ARCADIA-Studio/harness/release-behavior-canvas-r123-review-20260911.md

Shared behavior canvas R1/R2/R3 — independent source review

Codex-956atf /root/canvas_review, 2026-09-11. No material source finding remains against the three previously reported R1/R2/R3 counterexamples in this bounded review. This is a source verdict; compilation, mounted tests, pixels and native behavior remain unverified for this freeze.

Reviewed stopped isolated .local/behavior-canvas-worktree-20260911, branch codex/behavior-canvas-20260911, base e511c4153fb5bb484652434340e0e4c7000c93d0 plus the author's patch. Read AGENTS/PROJECT_GOAL, the prior independent report, issue 2 comment 392, relevant coordination, current BehaviorCanvasPhase120260911 Wiki and open PR inventory (empty). Review ownership: comment 395. The Wiki still identifies the preceding C1/C2 freeze; comment 392 and the new source report identify this correction.

Source identity

Independently read and verified isolated harness/release-behavior-canvas-r123-source-20260911.md SHA256 61F7B24B29264766F93A4CB3F79B88F7D2DB08FAF15591B3FA78458A4005883D. All 19 Rust hashes in its table match the actual files. Independently reconstructed the specified UTF-8 manifest, one path/space/uppercase hash/LF per row: SHA256 9EBEC63D5D8B2595FB3867E63E7C6A26C4B04DFA1C7644B840E6FA001A2F0692 matches. Shared form_session remains F5027FB3A5A5599A182E7D1A10DBA56DD66EB1F23A4BA4C4A1744C9A6A5B6E61.

Locations below are in the isolated crates/oa-desktop/src tree. They describe directly observed source; expected execution follows from those paths and installed Iced source, not a runtime observation.

R1/R2: toolbar admission corrected in both production paths

app.rs:1116–1177 admits a BehaviorControl only when its full Scope equals the current clean input owner, including exact camera lifetime. Only then does its presentation-action whitelist permit semantic epochs within the current lifetime's interval and normalize the context for the existing exact adapters. The old process-only exception is gone (app/process_canvas.rs:93); scenario retains exact admission at app.rs:1601 behind the same envelope. Domain authoring events are not normalized by this path.

Production controls are wrapped at behavior/canvas_workspace.rs:33 and :179; both explicit Panels buttons are wrapped at topology/view.rs:236 and scenario/workspace.rs:122. This covers palette, Details, Panels, Canvas, Fit and zoom. I found no remaining unstamped production emission for these toolbar actions. The process Details Shelf message, which has no embedded semantic Context, still receives the outer owner/revision/lifetime guard and narrow whitelist. Canvas explicitly requests viewport focus.

The prior held-middle → CursorMoved → left Fit batch now permits its own earlier Pan semantic increment while retaining its presentation lifetime. Accepted Fit/tool/panel actions end that lifetime, including an unchanged Fit/tool (app.rs:1167–1173). A retained toolbar packet captured before chooser open/Escape, dirty/revert, picker busy/cancel, caller return or resize fails exact Scope comparison even if semantic epoch is unchanged. The non-camera boundary wrapper (app.rs:1099–1113, :1182–1195) observes these transitions; camera-relative packets retain their separate lifetime. Existing viewport cancellation remains intact.

R3: final-view Tasks and overlay operations corrected

Control::update no longer emits a press-time ControlFocus. Accepted activation requests focus using the resulting lifetime (app.rs:1174), so its operation addresses Iced's final view. Stable control IDs retain the keyboard target across presentation changes.

The mounted helper now uses actual UserInterface/Cache for input, operations and drawing. canvas_workspace/tests.rs:137–150 drains App messages before actions; :181–233 builds the resulting view, operates synchronous Chain passes against it and feeds outputs into the next update cycle. Pending Task streams survive. This matches the relevant installed iced_winit-0.14.0/src/lib.rs:1214–1251, :1300–1335 and :1742–1759 ordering. Actual UserInterface::operate supplies root and nested-overlay traversal (iced_runtime-0.14.0/src/user_interface.rs:539–578). No private canvas focus/gesture state is seeded.

The presentation owner marker wraps actual App::view (app.rs:1041). Collect and Apply each recheck it before focus/reveal (canvas_workspace/focus.rs:31–39, :127–159). A retained Apply after chooser/Review or return to the same clean canvas with a new lifetime stays inert. This deliberately stronger retained-operation test does not claim that native synchronous Chain execution interleaves that way.

Assertions and remaining acceptance

• Both existing held-pan tests preserve Fit pan==ZERO and now assert same-batch pointer focus, followed by Tab reaching ZoomOut without F6 (topology/layout_tests.rs:245–269, scenario/workspace/tests.rs:848–872). Retained camera and toolbar packets are checked separately.
• Actual captured Fit/tool/Details/Panels/Canvas packets are replayed across real chooser, Field/RevertProperties and Save/cancellation transitions (canvas_workspace/tests.rs:616–735). They assert lifetime changes with unchanged semantic epoch, preserved presentation/focus and caller source/snapshot/history invariants. The Windows native picker Task is deliberately dropped before polling and SavePath(None) injected; this is not a native dialog test.
• The two overflow tests require the last tool to start completely below the palette, then require positive scroll, full tool visibility, Enter activation and focus-border pixel changes (canvas_workspace/tests.rs:574–614). They use a 1100×420 stress fixture; minimum-window native acceptance remains separate.
• The chooser/Review test now observes the focused nested search absent from root input geometry and checks delayed Collect/retained Apply, Review focus, scrolls and raw state (topology/layout_tests.rs:568–789). The chooser itself focuses its search during reconciliation, so the assertion does not depend on an invented focus Task.

Seventeen production App-root mounted tests plus two shared tests remain prepared, uncompiled and unexecuted here. Backend initialization uses expect; unavailable WGPU cannot silently skip. Pixel comparisons establish only the tested visible focus borders when executed. They do not prove transformed scene clipping, clipped child text, refusal text, native accessibility or all popup geometry. The helper is a deterministic single-window widget/App harness, not the native event loop or external-dialog acceptance.

Root owns integration and coherent Windows compiler/test/Clippy/build/native gates. Preserve I1/I2 session-versus-mount Name/FormShown/root marker/rearm/zero-axis focus and regressions, boxed Semantic/compiler/chooser corrections, and B4 pan-plus-scale on both clip rectangles and clipped child text. Their deliberate absence from this isolated baseline is not a new defect. Earlier root passing gates identify different bytes.

Only this new report was written. No production edits, compiler/rustfmt/test/render/native execution, Git/WSL/Linux/VPN mutation or delegation occurred. Linux remains user-deferred. Root owns common Wiki/ledgers and publication. Persistent authored placement/lane arrangement, broader semantic manipulation, phase 1 acceptance and full issue 2/PROJECT_GOAL completion remain open.