Add Scenario sibling-block planner on integrated presentation model

crates/oa-desktop/src/behavior/scenario.rs

@@ -6,6 +6,7 @@ use iced::widget::{Column, column, text_input};
 use std::{cell::RefCell, collections::BTreeSet};
 mod camera;
 pub(crate) mod focus;
+pub(crate) mod group_reorder;
 pub(crate) mod spacing;
 use super::scenario_layout::{
     Representation,
@@ -1253,26 +1254,21 @@ pub(crate) fn reorder(
     occurrence: Id,
     slot: Slot,
 ) -> Result<Command, String> {
-    let to = slot_index(p, owner, slot)?;
-    if p.elements.get(&occurrence).and_then(|e| e.parent) != Some(slot.parent) {
-        return Err(
-            "Reorder inside the occurrence's current sequence; dragging never changes its operand."
-                .into(),
-        );
+    let prepared = group_reorder::Prepared::new(
+        std::sync::Arc::new(p.clone()),
+        owner,
+        &[crate::diagram_usage::Target::ScenarioObject(occurrence)],
+    )?;
+    match prepared.plan(slot)? {
+        group_reorder::Plan::Change(command) => Ok(*command),
+        group_reorder::Plan::Noop => Ok(Command::SetSteps(
+            slot.parent,
+            p.elements[&slot.parent]
+                .steps()
+                .expect("admitted sequence")
+                .clone(),
+        )),
     }
-    let mut steps = p.elements[&slot.parent]
-        .steps()
-        .expect("slot validated")
-        .clone();
-    let from = steps
-        .iter()
-        .position(|id| *id == occurrence)
-        .ok_or("This occurrence is not in the sequence.")?;
-    steps.remove(from);
-    steps.insert(to - usize::from(from < to), occurrence);
-    let command = Command::SetSteps(slot.parent, steps);
-    execute_batch(p, std::slice::from_ref(&command)).map_err(|error| error.to_string())?;
-    Ok(command)
 }
 fn compatible_binding(p: &Project, referenced: Id, local: Id) -> bool {
     represented(p, referenced)

crates/oa-desktop/src/behavior/scenario/group_reorder.rs

@@ -0,0 +1,179 @@
+//! Frozen, all-or-nothing reorder of one immediate Scenario sequence.
+use super::Slot;
+use crate::diagram_usage::Target;
+use oa_core::{Command, Id, Kind, OccurrenceBody, Project, SharedBody, execute_batch};
+use std::{collections::BTreeSet, sync::Arc};
+
+#[derive(Debug)]
+pub(crate) enum Plan {
+    Noop,
+    Change(Box<Command>),
+}
+
+pub(crate) struct Prepared {
+    project: Arc<Project>,
+    parent: Id,
+    original: Vec<Id>,
+    selected: BTreeSet<Id>,
+}
+
+fn step_body(project: &Project, id: Id) -> Option<&OccurrenceBody> {
+    match project.elements.get(&id)?.shared()? {
+        SharedBody::Occurrence { body, .. }
+            if matches!(
+                body,
+                OccurrenceBody::Exchange { .. }
+                    | OccurrenceBody::Action { .. }
+                    | OccurrenceBody::State { .. }
+                    | OccurrenceBody::ScenarioUse { .. }
+                    | OccurrenceBody::Fragment { .. }
+            ) =>
+        {
+            Some(body)
+        }
+        _ => None,
+    }
+}
+
+// Follow the same structural edges that make rows visible; parent pointers alone
+// would admit children of an operand omitted from its fragment's branch list.
+fn reachable_parent(project: &Project, owner: Id, wanted: Id) -> bool {
+    let mut pending = vec![owner];
+    let mut visited = BTreeSet::new();
+    while let Some(parent) = pending.pop() {
+        if !visited.insert(parent) {
+            continue;
+        }
+        if parent == wanted {
+            return true;
+        }
+        let Some(steps) = project.elements.get(&parent).and_then(|e| e.steps()) else {
+            continue;
+        };
+        for id in steps {
+            if project.elements.get(id).and_then(|e| e.parent) != Some(parent) {
+                continue;
+            }
+            if let Some(OccurrenceBody::Fragment { branches, .. }) = step_body(project, *id) {
+                pending.extend(branches.iter().copied().filter(|branch| {
+                    project.elements.get(branch).is_some_and(|element| {
+                        element.parent == Some(*id)
+                            && matches!(
+                                element.shared(),
+                                Some(SharedBody::Occurrence {
+                                    body: OccurrenceBody::Branch { .. },
+                                    ..
+                                })
+                            )
+                    })
+                }));
+            }
+        }
+    }
+    false
+}
+
+impl Prepared {
+    pub(crate) fn new(
+        project: Arc<Project>,
+        owner: Id,
+        targets: &[Target],
+    ) -> Result<Self, String> {
+        if project.elements.get(&owner).map(|e| e.kind()) != Some(Kind::Scenario) {
+            return Err("This scenario no longer exists.".into());
+        }
+        let mut selected = BTreeSet::new();
+        let mut parent = None;
+        for target in targets {
+            let Target::ScenarioObject(id) = target else {
+                return Err("Select only ordered occurrences in this scenario.".into());
+            };
+            if !selected.insert(*id) || step_body(&project, *id).is_none() {
+                return Err(
+                    "Every selected subject must be a unique ordered scenario occurrence.".into(),
+                );
+            }
+            let actual = project.elements[id]
+                .parent
+                .ok_or("The occurrence has no sequence.")?;
+            if parent.is_some_and(|parent| parent != actual) {
+                return Err(
+                    "Reorder inside one immediate sequence; dragging never changes operands."
