123 lines
8.1 KiB
Markdown
123 lines
8.1 KiB
Markdown
# Final bounded Process removal source review
|
||
|
||
Reviewed local commit `fe637dcd277b17653139ffa234e601b29775c565` on
|
||
2026-09-25 UTC. `git status --porcelain` was empty before this ignored local
|
||
review note. No production edits, Cargo, UI or Gitea operations were performed;
|
||
the parent's frozen-input verification gate was running independently.
|
||
|
||
**Result:** no new actionable production finding in the requested final scope.
|
||
The previous P1, P2 wording and same-batch gesture findings are addressed in
|
||
source; the two requested planner coverage gaps now have independent literal
|
||
test cases. Passing runtime/native gates remain the parent's separate evidence.
|
||
|
||
## Prior finding disposition
|
||
|
||
| Prior item | Final source assessment |
|
||
| --- | --- |
|
||
| P1 interpretation-only caller closure omitted explicit-to-explicit effects | Addressed. `Plan.affected_uses` remains independent of interpretation deltas, seeded from actual removed/changed definition topology. The OA/SA repeated/direct/transitive caller test is at `behavior/topology/group_removal/tests.rs:680`. |
|
||
| P2 “No remaining contributions” denied surviving unlisted contributions | Addressed. `app/process_removal/view.rs:89–93` now says “Empty order” / “One item in this order,” with no false global contribution count. Empty order explicitly permits incomplete contextual flow. |
|
||
| P2 candidate queued Delete admitted after a later private group press | Addressed in source with synchronous shared input generation and an active gesture lease; production-tree discriminator now exists at `app/process_removal/tests.rs:536`. Runtime result not independently observed by this reviewer. |
|
||
| Coverage: selected occurrence + covered selected link + uncovered selected link | Added at `behavior/topology/group_removal/tests.rs:707`, both layers. Literal removed IDs, changed IDs, exact two Delete commands, reverse selection order and independent final Project/source history oracle. |
|
||
| Coverage: global attachment/trace/placement/diagram impact | Added at `behavior/topology/group_removal/tests.rs:738`, both layers. Literal removed and changed sets include two placements, cascade-owned evidence, trace and surviving constraint/diagrams; counterpart, unrelated view, retained trace/artifact/placement remain exact. Full expected Project/source history oracle is independently constructed. |
|
||
|
||
## Input lifetime correction
|
||
|
||
`behavior/topology/removal_input.rs` supplies a shared `Arc<AtomicU64>` lifetime:
|
||
even generations admit idle capture; an acquired group gesture owns an odd
|
||
generation. A lease advances the generation on Drop, including ordinary
|
||
release, cancellation and widget-state destruction. Checked arithmetic leaves
|
||
overflow terminal/unavailable rather than revalidating old packets. Compare-
|
||
exchange prevents a stale lease from resetting an unrelated generation.
|
||
|
||
The production topology view supplies the State's lifetime to the Graph.
|
||
`direct_selection.rs` revokes idle captures synchronously on canvas presses and
|
||
Unfocused/Resized boundaries. A selected-card GroupPress holds the lease. The
|
||
shared viewport forwards synthetic Unfocused when camera ownership begins, so
|
||
the same native batch can revoke an earlier Delete even though App has not yet
|
||
consumed its queued Begin message.
|
||
|
||
`app/process_removal.rs:43–58` captures/requires an idle generation;
|
||
`:90` compares it before any source/canvas boundary; `:185` compares it again at
|
||
confirmation. This closes the specific prior race without substituting an App
|
||
message-order check for synchronous widget state. Full typed selection/context
|
||
admission remains present alongside the generation check.
|
||
|
||
The new mounted test at `app/process_removal/tests.rs:536` uses a real queued
|
||
Delete, cursor move and selected-card press in one production input batch. Its
|
||
assertions require no modal, unchanged canvas epoch, exact selection and shared
|
||
Document snapshot, disabled fresh capture during the live gesture, and a fresh
|
||
review after cancellation. The test at `:606` exercises Delete followed by
|
||
middle/background-left camera pan start. Direct lifecycle tests at
|
||
`behavior/topology/direct_selection_tests.rs:458` cover release, Escape,
|
||
unfocus and Input destruction, requiring idle recovery with a different
|
||
generation. The primitive lease test also checks concurrent acquisition refusal
|
||
and explicit idle revocation.
