ARCADIA-Studio/harness/process-group-removal-evidence-20260925/planner-review.md

Independent Process removal planner review

Read-only source/test review against the amended Process group-removal policy. Base c62622cce71e06f0beae49bc3b4fe8e890eba951; inspected uncommitted files:

• crates/oa-desktop/src/behavior/topology/group_removal.rs, SHA256 4F125AB9F5EFEE7B92700E2B23E5B805A16BF2529F662D5C4413368752960C79.
• crates/oa-desktop/src/behavior/topology/group_removal/tests.rs, SHA256 3E6E56A45738F5E377C0659C58AD782ECDA408657439B806DAEFD396E06A46D5.

No production defect found in this bounded inspection. No Cargo/UI execution; this does not establish passing tests, App admission, native usability or release acceptance. Prior policy critique is process-removal-policy-critique-20260925.md.

Prior P1 correction verified in source

prepare:213–217 derives affected definition owners from actual removed and changed IDs using both project versions, then traverses unioned before/after reuse dependencies. definition_owner:106–124 handles definition records, direct contributions and both maintained relation kinds with explicit owner for ContextualLink. It does not require interpretation changes. The test at :372 uses Actions A/B/C, A→B and B→C, repeated direct references and a transitive caller; deleting A or A→B yields literal {caller,outer} with unchanged interpretation facts and unchanged caller records. This addresses the reported explicit-to-explicit false negative.

Admission and transaction assessment

• prepare:127–178 validates the initial structural model, every owner-listed contribution and every original typed member. Correct owner, body, layer, membership and uniqueness are enforced. Qualified occurrences/preview links, unlisted selected cards, wrong target classes and foreign maintained links refuse before mutation/normalization.
• SequenceLink endpoints must both be validated listed contributions; ContextualLink admission uses its explicit owner. Initial core validation supplies remaining endpoint/purpose constraints and permits warning-only incomplete models.
• :181–187 unions occurrence cascades, omits only covered relation commands and evaluates one Batch. Sorting admitted occurrence roots before uncovered links avoids UUID/click-order dependency. This is valid for the admitted contribution and maintained-link domain; no mutual occurrence deletion dependency exists.
• :188–206 derives actual identity differences, rejects new IDs and verifies every original selection was removed. Project::identities includes embedded placements; complete surviving record comparisons include diagram records and embedded nodes, artifacts and traces. The implementation covers every mutable record map in the current Project schema.

Semantic impact assessment

interpretations:43–73 correctly separates desktop listed-step interpretation, core indexed-contribution/no-maintained-relation interpretation, and transitive ContextualLink presence. All surviving definitions are compared, independently of record deltas. Owned-unlisted contributions affect the core predicate and caller edges. Empty Some([]) remains a classifier, not proof of a valid flow; the policy's user-visible wording condition remains applicable.

callers:85–98 terminates with a seen set, deduplicates definition owners and filters to surviving definitions. It does not enumerate repeated instance paths or assert complete expanded connectivity. Both snapshots contribute reuse edges. Global dependent link removal seeds its explicit defining owner even when that owner's own record is unchanged.

Test evidence and remaining gaps

The tests construct literal removal and surviving-change identity sets, literal interpretation vectors/flags/caller sets, and independently clone/prune the expected model (expected_without:68). They do not use the planner candidate as the expected result. assert_history:76 compares the complete Project, reopens the emitted source bundle and verifies exact bundle/model Undo and Redo. OA and SA execute each scenario. This is meaningful source-level evaluator design.

Two useful remaining verification gaps were sent to the parent; they are not demonstrated production failures:

1. Mixed covered and uncovered selected relations in the same group. Current mixed occurrence/link tests cover every selected relation via occurrence roots; uncovered selected links are otherwise tested alone. Add A,B,C,D with L1=A→B and independent L2=C→D; select A,L1,L2; literal result removes exactly {A,L1,L2}, preserves B,C,D and runs exactly Delete(A),Delete(L2), regardless of click/UUID order. This discriminates accidentally dropping uncovered relations when occurrence roots exist.
2. Aggregate identity bookkeeping outside process records. Existing fixtures contain no artifacts, traces, opposite-layer counterpart or embedded diagram placements. Add a valid attachment/trace/placement case and compare literal removed IDs, changed surviving diagram/owner IDs, and complete preserved counterpart/source model. Core cascade behavior has existing independent tests, but this new planner's review accounting still needs direct evidence.

Other bounded limitations: fixed adversarial UUID ordering is not explicitly constructed; source inspection proves occurrence-before-link partitioning, while tests reverse click order. App/source-write-failure/visibility/lifetime tests belong to the adapter review. Large reuse performance and incomplete expanded analysis are not runtime-tested here.