+                        .into(),
+                );
+            }
+            parent = Some(actual);
+        }
+        let parent = parent.ok_or("Select at least one occurrence.")?;
+        if !reachable_parent(&project, owner, parent) {
+            return Err("The selected sequence is not reachable in this scenario.".into());
+        }
+        let original = project.elements[&parent]
+            .steps()
+            .ok_or("The parent is not a sequence.")?
+            .clone();
+        let mut listed = BTreeSet::new();
+        for id in &original {
+            if !listed.insert(*id)
+                || step_body(&project, *id).is_none()
+                || project.elements[id].parent != Some(parent)
+            {
+                return Err("The complete sequence must contain unique, existing occurrences of this parent.".into());
+            }
+        }
+        if !selected.is_subset(&listed) {
+            return Err("A selected occurrence is not in this sequence.".into());
+        }
+        // Cache a validated immutable baseline, including descendants and other
+        // sequences. Advisory authoring diagnostics deliberately remain allowed.
+        oa_core::session::validate_candidate(&project).map_err(|e| e.to_string())?;
+        Ok(Self {
+            project,
+            parent,
+            original,
+            selected,
+        })
+    }
+
+    pub(crate) fn plan(&self, slot: Slot) -> Result<Plan, String> {
+        if slot.parent != self.parent {
+            return Err("Reorder inside the occurrence's current sequence; dragging never changes its operand.".into());
+        }
+        if let Some(anchor) = slot.before {
+            if !self.original.contains(&anchor) {
+                return Err("The insertion slot changed. Choose its position again.".into());
+            }
+            if self.selected.contains(&anchor) {
+                return Ok(Plan::Noop);
+            }
+        }
+        let mut steps: Vec<_> = self
+            .original
+            .iter()
+            .copied()
+            .filter(|id| !self.selected.contains(id))
+            .collect();
+        let at = slot.before.map_or(steps.len(), |anchor| {
+            steps
+                .iter()
+                .position(|id| *id == anchor)
+                .expect("admitted anchor")
+        });
+        steps.splice(
+            at..at,
+            self.original
+                .iter()
+                .copied()
+                .filter(|id| self.selected.contains(id)),
+        );
+        if steps == self.original {
+            return Ok(Plan::Noop);
+        }
+        let command = Command::SetSteps(self.parent, steps);
+        execute_batch(&self.project, std::slice::from_ref(&command)).map_err(|e| e.to_string())?;
+        Ok(Plan::Change(Box::new(command)))
+    }
+}
+
+#[cfg(test)]
+mod tests;

crates/oa-desktop/src/behavior/scenario/group_reorder/tests.rs

@@ -0,0 +1,720 @@
+use super::*;
+use crate::{behavior::topology::occurrence, document::Document};
+use oa_core::{FragmentOperator, Layer, LifelineBinding, MessageKind, language};
+
+fn add(p: &mut Project, parent: Id, name: &str, body: OccurrenceBody) -> Id {
+    let e = occurrence(p, parent, name, body);
+    let id = e.id;
+    p.elements.insert(id, e);
+    p.elements
+        .get_mut(&parent)
+        .unwrap()
+        .steps_mut()
+        .unwrap()
+        .push(id);
+    id
+}
+fn row(p: &mut Project, parent: Id, name: &str) -> Id {
+    add(
+        p,
+        parent,
+        name,
+        OccurrenceBody::Action {
+            action: None,
+            lifeline: None,
+        },
+    )
+}
+fn operand(p: &mut Project, parent: Id, operator: FragmentOperator) -> (Id, Id) {
+    let fragment = add(
+        p,
+        parent,
+        "Fragment",
+        OccurrenceBody::Fragment {
+            operator,
+            branches: vec![],
+        },
+    );
+    let branch = occurrence(
+        p,
+        fragment,
+        "Operand",
+        OccurrenceBody::Branch {
+            guard: "ready".into(),
+            occurrences: vec![],
+        },
+    );
+    let id = branch.id;
+    p.elements.insert(id, branch);
+    if let Some(SharedBody::Occurrence {
+        body: OccurrenceBody::Fragment { branches, .. },
+        ..
