68 lines
12 KiB
Markdown
68 lines
12 KiB
Markdown
# Independent Text/root source review — 2026-09-13
|
||
|
||
## Disposition and scope
|
||
|
||
**Repair required before admitting this source candidate for the combined rerun.** One confirmed P2 freshness defect is described below. The remaining inspected integration seams are consistent with the published Text contract and retained root behavior, subject to actual compilation, tests, notice generation, and native verification. This is a source review, not runtime acceptance.
|
||
|
||
Reviewed immutable commit `92ff99eb54b75a67c6320cad93d11790413bbd8d`, relative to root `feab2020d8e5b6bfdb59c86ab4aee161617b8b6f`. The worktree was verified clean at that pin before review; subsequent author corrections are outside this report. Published contract/source comparators are `2df7f580aa4bd728a728c83ac10e6ccc956ef069` and `9fd76aef3ae2810667d3f2b031fc43692fc04c89`, including `harness/text-workspace-interaction-contract-20260912.md`. The parent accepted the three retained-data assertion changes at `16904398dbddda9c073b3c420807e406086ad2ea`; I independently reviewed their meaning rather than treating that acceptance as proof.
|
||
|
||
No compiler, application, GUI, package, notice collector, or test execution was performed. No production source was edited. All test descriptions below concern authored assertions. The separate S3 worktree remains frozen.
|
||
|
||
## F1 — P2: recovery republishes stale diagnostics as current
|
||
|
||
**Source:** `crates/oa-desktop/src/app.rs:3393–3399`, `Message::SourceRecovered`; publication helper at approximately 718. The handler filters `pending_save` from the retained diagnostic vector and unconditionally calls `publish_source_diagnostics`. That helper creates a diagnostic publication stamped with the current `source_key`, regardless of the vector's original publication.
|
||
|
||
The vector can legitimately outlive its source key. `create_source_file` (approximately 4297–4361) edits the entry include, discovers a file, changes the workspace/version and requests lint without replacing the old diagnostics immediately. `SourceCloseFile` (approximately 3357–3362) similarly changes workspace membership/version while an old diagnostic vector remains retained. This is safe while the old publication remains stale. Recovery of an applied source workspace is allowed with current drafts and intentionally retains those drafts. Both the applied `Ok(disk)` branch and the `Err(error)` reload branch therefore can reach the unconditional republication without installing source bytes corresponding to the old warning spans.
|
||
|
||
The resulting warning/related locations now pass the publication/key check in `app/text_workspace.rs:616–632`, provided their old spans still fit a current file. A valid byte boundary is not evidence that the diagnostic was produced for those bytes. By contrast, `reset_source_navigation_session` already captures whether the old publication was current before deciding whether it can be republished.
|
||
|
||
**Required repair:** capture old publication freshness before filtering. Only mint a current publication for retained warnings when the old publication was current for the retained source. Otherwise leave authority revoked/stale or replace the diagnostics with results computed for the current source. Do not change the recovery policy that preserves current model and drafts.
|
||
|
||
**Discriminating controls:** start with a warning containing primary and related locations plus a pending-save notice. For a current publication, deliver a matching successful recovery receipt and verify that only the pending-save notice disappears and the current locations remain actionable. For a stale publication after a legitimate workspace/key change, deliver matching recovery and verify that no retained warning or related location becomes actionable, including when the disk reload fails. Preserve full Project, source bundle, drafts, and recovery semantics. Tests must distinguish publication authority, not merely check the displayed warning count.
|
||
|
||
Parent independently confirmed this finding and assigned a separate bounded correction. That future repair is not included in this pin's disposition.
|
||
|
||
## Verified integration invariants
|
||
|
||
### Diagnostics and exact source ownership
|
||
|
||
* Ordinary editor mutation and Undo/Redo update workspace/source identity and revoke old diagnostics before requesting lint. Source reset/open paths replace or clear presentation state. Destination/session reset checks whether the previous diagnostic publication was current before restoring it. F1 is the remaining observed exception.
|
||
* `SourceIncludedLoaded` checks the matching version/entry and exact retained active, inactive, and detached file bytes before installing recovery metadata, discovery, or diagnostics. Newly discovered files are intentionally allowed. `crates/oa-core/src/source_files.rs` now lints the raw reachable bundle instead of publishing post-stabilization compiler spans; this preserves original include/source coordinates. Two authored core tests distinguish missing-ID and legacy cases.
|
||
* Diagnostic actions require the current Problems drawer visit, exact publication identity, current source key, loaded target file, ordered span, and UTF-8 boundaries before root navigation/interaction changes. Annotation presentation additionally checks that the active editor buffer equals the captured source text. These checks rely on legitimate setter/version ownership; they should not be described as a universal complete-byte witness on every diagnostic event. References have the additional whole-snapshot byte check described below.
|
||
|
||
### Retained References and stale input
|
||
|
||
* Retained data does not itself reopen the drawer or authorize navigation. Completion separately checks ownership of the in-flight request, the latest admitted display request, snapshot identity and exact bytes. Navigation additionally requires the captured interaction/raw input clock, file/cursor, and availability. Hide/departure retention improves return-to-results workflow without granting permission to reveal the old selection.
|
||
* `app/source_symbols.rs:32–76` rejects stale Choose envelopes, including cache byte mismatch, before root shared boundaries. `source_results_current` checks key and exact cached snapshot. The visible References view computes that validity once and uses it for both stale summary and row enablement; this fixes the earlier same-key changed-buffer paint/dispatch discrepancy.
|
||
* The authored `same_key_changed_bytes_mark_retained_rows_stale_before_choice_boundaries` tests both active and inactive buffer mutations with the same key, shaped stale presentation, and preservation of a pending reveal/intent. It is a useful falsifier; it has not been run.
