8.1 KiB
Final bounded Process removal source review
Reviewed local commit fe637dcd277b17653139ffa234e601b29775c565 on
2026-09-25 UTC. git status --porcelain was empty before this ignored local
review note. No production edits, Cargo, UI or Gitea operations were performed;
the parent's frozen-input verification gate was running independently.
Result: no new actionable production finding in the requested final scope. The previous P1, P2 wording and same-batch gesture findings are addressed in source; the two requested planner coverage gaps now have independent literal test cases. Passing runtime/native gates remain the parent's separate evidence.
Prior finding disposition
| Prior item | Final source assessment |
|---|---|
| P1 interpretation-only caller closure omitted explicit-to-explicit effects | Addressed. Plan.affected_uses remains independent of interpretation deltas, seeded from actual removed/changed definition topology. The OA/SA repeated/direct/transitive caller test is at behavior/topology/group_removal/tests.rs:680. |
| P2 “No remaining contributions” denied surviving unlisted contributions | Addressed. app/process_removal/view.rs:89–93 now says “Empty order” / “One item in this order,” with no false global contribution count. Empty order explicitly permits incomplete contextual flow. |
| P2 candidate queued Delete admitted after a later private group press | Addressed in source with synchronous shared input generation and an active gesture lease; production-tree discriminator now exists at app/process_removal/tests.rs:536. Runtime result not independently observed by this reviewer. |
| Coverage: selected occurrence + covered selected link + uncovered selected link | Added at behavior/topology/group_removal/tests.rs:707, both layers. Literal removed IDs, changed IDs, exact two Delete commands, reverse selection order and independent final Project/source history oracle. |
| Coverage: global attachment/trace/placement/diagram impact | Added at behavior/topology/group_removal/tests.rs:738, both layers. Literal removed and changed sets include two placements, cascade-owned evidence, trace and surviving constraint/diagrams; counterpart, unrelated view, retained trace/artifact/placement remain exact. Full expected Project/source history oracle is independently constructed. |
Input lifetime correction
behavior/topology/removal_input.rs supplies a shared Arc<AtomicU64> lifetime:
even generations admit idle capture; an acquired group gesture owns an odd
generation. A lease advances the generation on Drop, including ordinary
release, cancellation and widget-state destruction. Checked arithmetic leaves
overflow terminal/unavailable rather than revalidating old packets. Compare-
exchange prevents a stale lease from resetting an unrelated generation.
The production topology view supplies the State's lifetime to the Graph.
direct_selection.rs revokes idle captures synchronously on canvas presses and
Unfocused/Resized boundaries. A selected-card GroupPress holds the lease. The
shared viewport forwards synthetic Unfocused when camera ownership begins, so
the same native batch can revoke an earlier Delete even though App has not yet
consumed its queued Begin message.
app/process_removal.rs:43–58 captures/requires an idle generation;
:90 compares it before any source/canvas boundary; :185 compares it again at
confirmation. This closes the specific prior race without substituting an App
message-order check for synchronous widget state. Full typed selection/context
admission remains present alongside the generation check.
The new mounted test at app/process_removal/tests.rs:536 uses a real queued
Delete, cursor move and selected-card press in one production input batch. Its
assertions require no modal, unchanged canvas epoch, exact selection and shared
Document snapshot, disabled fresh capture during the live gesture, and a fresh
review after cancellation. The test at :606 exercises Delete followed by
middle/background-left camera pan start. Direct lifecycle tests at
behavior/topology/direct_selection_tests.rs:458 cover release, Escape,
unfocus and Input destruction, requiring idle recovery with a different
generation. The primitive lease test also checks concurrent acquisition refusal
and explicit idle revocation.
These are meaningful discriminators for the reported paths. They are not a claim that the generation tracks every internal viewport gesture: existing viewport keyboard/capture rules still own camera input. No additional concrete production bypass was found in that composition.
Review presentation correction
Identical local/expanded order dimensions are coalesced only when BOTH before
and after vectors match (app/process_removal/view.rs:62–80). A divergence in
either snapshot still produces separately labeled dimensions, preserving the
owned-unlisted discriminator. Contextual-analysis changes remain independent.
Affected caller definitions are deduplicated for the header count; rows retain
definition-to-caller relationships, without claiming reference-instance counts.
The text continues to disclose possible reused entry/exit changes and the lack
of complete expanded-graph analysis.
Precise verification boundary
This review establishes source consistency, test-oracle suitability and old finding disposition for the identified commit only. I did not execute any new or existing test, inspect the parent's gate output, run the native UI, verify compact layout/focus with real input, test packaged launch/save/reopen, or confirm remote publication/integration. In particular, the mounted race tests' presence and correct assertions do not by themselves establish their passing result. Parent gate/native evidence must remain attached to the tested commit; later changes invalidate only the affected portion of this source review.
Addendum: qualified-definition menu restoration after runtime gate
The parent subsequently reported 185 passing and two failing tests for
fe637dcd277b17653139ffa234e601b29775c565: an existing qualified-definition menu
regression and a literal source-oracle whitespace mismatch. Those are parent-
reported runtime results; I did not run or independently inspect their logs.
I reviewed the uncommitted crates/oa-desktop/src/model_menu.rs correction
relative to that commit. Inspected file SHA256:
8BC2C74EA83EAEC8BD342AF5600FBF8E9963BED7290DC094E8B4FC7ABFC0B70D.
At inspection this was the only tracked modification. This addendum binds to
that file content, not a claim that all current files equal the prior HEAD.
No actionable finding in the correction. The qualified navigation entry is now constructed before the aggregate-selection early return, so it remains available for a clicked selected or unselected preview while preserving group removal. Its message uses the captured request's Process context and exact qualified endpoint; it does not read the primary selection or strip reference paths. Preview-link navigation retains the prior source-endpoint convention.
The group branch still returns before singleton mutation entries are built. Outside the group branch, a qualified target still returns before those entries. The group Remove message continues to capture the entire current selection; adding navigation does not bypass the planner's qualified-member refusal or turn deletion into a clicked-object action. Selection-changing menu entries remain explicit.
Existing menu token/context/exact-selection validity checks apply unchanged.
App menu invocation routes TopologyCanvas navigation before ordinary clicked-
object selection. app/process_canvas.rs:125 resolves the complete endpoint,
remembers that exact invocation and opens its defining sequence; it retains
pending-edit admission. No singleton destructive bypass was introduced by the
entry relocation.
The previously passing source-only review did not catch the menu regression; the runtime gate supplied necessary additional evidence. The correction still requires its relevant regression rerun. The independent source-oracle whitespace repair is outside this addendum's inspected scope and is not treated as a production defect or as verified here. No Cargo/UI/Gitea or production edits were performed for this addendum.