+    }) = p.elements.get_mut(&fragment).unwrap().shared_mut()
+    {
+        branches.push(id);
+    }
+    (fragment, id)
+}
+fn prepare(p: &Project, owner: Id, ids: &[Id]) -> Result<Prepared, String> {
+    Prepared::new(
+        Arc::new(p.clone()),
+        owner,
+        &ids.iter()
+            .copied()
+            .map(Target::ScenarioObject)
+            .collect::<Vec<_>>(),
+    )
+}
+fn slot(parent: Id, before: Option<Id>) -> Slot {
+    Slot { parent, before }
+}
+fn ordered(p: &Project, parent: Id, ids: &[Id]) -> Project {
+    let mut expected = p.clone();
+    *expected
+        .elements
+        .get_mut(&parent)
+        .unwrap()
+        .steps_mut()
+        .unwrap() = ids.to_vec();
+    expected
+}
+fn exact_transaction(p: &Project, plan: Plan, expected: Project) {
+    let Plan::Change(command) = plan else {
+        panic!("expected a change")
+    };
+    assert_eq!(
+        execute_batch(p, std::slice::from_ref(&command)).unwrap(),
+        expected
+    );
+    let mut doc = Document::from_project(p.clone(), Default::default()).unwrap();
+    let original_source = doc.bundle().clone();
+    doc.execute(*command).unwrap();
+    assert_eq!(doc.project(), &expected);
+    assert_eq!(
+        language::parse(&language::format(doc.project())).unwrap(),
+        expected
+    );
+    let changed_source = doc.bundle().clone();
+    assert_eq!(
+        Document::from_bundle(changed_source.clone(), Default::default())
+            .unwrap()
+            .project(),
+        &expected
+    );
+    assert!(doc.undo());
+    assert_eq!(doc.project(), p);
+    assert_eq!(doc.bundle(), &original_source);
+    assert!(!doc.can_undo());
+    assert!(doc.redo());
+    assert_eq!(doc.project(), &expected);
+    assert_eq!(doc.bundle(), &changed_source);
+    assert!(!doc.can_redo());
+}
+fn four(nested: bool) -> (Project, Id, Id, [Id; 4]) {
+    four_in_layer(nested, Layer::Oa)
+}
+fn four_in_layer(nested: bool, layer: Layer) -> (Project, Id, Id, [Id; 4]) {
+    let mut p = Project::empty();
+    let owner = p
+        .add_element(oa_core::Kind::Scenario, layer, "Scenario", None)
+        .unwrap();
+    let parent = if nested {
+        operand(&mut p, owner, FragmentOperator::Alternative).1
+    } else {
+        owner
+    };
+    let ids = ["A", "B", "C", "D"].map(|name| row(&mut p, parent, name));
+    oa_core::session::validate_candidate(&p).unwrap();
+    (p, owner, parent, ids)
+}
+
+#[test]
+fn root_and_operand_use_semantic_block_order_with_exact_history() {
+    for (nested, layer) in [
+        (false, Layer::Oa),
+        (true, Layer::Oa),
+        (false, Layer::Sa),
+        (true, Layer::Sa),
+    ] {
+        let (p, owner, parent, [a, b, c, d]) = four_in_layer(nested, layer);
+        let prepared = prepare(&p, owner, &[c, a]).unwrap();
+        exact_transaction(
+            &p,
+            prepared.plan(slot(parent, Some(d))).unwrap(),
+            ordered(&p, parent, &[b, a, c, d]),
+        );
+        exact_transaction(
+            &p,
+            prepared.plan(slot(parent, None)).unwrap(),
+            ordered(&p, parent, &[b, d, a, c]),
+        );
+    }
+}
+
+#[test]
+fn singleton_wrapper_noop_preserves_existing_redo_and_source() {
+    for nested in [false, true] {
+        let (p, owner, parent, [a, b, c, d]) = four(nested);
+        let mut doc = Document::from_project(p.clone(), Default::default()).unwrap();
+        let change = super::super::reorder(doc.project(), owner, a, slot(parent, None)).unwrap();
+        doc.execute(change).unwrap();
+        assert_eq!(doc.project(), &ordered(&p, parent, &[b, c, d, a]));
+        let changed = doc.bundle().clone();
+        assert!(doc.undo());
+        let source = doc.bundle().clone();
+        let revision = doc.revision();
+        for before in [Some(a), Some(b)] {
+            let noop =
+                super::super::reorder(doc.project(), owner, a, slot(parent, before)).unwrap();
+            doc.execute(noop).unwrap();
+            assert_eq!(doc.project(), &p);
+            assert_eq!(doc.bundle(), &source);
+            assert_eq!(doc.revision(), revision);
+            assert!(!doc.can_undo());
+            assert!(doc.can_redo());
+        }
+        assert!(doc.redo());
+        assert_eq!(doc.bundle(), &changed);
+    }
+}
+
+#[test]
+fn selected_anchor_and_exact_noop_preserve_redo_and_frozen_snapshot() {
+    let (p, owner, parent, [a, b, c, d]) = four(false);
+    let prepared = prepare(&p, owner, &[c, a]).unwrap();
+    let mut doc = Document::from_project(p.clone(), Default::default()).unwrap();
+    let Plan::Change(command) = prepared.plan(slot(parent, Some(d))).unwrap() else {
+        panic!()
+    };
+    doc.execute(*command).unwrap();
+    let changed = doc.bundle().clone();
+    assert!(doc.undo());
+    let source = doc.bundle().clone();
+    let revision = doc.revision();
+    for plan in [
+        prepared.plan(slot(parent, Some(c))),
+        prepare(&p, owner, &[a])
+            .unwrap()
+            .plan(slot(parent, Some(b))),
+        prepare(&p, owner, &[c, d])
+            .unwrap()
+            .plan(slot(parent, None)),
+    ] {
+        assert!(matches!(plan.unwrap(), Plan::Noop));
+        assert_eq!(doc.project(), &p);
+        assert_eq!(doc.bundle(), &source);
+        assert_eq!(doc.revision(), revision);
+        assert!(doc.can_redo());
+    }
+    assert!(doc.redo());
+    assert_eq!(doc.bundle(), &changed);
+    // The earlier prepared value still plans from its original owned snapshot.
