# Process aggregate removal — App implementation and verification, 2026-09-25 UTC

Local-only contribution for issue 29. Source `572e96ba03522cfb822b13fe4abb50e857a5de48` builds and runs on Windows. Process/FunctionalChain aggregate removal has source review, filtered regression checks and a native OA model/source/history/reopen receipt. The [compact follow-up](process-removal-compact-20260925.md) additionally verifies the bounded removal review at 1102x732. No integration, release or remote publication is claimed.

## Behavior and reviewed corrections

The [removal policy](process-group-removal-policy-20260925.md) defines this scope. Process/FunctionalChain removal captures the complete typed group of listed local contributions and maintained links, admits every original member, and evaluates one Batch. Occurrence cascade coverage suppresses redundant selected-link commands without hiding those selections from review. Qualified previews cause whole-set refusal; local ContextualLinks use explicit owner even with qualified endpoints. Actual before/after candidates determine removed identities and changed surviving records, including embedded placements. Referenced definitions, other uses and opposite-layer counterparts are preserved under existing core cascade rules.

Review separately reports stored impact, local listed order, expanded indexed order, contextual-analysis changes and surviving caller definitions. Caller impact includes ordinary explicit-to-explicit topology changes, and warns that reused entry/exit connectivity and diagnostics may change without creating stored identities. It does not claim complete expanded graph analysis or count repeated reference instances as separate caller definitions.

Source review found and corrected:

- P1: interpretation-only caller closure missed changed explicit topology. `affected_uses` now derives from actual changed definition topology, independently of interpretation deltas; literal OA/SA direct, repeated and transitive caller discriminators were added.
- P2: empty local-order wording falsely denied surviving unlisted contributions. Review now says “Empty order” / “One item in this order,” retaining incomplete-flow qualifications and separate dimensions when they differ.
- A same-input-batch queued Delete could precede a later private gesture while App admission lacked that evidence. Synchronous shared input generation and a gesture lease now revoke stale captures; mounted production-tree and lease lifecycle discriminators were added. The bounded source review found the specific race addressed, without claiming every viewport gesture is represented.
- Independent planner review prompted literal tests for covered plus uncovered selected links and global attachment/trace/placement/diagram bookkeeping. Final source review at `fe637dcd277b17653139ffa234e601b29775c565` found no new actionable production finding in its bounded scope. Its later menu-correction addendum likewise found no actionable issue. These reviews did not execute runtime/native gates.

Exact historical review notes: [policy critique](process-group-removal-evidence-20260925/policy-critique.md), [planner](process-group-removal-evidence-20260925/planner-review.md), [adapter](process-group-removal-evidence-20260925/adapter-review.md), and [final review/addendum](process-group-removal-evidence-20260925/final-review.md). Their original source/runtime boundaries remain intact; source-only conclusions are not retroactively represented as executed tests.

## Closed failed gate history

Both runs used Windows `stable-x86_64-pc-windows-gnullvm`, Cargo/rustc 1.98.1, one build job, incremental compilation disabled, and:

```text
cargo test -p oa-desktop --message-format=json -- process_ topology scenario_removal removal --test-threads=1
```

The identified local closed receipts for `process-removal-tests-1` and `process-removal-tests-2` were inspected with their exact source proofs and logs. Raw evidence publication is pending; these local files are not a peer-accessible handoff. Both closed with exit 101 and unchanged captured inputs. Each separate source proof passed exact captured inventory/Git-blob comparison; that proof does not change the failed test outcome. Neither command is the full suite (1469 tests filtered out).

