113 lines
6.9 KiB
Markdown
113 lines
6.9 KiB
Markdown
# Independent Process removal adapter source review
|
||
|
||
Read-only inspection of uncommitted production adapter surfaces on base
|
||
`c62622cce71e06f0beae49bc3b4fe8e890eba951`. Inspected `app/process_removal.rs`,
|
||
its `view.rs`, and the diffs/context in `app.rs`, `app/diagram_removal.rs`,
|
||
`app/escape.rs`, `model_menu.rs`, `views.rs`, `behavior/topology/view.rs` and
|
||
`behavior/topology/direct_selection.rs`. Adapter tests were still being authored;
|
||
no Cargo/UI execution and no production edits. This is not native acceptance.
|
||
|
||
## P2: local empty-order wording can deny surviving unlisted contributions
|
||
|
||
At inspection, `matching_rows` rendered `Some([])` as “No remaining
|
||
contributions; no ordered pair” for both order dimensions; `Some([E])` rendered
|
||
“One contribution; no ordered pair.” This is false when describing local listed
|
||
order in the supported owned-but-unlisted case.
|
||
|
||
Literal discriminator: owner P lists Action A and owns unlisted Action U. Remove
|
||
A. U survives; local order changes from explicit to `Some([])`, expanded order
|
||
stays explicit. The review must not tell the user that no contributions remain.
|
||
Use “No listed contributions” for the local dimension, “No indexed
|
||
contributions” for the expanded dimension, or dimension-neutral “Empty order.”
|
||
Similarly qualify “One contribution.” This is a wording defect introduced by
|
||
the new review, not a request to repair preexisting desktop/core semantics.
|
||
Reported to parent for the adapter owner.
|
||
|
||
## P2 candidate: same input-batch newer gesture is invisible to App admission
|
||
|
||
`process_removal_enabled` checks modal/draft/tool state but has no Process
|
||
gesture token. `direct_selection::selection_input` correctly captures Delete
|
||
when `Input.group` already exists, and blocks ordinary press/source gestures.
|
||
However starting a group press sets only private canvas `Input.group` and
|
||
publishes a redraw, leaving the App context and selection generation unchanged.
|
||
|
||
A source-supported event ordering to test, instead of arbitrary packet replay:
|
||
|
||
1. Production tree has local A/B selected and a cursor over selected A.
|
||
2. The same UI event batch receives Delete, then LeftPressed over A.
|
||
3. Delete publishes a captured removal Begin. LeftPressed starts private
|
||
`Input.group` with the same context/snapshot and publishes redraw only.
|
||
4. App consumes Begin after the UI batch; admission has no evidence of that
|
||
newer gesture and opens review, increments epoch and retires the gesture.
|
||
|
||
Source evidence: `direct_selection.rs:209–229` publishes Begin;
|
||
`:316–334` creates private GroupPress without an App gesture message;
|
||
`app/process_removal.rs:51–92` admits using App state alone.
|
||
`app/escape.rs` explicitly documents Iced's batching behavior, and existing
|
||
production `Mounted.batch` topology tests exercise multiple input events before
|
||
App messages are applied. This is a concrete plausible production-event path,
|
||
but this reviewer did not execute it. Parent was asked to run the literal batch
|
||
discriminator before treating it as a reproduced defect.
|
||
|
||
This can violate the policy's “active gestures refuse admission” promise, but
|
||
does not silently delete: an explicit current review confirmation is still
|
||
required. It therefore does not justify P1/data-loss severity from current
|
||
evidence. The successful admission represents an earlier Delete followed by a
|
||
later gesture in one batch; the project should either test/enforce the promised
|
||
lifetime ordering or state a narrower supported guarantee. Do not claim the App
|
||
proves absence of every private canvas gesture.
|
||
|
||
## Verified source properties
|
||
|
||
- Whole-group admission happens before shared source/canvas boundaries.
|
||
`process_removal_matches` validates exact topology context, selection
|
||
generation/membership/primary and actual graph target visibility. The planner
|
||
subsequently refuses mixed local/qualified content as a whole.
|
||
- Header and focused Delete/Shift+Delete capture complete snapshots. Keyboard
|
||
repeat and unsupported modifiers do not issue deletion. Active GroupPress
|
||
captures keyboard input before Delete can reach removal.
|
||
- Process context-menu requests retain selection. Menu invocation accepts the
|
||
new group message before ordinary clicked-object `select`, so a menu opened
|
||
over an unselected object does not silently replace the group. Menu validity
|
||
now also captures the Process selection snapshot.
|
||
- Legacy `Message::Delete` and singleton TopologyCanvas Remove packets are
|
||
refused while a group exists before shared state is disturbed. Qualified
|
||
singleton previews remain read-only. A direct arbitrary Command injection is
|
||
not an established production removal entry point and was not presented as a
|
||
user-reachable bypass.
|
||
- Query/Page/Cancel packets are token scoped; ConfirmDelete is checked before
|
||
forwarding. Unstamped CancelDelete/Escape cannot close a later Process review.
|
||
Root Escape emits the captured current review's token before focused search
|
||
receives it. Search has no Enter-submit confirmation handler.
|
||
- Confirmation checks current document/revision/owner/epoch, exact selection,
|
||
actual visibility, primary inspector identity, pending source/property/
|
||
behavior drafts, source rename and Select tool. It executes one captured
|
||
Document command. Failed source preparation remains the Document layer's
|
||
responsibility; this source review does not independently establish its
|
||
runtime preservation behavior.
|
||
- Initial enabled gates include hosted/workflow/file/pending/menu/usages/
|
||
reference-input states via `keyboard_owner_enabled`. Existing modal dispatch
|
||
prevents ordinary new modal actions while review is open. Confirm's local
|
||
guard does not re-enumerate every other modal, but no concrete production path
|
||
establishing an intervening competing modal was found. Do not promote a
|
||
manually mutated App test alone into a claimed user-reachable failure.
|
||
- Review distinguishes actual removed/updated records, local/expanded order,
|
||
contextual-analysis changes and caller definitions. Affected-caller rows merge
|
||
the prior P1 correction with interpretation caller closure. Repeated reference
|
||
instances are not falsely counted as separate caller rows. The explanatory
|
||
text acknowledges possible reused entry/exit changes and disclaims complete
|
||
expanded graph analysis.
|
||
- All impact rows are searchable/pageable with full names and aliases. Long
|
||
text wraps. Footer is separate from the scrolling body. These structural
|
||
choices support usability but do not establish native layout/focus behavior.
|
||
|
||
## Remaining acceptance work
|
||
|
||
Resolve or narrow the two items above. Run App and actual production-tree tests
|
||
for stale/ABA snapshots, menu selection preservation, wrong/old tokens,
|
||
source-write failure, exact cancel/Undo/Redo and keyboard focus. Inspect compact
|
||
native modal layout, every impact category and search/page access, including a
|
||
long implicit order and multiple caller definitions. Validate save/reopen on the
|
||
identified tested source. No additional P1 production defect was found in this
|
||
bounded review.
|