+    exact_transaction(
+        &p,
+        prepared.plan(slot(parent, Some(d))).unwrap(),
+        ordered(&p, parent, &[b, a, c, d]),
+    );
+}
+
+#[test]
+fn admission_rejects_every_invalid_member_list_and_destination_before_noop() {
+    let (p, owner, parent, [a, b, c, d]) = four(false);
+    for ids in [vec![], vec![a, a], vec![a, Id::new_v4()]] {
+        assert!(prepare(&p, owner, &ids).is_err());
+    }
+    for target in [Target::Whole, Target::Placement(a)] {
+        assert!(
+            Prepared::new(
+                Arc::new(p.clone()),
+                owner,
+                &[Target::ScenarioObject(a), target]
+            )
+            .is_err()
+        );
+    }
+    let mut with_line = p.clone();
+    let line = with_line
+        .add_element(Kind::Lifeline, Layer::Oa, "Line", Some(owner))
+        .unwrap();
+    assert!(prepare(&with_line, owner, &[a, line]).is_err());
+    let mut nested = p.clone();
+    let (fragment, branch) = operand(&mut nested, owner, FragmentOperator::Alternative);
+    let child = row(&mut nested, branch, "Child");
+    assert!(prepare(&nested, owner, &[a, child]).is_err());
+    assert!(prepare(&nested, owner, &[fragment, child]).is_err());
+    let prepared = prepare(&p, owner, &[a, c]).unwrap();
+    assert!(prepared.plan(slot(branch, Some(a))).is_err());
+    assert!(prepared.plan(slot(parent, Some(Id::new_v4()))).is_err());
+    for list in [vec![a, b, c, b], vec![a, Id::new_v4(), c, d]] {
+        assert!(prepare(&ordered(&p, parent, &list), owner, &[a, c]).is_err());
+    }
+    let mut wrong_parent = p.clone();
+    wrong_parent.elements.get_mut(&b).unwrap().parent = Some(branch);
+    assert!(prepare(&wrong_parent, owner, &[a, c]).is_err());
+    for body in [
+        OccurrenceBody::Control {
+            kind: oa_core::ControlKind::Choice,
+        },
+        OccurrenceBody::SequenceReference { sequence: None },
+    ] {
+        let mut wrong_type = p.clone();
+        if let Some(SharedBody::Occurrence { body: actual, .. }) =
+            wrong_type.elements.get_mut(&b).unwrap().shared_mut()
+        {
+            *actual = body;
+        }
+        assert!(prepare(&wrong_type, owner, &[a, c]).is_err());
+    }
+    if let Some(SharedBody::Occurrence {
+        body: OccurrenceBody::Fragment { branches, .. },
+        ..
+    }) = nested.elements.get_mut(&fragment).unwrap().shared_mut()
+    {
+        branches.clear();
+    }
+    assert!(
+        prepare(&nested, owner, &[child]).is_err(),
+        "parent ancestry cannot admit omitted operand"
+    );
+}
+
+#[test]
+fn unlisted_warning_child_is_preserved_but_cannot_be_selected() {
+    let (mut p, owner, parent, [a, b, c, d]) = four(false);
+    let hidden = row(&mut p, parent, "Hidden draft");
+    p.elements
+        .get_mut(&parent)
+        .unwrap()
+        .steps_mut()
+        .unwrap()
+        .pop();
+    assert!(
+        oa_core::validation::validate(&p)
+            .iter()
+            .any(|i| i.code == "unordered_occurrence")
+    );
+    assert!(prepare(&p, owner, &[hidden]).is_err());
+    exact_transaction(
+        &p,
+        prepare(&p, owner, &[c, a])
+            .unwrap()
+            .plan(slot(parent, Some(d)))
+            .unwrap(),
+        ordered(&p, parent, &[b, a, c, d]),
+    );
+}
+
+#[test]
+fn call_reply_moves_as_explicit_stable_pair_and_invalid_baseline_refuses_noop() {
+    let f = super::super::direct_tests::fixture();
+    let mut p = f.project;
+    let x = row(&mut p, f.owner, "X");
+    let y = row(&mut p, f.owner, "Y");
+    p = ordered(&p, f.owner, &[f.call, x, f.reply, y]);
+    let prepared = prepare(&p, f.owner, &[f.reply, f.call]).unwrap();
+    exact_transaction(
+        &p,
+        prepared.plan(slot(f.owner, None)).unwrap(),
+        ordered(&p, f.owner, &[x, y, f.call, f.reply]),
+    );
+    assert!(
+        prepare(&p, f.owner, &[f.reply])
+            .unwrap()
+            .plan(slot(f.owner, Some(f.call)))
+            .unwrap_err()
+            .contains("reply_order")
+    );
+    let invalid = ordered(&p, f.owner, &[f.reply, x, f.call, y]);
+    assert!(prepare(&invalid, f.owner, &[x]).is_err());
+}
+
+#[test]
+fn nested_fragment_descendant_reply_is_validated_and_subtree_preserved() {
+    let f = super::super::direct_tests::fixture();
+    let mut p = f.project;
+    let x = row(&mut p, f.owner, "X");
+    let (fragment, outer) = operand(&mut p, f.owner, FragmentOperator::Alternative);
