ARCADIA-Studio/harness/process-group-removal-evidence-20260925/adapter-review.md

Independent Process removal adapter source review

Read-only inspection of uncommitted production adapter surfaces on base c62622cce71e06f0beae49bc3b4fe8e890eba951. Inspected app/process_removal.rs, its view.rs, and the diffs/context in app.rs, app/diagram_removal.rs, app/escape.rs, model_menu.rs, views.rs, behavior/topology/view.rs and behavior/topology/direct_selection.rs. Adapter tests were still being authored; no Cargo/UI execution and no production edits. This is not native acceptance.

P2: local empty-order wording can deny surviving unlisted contributions

At inspection, matching_rows rendered Some([]) as “No remaining contributions; no ordered pair” for both order dimensions; Some([E]) rendered “One contribution; no ordered pair.” This is false when describing local listed order in the supported owned-but-unlisted case.

Literal discriminator: owner P lists Action A and owns unlisted Action U. Remove A. U survives; local order changes from explicit to Some([]), expanded order stays explicit. The review must not tell the user that no contributions remain. Use “No listed contributions” for the local dimension, “No indexed contributions” for the expanded dimension, or dimension-neutral “Empty order.” Similarly qualify “One contribution.” This is a wording defect introduced by the new review, not a request to repair preexisting desktop/core semantics. Reported to parent for the adapter owner.

P2 candidate: same input-batch newer gesture is invisible to App admission

process_removal_enabled checks modal/draft/tool state but has no Process gesture token. direct_selection::selection_input correctly captures Delete when Input.group already exists, and blocks ordinary press/source gestures. However starting a group press sets only private canvas Input.group and publishes a redraw, leaving the App context and selection generation unchanged.

A source-supported event ordering to test, instead of arbitrary packet replay:

1. Production tree has local A/B selected and a cursor over selected A.
2. The same UI event batch receives Delete, then LeftPressed over A.
3. Delete publishes a captured removal Begin. LeftPressed starts private Input.group with the same context/snapshot and publishes redraw only.
4. App consumes Begin after the UI batch; admission has no evidence of that newer gesture and opens review, increments epoch and retires the gesture.

Source evidence: direct_selection.rs:209–229 publishes Begin; :316–334 creates private GroupPress without an App gesture message; app/process_removal.rs:51–92 admits using App state alone. app/escape.rs explicitly documents Iced's batching behavior, and existing production Mounted.batch topology tests exercise multiple input events before App messages are applied. This is a concrete plausible production-event path, but this reviewer did not execute it. Parent was asked to run the literal batch discriminator before treating it as a reproduced defect.

This can violate the policy's “active gestures refuse admission” promise, but does not silently delete: an explicit current review confirmation is still required. It therefore does not justify P1/data-loss severity from current evidence. The successful admission represents an earlier Delete followed by a later gesture in one batch; the project should either test/enforce the promised lifetime ordering or state a narrower supported guarantee. Do not claim the App proves absence of every private canvas gesture.

Verified source properties

• Whole-group admission happens before shared source/canvas boundaries. process_removal_matches validates exact topology context, selection generation/membership/primary and actual graph target visibility. The planner subsequently refuses mixed local/qualified content as a whole.
• Header and focused Delete/Shift+Delete capture complete snapshots. Keyboard repeat and unsupported modifiers do not issue deletion. Active GroupPress captures keyboard input before Delete can reach removal.
• Process context-menu requests retain selection. Menu invocation accepts the new group message before ordinary clicked-object select, so a menu opened over an unselected object does not silently replace the group. Menu validity now also captures the Process selection snapshot.
• Legacy Message::Delete and singleton TopologyCanvas Remove packets are refused while a group exists before shared state is disturbed. Qualified singleton previews remain read-only. A direct arbitrary Command injection is not an established production removal entry point and was not presented as a user-reachable bypass.
• Query/Page/Cancel packets are token scoped; ConfirmDelete is checked before forwarding. Unstamped CancelDelete/Escape cannot close a later Process review. Root Escape emits the captured current review's token before focused search receives it. Search has no Enter-submit confirmation handler.
• Confirmation checks current document/revision/owner/epoch, exact selection, actual visibility, primary inspector identity, pending source/property/ behavior drafts, source rename and Select tool. It executes one captured Document command. Failed source preparation remains the Document layer's responsibility; this source review does not independently establish its runtime preservation behavior.
• Initial enabled gates include hosted/workflow/file/pending/menu/usages/ reference-input states via keyboard_owner_enabled. Existing modal dispatch prevents ordinary new modal actions while review is open. Confirm's local guard does not re-enumerate every other modal, but no concrete production path establishing an intervening competing modal was found. Do not promote a manually mutated App test alone into a claimed user-reachable failure.
• Review distinguishes actual removed/updated records, local/expanded order, contextual-analysis changes and caller definitions. Affected-caller rows merge the prior P1 correction with interpretation caller closure. Repeated reference instances are not falsely counted as separate caller rows. The explanatory text acknowledges possible reused entry/exit changes and disclaims complete expanded graph analysis.
• All impact rows are searchable/pageable with full names and aliases. Long text wraps. Footer is separate from the scrolling body. These structural choices support usability but do not establish native layout/focus behavior.

Remaining acceptance work

Resolve or narrow the two items above. Run App and actual production-tree tests for stale/ABA snapshots, menu selection preservation, wrong/old tokens, source-write failure, exact cancel/Undo/Redo and keyboard focus. Inspect compact native modal layout, every impact category and search/page access, including a long implicit order and multiple caller definitions. Validate save/reopen on the identified tested source. No additional P1 production defect was found in this bounded review.