1. **Gate 1**, source `fe637dcd277b17653139ffa234e601b29775c565`, finished 03:12:51 UTC: **185 passed, 2 failed**. The existing qualified-definition navigation regression exposed a real menu omission. Correction `f20497b29bf637619bc35ffe41274fc0f66c387b` restores qualified navigation before the aggregate menu early return, preserving exact endpoint/context and whole-group removal. The other failure was the newly authored v1 lexical oracle: complete semantic Project equality passed, then exact Document source equality failed. Independent source-policy investigation derived retained declaration trivia (22/20/16 spaces and existing annotation LF boundaries) and unformatted surviving `[@e1,@e2]`. V2 was derived from the checksum-pinned baseline before separate comparison with observed output; it matched 2258 bytes, SHA256 `b4a2b07ad4c796f555c61945ca42b1c221b454b35488c60fefc86f96f7aa71ba`. V1 and failed evidence remain preserved. This was an incorrect lexical assumption, not evidence of a semantic deletion defect or a new writer regression. See the [exact source-oracle investigation](process-group-removal-evidence-20260925/source-oracle-investigation.md).
2. **Gate 2**, source `f20497b29bf637619bc35ffe41274fc0f66c387b`, finished 03:20:16 UTC: **186 passed, 1 failed**. Qualified-navigation regression passed. In the literal test, complete Project and exact Document/v2 source assertions passed; the later `app.source_workspace.bundle()` equality failed. This is distinct from v1: the fixture helper replaced Document after `open_project` but retained its generated split workspace. `sync` preserves discovered files; it is not a new-document initializer. Commit `d93c0a801249f361d95721fb0fc239a95159af5c` initializes `Workspace::new(app.document.bundle(), true)` before sync and asserts baseline workspace equality. No production writer change or weakened source equality was needed. Undo/Redo assertions later in this failing test were not reached.


## Closed correction and final-source gates

All gates below closed with unchanged captured inputs and a separate PASS proving exact input inventory/Git-blob bytes. The result/input-map hashes were checked against those proofs. A source-proof PASS means source binding; it does not turn a failed gate into a pass.

| Gate | Identified source | Result |
| --- | --- | --- |
| tests-3 | d93c0a801249f361d95721fb0fc239a95159af5c | 187 passed, 0 failed; 1469 filtered out |
| clippy-1 | d93c0a801249f361d95721fb0fc239a95159af5c | Exit 101: two style lints under warnings-as-errors |
| tests-4 | 572e96ba03522cfb822b13fe4abb50e857a5de48 | 27 passed, 0 failed; 1629 filtered out |
| format-3 | 572e96ba03522cfb822b13fe4abb50e857a5de48 | PASS, exit 0 |
| clippy-2 | 572e96ba03522cfb822b13fe4abb50e857a5de48 | PASS, exit 0 |
| build-1 | 572e96ba03522cfb822b13fe4abb50e857a5de48 | Studio and CLI PASS, exit 0 |

Gate names have the prefix `process-removal-`. Tests-3 used the broad filtered test command above and passed the literal model/source/one-Undo/Redo case after the fixture initialization correction. Clippy-1 identified manual parity and manual saturating arithmetic in the input lifetime helper. Commit `572e96ba03522cfb822b13fe4abb50e857a5de48` replaces `generation % 2 == 0` with `generation.is_multiple_of(2)`, and `checked_add(2).unwrap_or(u64::MAX)` with `saturating_add(2)`; these retain the same unsigned-integer and terminal-overflow semantics. Tests-4 reran the affected Process removal, input generation and gesture coverage on that final source. The broad 187-test result belongs to d93c0a80, not a rerun of all 187 on 572e96ba.

Final-source commands:

```text
cargo test -p oa-desktop --message-format=json -- process_removal removal_input group_gesture --test-threads=1
cargo fmt --all --check
cargo clippy -p oa-desktop --all-targets -- -D warnings
cargo build -p oa-desktop -p oa-cli --message-format=json
```

Runtime results are filtered Windows evidence, not a full-suite or Linux claim. Both passing test runs include the literal aggregate removal model/source history oracle and mounted queued-Delete/camera-boundary discriminator.

Receipt SHA-256 anchors (result.json; raw package publication pending):

| Gate | SHA-256 |
| --- | --- |
| tests-3 | 82709fef9b1aabdf2fcc07a7cb9300d16474bc62370d7157e6bb6270cd8264f8 |
| tests-4 | 8513d24b9f05645908f4a475fcc90b5887362473f8046282bfd8af6a24c61dd5 |
| format-3 | 7ec891fa7a881b4f04fc3f58047a15f3972b397b7d2595e4a0bb04a9f658d9a3 |
| clippy-1 | 35e1afdd586853dbd992b3b944045e479297bf6dc2bf33db5186be0a51c3e41f |
| clippy-2 | 12f3352607a1608fcd1242b48336ae877b81677df38d96d17bbe9dc6ed3ff49b |

## Native verification and portable records

The closed build has 832 unchanged captured inputs and an exact Git-blob source proof. Its copied Studio binary and explicitly pinned libunwind.dll launch with only Windows system directories on PATH. Current CLI preflight accepts both oracle-v2 files with warning-only model diagnostics. Run 1 removes Action @a, Control @c (both named Review gate) and their selected authored link @approved. The review distinguishes them by alias and exposes all ten effects through scrolling and two pages: three selected removals, one updated owner, before/after implicit-order consequences, the two remaining exchange positions and direct/transitive caller definitions. Search finds @outer; Enter does not confirm; empty search supplies recovery guidance. Cancel and Escape retain the full group and link primary. Header, context menu over an unselected object, focused Delete and focused Shift+Delete all open the complete review.