+    let (_, inner) = operand(&mut p, outer, FragmentOperator::Parallel);
+    p.elements.get_mut(&f.reply).unwrap().parent = Some(inner);
+    p.elements
+        .get_mut(&inner)
+        .unwrap()
+        .steps_mut()
+        .unwrap()
+        .push(f.reply);
+    let y = row(&mut p, f.owner, "Y");
+    p = ordered(&p, f.owner, &[f.call, x, fragment, y]);
+    let prepared = prepare(&p, f.owner, &[fragment, x]).unwrap();
+    assert!(
+        prepared
+            .plan(slot(f.owner, Some(f.call)))
+            .unwrap_err()
+            .contains("reply_order")
+    );
+    exact_transaction(
+        &p,
+        prepared.plan(slot(f.owner, None)).unwrap(),
+        ordered(&p, f.owner, &[f.call, y, x, fragment]),
+    );
+}
+
+#[test]
+fn nested_lifetime_and_opaque_local_bindings_are_checked_without_expansion() {
+    let f = super::super::direct_tests::fixture();
+    let mut p = execute_batch(
+        &f.project,
+        &[Command::Delete(f.reply), Command::Delete(f.call)],
+    )
+    .unwrap();
+    let create = add(
+        &mut p,
+        f.owner,
+        "Create",
+        OccurrenceBody::Exchange {
+            exchange: None,
+            sender: Some(f.sender),
+            receiver: Some(f.receiver),
+            message_kind: MessageKind::Create,
+            reply_to: None,
+            values: vec![],
+            operation: None,
+        },
+    );
+    let x = row(&mut p, f.owner, "X");
+    let (fragment, outer) = operand(&mut p, f.owner, FragmentOperator::Alternative);
+    let (_, inner) = operand(&mut p, outer, FragmentOperator::Parallel);
+    add(
+        &mut p,
+        inner,
+        "Use local",
+        OccurrenceBody::Action {
+            action: None,
+            lifeline: Some(f.receiver),
+        },
+    );
+    let y = row(&mut p, f.owner, "Y");
+    let prepared = prepare(&p, f.owner, &[fragment, x]).unwrap();
+    assert!(
+        prepared
+            .plan(slot(f.owner, Some(create)))
+            .unwrap_err()
+            .contains("lifeline_lifetime")
+    );
+    exact_transaction(
+        &p,
+        prepared.plan(slot(f.owner, None)).unwrap(),
+        ordered(&p, f.owner, &[create, y, x, fragment]),
+    );
+    let definition = p
+        .add_element(Kind::Scenario, Layer::Oa, "Definition", None)
+        .unwrap();
+    let represented = match p.elements[&f.receiver].shared().unwrap() {
+        SharedBody::Lifeline { represented } => *represented,
+        _ => panic!(),
+    };
+    let remote = p
+        .add_element(Kind::Lifeline, Layer::Oa, "Formal", Some(definition))
+        .unwrap();
+    *p.elements.get_mut(&remote).unwrap().shared_mut().unwrap() =
+        SharedBody::Lifeline { represented };
+    let uses = ["First use", "Second use"].map(|name| {
+        add(
+            &mut p,
+            f.owner,
+            name,
+            OccurrenceBody::ScenarioUse {
+                scenario: Some(definition),
+                bindings: vec![LifelineBinding {
+                    referenced: remote,
+                    local: f.receiver,
+                }],
+            },
+        )
+    });
+    let prepared = prepare(&p, f.owner, &[uses[1], uses[0]]).unwrap();
+    assert!(
+        prepared
+            .plan(slot(f.owner, Some(create)))
+            .unwrap_err()
+            .contains("lifeline_lifetime")
+    );
+    exact_transaction(
+        &p,
+        prepared.plan(slot(f.owner, Some(x))).unwrap(),
+        ordered(&p, f.owner, &[create, uses[0], uses[1], x, fragment, y]),
+    );
+}
+
+fn delete_line(p: &mut Project, parent: Id, sender: Id, receiver: Id) {
+    add(
+        p,
+        parent,
+        "Delete participant",
+        OccurrenceBody::Exchange {
+            exchange: None,
+            sender: Some(sender),
+            receiver: Some(receiver),
+            message_kind: MessageKind::Delete,
+            reply_to: None,
+            values: vec![],
+            operation: None,
+        },
+    );
+}
+
+fn second_operand(p: &mut Project, fragment: Id) -> Id {
+    let branch = occurrence(
+        p,
+        fragment,
+        "Other operand",
+        OccurrenceBody::Branch {
+            guard: "otherwise".into(),
+            occurrences: vec![],
+        },
+    );
+    let id = branch.id;
+    p.elements.insert(id, branch);
+    let Some(SharedBody::Occurrence {
+        body: OccurrenceBody::Fragment { branches, .. },
+        ..
