10 KiB
Scenario aggregate removal: Windows implementation and verification
Later keyboard and real source-budget-failure verification covers focused native Delete/Shift+Delete and the bounded App source-update error path. The original observations and archives below remain unchanged.
Implemented and tested at 43340b94a13f192c3b5d3c3112dbe87246790a44 on codex/scenario-multiselect-9e8r6t-20260924, following the removal policy and multiple-selection contract. This is branch-specific evidence, outside the delivered issue-37 prerelease. Default-branch integration, a new release and all issue-29 acceptance are not asserted.
Scenario groups now have one captured local removal operation through the header, contextual menu and mounted canvas Delete/Shift+Delete route. The review shows selected and additional removals separately from changed surviving records, searches full labels/aliases and pages the complete impact. One explicit confirmation executes one Document transaction. Native Windows checks establish cancellation, mixed participant/message removal, exact saved source, one Undo/Redo, compact review expiry/recovery and fresh-process reopening for the fixture below.
Behavior and review boundaries
Every original typed target must exist, belong to the active Scenario and be reachable through actual owner/branch lists; the App also checks actual visibility, exact document/revision/view/visit, selection generation/membership/primary and clean input ownership. Admission occurs before collapsing selected descendants covered by a selected ancestor. Cross-parent local occurrences and mixed participant/occurrence groups share one removal meaning. A missing, stale, hidden, foreign or unsupported member refuses the complete set.
The planner constructs one deterministic Batch of core Delete commands and evaluates the final candidate. Impact is the actual removed identity set and changed surviving records, including references, parent lists, placements, artifact/trace records and affected saved layouts. Reusable engineering definitions and counterparts are preserved under the established core deletion contract. A removed call can leave a warning-admitted reply with its call reference cleared; it is not silently deleted. Candidate state is not retained as an extra long-lived Project clone.
The App intercepts captured Begin and modal events before ordinary selection/source handling. Begin retires the old canvas epoch and captures a fresh review context. Confirmation, Cancel, search and paging carry the exact review token; old packets cannot disturb a newer review. Confirmation rechecks complete selection/context and edit eligibility before executing once. Expired reviews show a disabled Remove action and an explicit recovery message. Successful removal selects the Scenario owner and clears removed transient selection. Model Undo restores source/model, not transient selection. Legacy singleton deletion remains refused while a group is depicted.
Source review found a repeated visibility-enumeration cost, corrected to one enumeration per admission. Strict Clippy led to boxing the large captured Begin snapshot; the final delta changes representation only. Adapter review records independence limits: its reviewer authored the view, which was excluded from independent source review and separately inspected in the actual native workflow.
Closed Windows gates
Rust/Cargo 1.98.1, project GNU/LLVM toolchain, one Cargo job and incremental compilation disabled. Each of the eleven recorded attempts has 823 unchanged captured inputs and an exact Git-blob source proof. Final-source input-map SHA256 is 839b041088be0638c55cdcc4da18d6cf9b69eecee3c00d48734759166ed06a0f. See portable evidence for raw streams, commands, source capsules, proofs and offline verification.
| Final gate | Command | Result |
|---|---|---|
removal-app-scenario-4 |
cargo test -p oa-desktop scenario --message-format=json -- --nocapture |
333 passed, 0 failed, 1 existing ignored timing diagnostic, 1296 filtered |
removal-app-removal-2 |
cargo test -p oa-desktop removal --message-format=json -- --nocapture |
53 passed, 0 failed, 0 ignored, 1577 filtered |
removal-app-format-2 |
cargo fmt --all -- --check |
exit 0 |
removal-app-clippy-2 |
cargo clippy -p oa-desktop --all-targets --message-format=json -- -D warnings |
exit 0 |
removal-app-build-1 |
cargo build -p oa-desktop -p oa-cli --message-format=json |
exit 0, Studio and CLI artifacts |
The filters overlap; their counts must not be added as unique tests. The ten new planner test functions cover OA/SA exact transactions, mixed references/both views, calls/replies, selected ancestors, separate operands, ScenarioUse preservation, placements/artifacts/traces, complete typed admission/reachability and invalid baseline/Redo refusal. Eight new App functions cover Derived/Saved transactions, stale modal packets, context/selection ABA, cancel with Redo, competing operations, contextual subject preservation, dirty/legacy refusal and mounted Delete/Shift+Delete/repeat routing.
