view_places_only_its_machine_and_restores_exact_source_in_one_undo() {
     let mut f = fixture();

harness/DECISIONS.md

@@ -58,3 +58,8 @@ relative to a canvas whose origin may move when selection changes the toolbar.
 Viewport notifications fit only on actual size changes. Native testing also showed
 Iced WGPU places parent meshes after clipped child meshes; backgrounds must share
 their content clip to avoid hiding vector geometry while leaving text visible.
+
+State camera/tool lifetime follows effective machine and diagram identity, even
+when selection changes through Catalog or Layer outside Behavior. Reset only on
+actual context change; preserve same-view return. Independent review reproduced
+the leak and native Windows/Linux tests verified the correction in316dc55.

harness/PLAN.md

@@ -16,17 +16,30 @@ The current forms are a closed typed-record adapter, not a second metamodel. Exp
 
 Nested source ownership and persistent REST bundles are implemented and verified: Windows minimum-size source-to-graphics, nested reparent/source/Undo/Redo/Save/reopen, recovery, rebuilt Linux source/history/Save/reopen, independent review and both platform suites passed. Preserve the existing grammar/updater and separate allocation/order semantics.
 
-The user-directed contextual-menu/source-tree, movable-port and direct-connection milestone has scoped Windows/Linux native acceptance. See release-port-drawing.md for exact builds, saved trials and minimum-size boundaries. Continue direct state-machine editing in the isolated state-integration checkout: persist typed machine context, use shared state/route geometry, retain drafts until accepted document commit, then verify creation, movement, transition drawing/reconnection, undo and reopen. This first behavior slice precedes scenario/process gestures; all broader release milestones remain required.
+Explorer/port discovery, custom routing, direct palette connections, four-side port
+anchors, contextual menus and source folders have scoped Windows/Linux acceptance.
+See release-explorer-usability.md, release-routing-verification.md,
+release-routing-linux.md and release-port-drawing.md for exact evidence and limits.
 
-The user-directed actor/system port and model-navigation milestone is accepted: visible Add port → Connect boundary exchange, grouped roots, focused containment, breadcrumbs, contextual search and paging, clear full-depth outline, and separate allocations. Native Windows authoring/save/reopen, 251-root paging, 12-level navigation, 1440×900/1100×700 inspection, rebuilt Linux save/reopen and single-line font correction passed. Independent requirements, correctness, native UI and simplicity findings are addressed; release-explorer-usability.md records exact evidence and remaining performance boundaries. Resume source recovery acceptance and the release milestones below; the full scope remains intact.
+Direct state-machine editing is accepted through316dc55: typed persisted views,
+explicit-owner creation, movement, direct transitions/reconnection, typed detail
+forms, folding, placement and correct camera/tool lifetime. Windows default/minimum
+and Linux native acceptance plus independent reviews are recorded in
+release-state-editing.md. Direct scenario/process gestures remain required.
 
-Editable connection routing has passed code/native acceptance and independent follow-up at desktop checkpoint `23535b4`, with the Linux-discovered viewport correction in `366ce44` also verified on the actual rebuilt Linux app. Current WSL automated checks and routing runtime acceptance are recorded in release-routing-linux.md. Continue production source authoring under release-source-integration.md and direct behavior editing. Typed port integration and its native authoring/reopen checks are complete at `fa096ce`; `release-diagram-port-correction.md` records the domain correction. Existing R5 state authoring is preserved and still needs direct gestures and full native acceptance.
+R6 data contracts are active in the isolated data integration checkout. Freeze the
+full payload/dictionary shape as schema/source4, keep existing typed ports, migrate
+older formats explicitly while preserving lexical ownership/comments, then verify
+GUI/text/REST parity and real engineering workflows. See release-data-contract.md
+and the implementation plan in that checkout. R3 semantic drift/reconciliation
+follows the R6 freeze; its current prose-only behavior is insufficient.
 
-The user's routing correction is implemented as editable connection bend points with automatic obstacle-aware starting routes. Persistent commands, source/API parity, shared geometry and desktop gestures passed automated and native verification. `65fa9ab` resolves six default SA label-overlap pairs; follow-up typed reopen, short gestures and SVG export at 1100×700 passed. `release-routing-verification.md` records exact evidence, completed independent native follow-up and the 119 ms dense full-solve limitation. Route identity belongs to the diagram representation and does not alter semantic endpoints or ownership. Direct state gestures remain required and should reuse geometry/routing primitives only where semantics match.
-
-Drag selection, typed port/schema 3 and routing corrections are complete. Make behavior diagrams directly editable using shared persisted geometry and ordinary commands, and replace the single huge source editing experience with a modular project/include workflow. These are release requirements, not future limitations. The source bundle core and nested source experiments provide evidence and reusable foundations, not production editor acceptance. Source projects must preserve identity, precise per-file diagnostics, Git-friendly ownership of declarations, cycle/missing/duplicate include failures, safe local include resolution and GUI/API parity. Behavior acceptance requires actual canvas movement and contextual creation/editing, not only selection plus external menus. The proposed first state-machine slice is in `release-state-gesture-design.md`; verify its interfaces before changing the shared schema.
-
-Source direction: extend the production parser/span index and shared updater for selected nesting and shorthand constructs, retaining the existing virtual-bundle foundation. The 23-test experiment is evidence, not production code to copy: independent probes found item-comment misattachment, shorthand description rejection and unsupported deletion. Verify explicit comment ownership, all edit/delete paths, exact source Undo, invalid drafts and per-file diagnostics before adopting syntax. Direct behavior editing first tests a state-machine task (create in region, drag, draw/reconnect transition, edit guard, undo/reopen) before propagating the interaction design to scenarios/chains. Compare successful task completion, semantic clarity, mode switches and recoverability, not control counts.
+Continue source authoring improvements only through the production parser/updater.
+The23-test experiment is evidence, not architecture: independent probes exposed
+comment misattachment and unsupported edits. Additional shorthand must preserve
+complete edit/delete behavior and exact source history, and justify itself in real
+human authoring tasks. Shared state placements are now validated; scenario/chain
+interaction must preserve its own occurrence and ordering semantics.
 
