fix(studio): preserve connected architecture inspection context

docs/README.md

@@ -26,6 +26,7 @@ Solve a specific problem:
 - [Ship a breaking proto change](how-to/ship-a-breaking-proto-change.md)
 - [Start an event model from scratch](how-to/start-a-model-from-scratch.md)
 - [Track a version migration](how-to/track-a-migration.md)
+- [Verify a connected architecture graph](how-to/verify-connected-architecture.md)
 
 ## Reference
 
@@ -38,6 +39,7 @@ Look up exact behavior:
 
 Resource contracts and acceptance:
 
+- [Architecture resource coverage](reference/architecture-resource-coverage.md)
 - [Channel and DataStore contracts](reference/channel-and-datastore-contracts.md)
 - [Channel and DataStore acceptance fixture](reference/channel-and-datastore-acceptance.md)
 - [Specification and API contracts](reference/specification-and-api-contracts.md)

docs/explanation/architecture-resource-roadmap.md

@@ -1,10 +1,10 @@
 # Architecture resources
 
-Status: the native Channel and DataStore resource slice is implemented. Its
-[contract reference](../reference/channel-and-datastore-contracts.md) describes
-the supported fields and lifecycle. The
-[acceptance fixture](../reference/channel-and-datastore-acceptance.md) links the
-executable coverage and records its verification boundaries.
+Status: native transport, storage, Specification, DataProduct, responsibility,
+Decision and Document resources are implemented, alongside supplied-bundle
+source reconciliation. The [coverage reference](../reference/architecture-resource-coverage.md)
+links their field and connection contracts and separates implementation from
+acceptance evidence. The remaining design scope is described below.
 
 ## Start with the behavioral model
 
@@ -126,6 +126,14 @@ Remote connectors and additional format compilers remain separate milestones.
 
 ## Atlas Linter comes after the architecture resources
 
+The [remaining contract boundaries](../reference/architecture-resource-coverage.md#remaining-contract-boundaries)
+distinguish existing strategic references and Component membership from richer
+system/service relationships, unconfirmed communication, agent metadata,
+business-data relationships and arbitrary design topology. These require
+explicit scope decisions. Their absence does not make the implemented native
+resource slices proposals again. Connected acceptance must record which
+supported relationships and client workflows were actually exercised.
+
 Atlas Linter is deferred until the remaining architecture resources and source
 integration concerns are defined. Its rules can inspect model consistency,
 ownership, documentation, naming, contract compatibility and architectural

