ARCADIA-Studio/harness/process-group-removal-evidence-20260925/source-failure-investigation.md

Process aggregate removal source-budget investigation

Scope: local branch codex/scenario-multiselect-9e8r6t-20260924, parent-provided baseline 7323a80e. Static investigation only; no Cargo, GUI, Gitea, commit, or runtime experiment performed. No production or test source edited.

Finding

No legitimate source-growth case was found for an admitted Process / Functional Chain aggregate removal. Do not transplant the Scenario lifeline budget fixture by giving Process contributions invalid references, alter a prepared command to perform unrelated growing changes, or reduce private Document limits after loading. Those would test a different operation or an invalid model.

The existing Process regression (crates/oa-desktop/src/app/process_removal/tests.rs:205) replaces the admitted plan with Delete(existing) + Delete(nonexistent). It evaluates atomic engine failure and App recovery, not an actual source update failure. Keep that evidence boundary explicit.

Evidence and excluded candidates

• behavior/topology/group_removal.rs:176 admits only listed local contributions or locally maintained SequenceLink / ContextualLink. behavior/topology.rs:395 restricts contributions to Action, Exchange, Control and SequenceReference occurrences. Removing a reused contribution does not remove its referenced definition or the referenced work/exchange.
• oa-core/src/references.rs:325 cascades ownership, incident relations, contextual references, diagram nodes, traces and artifact links. A contextual link referencing a removed occurrence is deleted, not rewritten to a longer reference. No new identities are introduced by the removal plan (group_removal.rs:263).
• references.rs:459 removes records and prunes surviving steps, constraint lists, view options, routes and Scenario layout references. Process occurrence and maintained-link identities cannot be valid targets of the optional work, sequence, scenario, lifeline, supertype, operation-allocation or exchange fields that become none when their targets disappear.
• The plausible remaining optional occurrence reference, reply_to, cannot reference an admitted Process contribution: validation.rs:1626 rejects Call/reply semantics outside Scenario; validation.rs:1688 requires the target Call to belong to the same Scenario. State trigger fallback text likewise requires Event or work targets (validation.rs:2619), not occurrence or maintained-link targets.
• view_options.rs:96 retains explicit empty selection variants and only filters their identity lists; no longer enum is substituted.
• source_project.rs:1516 uses identity keys for surviving reference list entries, preserving surviving syntax/trivia and stripping deleted tokens. item_key at approximately 1695 keys references, routes and semantic rows. trivia at 1127 filters input tokens without adding bytes. Structural deletion in source_project/source_structure.rs retains trivia of deleted declarations and does not create/move surviving records for this cascade. There was no credible canonical-format expansion candidate in the paths inspected.

These are reviewed code-path observations, not a formal proof that every possible accepted source spelling is byte-monotone. No claim of an exhaustive runtime search is made. OA and SA share these admission and cascade rules; saved views add record/list pruning, not a discovered growth mechanism.

Better evaluator

1. Retain the existing Process injected engine-failure test with its precise scope. It already checks snapshot identity, exact model/bundle, editor/workspace, selection targets/primary, camera and usable redo. Future strengthening may add revision/clean state, selection generation and navigation, but cannot turn that test into source-write-failure evidence.
2. Use app/scenario_removal/tests.rs:199 as the genuine source-budget failure evaluator: valid lifeline removals rewrite many short @a / @b references in surviving messages to none, prove unrestricted exact-model success and net source growth, and fail through public Document::from_bundle limits. That test covers the shared Document transactional source-write boundary plus Scenario App recovery.
3. If explicit Process source-write failure branch coverage is required, introduce a narrowly scoped test fault at the Document source writer, and label it an injected source-writer failure. That is more honest than a semantically invalid growth fixture, but adds a test seam and is outside the delegated tests-only scope. A meaningful non-fault alternative is a public input-sized-budget successful Process removal test over the literal native fixture; it checks that deletion remains possible at the admitted source budget, not failure atomicity.
4. Revisit if Process semantics gain surviving optional references to contributions or if source editing changes to insert replacement syntax during removal.