 1. **Release coverage audit and interfaces.** Compare actual core/UI/API with official Capella OA/SA semantics and the new objective. Freeze a coverage table and concrete variant/reference/transition contracts before editing shared interfaces. Distinguish unsupported later layers from missing OA/SA workflows; V2 exclusions are reconsidered. Native audit exercises onboarding/help/authoring at supported sizes. Independent audits have separate file ownership.
 2. **Complete engineering semantics.** Fill verified gaps in capability relationships and mission involvement; operational process/functional-chain function/control topology; scenario/state/data constructs needed by OA/SA engineers. Add typed semantic-content drift and reviewed existing-counterpart reconciliation, including reference mapping and explicit dependency/ownership decisions. Every addition has a usable graphical authoring workflow, equivalent source/API representation, meaningful reject/undo/delete/reidentify/transition tests and a worked example. Exact additions and invariants are recorded in the coverage/interface artifact from milestone1, avoiding speculative LA/PA concepts.

harness/STATE.md

@@ -1,188 +1,38 @@
-# First release — current engineering state
+# First release continuation pointer — 2026-09-06
 
-## Objective and current phase
+The goal is active and incomplete. This C: checkout remains a continuation pointer
+with older production code. Do substantial work in the active integration checkout,
+not here; read its STATE, PLAN and TASK_LEDGER before continuing:
 
-The first-release goal remains active and incomplete. Deliver Rust/Iced Operational
-Analysis and System Analysis/System Architecture for system engineers, equivalent
-graphical/textual/REST semantics, hierarchical diagrams and typed ports, modular
-source projects, artifact traceability, editable behavior, useful offline help,
-and Windows/Linux release evidence. Later Arcadia layers remain future releases.
-Authoritative objective: attachment
-`07aee762-7d27-4cbe-81c3-2e82c7170711/goal-objective.md`, reread 2026-09-06.
-PLAN.md, TASK_LEDGER.md and release-semantics-audit.md retain full release scope.
+D:/CodexBuilds/Capella2-data-integration (codex/data-contract-integration).
+Current production cf04ff1, root native/evidence checkpoint follows it.
+Linux peer D:/CodexBuilds/Capella2-data-linux-review, b5db730.
+Authoritative objective: attachment10134df9-bea2-4c02-a820-67b53d6b86f7/goal-objective.md.
 
-The latest user-directed drawing/port/menu/source-tree milestone is accepted at
-`fef2e0d` plus tooltip-layer follow-up `ad7feb5`. It does not complete the release.
-Root now integrates direct state-machine editing in an isolated worktree. There
-is meaningful implementation, independent review and real runtime progress; no
-external blocker or disk blocker exists.
+R6 contracts, direct behavior, source5/core/REST/scalar and closed constructor GUI
+are integrated. Full Windows767/Linux770 workspace tests, strict checks and release
+builds passed before newest desktop constructor/help slice; its platform gates run.
+REST live184schemas/19typed values/9 malformed rejections passed earlier. No remote
+service was deployed. Native Windows hosted publish, exact includes/comments,
+graph/text Save, invalid-draft rejection, API artifact review/Reload/Undo/Redo,
+revision conflicts, offline recovery, local copy and catalog Open were exercised.
+That trial closed0/empty stderr. Source/history/ports/routing/explorer/state and
+basic advanced behavior have scoped native Windows/Linux evidence in active ledgers.
 
-## Accepted foundations and evidence
+Current high-impact issue: installed invalid local repair source retained a previous
+hosted handle, allowing repaired source to save to the old resource. Actual-App/HTTP
+red reproduction exists; HOST owns minimal fix and fresh reviewer. A separate stale
+empty catalog UX fix follows. Native verification is required after both fixes.
+GUI worker owns independent reset/member/literal decisions in SEM; other keyed/order/
+artifact/multi-source decisions remain. Whole release coverage, advanced native cases,
+Home/recovery/help and final cross-disciplinary acceptance/packaging are unfinished.
 