docs/how-to/verify-connected-architecture.md

@@ -0,0 +1,116 @@
+# Verify a connected architecture graph
+
+Use this procedure to inspect the same disposable graph through the backend,
+CLI, MCP and Studio. The [coverage reference](../reference/architecture-resource-coverage.md#composed-graph)
+defines its resources and limits. Docker must be available for the test's NATS
+Store. Run commands from the repository root and serialize Cargo work with
+other contributors using this checkout.
+
+## Exercise the graph
+
+```sh
+mise exec -- cargo test --manifest-path rsworkspace/Cargo.toml \
+  -p trogon-atlas-server --test connected_architecture_fixture
+```
+
+This checks native selectors, reference discovery, source adoption, observation
+reorder and same-store manifest reapply. The live harness is ignored during
+normal testing.
+
+## Expose the exercised graph
+
+In one terminal, start the bounded manual harness:
+
+```sh
+mise exec -- cargo test --manifest-path rsworkspace/Cargo.toml \
+  -p trogon-atlas-server --test connected_architecture_fixture \
+  serve_connected_architecture_fixture -- --ignored --exact --nocapture
+```
+
+Wait for `READY`. Retain the reported namespace and endpoints; namespace IDs
+are generated. The model slug is `model`, version `1`. Default listeners are
+gRPC `http://127.0.0.1:19473` and MCP `http://127.0.0.1:19474/mcp`.
+Both require the synthetic test bearer `connected-fixture-admin`. This token
+belongs only to the disposable fixture, not a deployment.
+
+`ATLAS_CONNECTED_FIXTURE_GRPC_PORT` and `ATLAS_CONNECTED_FIXTURE_MCP_PORT`
+override the ports; `0` requests an available port. The harness reports the
+actual endpoints. `ATLAS_CONNECTED_FIXTURE_SECONDS` sets a lifetime between
+1 and 600 seconds, defaulting to 600. The deadline includes listener startup
+verification. Interrupting the harness closes its listeners; the test Store
+is disposable. Do not seed or restart an existing deployment for this proof.
+
+## Inspect with CLI and MCP
+
+Build the CLI, then replace `<namespace>` and `<grpc-endpoint>` with the
+`namespace=` and `grpc=` values reported in `READY`:
+
+```sh
+mise exec -- cargo build --manifest-path rsworkspace/Cargo.toml \
+  -p trogon-atlas-cli --bin trogon-atlas
+mise exec -- rsworkspace/target/debug/trogon-atlas \
+  --endpoint '<grpc-endpoint>' --auth-token connected-fixture-admin \
+  --format json describe component/<namespace>/receipt-service@1
+mise exec -- rsworkspace/target/debug/trogon-atlas \
+  --endpoint '<grpc-endpoint>' --auth-token connected-fixture-admin \
+  --format json inspect-data-product data_product/<namespace>/receipts@1
+```
+
+Connect an MCP client to the `mcp=` value reported in `READY`, using
+Streamable HTTP and the same bearer. Initialize
+the connection and discover `tools/list` before invoking tools. Query
+`get_entity_json` for `automation_slice`, slug `observe`, exact namespace and
+version `1`. Its equal ReadModel endpoints must retain distinct connection IDs.
+Use `inspect_data_product` with kind `data_product`, slug `receipts` and the
+same exact identity. Compare its returned ports, access selections and checked
+scope with CLI inspection.
+
+For `list_subject_assignments`, `get_document_detail` and `get_source_run`,
+`tools/list` identifies the `request_json` envelope. Its fields follow the
+canonical [responsibility requests](../../proto/trogonatlas/api/eventmodel/v1alpha1/responsibility.proto),
+[document requests](../../proto/trogonatlas/api/eventmodel/v1alpha1/decision_documents.proto)
+and [source requests](../../proto/trogonatlas/api/eventmodel/v1alpha1/source_integration.proto).
+Build requests from returned selectors,
+including owner UID, local identity and digest pins. Do not guess them from
+display names. The source registration/run IDs are `receipt-source` and
+`receipt-title-update`; the retained outcome must be APPLIED. Product output
+access must resolve independently of its declared lineage and undeclared
+provider. Compare CLI/MCP response data for the same request and scope.
+
+Export the fixture namespace, run `diff` against that export and preview reapply
+with `--dry-run`. Preserve the command results and original export. These client
+checks establish export, comparison and validation-only preview. The fixture's
+`assert_roundtrip` establishes persisted same-store no-op reapply. Neither proves
+new-store selector rebinding or a new source publication through either client.
+
+## Inspect with Studio
+
+Build and start the repository's bridge against the fixture in another terminal.
+Replace `<grpc-endpoint>` with the `grpc=` value reported in `READY`:
+
+```sh
+mise exec -- pnpm --dir tsworkspace/webapps/studio build
+mise exec -- env TROGON_ATLAS_GRPC='<grpc-endpoint>' \
+  TROGON_ATLAS_AUTH_TOKEN=connected-fixture-admin \
+  TROGON_ATLAS_AUTH_PASSTHROUGH=true PORT=19475 HOST=127.0.0.1 \
+  node tsworkspace/webapps/studio/server/index.mjs
+```
+
+Open `http://127.0.0.1:19475/em/<namespace>/model`, enter the fixture key when
+prompted and reload the model if needed. The bridge serves the built Studio
+and forwards each browser credential to the fixture backend. Stop this bridge
+after the run.
+
+Use `?focus=data_product:<namespace>/receipts`,
+`?focus=decision:<namespace>/delivery-choice`,
+`?focus=document:<namespace>/delivery-note` and
+`?focus=channel:<namespace>/delivery` to inspect those resources. Confirm the
+receipt title is `Source receipt` and its local documentation remains intact.
+Inspect exact port responsibility, accepted rationale, document content and
+anchor, repeated observation selections and source run records.
+
+Capture screenshots, rendered text and API/console diagnostics with the exact
+model identity and candidate build evidence. The fixture intentionally exposes
+`SLICE_NOT_IN_STORYBOARD` and `SLICE_NO_SCENARIOS`; it is a bounded resource graph,
+not a complete behavioral example. The stock Studio e2e suite uses a fake gRPC
+backend and does not substitute for this real-store inspection.

