Reject stale navigation envelopes before shared boundaries

2026-09-12 19:49:27 -07:00
parent a17ca5d066
commit 659b7a655a
11 changed files with 422 additions and 51 deletions
@@ -56,3 +56,29 @@ Only source inspection, bounded formatting and whitespace checks are performed h
 No `cargo`, `rustc`, test binary or GUI was run. Compile/lint correctness, new test outcomes, timing and actual native usability remain open. The integration owner should run focused new filters first, retain existing grouped/full/strict gates and build the matching executable. The parent's e44 results do not validate this union.

 Native acceptance retains the peer's six-file `examples/source-project` oracle: rename the second `@assess_report` reference to `assess_report_union`, exactly six alias-token changes in two files, no disk change before Save, immediate editor selection/typing and text Undo, navigation without model history, complete model Undo/Redo, then Save/reopen equality. Also exercise actual overflowing preview/Details return, modal exclusivity, source syntax selection, canvas focus/Delete after navigation, exact port/state-row and repeated-placement targets, nested activation shoulders/lifecycle boundaries, and passive event timing. Use deterministic race tests for held operations; screenshots alone do not establish ordering. Linux remains deferred.
+
+## Independent-review correction after 4e51, source only
+
+The independent review of `4e51d68973da52cf057fab4983b9f112400b802c` identified an actual dispatch-order defect: old source, chooser and allocation envelopes reached shared reveal/allocation boundaries before their handlers rejected them. The follow-up shares those existing admission checks with the outer App boundary. SourceSymbols retains session/path checks; Find-close retains context/instance/open/availability checks and maps to the legacy Close only inside the checked handler. DiagramUsage retains exact Open document/revision/subject checks and all seven panel-token checks. Cancel, Preview and Release retain the active gesture token check; Refused retains its epoch check. Worker completion handlers and their exact occupied-slot release remain unchanged.
+
+Rejected Press packets still run their existing feedback handler, before shared boundaries, so an old stamp can explain the changed view without consuming a newer destination. Current gestures, current chooser actions and current Find-close remain active. Current-token chooser model-refresh recovery is retained; this change does not require a matching panel revision before its existing refresh handler can run. No selection rewrite or broader event classification is introduced.
+
+The exact test-only peer correction `a49b0ec7ac4538a372139175386a881645c1a59e` was inspected and applied: two collapsed conditions and one range containment expression in `app/diagram_usages/tests.rs` and `behavior/scenario/usage/tests.rs`. A source sweep also supplies the newly required `navigation_focus: None` in the root allocation test canvas and the production dirty-point-only canvas in `allocation_input.rs`. The latter is used only for the dirty-work hit check, not painted.
+
+Four further tests under `app::source_rename::tests::navigation_union_tests::palette_union::`, all unrun:
+
+- `captured_old_source_query_and_find_close_preserve_the_new_destination`
+- `current_source_query_and_checked_find_close_remain_live`
+- `captured_old_chooser_context_and_every_token_variant_are_inert`
+- `current_chooser_open_and_close_keep_their_boundary_and_worker_semantics`
+
+They capture actual prior owners/tokens and check complete navigation, allocation epoch, source interaction, status and accepted snapshot retention; each rejected navigation case then completes the valid pending viewport. Positive controls exercise current source query/Find-close and current chooser boundaries, including close while its worker slot remains occupied and exact completion release.
+
+Two further tests under `app::allocation_drag::tests::navigation_union::`, all unrun:
+
+- `stale_gesture_packets_preserve_navigation_and_a_new_live_cancel_still_works`
+- `old_chooser_envelopes_preserve_a_current_canvas_gesture`
+
+They capture Press through the actual DiagramCanvas event path, navigate through the actual chooser, preserve camera/selection/focus/pending measurement and the newer active gesture across stale packets, retain invalid-Press feedback, and exercise current Cancel and current chooser retirement. They do not seed private active gesture state. The resulting `palette_union::` filter contains seven tests, its enclosing `navigation_union_tests::` contains thirteen, the separate removal union still contains two, and the new allocation union contains two. The four existing preview-scroll tests are retained.
+
+Only bounded rustfmt and whitespace/source checks are performed for this follow-up; the ignored formatting receipt is `.local/navigation-import/stale-envelope-format.json`. All new tests, compilation, strict lint and native acceptance remain unrun here. Root readonly, typed activation/lifecycle and paint implementations are untouched by this follow-up. The integration owner must execute the combined source gates; neither source review nor peer-only passes establishes union acceptance.