-- Typed OA/SA model, schema 3 ports, validated atomic commands and ordinary history
-  are shared across three Rust crates. Typed contracts and migration are documented
-  in release-port-contract.md, release-port-core.md and release-port-migration.md.
-  Desktop typed authoring checkpoint `fa096ce` passed native creation, generation,
-  undo/redo and persistence. Original Capella was operated in a disposable workspace;
-  exact observed semantics/workflows: release-capella-workflow-benchmark.md.
-- Explorer/port discovery `d364d3c`: visible Add port, grouped roots, focused children,
-  breadcrumbs, contextual search/paging and full-depth outline. Windows port/Standard
-  exchange, 251-root paging, 12-level navigation and 1100x700 trials passed; rebuilt
-  Linux save/reopen/font correction passed. See release-explorer-usability.md.
-- Editable routes `23535b4`, viewport fix `366ce44`, automatic labels `65fa9ab`:
-  authored bends/labels, nested group movement, folding/restoration, undo/redo,
-  save/reopen, SVG and minimum-size gestures passed native and independent review.
-  See release-routing-verification.md and release-routing-linux.md. Dense optimized
-  full solve measured119ms; arbitrary dense crossings remain possible.
-- Nested source and coupled hosted source/model checkpoint `4e8575b`: source3
-  element nesting/includes, token/provenance-aware structural writes, exact model
-  source history, retained drafts and safe Save All/recovery. Full422 Windows and
- 425 Linux tests, strict checks and builds passed at that checkpoint. Actual REST
-  import/comment-only revision/cross-file reparent/stale ETag/restart passed.
-  Windows/Linux source and nested graphical edits, save/reopen and recovery were
-  exercised. See release-source-integration.md. Experiments remain evidence only;
-  do not adopt their independent parser/writer.
+Root is sole native operator; authorization persists. Isolated loopback test server
+20984 at127.0.0.1:8787 uses Temp/capella2-hosted-native-20260906/store, resource
+d28b2fc9-fbbd-456b-8ba8-a1195d1c8f33 revision6. No desktop trial is currently active.
+Original Capella remains available; re-inventory native windows before input.
 