docs/reference/architecture-resource-coverage.md

@@ -0,0 +1,87 @@
+# Architecture resource coverage
+
+This reference separates native resource support from connection coverage and
+acceptance evidence. A retained field or artifact does not establish a checked
+relationship, executable behavior, or a passing client workflow. See the
+[roadmap](../explanation/architecture-resource-roadmap.md) for design boundaries.
+
+## Native resource contracts
+
+| Resource | Supported fields and selections | Contract and executable coverage |
+| --- | --- | --- |
+| Strategic scope | Project, Domain, Subdomain and BoundedContext records; project/domain references, realized subdomains and directed context agreements. | [Strategic schema](../../proto/trogonatlas/eventmodel/v1alpha1/strategic.proto), [reference extraction](../../rsworkspace/crates/trogon-atlas-core/src/refs.rs). |
+| Component and ExternalSystem | Component technology and curated exact entity membership; external boundary descriptions, ReadModel external-source links and Processor calls. | [Infrastructure schema](../../proto/trogonatlas/eventmodel/v1alpha1/infrastructure.proto), [reference extraction](../../rsworkspace/crates/trogon-atlas-core/src/refs.rs). |
+| Channel | Address parameters, protocols, delivery declarations, optional broker and bindings to exact AutomationSlice observation occurrences. | [Contract](channel-and-datastore-contracts.md), [acceptance](channel-and-datastore-acceptance.md). |
+| DataStore | Store class, technology, purpose, authority, access mode, classification, residency, retention and identified ReadModel attachments. | [Contract](channel-and-datastore-contracts.md), [acceptance](channel-and-datastore-acceptance.md). |
+| Specification | Retained artifacts, schema/message/operation members, individual message mappings, operation roles, provider exposures and usages. | [Contract](specification-and-api-contracts.md), [acceptance](specification-and-api-acceptance.md). |
+| DataProduct | Input/output ports, output contracts, selected storage/channel/operation access and declared lineage; inspection reports checked model paths separately. | [Contract](data-product-contracts.md), [acceptance](data-product-acceptance.md). |
+| Team and Person | Directory records, identified membership and explicit responsibility for an exact entity, supported connection occurrence, Specification member or DataProduct port. | [Contract](responsibility-contracts.md), [acceptance](responsibility-acceptance.md). |
+| Decision | Subjects, disposition, options, selected option, rationale, consequences, replacement and supporting Document selections. | [Contract](decision-and-document-contracts.md), [acceptance](decision-and-document-acceptance.md). |
+| Document | Subjects, retained content or link, content digest, identified anchors and navigation. | [Contract](decision-and-document-contracts.md), [acceptance](decision-and-document-acceptance.md). |
+| Source control | Registrations, immutable supplied snapshots, explicit mappings/adoption, field ownership, overlays, guarded runs and durable publication/recovery. Source records are separate from native entity kinds. | [Contract](source-integration-contracts.md), [API](source-control-api.md), [acceptance](source-integration-acceptance.md). |
+
+Shared native identity uses exact kind, namespace, slug and numeric version.
+Contained selections additionally use the returned owner incarnation and local
+identity required by their contract. Titles, names, list positions and source
+version strings do not replace these selectors. See
+[connection identity](connection-identity.md).
+
+## Remaining contract boundaries
+
+| Area | Existing representation | Remaining boundary |
+| --- | --- | --- |
+| Strategic membership | Domain project, Subdomain domain and context realizations are native references. | Arbitrary domain nesting and shared authored system/service membership have no dedicated fields. Domain listing derives membership from namespace and one realized subdomain; its maps omit versions. It does not prove exact-version or multi-domain membership. |
+| System and service relationships | Component members can select other Components and ExternalSystems, with ordinary reference discovery. | Dedicated grouping levels, labeled directed system relationships and system-level actor interactions require a contract decision. Containment is Component-owned; ExternalSystem has no members field, so external-system-owned membership also remains a contract decision. |
+| Communication | API roles/providers/usages, Processor calls and Channel bindings to actual observations are supported. | General authored send/receive and conditional-trigger declarations before behavioral mapping have no native relationship contract. Retained source declarations do not establish executable paths. |