+    }) = p.elements.get_mut(&fragment).unwrap().shared_mut()
+    else {
+        panic!()
+    };
+    branches.push(id);
+    id
+}
+
+#[test]
+fn conditional_delete_rejects_moving_an_earlier_use_after_the_fragment() {
+    let f = super::super::direct_tests::fixture();
+    let mut p = f.project;
+    let use_line = add(
+        &mut p,
+        f.owner,
+        "Use participant",
+        OccurrenceBody::Action {
+            action: None,
+            lifeline: Some(f.receiver),
+        },
+    );
+    let x = row(&mut p, f.owner, "X");
+    let (_, branch) = operand(&mut p, f.owner, FragmentOperator::Alternative);
+    delete_line(&mut p, branch, f.sender, f.receiver);
+    row(&mut p, f.owner, "Y");
+    oa_core::session::validate_candidate(&p).unwrap();
+    let prepared = prepare(&p, f.owner, &[x, use_line]).unwrap();
+    assert!(
+        prepared
+            .plan(slot(f.owner, None))
+            .unwrap_err()
+            .contains("lifeline_lifetime")
+    );
+}
+
+#[test]
+fn exclusive_operand_move_is_legal_but_parallel_baseline_is_invalid() {
+    for operator in [FragmentOperator::Alternative, FragmentOperator::Parallel] {
+        let f = super::super::direct_tests::fixture();
+        let mut p = f.project;
+        let (fragment, left) = operand(&mut p, f.owner, operator);
+        let right = second_operand(&mut p, fragment);
+        delete_line(&mut p, left, f.sender, f.receiver);
+        let use_line = add(
+            &mut p,
+            right,
+            "Use participant",
+            OccurrenceBody::Action {
+                action: None,
+                lifeline: Some(f.receiver),
+            },
+        );
+        let x = row(&mut p, right, "X");
+        let y = row(&mut p, right, "Y");
+        if operator == FragmentOperator::Alternative {
+            oa_core::session::validate_candidate(&p).unwrap();
+            exact_transaction(
+                &p,
+                prepare(&p, f.owner, &[x, use_line])
+                    .unwrap()
+                    .plan(slot(right, None))
+                    .unwrap(),
+                ordered(&p, right, &[y, use_line, x]),
+            );
+        } else {
+            // This is an invalid input control, not a valid model broken by reorder.
+            assert!(
+                oa_core::session::validate_candidate(&p)
+                    .unwrap_err()
+                    .to_string()
+                    .contains("lifeline_lifetime")
+            );
+            assert!(prepare(&p, f.owner, &[x, use_line]).is_err());
+        }
+    }
+}
+
+#[test]
+fn repeated_reply_warning_does_not_block_independent_sibling_reorder() {
+    let f = super::super::direct_tests::fixture();
+    let mut p = f.project;
+    let (_, branch) = operand(&mut p, f.owner, FragmentOperator::Loop);
+    p.elements
+        .get_mut(&f.owner)
+        .unwrap()
+        .steps_mut()
+        .unwrap()
+        .retain(|id| *id != f.reply);
+    p.elements.get_mut(&f.reply).unwrap().parent = Some(branch);
+    p.elements
+        .get_mut(&branch)
+        .unwrap()
+        .steps_mut()
+        .unwrap()
+        .push(f.reply);
+    let x = row(&mut p, branch, "X");
+    let y = row(&mut p, branch, "Y");
+    let z = row(&mut p, branch, "Z");
+    let warning = |project: &Project| {
+        oa_core::validation::validate(project).iter().any(|issue| {
+            issue.element == Some(f.reply)
+                && issue.code == "reply_repetition"
+                && issue.severity == oa_core::validation::Severity::Warning
+        })
+    };
+    assert!(warning(&p));
+    let expected = ordered(&p, branch, &[f.reply, y, x, z]);
+    assert!(warning(&expected));
+    exact_transaction(
+        &p,
+        prepare(&p, f.owner, &[z, x])
+            .unwrap()
+            .plan(slot(branch, None))
+            .unwrap(),
+        expected,
+    );
+}
+
+#[test]
+fn semantic_reorder_preserves_affected_and_unrelated_authored_layouts() {
+    use oa_core::{
+        Diagram, DiagramLayout, OccurrenceEndpoint, ProjectionKind, ScenarioLanePosition,
+        ScenarioLayout, ScenarioMessagePosition,
+    };
+    let f = super::super::direct_tests::fixture();
+    let mut p = f.project;
+    let x = row(&mut p, f.owner, "X");
+    let y = row(&mut p, f.owner, "Y");
+    p = ordered(&p, f.owner, &[f.call, x, f.reply, y]);
+    for (alias, offset) in [("group_saved_a", 0.), ("group_saved_b", 1500.)] {
+        let id = Id::new_v4();
+        p.diagrams.insert(
+            id,
+            Diagram {
+                id,
+                alias: alias.into(),
+                name: alias.into(),
+                description: "Preserve my layout".into(),
+                layer: Layer::Oa,
+                projection: ProjectionKind::Scenario { scenario: f.owner },
+                view_options: Default::default(),
+                nodes: Default::default(),
+                routes: vec![],
+                layout: Some(DiagramLayout::Scenario(ScenarioLayout {
+                    lanes: vec![
+                        ScenarioLanePosition {
+                            lifeline: f.sender,
+                            x: -300. + offset,
+                        },
+                        ScenarioLanePosition {
+                            lifeline: f.receiver,
+                            x: 700. + offset,
+                        },
+                    ],
+                    messages: vec![
+                        ScenarioMessagePosition {