-## Drawing acceptance — current main checkout
-
-`93fd32c` fixes candidate scaling without weakening validation; `35133de` supplies
-persisted four-side normalized port anchors. `fef2e0d` adds direct palette drawing,
-shared automatic labels, contextual menus and the source folder tree. OA Interaction,
-SA Functional Exchange and Boundary Exchange accept click-click or drag. Function
-cards create/reuse typed ports atomically. Compatible targets highlight; Standard
-and Flow contracts remain distinct. Pan retains source; Escape cancels.
-
-Independent review reproduced batched-pointer click corruption and overview port
-mispicking. Ordered CursorMoved coordinates, explicit context epochs and nearest
-port glyph picking fix these, with production regressions. Native review then
-reproduced port-tooltip overprint: separate Frames still share an Iced GPU layer.
-The fix uses a passive second stacked Canvas (a real renderer layer). It preserves
-interactive child state/input and resets held-button suppression on context change,
-matching releases, Escape and focus loss. CursorLeft alone does not end suppression.
-
-Evidence is in release-port-drawing.md and release-context-menus.md. Exact native
-review report: `D:/CodexBuilds/Capella2-release1-01a06e2e/drawing-independent-native-review.md`.
-Windows independent trials passed Standard rejection/completion, automatic function
-ports, undo/redo, save/reopen and1100x700. Overprint was reproduced on9A7FF074 and
-closed on3F534C67 at1440x900 and1100x700. Root tested final1EEBDC3C: first port drag,
-menu outside dismissal, first repeated drag, direct FE, readable identity and Save.
-Saved trial: `ui-port-tooltip-final/project.arcadia`,41objects/26links/0checks.
-
-Root operated actual Linux7AC5EEE: first FE drag, Right-to-Bottom port drag, Reset/
-Undo, repeated Bottom-to-Left drag, source-offscreen arrow pan and completion,
-Save All/reopen, persisted geometry and source-tree expansion/open. Saved trial:
-`ui-port-tooltip-linux/project.arcadia`,41objects/27links/0checks. Runtime log empty;
-Linux window closed normally, exec13766 exit0. Linux was inspected at1440x900;
-minimum-size acceptance is Windows, not a claim of Linux minimum-size testing.
-
-Verification scopes: full485 Windows /488 Linux workspace tests preceded the last
-pointer/tooltip refinements. Latest main Windows193 desktop tests, strict desktop
-all-target Clippy and debug build passed. Latest Linux189 desktop tests, strict
-desktop Clippy and release build passed; four new tooltip lifecycle tests then
-passed separately. A142-test Linux result from a shared-worktree Cargo cache was
-identified and EXCLUDED; scoped package cleaning and explicit main recompilation
-established the valid189-test result. Use a distinct CARGO_TARGET_DIR per worktree.
-
-## Active isolated state integration
-
-Worktree: `D:/CodexBuilds/Capella2-state-integration`, branch`codex/state-integration`.
-Target: `D:/CodexBuilds/Capella2-state-integration-target`. Main core is not yet changed.
-
-- `e7a8163` integrates reviewed core state-context commit a63654f, preserving latest
-  anchors and routing labels. State views skip semantic port layout after boundary
-  snapping; both routing and label passes reserve actual internal-row headers.
-- `2459581` retains behavior drafts until Document commit succeeds.
-- `53cd096` adds typed state-context forms, placement membership choices and normative
-  source/JSON/REST/OpenAPI contracts. Strict HTML generation passed. Two actual HTTP
-  tests passed, including malformed/invalid rejection, revision/source atomicity and
-  restart. Destination pickers permit intermediate invalid drafts so coordinated
-  element/diagram retargeting is reachable; Apply remains strict.
-- `e5660b8` integrates App dirty/Close/Save/navigation/mutation guards. Exact prepared
-  commands acknowledge drafts only after accepted source/model writes. Review found
-  passive viewport events applying properties, queued source controls creating
-  competing drafts and stale delete confirmations; all three fixes have App tests.
-  Six App lifecycle tests passed, including typed source-writeback rejection/retry
-  and one Undo. Clean detached buffers after Undo are intentional; reachable bundle
-  and accepted Document are restored exactly.
-- Integrated baseline:514 Windows workspace tests (277core,199desktop,38server),
-  strict workspace all-target Clippy passed. This baseline precedes direct gestures;
-  there is no native state-gesture acceptance yet.
-
-Direct-state UI integration is now implemented (uncommitted): persisted canvas,
-creation within explicit regions, movement, direct transitions and endpoint
-reconnection, pan/zoom/Fit, typed detail forms, and contextual fold/unfold/hide.
-The old computed static state scene is removed. Source/model commands remain atomic.
-Independent review found removed typed-form access, unreachable folded contents,
-selection relayout altering drag deltas, fallback owner resetting the first drag,
-and same-size viewport events refitting the camera. Fixes preserve typed creation,
-use state-specific menus, window-space ordered gesture deltas, retained owner and
-actual-size resize checks. App tests also exposed Architecture placement leaking
-into Behavior selection; the two view selections are now separate.
-
-First direct-state Windows verification:231 desktop tests and strict desktop
-all-target Clippy passed, logs `D:/CodexBuilds/Capella2-state-direct-{tests,clippy}.log`.
-Native trial2A4B5C11 created a new SA StateMachine and dedicated view; it reproduced
-missing box fills/borders while text remained. Iced WGPU appends parent meshes after
-clipped children: the opaque parent background covered every node. The fix moves
-the content background into the clip and restricts the outer fill to the guidance
-strip. Native re-verification remains required. Saved reproduction is
-`ui-state-direct-01/project.arcadia`,42objects/25links/2 expected incomplete-machine
-checks. Trial window1442250 received normal close after verified Save; re-inventory.
-
-Latest verification:551 Windows workspace tests (277core,236desktop,38server)
-and strict workspace all-target Clippy passed. A single let-and-return lint in the
-new label hit helper was fixed without changing behavior. Subsequent compact-toolbar
-changes passed desktop Clippy and build. Exact logs use `state-direct-workspace-*`
-and `state-compact-*` under D:/CodexBuilds.
-
-Native82AE5A2C closed the missing-shapes bug; root directly created Region, Initial,
-State, first-drag Initial→State transition, selected without motion, moved/undid the
-state, created Internal Monitor communications with generated After30s Event,
-Undo/Redo of both, and Fold/Unfold via right-click. Saved trial46objects/27links/1
-remaining model check uses ui-state-direct-01/project.arcadia; its original empty
-machine fixture is preserved in baseline-before-editing. Minimum1100x700 exposed
-excessive toolbar height; latest build removes selected-action row and shortens
-state heading. Native recheck is pending, along with reconnection, nested composite,
-Linux state runtime and independent final runtime review.
-
-Additional review/native fixes: Fold retains semantic selection; placement property
-Apply retains Behavior view without overwriting Architecture view. Initial names
-choose among12 deterministic route-aware positions, and label hit testing uses the
-same cached rectangle. This closes the observed rightward-line/name collision in
-code; native verification of this last refinement remains pending.
-
-Root owns integration/native input; all workers have returned files. Every worktree
-uses its own Cargo target. Main remains ad7feb5; state work is isolated and not yet
-accepted into main. No release-completion claim.
-
-## Exact next actions
-
-1. Rebuild and verify the state rendering fix on the saved native reproduction;
-   complete real state creation, connections, folding, form edit, Save/reopen and
-   minimum-size trials. Commit only after reviewed behavior is demonstrated.
-2. Finish state-edit acceptance with explicit retained
-   behavior view, creation in a region, movement, transition drawing/reconnection,
-   guarded forms, discoverable missing placements, pan/zoom and contextual actions.
-   Build/run/test native at default/minimum sizes; review/reproduce/fix findings.
-3. Continue direct scenario/process gestures, R3 semantic drift/reconciliation,
-   R6 data contracts, persistent coverage/filters, Home/recent/recovery, hosted ETag
-   workflows, offline guidance and normative contracts. All remain release work.
-4. Fresh final requirements/domain/correctness/native UX/architecture reviews;
-   Windows/Linux/MSRV checks, actual runtime, docs and packages/checksums before
-   completing the broad goal. V2 or a subsystem checkpoint is insufficient.
-
-## Native safety and environment
-
-Root owns native input. Final Windows1EEBDC3C window2100032/exec55548 is saved on
-its isolated41/26 trial. Earlier windows524634 and328292 are saved on the Standard
-and auto-port review fixtures. Re-inventory and inspect current dirty state before
-operating any window. Protected user7210312 and earlier6228978 were absent; root did
-not close them and makes no recovery claim. If either returns, do not save/reset/close.
-
-Main Windows target `D:/CodexBuilds/Capella2-01a06e2e`; Rust1.98.1. Use `cargo test
---locked --workspace`, `cargo clippy --locked --workspace --all-targets -- -D warnings`
-and `cargo build --locked -p oa-desktop -p oa-server`. WSL Ubuntu24.04 uses the
-existing target/linux-cargo.toml vendor config and its own linux-target; launch
-with WGPU_BACKEND=vulkan and the Mesa lvp ICD. Release evidence lives under
-`D:/CodexBuilds/Capella2-release1-01a06e2e`. No remote push or usage reset is authorized.
-Do not retry the previously rejected broad recursive target deletion.
+Linux is WSL Ubuntu-24.04, not the separate unconfigured Ubuntu distro. Optional
+X11 needs libxkbcommon-x11-0 and the user's sudo password; the user already has the
+exact apt command. Wayland/Windows/REST work is not blocked. Do not bypass auth.
+No remote push, usage reset or broad target cleanup authorized.