After restoring/reactivating the window, the captured review is expired and Remove is disabled; that native sequence does not isolate resizing from focus changes. Explicit confirmation of a fresh review leaves two exchange cards and their implicit connection. Save produces exactly 2258 oracle bytes; one Undo and Save restores all 2609 baseline bytes; one Redo and Save reproduces all 2258 removed bytes. Run 2 starts a fresh process from the saved Redo file, displays the same two exchanges/implicit connection and saves identical bytes. Both processes exit normally with empty logs and unchanged executable, runtime and fixture pins. These exact bytes preserve underlying work/exchanges, caller definitions/references and SA sentinels.

The [native action record](process-group-removal-evidence-20260925/native-actions.md) identifies capture labels, actual keys, source snapshots and automation failures. Captures are observations, not an instrumented input log. Membership used context Add, not native Shift-click. After Escape, Shift+Delete required F6 to restore canvas focus. A restored-window capture initially failed as minimized and recovered through fresh window selection/reactivation; a later out-of-bounds positioning drag was rejected before capture. These are recorded separately from application behavior. True compact 1100px layout is unverified; the restored view was partly clipped by the desktop. Maximum-window review reachability is established at 1605x872.

Portable [Cargo records and offline verifier](process-group-removal-evidence-20260925/checks/README.md) preserve all ten attempts, including three failures, with four distinct source input capsules. [Native archive](process-group-removal-evidence-20260925/native/native-evidence.zip) and [standalone verifier](process-group-removal-evidence-20260925/native/verify.py) preserve original v1, separately derived v2, 53 raw capture records, exact saved snapshots and closed process receipts. Both standalone verifiers pass. Native ZIP: 5,617,713 bytes, SHA256 `f77fd3abe7ecc5838395b94a95ba935c8dc5c10a36c8e3a2c1ec4a1da1521b84`, 327 members, six omitted executable/DLL payloads represented by pins. These evidence archives are not runnable releases.

Cargo ZIP: 13,162,535 bytes, SHA256 `13aeacd8b1326ec5d57d49a13e8fd0c2e8611f85da1244cbcb1362edcb6fd4d5`. The [independent native review](process-group-removal-evidence-20260925/native-review.md) found no blocking issue within the bounded flow, recomputed both runs' immutable file pins and checked all saved-source results. It preserves the distinction between parent-reported actions and captured states, and leaves compact layout and accessibility unaccepted. Exact source comparison and archive integrity do not substitute for this visual review. Recheck records offline with Python 3.11+:

```text
python -B harness/process-group-removal-evidence-20260925/checks/verify.py
python -B harness/process-group-removal-evidence-20260925/native/verify.py harness/process-group-removal-evidence-20260925/native
```

## Remaining scope and publication

This original native receipt covers OA derived layout and the bounded fixture. SA/qualified paths, cascades, stale input races and command-failure preservation have separate filtered-test evidence. The [follow-up](process-removal-compact-20260925.md) closes the compact review gap for this fixture. Actual Process source-budget failure, native Shift-click, comprehensive accessibility, full-suite and Linux acceptance remain unclaimed. Static investigation found no valid source-growth case for the admitted Process removal; see the [evaluator boundary](process-group-removal-evidence-20260925/source-failure-investigation.md). This is not a formal monotonicity proof or actual Process source-write-failure coverage. Preserve these limits when integrating; no issue closure is justified by this branch alone.

Fresh guarded push was rejected with `remote unpack failed: unable to create temporary object directory`; a Gitea MCP issue-comment write also failed. Read operations work, main AGENTS remains blob e76647f49913b314e1543c4464f6199533909bae, and the remote contribution branch remains 43340b94. WSL DNS still timed out after ten seconds; Linux builds remain explicitly user-paused. These are observed failed attempts, not a newly verified disk-full root cause. Pending Scenario follow-up and this Process contribution remain local-only. Reconcile and publish the buffered issue-29 handoff when writes recover; do not overwrite remote history. Historical local paths inside copied reviews identify their original context, not peer-accessible deliverables.