Record verified Allocation assignment planner and portable evidence

2026-09-23 11:29:58 -07:00
parent 33e880103c
commit 16b30a6760
13 changed files with 918 additions and 2 deletions
@@ -0,0 +1,115 @@
+# Ordinary Allocation group assignment: pure planner checkpoint
+
+Status: implemented and verified as a pure planner; App wiring and native
+acceptance remain pending. Source commit
+`33e880103c5fa935a4431ec3dc089e2c4c92f680`, on the Allocation contribution branch
+above the [Arrange foundation](allocation-arrange-planner-20260923.md).
+This is a branch-specific checkpoint, not an integrated application release.
+
+Required behavior comes from [multiselect](multiselect-contract-20260923.md),
+[Allocation v2](release-activity-allocation-drag-contract-v2-20260911.md) and the
+[explicit Arrange amendment](allocation-arrange-amendment-20260923.md).
+No core model, source schema or user-owned specification changed.
+
+## Result and design
+
+Ordinary assignment captures every original visible work placement before
+normalizing selected semantic ancestors. It collects the union of leaf work,
+including unplaced leaves, and existing active placements, including folded
+descendants. Each normalized root retains its own accepted responsibility:
+independent roots may start under different performers; a distributed composite
+still refuses ordinary assignment. Already-correct role-only work does not gain
+a direct Allocation merely because another selected root changes performer.
+
+One destination plan accumulates stable IDs, unique aliases and intended edits,
+prepares one semantic Batch, and compares the complete candidate Project with
+the intended result. Existing Allocation IDs and header metadata survive
+retargeting. Outside removes only intended direct Allocations and their own
+saved routes across views. Role exits and collateral changes to surviving
+records refuse the whole plan. Warning collection and changed/already-correct
+leaf counts are retained for future App feedback.
+
+One shared geometry helper now serves singleton assignment, group assignment
+and explicit Arrange. It uses accepted endpoint ownership and the complete
+movement map: internal pins translate once, one-ended pins stay fixed, labels
+and attachments remain exact. Geometry checks compare whole visible scenes and
+the affected/ancestor diagnostic expansion, require rigid affected footprints
+and every original selected header, and authorize target unfolding only when
+assignment actually changes. Accepted and candidate expansion use their own
+ancestry. Per-pointer placement does not clone or validate a Project or rebuild
+semantic indexes. Finish rechecks the entire live Project and recomputes the
+placement before one exact source Batch. Zero movement can still change
+assignment; complete Project equality alone yields no command.
+
+## Verification
+
+Windows gnullvm, cargo/rustc 1.98.1, LLVM-MinGW 20260826, one Cargo build job,
+incremental disabled. Linux remains user-deferred. The focused example imports
+the actual production planner and Document modules; it is not a substitute
+implementation. Commands:
+
+```powershell
+cargo test -p oa-desktop --example allocation_policy_probe --message-format=json -- --test-threads=1
+cargo clippy -p oa-desktop --example allocation_policy_probe --tests --message-format=json -- -D warnings
+cargo fmt --all -- --check
+```
+
+Final canonical-byte gates: `assignment-planner-3` **84 passed, 0 failed**,
+`assignment-lint-2` strict lint passed, `assignment-format-2` passed. Each captured
+750 unchanged inputs, including 71 vendored dependency files and both explicit
+compiled fixtures; all captured blobs compare exactly with source commit
+`33e880103c5fa935a4431ec3dc089e2c4c92f680`.
+Final input-map SHA256:
+`ce988ecaeaca395d0f120844db7e3da90d039633beef10d2d4a8b8f19e92ee27`.
+
+The 14 added test families cover OA/SA independent roots and original identity,
+normalization/unplaced work, distributed composite versus independent leaves,
+role provenance and unresolved OA roles, stable IDs/aliases, zero-delta semantic
+change, target unfold and newly exposed overlap, simultaneous vacated-space
+movement, internal/external routes with explicit attachments and SA port anchor,
+own-route deletion across views, surviving Constraint collateral refusal,
+stale/tampered results and all selected headers. Existing singleton/Arrange and
+Document tests remain in the same passing suite.
+
+Positive tests use independently authored complete Projects and actual Document
+execute, source compilation/reopen and exact one-step Undo/Redo. The source-budget
+case executes the actual group command against an existing Document with Undo
+and Redo available, preserves Project/bundle/revision, and exercises both history
+paths after refusal. The same command/IDs then succeed in a fresh normal-budget
+Document; this is not evidence of same-session gesture retry.
+
+Independent review found no concrete planner defect. A second pass reviewed
+the added evaluators and found no blocking invalid fixture or circular oracle.
+It inspected the captured 84-test result without claiming its own execution.
+Exact historical notes and newline diagnosis are in the
+[review archive](allocation-assignment-evidence-20260923/reviews/README.md).
+
+## Evidence identity and limits
+
+The [portable gate package](allocation-assignment-evidence-20260923/checks/README.md)
+retains seven runs: the first 75-test capture, expanded 84-test capture, initial
+lint/format and three final canonical-byte gates. Initial expanded checks
+passed, but exact Git comparison refused because `arrange.rs` was CRLF in the
+working tree and LF in the committed blob. The independently checked difference
+was newline-only. Those historical captures are not attributed to the pristine
+commit and have no source-proof receipt. The file was restored to the committed
+bytes and all three gates rerun. No receipt or historical log was rewritten.
+
+Run the package verifier with `python -B checks/verify.py` from the evidence
+directory. It checks archive/receipt consistency and pinned historical source
+proofs, not external authenticity or a new Git comparison. The report's named
+source comparisons were executed separately against actual Git blobs.
+
+Remaining focused protective coverage includes deeper folded-grandchild group
+reassignment and a changed-assignment enclosure-growth blocker. Existing
+singleton and shared geometry coverage reduces but does not remove those gaps.
+Role warning collection is reviewed; the new role tests do not independently
+assert every warning code/severity.
+
+There is no new App execution, full desktop test run, matching GUI build or native
+acceptance for this checkpoint. Exact typed selection, frozen pointer target,
+minimum readable zoom, pending-click behavior, sticky drag threshold, selection
+generation, clean-owner admission and focus/camera/token retirement remain the
+App adapter's obligations. The archived App plan is design only. Neither this
+checkpoint nor the earlier Arrange foundation closes issue 29 or authorizes a
+combined release; the coordinated integration/release owner is unchanged.