ARCADIA-Studio/harness/release-scenario-editing.md

Direct scenario editing — bounded implementation plan

Status: implementation and automated Windows checks passed in the isolated codex/scenario-direct checkout, based on ab661f2. Initial production is d1d8f0b; independent-review fixes are in 7a66607 and e7e37d4. The focused independent recheck reports no remaining medium/high finding. Root-owned Windows/Linux native trials remain pending. DATA b35dede is integrated in dfd2e41 with 286 desktop tests, strict Clippy and a fresh frozen Windows release artifact. This does not complete the release or process/chain work.

Decisions

Extend the existing behavior::Scene; retain its derived lifeline columns and ordered occurrence rows. No model/schema/layout records are added. Lifeline and occurrence UUIDs remain distinct from represented work and global exchanges.

Select mode selects headers, stems, messages and occurrence boxes. A selected occurrence has a reorder handle; dragging it chooses a visible slot in its same parent sequence. It never reparents or changes lifeline columns. A Message tool uses the existing MessageStyle, with Call + correlated reply initially selected. Click-click or drag between represented lifelines captures a highlighted explicit insertion slot (parent, before occurrence or append) and opens the existing typed draft with those endpoints. Exchanges are filtered by layer, viewpoint and the core's represented-endpoint compatibility. Earlier calls retain complete exact-slot validation, cached by document revision, owner, slot and endpoints. Choices use search plus 24-item pages; every final creation still validates the complete ordinary command at the captured insertion slot. No compatible exchange produces an actionable retained draft, not a new global exchange or a silently changed endpoint. Timer remains available as a local tool.

The canvas remains rendered while a bounded, independently scrollable form is open. Values keep the existing qualified-path editor and lifecycle. Final creation uses ordinary CreateElement plus SetSteps in one Batch; paired call/reply are inserted together and undo together. Reordering uses SetSteps within the captured parent. Existing core validation decides reply order, branch dominance, lifetime, phase and endpoint compatibility. Failed preparation/source writes retain drafts.

Transient events capture document/scenario/revision/epoch, and the App validates the current Behavior owner before handling them. Selection does not invalidate a gesture within the same scenario. Escape, unfocus, context/tool change and pending drafts cancel gestures. Scroll, bounds changes and actual window resize also cancel the captured source/slot. Ordered raw pointer events are translated by the actual combined inner/page Scrollable offsets. No geometry is persisted.

Execution bars derive their ends from actual correlated reply positions; separate conditional reply branches render their corresponding spans. Calls without a visible reply use a short explicitly open activation, not a fabricated reply.

Acceptance checks

Production-event tests cover hit priority, click-click/drag, scroll-origin changes, Escape/unfocus/stale contexts and exactly one result per gesture. Planner/App tests cover middle/operand insertion, paired identities, complete SetSteps ordering, same-parent reorder, rejected reply-before-call, unchanged global exchanges, exact source/model Undo, draft retention and bounded exchange/call controls. Run focused and full desktop tests, strict all-target desktop Clippy and optimized build with the dedicated D:/CodexBuilds/Capella2-scenario-target target.

Root native tasks (not yet performed):

1. Draw an existing exchange again into the middle of a scenario as Call+Reply; enter a qualified value, select both occurrences, Undo/Redo, save/reopen.
2. Insert inside an ALT/LOOP operand, reorder within it, reject a reply before its call, and inspect correlated execution bars and preserved occurrence identities.
3. Cancel drawing after scrolling/layout change, retry, retain typed values while navigation is blocked, and open/return from a referenced scenario. Verify at 1440x900 and 1100x700 on Windows and Linux before scoped acceptance.

Initial automated evidence — 2026-09-06 (superseded by review fixes)

Source checkout: D:/CodexBuilds/Capella2-scenario-direct, production commit d1d8f0bbed5aa0112189138a1cc025affe26c09b. Changes are confined to desktop app.rs, behavior.rs and behavior/scenario.rs; no core model, persisted layout or schema changes are included.

