148 lines
9.4 KiB
Markdown
148 lines
9.4 KiB
Markdown
# Independent local behavior creation review — 2026-09-10
|
|
|
|
Codex-9e8r6t /root/palette_finish. Read-only review of prepared
|
|
`crates/oa-desktop/src/behavior/creation.rs`, its ten nested tests, the author's
|
|
`release-local-behavior-creation-20260910.md` integration plan, current App
|
|
execution/modal/recovery code and core eligibility rules. No production edits,
|
|
Cargo or native Studio input. The module was not yet declared in the parent at
|
|
review time; this is not compilation or acceptance evidence.
|
|
|
|
Native comparison: `release-capella-creation-study-20260910.md`. The compact
|
|
family/name/viewpoint card avoids Capella's separate chain semantic creation,
|
|
rename and first representation actions. Explicit OA/SA viewpoint choice and
|
|
source-versus-involvement language fit the observed distinction. The current
|
|
SA boundary wording also respects Studio's actual System/SystemActor endpoint
|
|
contract; it should not be broadened casually to all components.
|
|
|
|
No material defect was found in the normal prepared command paths. Raw names,
|
|
reserved IDs, family/layer restrictions, valid owner/context checks and failure
|
|
retention are coherent. The opt-in first state view reuses its planner and
|
|
substitutes stable presentation IDs, with no invented state/region. Recovery
|
|
retains raw values and validates references when preparing. Whole-project and
|
|
SourceBundle Undo/Redo/reopen checks are meaningful, although unexecuted at this
|
|
boundary. A same-ID owner rename remains the same semantic identity; rejecting
|
|
all such edits would not be justified by this review.
|
|
|
|
Three bounded items were sent to the author and root before integration:
|
|
|
|
1. **Command correlation is narrower than exact draft correlation.**
|
|
`created_by` matches CreateElement ID/layer/kind/name/parent and an optional
|
|
CreateDiagram projection, but not a scenario's viewpoint/context/body. A
|
|
prepared scenario command with only a different valid viewpoint or context
|
|
still matches. A batch containing the expected create followed by a rename
|
|
or deletion also matches because the recursive helper uses `any`. These
|
|
commands are not produced by this module's normal Submit; this is a boundary
|
|
hardening issue rather than a demonstrated UI failure. Compare the expected
|
|
command more fully or validate the resulting target before selection, and
|
|
test changed scenario body and later mutations in the same batch. Do not
|
|
describe the helper as exact full-command correlation before resolving it.
|
|
|
|
2. **Captured Escape must preserve modal priority.** The plan correctly avoids
|
|
globally accepting captured keys. However, emitting Creation(Cancel) merely
|
|
because a draft exists is insufficient when a Save As, pending navigation,
|
|
hosted or model-menu overlay owns focus. Current App modal guards recognize
|
|
ordinary Escape specially. A creation-specific captured message may be
|
|
swallowed by those guards, or cancel the underlying draft if routed too
|
|
early. The added subscription must be scoped to the actual visible creation
|
|
card and respect overlay ownership. Require both a real focused creation
|
|
input first-Escape test and an overlay-focused captured Escape test proving
|
|
the underlying raw draft survives.
|
|
|
|
3. **Minimum-size claims remain a layout/native gate.** `picker_view` limits its
|
|
candidate iterator to six and places actions outside the field scrollable,
|
|
which is a sound source-level structure. The 105-owner test only constructs
|
|
the view and asserts it exists; it does not assert rendered candidate count,
|
|
wrapping, action bounds or focus. Long Unicode names/aliases can create tall
|
|
rows. Verify six-candidate pagination and Create/Cancel reachability at the
|
|
minimum window, with optional scenario context expanded and machine owner
|
|
search, before describing this as verified usability.
|
|
|
|
The author already identified the important shared integration risks: do not
|
|
auto-apply a valid property draft while opening creation; include creation in
|
|
all pending guards; select only after successful document execution; use the
|
|
recorded layer for a recovered new SA behavior; retain simultaneous raw source
|
|
and properties rather than calling a destructive sync; batch autofocus with
|
|
existing lint work. These remain tests required of the actual integration, not
|
|
additional confirmed defects in the standalone module.
|
|
|
|
One deliberate UX limit remains: when a machine has no eligible participant,
|
|
the card tells the user to cancel and create one in Architecture, losing this
|
|
creation intent. A suspended draft plus local Create missing participant would
|
|
better satisfy the revised goal and the observed OAS source-creation pattern.
|
|
It is separate work from this module and must not be claimed as delivered here.
|
|
|
|
## Integrated boundary review — 2026-09-11
|
|
|
|
Codex-9e8r6t /root/behavior_audit. Independent read-only review of the uncommitted
|
|
creation integration on `d114a271c5ecffcd7960fb8aa44d45989c10dc33`, after reading
|
|
the revised PROJECT_GOAL, current Gitea decisions through #117, and the existing
|
|
review above. The creation author retained the shared source/Cargo lease. No
|
|
Rust edits, Cargo commands, native input, or new test execution by this reviewer.