Retained development failures: scenario-1 at ed6eaaa73ee409857b8d9bab81b9134981daca30 failed compilation for missing model_menu imports; scenario-2 at 81db58c8b3a94c7f3fcc2a17d9400dfcd38f6574 compiled with331 passes/two incorrect fixtures/one ignore; the strict group-menu expectation had not admitted the new aggregate action, and the cancel/Redo fixture failed to reselect after Undo changed its primary. Both fixtures were corrected without relaxing whole-selection/stale checks. Scenario-3 and removal-1 pass at 35be9ae133f3a32434c4d84edcdb0764044b7539; format-1 passes there but clippy-1 fails large_enum_variant. Final43340 boxes the snapshot and all five gates above pass. Three failed runs remain failures in the archive.
Native removal and persistence
The copied GUI is 120,067,072 bytes, SHA256 e118e7f0a2ff53ac9c22a73d07555929d11e1ad917d430a7ae88d469aaa91155; explicit libunwind DLL is 190,976 bytes, SHA256 f45604a12e8bcd839fd86f667c1be1cc7c4f9da2b3c69ff381ac708f0e1ae7d4. Each process uses a fresh bin/cwd and a restricted system PATH. Current-source CLI preflight checks both original and expected-removed sources successfully; warning-admitted incomplete messages remain allowed. Native source oracle was derived before executing the product writer and needed no revision or whitespace normalization.
Run1 uses three reusable OA activities, three local participants, eight identical message display names with aliases a–h, and two independently authored saved layouts. Click plus contextual Add selects intake_lane and a. Header Remove and the contextual group action show exactly2 removals/10 updates across12 affected records: the two selected bodies are removed, owner sequence/seven surviving sender references/two saved layouts updated. Search distinguishes h, absent search shows an explicit empty state, and Enter does not confirm. Cancel preserves selection and the full original source.
Explicit Remove produces two surviving participants and seven visible unfinished-message bodies; the view explains that saved positions are retained until endpoints are complete. All three reusable activity definitions, seven receiver references, remaining identities/names/kinds/order, both view identities and all surviving authored coordinates are preserved. One Ctrl+Z restores the entire original file. After reselection, window resizing expires review and disables removal; Escape and explicit Cancel retain the group. The fresh compact review remains readable with a fixed footer at1102x732 (capture dimensions). Page2 remains discoverable after scrolling and shows both affected views. One Ctrl+Y still redoes the original transaction after those UI-only steps. Saved B also opens with its surviving contents.
| Full-byte phase | Run1 snapshots | Bytes | SHA256 |
|---|---|---|---|
| baseline | 01-baseline, 02-cancel, 04-undo | 4389 | 70c32355b82393c03ef87b24862863e0a06c4dcb00cf2c0a84a7cfd2da687a8a |
| removed | 03-removed, 05-redo | 3856 | 1cb04cbab8428fc672293f29783fffdeecaf6ec6d81d5439501c32e866c8264f |
Run2 is a fresh process explicitly initialized from run1 snapshot05-redo. File Open, Scenario navigation and Saved A display the persisted remaining participants/messages. Save snapshot01-reopened and final working source equal all3856 expected bytes. Both processes close normally with exit0, empty stdout/stderr and unchanged prepared immutable files. Fresh reopen establishes source persistence, not selection/history persistence.
The archive retains original captures and detailed observation notes, including input/capture recoveries. Initial nonmaximized navigation misses recovered after maximize; file picker focus metadata disagreed with the visible filename field, and one typing attempt required refocus. One screenshot-less scroll returned16x16 bounds; one Restore capture reported minimized and recovered through activation. Capture35's filename misleadingly says Delete opens review, but the image shows no operation because canvas keyboard focus was not established. It does not count as successful native Delete entry. These limitations were recorded before package acceptance.
Limits
No full desktop-suite, native Shift-click, successful focused native Delete entry, keyboard-only confirmation, broad screen-reader support, arbitrary long-alias/paging stress, native Fragment/SA/reuse-expansion or Linux claim. Accessibility capture exposes mainly window chrome. Tests cover additional semantic/input cases separately from native observations. A real App source-write-failure fixture remains a runtime coverage gap; source inspection and Document atomicity evidence do not replace executing that error branch. Source/model success, cancellation, stale refusal and history coverage are bounded as described above.
Windows Gitea read/write/push networking works. Ubuntu26.04 starts, but the latest WSL curl to the crates index timed out resolving DNS after10seconds; no Linux build/check was attempted. Linux remains user-paused. Integration must fetch this delivered branch, reconcile other contributions and verify the combined source; these records do not imply that has occurred.