|
||
* The scoped-Escape assertion change checks the exact retained result Arc and notice after closing References. Word/Line effective selection, actual subsequent replacement and Undo, whole source/model, accepted snapshot, and history assertions remain. The two modal/chooser completion changes likewise require the exact retained completion Arc while retaining navigation, cursor, worker, chooser and model/source checks. The root selection helper and mounted focus-selection test file are byte-identical to the base. Retention is justified under the published contract, not merely for compatibility with peer tests.
|
||
|
||
### Root boundaries and permanent widgets
|
||
|
||
* Text events enter their own admission before shared root interaction handling. Wrong document/session/visit, stale menu tokens or diagnostic publications, invalid geometry, and blocked commands return before their local mutation boundary. Accepted drawer/menu/diagnostic actions call the existing root pending-navigation and allocation hooks. Source commands dispatch through the existing root update path.
|
||
* `ReferenceScrolled` updates passive geometry without invoking those hooks or changing interaction; valid `PreviewScrolled` retains the root's early inert return. Existing root reference chooser, Text menu, rename and other modal availability checks are composed rather than replaced with peer-only guards.
|
||
* The editor is one permanent `text_editor` with the existing content, root identity/bindings/style/highlighter. Decorations, viewport sensor and diagnostic gesture guard remain mounted across diagnostic availability changes. The guard quarantines obsolete pointer terminals and prevents old releases from activating replacement rows. Widget `diff`, layout, operate, update and overlay paths forward to the actual child rather than reconstructing a second editor.
|
||
* The annotation widget reads geometry from the real editor through the small read-only vendor accessor. It owns tooltip body/footer paragraph objects through deferred rendering, ends editor borrowing before later rendering operations, and bounds tooltip content. Hover is disabled behind blocking chooser/rename state. The inspected mounted/CPU tests do not establish production GPU/native lifetime or rendering success.
|
||
* Authored positive and negative local-boundary tests preserve complete source/model/history and camera/allocation boundary values where applicable. The positive control retires a real pending destination and allocation epoch; stale contexts preserve them. These assertions give meaningful discrimination beyond testing only a local boolean.
|
||
|
||
## Inventory, vendor and test evidence
|
||
|
||
The independent audit verifies the exact 107-path change inventory: 22 modified and 85 new files. Base/final Git blob IDs, lengths and SHA-256 values were checked, plus exact peer blob identity for all 71 vendor files: 200 recorded base/final/peer bindings. The lexical test-name additions/removals were independently derived, including `tokio::test` attributes, and agree with the submitted inventory: **91 added, 5 removed; desktop net +84 and core net +2**. These are source counts, not actual test-list membership or successful outcomes.
|
||
|
||
The three newly imported existing-peer manual ignores are `final_multi_glyph_cluster_anchor_uses_logical_trailing_advance_edge`, `mixed_direction_omitted_separator_has_one_logical_predecessor_anchor`, and `annotation_projection_cost_distributions`. They remain unexecuted limitations; they must not be counted as passing verification.
|
||
|
||
The workspace Cargo change adds the vendor exclusion and iced_widget patch. The lockfile removes that package's registry source/checksum without changing its resolved dependencies; desktop Cargo inputs remain unchanged. All 71 vendored files match the reviewed peer source, including license, upstream metadata and patch rationale. The documented upstream accessor patch is narrow and read-only. `.gitattributes` preserves exact vendor bytes.
|
||
|
||
The notice collector distinguishes workspace packages from non-workspace local dependencies, verifies repository containment/reparse constraints, requires the vendored license, records local source hashes/path and includes patch rationale. Registry supplements require actual registry checksum evidence. The imported collector retains this root's desktop/server default scope. Its behavior has been reviewed, not executed. Future gates/package manifests must include the new vendor inputs; old input counts and former core equivalence evidence cannot certify this changed source.
|
||
|
||
## Evidence bindings and remaining validation
|
||
|
||
* Handoff: `.local/text-union-source-handoff-20260913.md`, SHA-256 `66a56726385e5969751a32c7e3964eed41a52002f4023ace232629d984c69659`.
|
||
* Submitted exact inventory: `.local/text-union-source-inventory-20260913.json`, SHA-256 `a415cfeaa7a412bcb897ae779a45d7894efd8f77bed29a154de550b8ddd2f4e4`.
|
||
* Isolated boundary diff: `.local/text-union-local-mutation-boundary-20260913.patch`, SHA-256 `26d3d86500dd0276c9e276fe8726da4d28b9f39dbdb082cce5108708a9b86fcb`.
|
||
* Independent source audit: `.local/text-union-independent-source-audit-20260913.json`, SHA-256 `a96c27806d9c079e982a5d26806bc9cef24ab8714a58d45d9375599e924a0c13`.
|
||
* Parent stage-one context: `.local/parent-text-union-stage1-review-20260913.md`, SHA-256 `d5c063005d4dd1a804212e8b7deaae226e7d965cdc1988bd20d165ed23e8dcd9`.
|
||
* Earlier independent retention analysis: `.local/text-retained-results-independent-review-20260913.md`, SHA-256 `22aaf828c514e7d58e6f7b0b3132ed43eefb736e4bde78a1529851e6cb89fc0b`.
|
||
|
||
Review was concentrated on changed production ownership/lifecycle seams and discriminating tests, with exact inventory verification; it was not a line-by-line independent proof of every imported test or vendored upstream implementation. After F1 is corrected and reviewed, obtain fresh exact-source listing/focused/full/strict evidence, notice/package validation and realistic native Text/graphics workflows. No successful rerun or final Text/native acceptance is asserted here.
|