# Scoped UI Action Safety Evaluation

> **Evidence record — not current product guidance.** Use the [documentation index](../../../README.md) for current behavior and architecture.

**Date:** 2026-07-13

**Issue:** [Gitea #57](https://git.spacetrainclubhouse.com/Falling-Metal-Interactive/Blacksite/issues/57)

**Implementation commit:** `9e23ae731f95dc351ecc744d6ca61f6bc4467317`

**Release-candidate commit:** Not nominated

**Source validation:** **Pass**

**Native acceptance:** **Pass**

This record covers synchronous editor actions invoked while the egui host scopes `UiState` out of
the Bevy `World`. The implementation keeps callback-owned state in independently registered
resources, passes viewport data into toolbar/navigation actions, routes cross-panel selection and
tab requests through explicit APIs, and reconciles the complete selection slice so a direct UI
selection takes precedence over a stale deferred request.

## Automated Verification

| Command or suite | Result | Evidence |
|------------------|--------|----------|
| `cargo fmt --all -- --check` | Pass | Formatting check completed without changes. |
| `git diff --check` | Pass | No whitespace errors. |
| `cargo clippy --workspace --all-targets -- -D warnings` | Pass | Workspace and all targets completed with warnings denied. |
| `cargo test --workspace --all-targets --no-fail-fast` | Pass | All workspace targets passed; the editor crate reported 290 of 290 tests passing. |
| Scoped-action regressions | Pass | Six focused regressions cover history multi-selection, diagnostics selection, Inspector collapse and asset reveal state, primitive spawn, and navigation spawn while `UiState` is scoped out. |
| Selection precedence | Pass | Full-slice reconciliation preserves a direct primary or secondary UI selection over stale single- or multi-selection requests. |
| Independent re-review | Pass | The post-fix review found no remaining blockers. |
| Packaged acceptance | Deferred | Explicitly deferred by project-owner direction; no packaged result is claimed. |

## Native Acceptance

The exact rebuilt debug binary from the implementation commit was launched as
`target/debug/editor --project .`.

| Workflow | Result | Evidence |
|----------|--------|----------|
| Toolbar authoring actions | Pass | After **File > New Scene**, Cube, Ramp, Sphere, Point Light, and Navigation Bounds all spawned. Selection, transform gizmo, viewport overlay, hierarchy, and Inspector stayed synchronized. |
| Inspector state | Pass | Collapsing the Transform component persisted across subsequent UI rendering and selection work. |
| Cross-panel diagnostics action | Pass | **Window > Brush Diagnostics > Select** kept the editor live and synchronized the selected actor across hierarchy, viewport, and Inspector. |
| Guarded shutdown | Pass | The dirty native-close decision accepted **Discard** and the editor exited with code 0. |

## Native Evidence

![Scoped toolbar actions with authored actors selected in the live editor](https://git.spacetrainclubhouse.com/attachments/d265651b-aa8e-4ea5-841c-1fa8eb622766)

- Gitea attachment asset 37: `blacksite-issue57-scoped-ui-actions.png`, 3426x1384 RGB PNG,
  890,021 bytes.
- SHA-256: `4225aca19268e4817148507e95cdad56a5f18734fd69e2fe5702df1dc304142e`.

![Brush Diagnostics Select synchronized hierarchy, viewport, and Inspector](https://git.spacetrainclubhouse.com/attachments/ba176d82-fb2f-403b-a71c-108de9649f11)

- Gitea attachment asset 38: `blacksite-issue57-diagnostics-select.png`, 3426x1384 RGB PNG,
  1,418,849 bytes.
- SHA-256: `40422be59766a3e61005973c315d0fd6f663dd2d227aa92055fa2aa2e91320c3`.

Both images were uploaded as ordinary Gitea issue attachments; this record does not use repository
raw or LFS pointer URLs.

## Release Use

The #57 source and native feature-level acceptance record is complete. A future production candidate
must still rerun representative toolbar, Inspector, diagnostics, selection, and guarded-exit paths
from the exact nominated commit. This record does not nominate a candidate or establish production
readiness.