|
||
|
||
These are meaningful discriminators for the reported paths. They are not a
|
||
claim that the generation tracks every internal viewport gesture: existing
|
||
viewport keyboard/capture rules still own camera input. No additional concrete
|
||
production bypass was found in that composition.
|
||
|
||
## Review presentation correction
|
||
|
||
Identical local/expanded order dimensions are coalesced only when BOTH before
|
||
and after vectors match (`app/process_removal/view.rs:62–80`). A divergence in
|
||
either snapshot still produces separately labeled dimensions, preserving the
|
||
owned-unlisted discriminator. Contextual-analysis changes remain independent.
|
||
Affected caller definitions are deduplicated for the header count; rows retain
|
||
definition-to-caller relationships, without claiming reference-instance counts.
|
||
The text continues to disclose possible reused entry/exit changes and the lack
|
||
of complete expanded-graph analysis.
|
||
|
||
## Precise verification boundary
|
||
|
||
This review establishes source consistency, test-oracle suitability and old
|
||
finding disposition for the identified commit only. I did not execute any new
|
||
or existing test, inspect the parent's gate output, run the native UI, verify
|
||
compact layout/focus with real input, test packaged launch/save/reopen, or
|
||
confirm remote publication/integration. In particular, the mounted race tests'
|
||
presence and correct assertions do not by themselves establish their passing
|
||
result. Parent gate/native evidence must remain attached to the tested commit;
|
||
later changes invalidate only the affected portion of this source review.
|
||
|
||
## Addendum: qualified-definition menu restoration after runtime gate
|
||
|
||
The parent subsequently reported 185 passing and two failing tests for
|
||
`fe637dcd277b17653139ffa234e601b29775c565`: an existing qualified-definition menu
|
||
regression and a literal source-oracle whitespace mismatch. Those are parent-
|
||
reported runtime results; I did not run or independently inspect their logs.
|
||
|
||
I reviewed the uncommitted `crates/oa-desktop/src/model_menu.rs` correction
|
||
relative to that commit. Inspected file SHA256:
|
||
`8BC2C74EA83EAEC8BD342AF5600FBF8E9963BED7290DC094E8B4FC7ABFC0B70D`.
|
||
At inspection this was the only tracked modification. This addendum binds to
|
||
that file content, not a claim that all current files equal the prior HEAD.
|
||
|
||
**No actionable finding in the correction.** The qualified navigation entry is
|
||
now constructed before the aggregate-selection early return, so it remains
|
||
available for a clicked selected or unselected preview while preserving group
|
||
removal. Its message uses the captured request's Process context and exact
|
||
qualified endpoint; it does not read the primary selection or strip reference
|
||
paths. Preview-link navigation retains the prior source-endpoint convention.
|
||
|
||
The group branch still returns before singleton mutation entries are built.
|
||
Outside the group branch, a qualified target still returns before those entries.
|
||
The group Remove message continues to capture the entire current selection;
|
||
adding navigation does not bypass the planner's qualified-member refusal or
|
||
turn deletion into a clicked-object action. Selection-changing menu entries
|
||
remain explicit.
|
||
|
||
Existing menu token/context/exact-selection validity checks apply unchanged.
|
||
App menu invocation routes TopologyCanvas navigation before ordinary clicked-
|
||
object selection. `app/process_canvas.rs:125` resolves the complete endpoint,
|
||
remembers that exact invocation and opens its defining sequence; it retains
|
||
pending-edit admission. No singleton destructive bypass was introduced by the
|
||
entry relocation.
|
||
|
||
The previously passing source-only review did not catch the menu regression;
|
||
the runtime gate supplied necessary additional evidence. The correction still
|
||
requires its relevant regression rerun. The independent source-oracle whitespace
|
||
repair is outside this addendum's inspected scope and is not treated as a
|
||
production defect or as verified here. No Cargo/UI/Gitea or production edits
|
||
were performed for this addendum.
|