+| Metadata and agents | Registered annotations include links, code repository/path/symbol/ref provenance, tags and lifecycle status. | Lifecycle effective dates and agent model/tool declarations need dedicated contracts. Arbitrary metadata references are not recursively indexed. See [annotations](../../proto/trogonatlas/annotation/v1alpha1/annotations.proto). |
+| Business data | Schema fields, nested shapes, schema type references and identity-derivation annotations are available. | Business identifier roles, foreign entity/property selections, relationship labels and general aggregate intent are not supplied by type reuse. See [field schema](../../proto/trogonatlas/eventmodel/v1alpha1/fields.proto). |
+| Design graphs | Storyboards retain ordered slices and traces; Documents retain content, anchors and structured navigation. | Generic branches, loops and subflows remain document content without typed topology traversal. Parsing diagrams and validating executable examples require separate contracts. |
+| Dependency explanations | References expose actual field paths; impact follows graph reachability; DataProduct inspection checks selected access. | These queries do not classify every runtime service dependency or recover relationships absent from native contracts. |
+
+These boundaries are scoped design decisions, not implicit requirements to add
+resource kinds. Supplied-bundle source reconciliation is implemented; remote
+connectors, automatic synchronization, additional semantic format compilers,
+portable selector rebinding and the WASM/WIT linter host remain separate work.
+
+## Evidence boundaries
+
+The linked acceptance references identify separate executable fixtures and
+remaining requirements. The resource-specific fixtures use independent stores
+and namespaces. The composed fixture below supplies an additional shared graph;
+neither its existence nor separate passing tests prove every client workflow.
+
+Backend service tests, authenticated transport tests, CLI/MCP tests, Studio
+component tests and browser runs establish different boundaries. Browser
+evidence must identify its backend and fixture; a fake gRPC backend cannot
+establish native persistence or source publication. A native manifest roundtrip
+in the same store does not establish portable migration of incarnation-bound
+selectors into a new store.
+
+## Composed graph
+
+The [composed fixture](../../rsworkspace/crates/trogon-atlas-server/tests/connected_architecture_fixture.rs)
+creates a registered namespace and retains the actual returned owner UIDs,
+connection IDs, member IDs, port IDs and anchor IDs. Its logical identities use
+version `1`; the generated namespace is reported by the live harness.
+
+| Entry point | Connected declarations and checks |
+| --- | --- |
+| Component `receipt-service` | Exact membership of Processor `notifier`, ReadModel `receipt`, Specification `api` and DataProduct `receipts`. |
+| AutomationSlice `observe` | Repeated observations of `receipt` have distinct identities. Channel `delivery` binds both; DataStore `warehouse` attaches to the same ReadModel. Reordering observations preserves their selectors. |
+| Specification `api` | A response operation selects the returned Receipt message member mapped to `receipt`. Product output access selects that exact response, storage attachment and both channel observations. An undeclared provider remains undeclared. |
+| Product `receipts` | Input/output ports retain identity. Declared lineage is reported separately from resolved access and data selections. |
+| Person `maintainer` and Team `receipt-team` | Exact observation/member/port assignments and Team membership remain queryable. Assignment to one observation does not spread to its equal-endpoint sibling. |
+| Decision `delivery-choice` and Document `delivery-note` | Accepted rationale, exact subjects, retained Markdown and a digest-pinned anchor remain connected through typed queries and reverse discovery. |
+| Source registration `receipt-source` | A PARTIAL immutable bundle and explicit adoption own only the receipt title. Preview leaves native state unchanged; apply and replay preserve local documentation, all other owners and retained original bytes. |
+
+The fixture asserts expected outgoing endpoint multiplicities, unique field
+paths and matching incoming references. Native manifest export/reapply in the
+same store preserves content, etags and returned identities. It does not assert
+portable rebinding, all strategic-scope cases, every resource lifecycle case,
+or the broader source capture matrix.
+
+The ignored `serve_connected_architecture_fixture` test exposes that same
+exercised graph over authenticated loopback gRPC and MCP for a bounded manual
+run. See [connected acceptance](../how-to/verify-connected-architecture.md) for
+CLI, MCP and Studio verification. Normal test execution does not start these
+manual listeners.