harness/TASK_LEDGER.md

@@ -1,66 +1,65 @@
 # Task Ledger — first release
 
-Authoritative objective: attachment `07aee762-7d27-4cbe-81c3-2e82c7170711/goal-objective.md`, read fully on 2026-09-05. STATE.md records execution evidence; PLAN.md is the living strategy; DECISIONS.md and linked release contracts retain detailed rationale.
+Authoritative objective: attachment07aee762-7d27-4cbe-81c3-2e82c7170711/
+goal-objective.md, read fully2026-09-06. STATE.md records execution; PLAN.md retains
+scope; DECISIONS.md and linked contracts preserve rationale.
 
 ## Goal and success criteria
 
-System engineers can develop a coherent OA→SA system model, including iterative changes and evidence, through equivalent graphical, textual and REST workflows. Rust/Iced Windows and Linux release, strict reST semantics, navigable offline concepts/tutorials, and reproducible build/run/evaluation instructions. Later Arcadia layers are future releases. Completion requires actual native workflows, automated invariants, and fresh cross-disciplinary acceptance, not compilation or a feature count.
+System engineers develop and iteratively reconcile OA/SA models through equivalent
+graphical, textual and REST workflows. Rust/Iced Windows/Linux, strict reST,
+traceability, navigable offline guidance and reproducible deployment. Acceptance
+requires native workflows, semantic evaluators and fresh independent review.
 
 ## Given facts
 
-- User prioritizes engineering usability and Capella domain fidelity, hierarchical containment/allocation displays, real function/component ports and intuitive transitions in both directions.
-- Text-only model development must be practical; modular files/includes are the proposed answer to the current huge flat file.
-- Drag selection must remain stable; behavior/scenario canvases must support direct editing consistent with architecture.
-- Git and worktrees are authorized. Remote publication is not requested.
-- Connection routes need explicit bend points/customization or sufficiently effective automatic routing. User observed straight connections prevent readable diagrams. Treat saved per-diagram routes and practical obstacle avoidance as a primary requirement, not visual decoration.
+- User prioritizes Capella domain fidelity, hierarchy, typed ports and intuitive
+  transitions in both directions, without its clutter and navigation friction.
+- Direct exchange drawing must avoid large endpoint dropdowns; ports must move
+  between sides; contextual menus should replace persistent action clutter.
+- Modular source must be practical for humans/AI and Git. Text/graph/API parity is
+  required. Behavior canvases must support editing and preserve drag selection.
+- Git/worktrees are authorized. Remote publication is not requested.
 
 ## Verified facts
 
-- Native modular source editing/reopen/repair/recovery passed on Windows at 1100×700. Production nested ownership, structural writeback and coupled REST source bundles now pass an initial 416-test workspace run. Actual service import/comment-only revision/cross-file move/stale ETag passed. Comment fidelity needs independent checks: review exposed owner-opening-line comment reassignment; root reproduced it and all 12 updater tests pass after the fix. Equal-model delete/recreate provenance was also reproduced and fixed in desktop and REST. Native nested workflow and final integrated review/checks remain.
+- Original Capella SAB creates FE function input/output endpoints; component ports
+  are separately Standard/Flow with explicit allocation. Native observations are in
+  release-capella-workflow-benchmark.md; adopted contracts preserve that distinction.
+- Explorer/port discovery, editable routing, nested modular source and coupled REST
+  bundles have scoped Windows/Linux acceptance. Evidence links are in STATE.md.
+- Direct palette connections, four-side port anchors, context menus and source
+  folders passed real Windows/Linux operation. Passive stacked Canvas fixes native
+  tooltip overprint; separate Frames did not. See release-port-drawing.md.
+- Persisted state editing now passes Windows/Linux native and independent review:
+  creation, movement, direct transitions, typed forms, reconnection, fold/reopen.
+  See release-state-editing.md. Scenario/process canvases still need direct editing.
+- Ordinary Document commands atomically synchronize source/model; failed writes
+  retain drafts. Source comments require occurrence/provenance-aware edits, not
+  whole-model equality or flat reformatting. Independent counterexamples were fixed.
+- R3 existing-target reconciliation remains name/description only. R6 data shape
+  expansion is active implementation, not accepted functionality.
 