All commands used the dedicated D:/CodexBuilds/Capella2-scenario-target target with --locked --offline:

• cargo check -p oa-desktop --all-targets: passed.
• cargo test -p oa-desktop direct_: 19 passed, including 13 new direct-scenario tests and six existing matching tests.
• cargo test -p oa-desktop: final source passed all 274 tests, zero failures or ignored tests. This includes exact source/model Undo, creation and reorder selection, rejected stale contexts, retained failed-write drafts, bounded contextual controls, scroll-origin cancellation and correlated activation spans.
• cargo clippy -p oa-desktop --all-targets -- -D warnings: passed.
• cargo build -p oa-desktop --release: passed.
• git diff --check: passed before the production commit.

Logs are under D:/CodexBuilds/: Capella2-scenario-check.log, Capella2-scenario-direct-tests.log, Capella2-scenario-desktop-final-tests.log, Capella2-scenario-desktop-clippy.log and Capella2-scenario-desktop-release.log.

Windows artifact: D:/CodexBuilds/Capella2-scenario-target/release/arcadia-studio.exe, 20,345,856 bytes, SHA-256 7CC6DCDB7ECC0C6B144137D31DB0BE9BC1555FEFAE6B465DAEABCF52DFE1A166. This artifact has not been native-tested. Widget-tree/event tests do not establish visual usability, scrolling behavior or GPU rendering acceptance; the three native tasks above remain required. Process/chain direct editing remains outside this bounded implementation.

Independent-review fixes and final automated evidence — 2026-09-06

Production commit: 7a666076bfcfd1f2258d2f5508328db5adf40825, same isolated checkout and dedicated target. Only the three previously owned desktop source files changed. No core/source/schema or process/chain features were added.

The new event regressions failed on the prior implementation: a bounds shift kept the first click's source/slot armed, and a held drag could still publish its old slot after the bounds changed. Both now cancel. After scrolling, resizing or clipping changes, the next click starts a fresh gesture. App tests also verify unchanged-size notifications retain context, actual resize invalidates it, and scrolling preserves property/source history and the pending behavior form.

Local Iced inspection established that Scrollable translates its supplied cursor but leaves raw CursorMoved coordinates and the canvas layout unchanged. The existing inner and outer scrollables now have a local, passive observer which reads their actual translation through Widget::operate. Ordinary on_scroll cannot report initial/remounted state or passive content-size clamping. The observer forwards layout, drawing, overlays and event capture, and publishes only changed translations or document/owner context. Reporting before child input makes a result using an old slot stale before App processes it; reporting after input captures wheel/scrollbar changes. The real Iced Scrollable test uses its debug null renderer and verifies 0 → 180 wheel offset → 50 passive clamp → 180 on expansion → 0 after remount, with no repeated messages on unchanged redraws.

The reported ALT fixture also failed before the fix: a root Call, Reply then Action in operand one, another Reply in operand two, and a third operand without a Reply. Derived execution geometry now splits at operand boundaries, stops each returned operand at its own correlated Reply, leaves its following Action outside that segment, and marks the reply-free operand open. It does not imply chronology between alternative operands or add persistent execution records.

Picker measurement on the same Windows debug target:

Probe	Before	After
500 compatible exchange choices	7.87 s	1.46 ms
Same choices after one name edit	8.14 s	1.48 ms
100 exact-slot earlier calls, initial validation	not measured	595 ms
Those calls after name/value/search/page edits	not measured	34–39 µs

The exchange list no longer clones and validates the entire project per candidate. Final Apply still rejects a Delete inserted before a later Call on that lifeline; the new regression confirms appending that same Delete succeeds. Reply choices retain exact validation, invalidate for changed slot/document/revision/endpoints, and do not lose their cached eligibility while expressions are being typed. These are bounded picker measurements, not complete native-frame timings.

Final checks (--locked --offline): 27 focused matching tests passed; all 282 desktop tests passed, zero failures/ignored tests; strict desktop all-target Clippy passed; optimized desktop build passed; git diff --check passed. Clippy requested one test-only nested-if cleanup, which was applied before the final clean Clippy/build.

Logs under D:/CodexBuilds/: Capella2-scenario-review-before-tests.log, Capella2-scenario-alt-before.log, Capella2-scenario-scroll-observer-tests.log, Capella2-scenario-review-desktop-tests.log, Capella2-scenario-review-clippy.log, Capella2-scenario-review-release.log.

