95 lines
6.1 KiB
Markdown
95 lines
6.1 KiB
Markdown
# Independent correctness review — 2026-09-05
|
||
|
||
Scope: current core model, language parser/printer, JSON/text persistence,
|
||
transaction history, and desktop source/property/save/navigation state. Read the
|
||
attached goal and normative language specification. No implementation edits or
|
||
Computer Use were performed by this reviewer.
|
||
|
||
## Material findings
|
||
|
||
1. **P2: invalid property draft could trap the user in Getting started.**
|
||
Previously `Message::Page(Guide)` skipped `apply()` while the guide hid the
|
||
inspector. Select an element, enter `invalid` as X, enter Getting started,
|
||
then attempt Architecture or another selection: validation rejected every
|
||
return action and the correction/revert controls were inaccessible. Root
|
||
changed `app.rs` to apply property drafts before opening help when there is
|
||
no source draft. A temporary compiled update harness subsequently observed
|
||
that the invalid-X attempt stays on Diagram, preserving the draft and its
|
||
accessible controls. **Resolved in the inspected code; retain a regression
|
||
test and exercise the UI.** Invalid source still needs access to help.
|
||
|
||
2. **P2: accepted name strings could not all be authored graphically.**
|
||
`validation::valid_text` permits LF, CR and tab, and language tests explicitly
|
||
use these in names. Project, element and relationship names use Iced
|
||
`text_input` in `views.rs`; the installed Iced 0.14.2 implementation filters
|
||
control characters on paste (text_input.rs:970–975) and typing
|
||
(1022–1023). Thus a valid text-authored name was outside the graphical
|
||
editor's authoring capability. Root accepted the finding and is adding
|
||
an explicit exact-string inspector mode. **Resolved by the focused follow-up
|
||
review:** compiled state tests authored CR/LF/tab/quotes/backslashes/Unicode
|
||
in project, element and relationship names and element descriptions;
|
||
toggled both presentations; checked canonical source; executed the actual
|
||
Save tasks to `.arcadia` and `.json`; and loaded both files with complete
|
||
model equality. Invalid JSON literals and XML-forbidden decoded characters
|
||
in all four property cases preserved model, draft and mode, blocked Save,
|
||
and remained recoverable through Revert. Real-app visual verification
|
||
remains the lead's check.
|
||
|
||
3. **P2: noncanonical exact literals remain falsely dirty after Save/navigation.**
|
||
In exact-string mode, type `"\u0041"` as the project name and Save. The file
|
||
correctly contains the model name `A`, and the saved model baseline is
|
||
current; however, `project_name` retains its noncanonical spelling while
|
||
`draft_dirty()` compares it with `display_string(model.name)`, which yields
|
||
`"A"`. Save does not call `sync_selection()` after successful `apply()`, so
|
||
the UI continues reporting unsaved work and may show an unnecessary discard
|
||
guard. The same path affects element/relation names and descriptions.
|
||
Root now calls `sync_selection()` after a successful property command,
|
||
while leaving failed drafts intact. **Resolved and reverified:** the
|
||
compiled harness saved noncanonical literals in project, element and
|
||
relation names and descriptions, observed clean saved state in each case,
|
||
then edited another noncanonical literal and navigated to Text with clean
|
||
property state and matching canonical model. Before the fix this same
|
||
real-Save-task harness failed its clean-state assertion.
|
||
|
||
## Additional verification
|
||
|
||
- Compiled a focused parser harness against the current built core. Mutated
|
||
the valid document at every Unicode character boundary with punctuation,
|
||
quotes, escapes, comments, line breaks, control characters and extreme
|
||
exponents; also supplied 3,000 deterministic arbitrary Unicode strings.
|
||
All returned diagnostics or structurally valid models without panics, and
|
||
every accepted model round-tripped through the canonical printer.
|
||
- Compiled a focused Iced content harness: LF, CR, CRLF, trailing line endings,
|
||
U+2028 and U+0085 descriptions round-tripped through `text_editor::Content`
|
||
exactly. This potential description-normalization defect was not reproduced.
|
||
- Inspected duplicate-identity handling, forward reference resolution, strict
|
||
unknown-field rejection, UUID collisions, kind/endpoint edits, process step
|
||
references, failed replacement history, atomic persistence, and save guards.
|
||
No additional material correctness defect was established in these areas.
|
||
- Correction to the earlier review: treating identity entry as an explicit-only
|
||
action did not satisfy the specification's property-draft rule. The final
|
||
implementation treats IDs as ordinary property drafts: they contribute to
|
||
unsaved state, apply on Save/navigation, and commit atomically with the other
|
||
properties. The requirements reviewer identified and closed this gap.
|
||
- Temporary reproduction sources/binaries are outside the repository under
|
||
`D:/CodexBuilds/Capella2-01a06e2e/review-*`. Whole-workspace regression and
|
||
real-app verification remain the lead's integration checks; this report
|
||
does not claim those were independently rerun here.
|
||
- Follow-up complete: recompiled the current desktop modules in the isolated
|
||
harness and ran all 18 tests (15 repository desktop/diagram tests plus the
|
||
three independent exact-string tests); all passed. This covers real Save
|
||
task execution to private test files but does not replace Computer Use.
|
||
- Final identity follow-up: inspected `EditElement(old, record)`,
|
||
`EditRelation(old, record)`, `EditProject(id, name)`, the shared reference
|
||
update helper, identity-aware draft detection, and action remapping after
|
||
Apply. Recompiled the current modules and ran five focused identity tests;
|
||
all passed. Four repository tests cover failure preservation, references,
|
||
navigation, source parity, process actions, Delete and pending-ID movement.
|
||
An independent test executes real Save tasks for project, element and
|
||
relationship ID-plus-name drafts, reloads equal models, observes clean saved
|
||
state, then verifies one Undo restores both properties together. No material
|
||
issue was established in this bounded change; native drag verification is
|
||
assigned to the runtime reviewer.
|
||
|
||
No unresolved material correctness finding remains from this review.
|