-- Explorer/port usability accepted at `d364d3c`: actual Windows Actor → Standard port → Boundary Exchange, save/reopen and Undo/Redo; contextual duplicate-name search, 251-root paging, 12-level ancestry and 1100×700 inspection. Linux port save/reopen and font-dependent outline wrapping correction were verified. Exact evidence: release-explorer-usability.md. This resolves the latest discovery/navigation complaint without claiming broader release completeness.
+## Assumptions and open questions
 
-- Native Capella SAB authoring creates function input/output endpoints with an FE. Component ports separately carry Standard/Flow kind, orientation, interface roles and explicit allocated function ports. Details and successfully performed versus merely observed operations are in release-capella-workflow-benchmark.md.
-- Studio uses one typed Project and validated atomic commands across Rust core/desktop/server. Hierarchy projection distinguishes actual allocation from inferred parent summaries; IDs and placement are separate.
-- Drag selection bug fixed and committed `2ef16dc`; 71 desktop tests and real moved-card selection/property editing passed before typed-port integration.
-- Typed ports/schema 3 migration merged at `757ab88`. Existing port identities survive as Legacy and missing FE endpoints are generated deterministically; migration and port tests provide scoped evidence in release-port-core.md/release-port-migration.md.
-- Independent core review reproduced alias reservation and same-transaction allocation replacement defects; fixes have focused regression evidence. Typed desktop integration `fa096ce` passed full checks and native creation/generation, undo/redo, save/reopen and no-op synchronization trials. Long-reference previews were inspected at 1440×900 and 1100×700; detailed evidence is in STATE.md.
-- Per-diagram pins and labels, source/API parity and shared orthogonal routing are implemented in `4e5a88d`, `a7c6f96`, `68b1eff` and `30c7db1`. `65fa9ab` resolves all six reproduced default SA label-overlap pairs. Native OA/SA editing, movement/undo, fold restoration, save/reopen, SVG inspection and short gestures at 1100×700 passed. Routing code/native acceptance and independent native follow-up are complete at `23535b4`; exact scope is recorded in release-routing-verification.md.
-- The source experiment passed 23 tests, but an independent probe reproduced positional item-comment misattachment, shorthand description rejection and unsupported deletion. Whole-model equality does not establish source-comment fidelity. The production updater retained comment attachment on the same reorder probe; extend its parser/updater instead of copying the experimental parallel implementation.
-- Current behavior diagrams derive geometry and only handle selection; direct behavior editing remains a product gap. The source editor retains modular accepted source; nested element syntax and cross-file graphical updates passed Windows/Linux native acceptance at4e8575b. Port/exchange/steps shorthand remains an independent future implementation slice required by the current authoring strategy.
-- Independent source review exposed declaration/comment reassignment during UUID changes and swaps, Linux FIFO hangs during disk admission, file-mode changes on save, and overlong detached-file receipt lifetimes. Command provenance, pre-open regular-file admission, permission retention and saved-detach receipt retirement resolve the reproduced cases. Exact probes and test scopes are in STATE.md.
+- Nested aggregate files reduce cognitive load; any additional port/exchange/step
+  shorthand must justify grammar complexity through real authoring tasks.
+- State placements proved viable without a second geometry system. Scenario/chain
+  gestures still need their own occurrence/order semantics and task verification.
+- Routing offers a usable initial path plus manual pins; arbitrary dense diagrams
+  are not guaranteed crossing-free. Measured dense full solve119ms remains a limit.
+- R3 typed historical bodies plus finite proposals appear simpler than a separate
+  recursive semantic-value schema. This candidate awaits R6 freeze and review.
 
-## Assumptions to test
+## Decisions and current strategy
 
-- Aggregate-oriented source files will reduce cognitive load enough for routine engineering edits; file splitting alone may leave declaration syntax too flat.
-- Behavior layout can reuse NodePlacement plus typed diagram context without duplicating semantic state; reconnection/reordering must preserve existing occurrence/relation identities.
-- Editable per-diagram bends and the automatic initial route passed the recorded workshop trials. This does not guarantee an ideal arrangement or zero crossings for arbitrary models; the measured dense release full solve is 119 ms, above the initial 100 ms target.
-- Source comments and ownership can survive graphical edits by replacing only changed declaration spans. Generated IDs must stabilize before subsequent text edits.
+Preserve one typed core and validated command boundary. Retain current typed ports;
+R6 uses schema/source4 with explicit1/2/3 migration and no intermediate public4
+shape. Freeze payload, defaults, inheritance, associations and identified interface
+allocations together. Preserve lexical includes/comments during migration.
 