Current Windows binary: D:/CodexBuilds/Capella2-scenario-target/release/arcadia-studio.exe, 20,349,952 bytes, SHA-256 1AE729097F267DE596AE0970D3A62AE06C0C89CE2FDE70DF980AD785A0E0A8E6. It supersedes the initial artifact above. Native acceptance is still pending. Root should repeat the three primary native tasks, including inner/outer wheel and scrollbar cancellation at a middle slot, resize/remount/clamp recovery, and the three-operand ALT fixture. The broader release objective remains incomplete.

Final passive-scroll save correction — 2026-09-06

Production e7e37d485d842731d270781bd4e60a323fe4cdba addresses the focused review's remaining App lifecycle finding. During an async save, Iced can change its scroll position while App's busy gate rejects ordinary messages. The observer had already recorded its report, so dropping that notice left App's offset stale after save completion. The new regression failed before the fix: App retained offset (0, 0) instead of (25, 140).

App now dispatches only the passive Scrolled event before interaction gates. Its existing handler still validates document, scenario and revision. Mutation input remains gated. The test checks current offsets and cancellation epoch while busy, rejects an old-document observation, delivers a successful Saved receipt, then uses production Canvas pointer events to create the intended sender/receiver/slot draft without a model or source-history mutation.

The independent reviewer rechecked this exact production change and regression; no remaining medium/high finding was reported in the focused review. Final full desktop tests pass 283/283, strict all-target desktop Clippy passes, optimized desktop build passes, and git diff --check passes. Logs under D:/CodexBuilds are Capella2-scenario-busy-scroll-before.log, Capella2-scenario-busy-scroll-after.log, Capella2-scenario-busy-scroll-desktop-tests.log, Capella2-scenario-busy-scroll-clippy.log and Capella2-scenario-busy-scroll-release.log.

Latest Windows artifact, superseding both builds above: D:/CodexBuilds/Capella2-scenario-target/release/arcadia-studio.exe, 20,349,952 bytes, SHA-256 CEEB8E277DFC47C0D55DA43F903FCA45AFBF902AFA418B3924375910D699373A. Native acceptance is pending. Include scrolling while saving in the root's native recovery task before accepting the direct scenario milestone.

Combined DATA/scenario integration — 2026-09-06

Merge dfd2e41259e73ef10a4e29a426569c08eaae215f integrates codex/data-contract-integration at b35dede75fc8778ea695b9b2c023cfa2a1e49e09 into the isolated scenario branch. The merge applied without conflicts and needed no manual code resolutions or new semantic design. Direct scenario geometry/planners/tests and the existing scenario evidence were unchanged by the merge. App's early passive-scroll handler remains intact alongside DATA's source migration and property-browser handling. The shared field-path API remains compatible: compact leaf-first labels and deterministic sorting now feed the existing bounded scenario value picker, while full qualified labels remain available for detail text.

Combined verification on the dedicated scenario target: all 286 desktop tests passed, no failures or ignored tests; strict desktop all-target Clippy passed; optimized desktop build passed; staged diff --check passed. All commands used --locked --offline. DATA's three new regressions are present together with the 283-test scenario suite, including source3 save/reopen and direct gesture/save lifecycle coverage. No DATA checkout, Linux checkout or native application was modified or operated in this integration task.

Frozen artifact directory: D:/CodexBuilds/Capella2-release1-01a06e2e/ui-scenario-data-windows-dfd2e41. It contains arcadia-studio.exe, the three combined verification logs and a manifest.json identifying the source checkout, merge commit, target and hash. The copied binary hash was checked against the release target binary. Binary size: 20,411,392 bytes. SHA-256: 8BC031CF6124859D31082BB0FFB0335C406D54E12ECAD8493CE50A23923E5589.

Root reports DATA b35dede's Windows native trial and independent focused review passed. This does not transfer native acceptance to the combined direct-scenario workflow. Its Windows/Linux native tasks remain pending, including scroll/resize cancellation, middle/operand insertion, execution spans and save recovery. Root owns final integration into main and native acceptance; process editing remains outside this task.