|
|
The author's concurrent owner/context label follow-up is outside this correctness
|
|
review; App, behavior and checkpoint seams stayed frozen.
|
|
|
|
**No additional confirmed blocker was found in the reviewed integration.** The
|
|
earlier command-correlation and captured-Escape concerns have concrete code
|
|
resolutions. This conclusion is bounded to the following source paths and
|
|
counterexamples, not a claim of release or native acceptance:
|
|
|
|
- **Command and success correlation:** `creation.rs:147` now compares the whole
|
|
deterministic prepared `Command`, including scenario body and every operation
|
|
in its batch. Changing only a valid viewpoint/context, adding a later rename
|
|
or delete, omitting the optional view, or presenting a different command cannot
|
|
inherit this creation's opening target. In `app.rs:851`, port-owner repair
|
|
leaves this Batch unchanged; correlation is captured before execution. Only
|
|
the success arm installs layer, new behavior selection, active owner and
|
|
opted-in state view. Rejection does not call sync or acknowledgement. Both
|
|
direct Behavior Submit and `apply_behavior` acknowledge after successful
|
|
execution. The first-view planner's temporary UUIDs are replaced with all
|
|
three reserved identities before comparison; the remaining planned fields
|
|
are deterministic for the current project.
|
|
- **Pending and stale-input boundaries:** `app.rs:2303` rejects an Open event
|
|
from the previous layer before applying any draft, and creation Open uses its
|
|
own raw-property/source/pending guard instead of generic implicit Apply.
|
|
Existing owner/layer navigation and Undo/Redo pass through `apply`, which
|
|
refuses while creation is pending. Source/property edits and another behavior
|
|
Start cannot bypass that pending boundary. A retained creation draft rejects
|
|
field edits/preparation against a different Project ID; current owner/context
|
|
eligibility and reserved-ID collisions are revalidated before execution.
|
|
This is not a claim that every local form event carries a canvas-generation
|
|
token: it does not. No reachable cross-document semantic commit was identified
|
|
through the reviewed reset/busy/pending routes.
|
|
- **Recovery and selection:** `app/checkpoints.rs:149` fully prepares recovery
|
|
before replacing the accepted document, reinstalls raw source and property
|
|
drafts, and uses `creation.pending_layer()` for a root-owned SA draft whose
|
|
selected project root has no layer. It does not resynchronize accepted text
|
|
after installing those raw buffers. A restored family-selected card batches
|
|
name focus with lint. Attempting Submit with simultaneous recovered property
|
|
or source drafts refuses before preparing/executing creation. The wrapper in
|
|
`behavior.rs:791` refuses multiple pending behavior drafts rather than choosing
|
|
one to discard.
|
|
- **Escape ownership:** the new subscription receives only captured Escape and
|
|
maps it to ordinary `Message::Escape`; the existing subscription ignores that
|
|
captured event, avoiding a second ordinary Escape from those two listeners.
|
|
App handles model-menu, hosted, workflow, file, delete and pending overlays
|
|
before the creation-cancel arm at `app.rs:1756`. A first Escape therefore
|
|
dismisses the active modal while retaining creation; a subsequent Escape
|
|
cancels the local draft without a model transaction. Normal guards prevent
|
|
opening the model menu or architecture placement while creation is pending.
|
|
|
|
Validation evidence read directly from `.local/behavior-creation-20260911/`:
|
|
`focused-tests-4.log` reports 20/20 creation tests in 0.28 s,
|
|
`behavior-tests.log` reports 166/166 in 13.35 s, and
|
|
`checkpoint-tests.log` reports 13/13 in 2.26 s. These include the author's
|
|
changed-body/trailing-command refusals, actual App selection and raw-input
|
|
guards, a focused Iced TextInput captured-Escape path, and mounted candidate and
|
|
pinned-action bounds. They are author-executed evidence, not an independent
|
|
rerun. Native typography, optional-context expansion and the complete creation
|
|
workflow remain root-owned acceptance. The missing-owner catalog detour above
|
|
remains separate unfinished functionality.
|
|
|
|
Frozen seam SHA-256 values for the reviewed source:
|
|
|
|
```text
|
|
app.rs 2CC2CF65CA0E2B999271BF6BE253D026102A4DA769D54A7BC9CF9982375B89F2
|
|
app/checkpoints.rs B5D319E6FDA8DEC3CD068C362E9C35E941EACC32EDCD291D9F66E33A055209CF
|
|
behavior.rs C957C86226012F8A1E6ED406A6BBE3407424CCEA47C0994130483CE758C8C114
|
|
```
|