-## Open questions
-
-- Which port/exchange/steps shorthand constructs add enough clarity to justify extending the accepted nested ownership syntax? Preserve comment attachment, exact source Undo and complete edit/delete support against the independent probe cases.
-- What remaining OA/SA gaps materially block target workflows? R3 semantic reconciliation, R6 data contracts, directly editable behavior, lifecycle/recovery and hosted editing remain in the release plan.
-
-## Candidate designs and current decisions
-
-- Source candidates compared explicit source3 aggregate files/includes with nested owner/context syntax lowering to the same model. The chosen implementation direction extends the production parser/span index and shared updater for selected constructs, preserving the pure bundle foundation. Do not copy the experiment's separate parser/writer. Freeze grammar only after comment ownership, edit/delete coverage, invalid drafts and exact source Undo pass their acceptance tasks.
-- Behavior alternatives: independent UI-only coordinates, new behavior-layout schema, or existing diagram placements with explicit context. Prefer the last candidate provisionally: it preserves text/API parity and command history without a second geometry system. Validate on direct state-machine creation/move/reconnect before extending all behavior views.
-- Ports: adopted typed separation based on official metamodel plus direct native evidence; rejected generic InOut/interface port conflation and inferred allocation facts. See release-port-contract.md. Revisit only with contradictory domain evidence or concrete usability failures.
-- Routing: a unique per-diagram route list references existing relation/trace IDs; pinned points and relative label placement are persisted, while orthogonal segments are derived by a shared pure router. This avoids duplicate semantic edge identities and preserves text/API/SVG parity. Folded endpoint promotion suspends custom geometry without deleting it. See release-routing-contract.md.
-
-## Current strategy and evaluators
-
-Accept native per-file editing, safe project saves and exact source Undo, then extend production source parsing/updating using the independent probe findings as regressions and integrate REST bundles. Linux routing is accepted with actual WSLg Save/reopen; all11 current Linux disk integration tests also pass. Full release Linux acceptance remains open. Prototype persisted direct behavior gestures next. Continue R3 reconciliation, R6 data contracts, lifecycle/recovery, hosted editing, offline guidance and fresh Windows/Linux release acceptance; no subsystem checkpoint constitutes release completion.
-
-Meaningful progress now includes verified drag and typed-port authoring, accepted editable routing with native save/reopen, group movement and minimum-size evidence, and tested source-bundle/nested-writeback foundations with independent limitations exposed. Production source and direct behavior usability remain open engineering tasks; feature counts alone do not establish completion.
-
-Current user-directed drawing evidence: palette creation and draggable per-placement port anchors passed scoped native Windows trials with Save/reopen; full485 Windows and488 Linux workspace suites passed before final pointer-release and hover refinements. Fresh independent review exposed post-release motion turning clicks into edits, nearest-port mispicking at overview zoom, and missing target identity feedback. The first two have production regressions and fixes; named owner/alias hover details and source-preserving pan are implemented, with final native acceptance pending. See release-port-drawing.md. The preceding goal turn made concrete progress through implementation, saved source/SVG artifacts, actual runtime verification and reproduced findings; it was not a wait or no-progress turn. Direct behavior and the broader release requirements remain active.
-2026-09-06 follow-up: direct drawing, movable ports, menus and source folders now
-have scoped native Windows/Linux acceptance. Independent QA falsified the initial
-separate-Frame tooltip fix; a real stacked GPU layer passed native retest. Current
-main Windows193 desktop tests and Linux189+4 focused tests passed. Independent
-state/representation/lifecycle integration passed514 Windows workspace tests and
-strict Clippy in its isolated checkout. Direct state-canvas authoring is underway;
-all broader release requirements remain active. This turn made concrete implementation,
-review and runtime progress, not a blocked or waiting-only turn. See STATE.md.
+Finish and independently verify R6, then semantic R3 reconciliation and direct
+scenario/process gestures. Complete lifecycle/recovery, hosted editing, guidance
+and fresh cross-disciplinary Windows/Linux acceptance. No subsystem checkpoint
+completes the first release. Current work is making measured implementation,
+review and runtime progress; no external blocker exists.