Root combined Windows native trial — 2026-09-06

Frozen dfd2e41 binary above, 1440x900. Native drag inserted Routed request and its correlated reply before the original third call. The Origin/Latitude value route.origin.latitude was authored in the bounded browser. Navigation while pending retained the draft. Create produced57 objects; Undo removed both messages (55), Redo restored them, Save All persisted the pair and qualified value. Saved steps are original call/reply, Routed request/reply, original second call/reply. Valid selected-message reorder retained selection; invalid reply-before-call reorder reported reply_order and added no history. Undo restored the saved order. Inner-canvas scrolling and injected Escape cleared armed source gestures, verified by the next lifeline click starting a new source without completing a draft. The saved app closed normally (exec63022 exit0, no runtime output).

Native findings: active/inactive tools looked identical, line labels used the shared exchange name despite distinct occurrence names, and Create/Cancel needed inner and outer scrolling. Root is refining those three issues before accepting the milestone. ALT/reuse/resize/save recovery and Linux native remain pending.

Root UI refinement checks:287 desktop tests passed, strict all-target desktop Clippy passed, optimized Windows desktop build passed. Native verification of this refinement remains pending.

Refined Windows native results and viewport finding

c6c07cc Windows frozen binary SHA256 4A49AD95C466BACBD1D1EA96FFF983BDA2F5DA9B7DCCBF91C387655CEF88B419, ui-scenario-refined-windows. Native1440x900 and1100x700 show differentiated tool selection, occurrence-first message names and pinned Create/Cancel. A pending Navigation outcome ALT fragment retained its name and route.available guard across width/height resizing. Create produced the fragment and two operands. Native click-click in its first operand explicitly captured that operand's append slot; Available route plus correlated Reply were created on Navigation request. Execution bar ends at that reply. Reply-before-call reorder rejects with reply_order. Save All writes62 objects/5 links/3 checks; exact nested source shows the guarded operand contains only that correlated pair. Undo removes both (60); Redo restores saved62. The saved native trial was closed before the next refinement.

Native also found the canvas jumps to its start whenever the palette is replaced by a form or restored. Diagnosis: conditional siblings change its Iced widget-tree position. Group the controls as one stable sibling and verify that actual viewport is retained across drawing/form/cancel/create. This is distinct from deliberate new-selection reveal (not implemented yet). Linux287 tests, strict Clippy and optimized build pass for c6c07cc; native Linux remains pending.

Stable-canvas refinement:287 desktop tests, strict all-target Clippy and optimized Windows build passed. Native retention trial remains pending.

Stable viewport native closure and process integration

ae1602a Windows native: reopened saved62-object model; scrolled to the guarded operand, dragged a message before Available route, and verified the pending form retained that guard/call region. Cancel returned to the same region and clean model. Runtime stdout/stderr empty; exec86766 exited0. Frozen ui-scenario-stable-windows SHA256 D0A0D6DAAADA8CEB3700C2A2071ABB15C41386BD9DD49203A7AFCB2869E5C896. This closes the observed palette/form remount jump. New-selection auto-reveal is not added. Compact actions/typed resizing and ALT behavior passed in priorc6c07cc.

Process merge60d162c adds reviewed8bc564b without source conflicts. Both platforms pass306 desktop tests, strict all-target Clippy and optimized build. New frozen ui-behavior-{windows,linux}-60d162c artifacts have copied62-object models. Linux exec61870/window4852212 launched and is now under root native test; acceptance remains pending. Full release scope is unchanged.

Root Linux native scenario trial — 2026-09-06

Frozen60d162c Wayland1440x900. Native drag in the gap after old reply6 and before Navigation outcome ALT opened Call+correlated Reply while preserving that region. Named Validated route and chose existing Navigation request. Create63→65, Undo65→63, Redo63→65; execution bar ends at its reply. Save All and native reopen passed. Call ef0ef967-041b-4bf2-86b8-977047a3ca90 and correlated reply 0005a94e-49c1-41e2-82f9-5a6f285dc604 appear before ALT in saved steps. Model: ui-behavior-linux-60d162c/model/project.arcadia. Linux ALT editing/reuse/ reorder/cancellation/minimum layout remain required. Wayland61870 closed0 normally.