+                            address: OccurrenceEndpoint {
+                                references: vec![],
+                                occurrence: f.call,
+                            },
+                            send_y: 123. + offset,
+                        },
+                        ScenarioMessagePosition {
+                            address: OccurrenceEndpoint {
+                                references: vec![],
+                                occurrence: f.reply,
+                            },
+                            send_y: 567. + offset,
+                        },
+                    ],
+                })),
+            },
+        );
+    }
+    let unrelated = p
+        .add_element(Kind::Scenario, Layer::Oa, "Unrelated scenario", None)
+        .unwrap();
+    let line = p
+        .add_element(
+            Kind::Lifeline,
+            Layer::Oa,
+            "Unrelated clock",
+            Some(unrelated),
+        )
+        .unwrap();
+    let timer = add(
+        &mut p,
+        unrelated,
+        "Wait",
+        OccurrenceBody::Exchange {
+            exchange: None,
+            sender: Some(line),
+            receiver: None,
+            message_kind: MessageKind::Timer {
+                expression: "5 s".into(),
+            },
+            reply_to: None,
+            values: vec![],
+            operation: None,
+        },
+    );
+    let diagram = Id::new_v4();
+    p.diagrams.insert(
+        diagram,
+        Diagram {
+            id: diagram,
+            alias: "group_unrelated_saved".into(),
+            name: "Unrelated arrangement".into(),
+            description: "Do not touch this view".into(),
+            layer: Layer::Oa,
+            projection: ProjectionKind::Scenario {
+                scenario: unrelated,
+            },
+            view_options: Default::default(),
+            nodes: Default::default(),
+            routes: vec![],
+            layout: Some(DiagramLayout::Scenario(ScenarioLayout {
+                lanes: vec![ScenarioLanePosition {
+                    lifeline: line,
+                    x: -123.,
+                }],
+                messages: vec![ScenarioMessagePosition {
+                    address: OccurrenceEndpoint {
+                        references: vec![],
+                        occurrence: timer,
+                    },
+                    send_y: 987.,
+                }],
+            })),
+        },
+    );
+    oa_core::session::validate_candidate(&p).unwrap();
+    exact_transaction(
+        &p,
+        prepare(&p, f.owner, &[f.reply, f.call])
+            .unwrap()
+            .plan(slot(f.owner, None))
+            .unwrap(),
+        ordered(&p, f.owner, &[x, y, f.call, f.reply]),
+    );
+}

harness/multiselect-contract-20260923.md

@@ -62,9 +62,11 @@ command or source schema is unnecessary. Preview and commit must consume the
 same plan; tests independently construct expected geometry rather than merely
 comparing those two uses of the implementation.
 
-Process and Scenario layouts are derived from semantic order, not free XY node
-placements. Their group drag must reorder a stable block while retaining its
-internal order and applicable owner/column/operand boundaries. Existing topology
+Process reorder and Scenario occurrence reorder change semantic sequence order.
+Saved Scenario presentations can additionally store lane/message coordinates;
+semantic group reordering preserves those authored records. A sequence group drag
+must reorder a stable block while retaining its internal order and applicable
+owner/column/operand boundaries. Existing topology
 and temporal/lifecycle validation remains authoritative. Qualified reused
 Process content must not silently edit the reusable definition. These adapters
 are required work for the issue, not waived because ordinary diagrams are easier.
@@ -84,8 +86,11 @@ The [explicit Arrange amendment](allocation-arrange-amendment-20260923.md) defin
 the bounded one-or-more work/performer footprint and diagnostic collision domain.
 Its [pure planner evidence](allocation-arrange-planner-20260923.md) and the
 [ordinary assignment foundation](allocation-assignment-planner-20260923.md)
-establish bounded source/planner behavior. App/native group input acceptance
-remains pending.
+establish bounded source/planner behavior. The [Allocation App/native checkpoint](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/57aec979f640ba1b8aa6fcbb7d9e26b29cf51596/harness/allocation-group-app-20260924.md)
+adds bounded Windows group assignment, explicit Arrange and ordinary performer
+acceptance; its limitations and source identity remain explicit. The
+[Scenario reorder policy](scenario-group-reorder-policy-20260924.md) defines the
+strict sibling-block increment without implying adapter or removal acceptance.
 
 ## Related group actions
 

harness/scenario-group-reorder-policy-20260924.md

@@ -0,0 +1,43 @@
+# Scenario group reorder policy
+
+Derived from [issue 29](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/29) and the [multiple-selection contract](multiselect-contract-20260923.md). Accepted design for the next Scenario adapter; this document alone establishes no implementation, native, integration or release acceptance. The original decision inspected `495464e84b5bae8ddad93e9fc69ef353e7f1c884`; the post-prerelease port additionally inspects the combined base `897d9f049406d5be597543eb0a6755b796259302` and preserves its saved Scenario presentation model.