harness/release-state-editing.md

@@ -0,0 +1,91 @@
+# Direct state editing — acceptance evidence
+
+Accepted production source:316dc55,2026-09-06. This is the state-machine slice of
+direct behavior editing, not acceptance of scenario/process gestures or the release.
+
+## Delivered behavior and boundaries
+
+Dedicated typed StateMachine views reuse persistent placements and shared core
+projection/routing. Palette creation inside explicit owners, nested group movement,
+direct external transitions, endpoint reconnection, typed Local/Internal/timed
+forms, fold/unfold/hide, placement editing and pan/zoom/Fit use ordinary atomic
+Document commands. Behavior selection/view is independent of Architecture.
+Creation places missing ancestry in the same command; dragging never reparents.
+Internal transitions are rows; Entry/Exit symbols snap to the containing boundary.
+Reconnection preserves relation identity and other fields and validates atomically.
+
+Invalid drafts survive rejected writes. Save/Close/navigation/mutations account
+for behavior drafts; passive viewport events do not apply forms. Ordered window
+coordinates prevent selection-induced layout changes corrupting drag displacement.
+Same-view returns retain camera/tool; actual machine/view changes reset and fit.
+
+## Automated and independent evidence
+
+- Full551 Windows workspace tests (277core,236desktop,38server) and strict workspace
+  all-target Clippy at e0b2210; full554 Linux (280core,236desktop,38server), strict
+  workspace Clippy and optimized desktop build from an isolated checkout/target.
+- Final316dc55:241 desktop tests and strict desktop all-target Clippy on Windows
+  and Linux, plus successful desktop builds. Five navigation regressions supplement
+  the earlier suite. Four tested pre-fix navigation scenarios failed as predicted;
+  all14 state App tests passed after the fix.
+- Two guide tests passed after5ce3eef. State source/JSON round trips, reference and
+  membership rules, atomic command planners, draft lifecycle and two actual HTTP
+  state-contract tests passed in the earlier integration. HTTP tests exercised
+  rejection, revision/source atomicity and restart.
+- Independent native report:
+  D:/CodexBuilds/Capella2-release1-01a06e2e/state-independent-native-review.md.
+  Independent architecture review found camera/tool leakage after Catalog/Layer
+  owner changes;316dc55 closes it. No material review finding remains in this slice.
+
+## Actual Windows operation
+
+Root created a machine/view, Region, Initial and State, drew Initial→State by its
+first drag, moved/undid State, created a timed Internal transition and generated
+After30s event, undid/redid both, folded/unfolded and saved. Actual GPU shape hiding
+was reproduced, fixed and retested; route-aware Initial label placement was also
+verified through movement and selecting the relocated label.
+
+An independent reviewer operated DE2723E7 at1440x900 and1100x700: nested Region
+and State creation, composite descendant movement, semantic fold selection,
+actual target-handle reconnect, invalid Initial target/Escape, placement width Apply
+remaining in Behavior, EntryPoint creation, typed Local transition, contextual
+reconnect and Save All/actual reopen. Final fixture49objects/28links/1check.
+The remaining check explicitly asks for a machine owner on this root-level test
+machine; it is intentionally incomplete model content.
+
+Root operated final316dc55 binary31A7E8505838FE99B73072B90D32072C280AF494F039710448D8AE36651C05ED:
+created a second machine view, panned A, armed Region, left/returned through
+Architecture and observed preserved94% camera/tool. Selected B through Model
+explorer and returned to Behavior:78% Fit and Select/move, with no inherited pan.
+Save All completed; runtime.log0bytes.
+
+## Actual Linux operation
+
+Root operated e0b2210 ELF1525135FDA1C4A0E42DC6EB9CD6F8FE4DCB30A1690ABA48AD1F3E8E9528DFC05
+through WSLg at1440x900. Opened an isolated empty-machine baseline; created Region,
+Initial and State, first-drag Initial→State, first State movement with correct
+selection/reroute, Undo/Redo, Fold and Save. Actual reopen retained collapse;
+Unfold restored moved vertices and transition. Saved45objects/26links/1owner check.
+Empty runtime log; normal close, exec72680 exit0.
+
+Root then operated final316dc55 ELF
+e2c2945a2fc750774a925eee33b5b1620c6537580b7ab502e97f44cbb4c4bab8
+on the saved two-view49/28/1 fixture. Panned A and armed Region; Architecture round
+trip retained94% camera/tool. Model explorer selected B; Behavior fitted78% and
+reset to Select/move. Empty runtime log; normal close, exec46107 exit0.
+
+## Reproduction artifacts and limits
+
+Evidence root:D:/CodexBuilds/Capella2-release1-01a06e2e. Saved models and immutable
+binaries are in ui-state-direct-01, ui-state-direct-03, ui-state-linux,
+ui-state-navigation-windows and ui-state-navigation-linux. Final Linux directory
+contains build-manifest.json, SHA256SUMS, desktop test/Clippy/build logs. Windows
+logs use D:/CodexBuilds/Capella2-state-navigation-*; full baseline logs use
+Capella2-state-direct-workspace-* and ui-state-linux/VERIFICATION.md.
+
+Native Linux minimum-size testing is not claimed;1100x700 evidence is Windows.
+Independent native review did not cover every pseudo kind, source-handle or Local
+reconnection, concurrent regions, guard/effect edits or full dirty-close matrix.
+Automated checks cover relevant semantics/lifecycle but are not relabeled native
+trials. Fitting a nested diagram at55% produces small labels; use zoom/pan to work.
+Scenario/process direct editing remains required release work.

harness/release-state-gesture-design.md

@@ -1,7 +1,10 @@
 # Direct state editing — bounded design, 2026-09-05
 
-Read-only investigation; implementation and native verification remain pending.
-Connection routing became the user's next priority after this design handoff.
+Originally a read-only proposal. Implemented in the isolated state-integration
+checkout through e0b2210; current verification and outstanding acceptance are in
+STATE.md. The old file/line seams below describe the pre-implementation baseline.
+State layouts now use the typed context and commands proposed here; full scenario
+and process direct editing remain separate release work.
 
 ## Decision and first task
 
@@ -121,4 +124,6 @@ behavior view independently of selection, including root Events. Reconnect
 clones the relation and changes one endpoint; preserve all other data and reject
 invalid cardinalities. Keep form editing in a bounded panel so the canvas remains
 usable at 1100×700. These are decision-ready interfaces; no implementation or
-native gesture acceptance is claimed.
+native gesture acceptance is claimed by this design record. The implemented
+contract and subsequent acceptance evidence are in release-state-editing.md;
+production316dc55 closes the direct state slice, while scenario/process work remains.