+
+## Operation and identity
+
+A Scenario drag changes semantic sequence order. It moves the exact selected local occurrences as one stable block inside their common immediate Scenario or Branch parent. It does not edit free XY positions, migrate operands, change a referenced definition or automatically select dependencies.
+
+Saved Scenario layouts are separate presentation records. Semantic reorder preserves all authored lane/message coordinates, metadata and other views exactly, even when the changed order requires derived presentation to accommodate those preferences. A future group presentation move is a separate capability; this increment does not silently reinterpret stored coordinates as sequence order. App admission must distinguish the active saved/derived representation and its visit lifetime, including a same-owner representation round trip.
+
+Eligible bodies are Exchange (including lifecycle and timer messages), Action, State, ScenarioUse and Fragment. A Fragment moves as one occurrence; its branches and descendant lists remain unchanged. Lifelines, Branch headers, Process-only occurrence bodies and other typed targets are unsupported movement members. Cross-parent sets and a Fragment plus one of its descendants refuse as a whole. These objects may still be selected and inspected; selection is not movement permission.
+
+Every original target must exist, have its actual eligible body, belong to the same immediate parent and occur exactly once in that parent's list. Check the entire edited list, including unselected entries, for duplicate/missing IDs, body and parent mismatches. The selected parent must be reachable from the active Scenario through the actual sequence lists and Fragment branch lists. An ancestor pointer alone cannot authorize a hidden Branch omitted from its Fragment. The App must also admit against exact current rendered visibility.
+
+An unlisted child is a supported warning-only authoring state: leave it unlisted and unchanged. Integrity of the edited list does not require every parented element to appear in it. Missing optional reference/binding information or loop warnings must not become blanket movement errors. The existing full-project error validator remains authoritative.
+
+## Stable-block transformation
+
+Let `S` be the original parent list and `T` the exact selected set. Form `B` by retaining members of `T` in their order in `S`; form `R` from the other members. The destination is an exact `Slot { parent, before }`.
+
+1. Complete typed/list/reachability admission and validate the unchanged baseline before any no-op result.
+2. Require the destination's same parent and an existing exact anchor, or append.
+3. If the anchor is selected, leave `S` exactly unchanged. Do not normalize to a neighboring row or compact a noncontiguous selection.
+4. Otherwise insert all of `B` before the anchor in `R`, or append. Exact unchanged order is a no-op.
+5. Validate the complete executed candidate. On success use one `SetSteps` transaction; on error change nothing.
+
+For `S=[A,B,C,D]`, selecting C then A and dropping before D produces `[B,A,C,D]`, regardless of primary or pressed member. Dropping that same set before C leaves `[A,B,C,D]`. Selecting `[Call,Reply]` preserves that internal order; it never implicitly selects another reply or expands a referenced Scenario.
+
+Full candidate validation includes unselected descendants. Moving a Fragment ahead of an external Call can invalidate a nested Reply; moving an occurrence with local lifeline use before Create or after a possibly coexecuting Delete must be refused. ALT exclusivity and PAR coexecution cannot be inferred from painted row order. Opaque ScenarioUse bindings remain local lifetime uses under the existing validator, without interprocedural expansion.
+
+## Gesture and transaction requirements
+
+Capture immutable model and exact selection identity before movement. Cache proposals by distinct Slot, not pointer pixels. Before release, verify document, surface, revision, epoch, selection generation and complete membership; refuse a stale set before reconciliation can prune it. Recompute against the same accepted snapshot and execute once through Document. Successful source updates, Undo and Redo each remain one transaction. Refusal and no-op preserve model, source, history branch, selection and primary.
+
+Use the nearest displayed slot, then apply parent admission. A farther legal slot must not replace a nearer invalid operand destination. Feedback identifies the selected count, destination/parent and refusal or no-change reason. A Fragment's interior can contain invalid operand slots even when a header anchor would be a no-op. Pointer/camera/focus lifetime, real selection modifiers and native readability need separate adapter verification; a passing pure planner does not establish them.
+
+## Alternatives and acceptance
+
+Contiguous-only selection rejects useful sibling groups without simplifying nested temporal validation. Stable semantic ordering is therefore preferred. Parent/child normalization silently drops selected intent, while automatic call/reply expansion has no unique closure in the presence of alternative replies, loops and nested fragments. Strict refusal keeps this first increment precise. Revisit these decisions only with an explicit user workflow and a compatible whole-set specification.
+
+Discriminating evaluators include literal whole-Project transformations at root and operand levels, noncontiguous order versus click order, selected-anchor/unchanged no-op with existing redo, malformed unselected entries, omitted Branch reachability, warning-only unlisted children, nested reply/lifetime failures and legal nested-fragment movement. Successful cases must preserve every other sequence, binding, relation, value, ID and metadata record. Use independent source round trips and one-step Document history, not preview/commit agreement alone.
+
+Aggregate removal remains separate required work. Until it exists, an interface displaying a group must refuse legacy primary-only Remove/Delete/reorder actions. Live ownership and progress remain in issue 29.