94 lines
5.4 KiB
Markdown
94 lines
5.4 KiB
Markdown
# Independent Process removal planner review
|
||
|
||
Read-only source/test review against the amended Process group-removal policy.
|
||
Base `c62622cce71e06f0beae49bc3b4fe8e890eba951`; inspected uncommitted files:
|
||
|
||
- `crates/oa-desktop/src/behavior/topology/group_removal.rs`, SHA256
|
||
`4F125AB9F5EFEE7B92700E2B23E5B805A16BF2529F662D5C4413368752960C79`.
|
||
- `crates/oa-desktop/src/behavior/topology/group_removal/tests.rs`, SHA256
|
||
`3E6E56A45738F5E377C0659C58AD782ECDA408657439B806DAEFD396E06A46D5`.
|
||
|
||
No production defect found in this bounded inspection. No Cargo/UI execution;
|
||
this does not establish passing tests, App admission, native usability or release
|
||
acceptance. Prior policy critique is `process-removal-policy-critique-20260925.md`.
|
||
|
||
## Prior P1 correction verified in source
|
||
|
||
`prepare:213–217` derives affected definition owners from actual removed and
|
||
changed IDs using both project versions, then traverses unioned before/after
|
||
reuse dependencies. `definition_owner:106–124` handles definition records,
|
||
direct contributions and both maintained relation kinds with explicit owner for
|
||
ContextualLink. It does not require interpretation changes. The test at `:372`
|
||
uses Actions A/B/C, A→B and B→C, repeated direct references and a transitive
|
||
caller; deleting A or A→B yields literal {caller,outer} with unchanged
|
||
interpretation facts and unchanged caller records. This addresses the reported
|
||
explicit-to-explicit false negative.
|
||
|
||
## Admission and transaction assessment
|
||
|
||
- `prepare:127–178` validates the initial structural model, every owner-listed
|
||
contribution and every original typed member. Correct owner, body, layer,
|
||
membership and uniqueness are enforced. Qualified occurrences/preview links,
|
||
unlisted selected cards, wrong target classes and foreign maintained links
|
||
refuse before mutation/normalization.
|
||
- SequenceLink endpoints must both be validated listed contributions;
|
||
ContextualLink admission uses its explicit owner. Initial core validation
|
||
supplies remaining endpoint/purpose constraints and permits warning-only
|
||
incomplete models.
|
||
- `:181–187` unions occurrence cascades, omits only covered relation commands and
|
||
evaluates one Batch. Sorting admitted occurrence roots before uncovered links
|
||
avoids UUID/click-order dependency. This is valid for the admitted contribution
|
||
and maintained-link domain; no mutual occurrence deletion dependency exists.
|
||
- `:188–206` derives actual identity differences, rejects new IDs and verifies
|
||
every original selection was removed. `Project::identities` includes embedded
|
||
placements; complete surviving record comparisons include diagram records and
|
||
embedded nodes, artifacts and traces. The implementation covers every mutable
|
||
record map in the current Project schema.
|
||
|
||
## Semantic impact assessment
|
||
|
||
`interpretations:43–73` correctly separates desktop listed-step interpretation,
|
||
core indexed-contribution/no-maintained-relation interpretation, and transitive
|
||
ContextualLink presence. All surviving definitions are compared, independently
|
||
of record deltas. Owned-unlisted contributions affect the core predicate and
|
||
caller edges. Empty `Some([])` remains a classifier, not proof of a valid flow;
|
||
the policy's user-visible wording condition remains applicable.
|
||
|
||
`callers:85–98` terminates with a seen set, deduplicates definition owners and
|
||
filters to surviving definitions. It does not enumerate repeated instance paths
|
||
or assert complete expanded connectivity. Both snapshots contribute reuse
|
||
edges. Global dependent link removal seeds its explicit defining owner even
|
||
when that owner's own record is unchanged.
|
||
|
||
## Test evidence and remaining gaps
|
||
|
||
The tests construct literal removal and surviving-change identity sets, literal
|
||
interpretation vectors/flags/caller sets, and independently clone/prune the
|
||
expected model (`expected_without:68`). They do not use the planner candidate as
|
||
the expected result. `assert_history:76` compares the complete Project, reopens
|
||
the emitted source bundle and verifies exact bundle/model Undo and Redo. OA and
|
||
SA execute each scenario. This is meaningful source-level evaluator design.
|
||
|
||
Two useful remaining verification gaps were sent to the parent; they are not
|
||
demonstrated production failures:
|
||
|
||
1. Mixed covered and uncovered selected relations in the same group. Current
|
||
mixed occurrence/link tests cover every selected relation via occurrence
|
||
roots; uncovered selected links are otherwise tested alone. Add A,B,C,D with
|
||
L1=A→B and independent L2=C→D; select A,L1,L2; literal result removes exactly
|
||
{A,L1,L2}, preserves B,C,D and runs exactly Delete(A),Delete(L2), regardless
|
||
of click/UUID order. This discriminates accidentally dropping uncovered
|
||
relations when occurrence roots exist.
|
||
2. Aggregate identity bookkeeping outside process records. Existing fixtures
|
||
contain no artifacts, traces, opposite-layer counterpart or embedded diagram
|
||
placements. Add a valid attachment/trace/placement case and compare literal
|
||
removed IDs, changed surviving diagram/owner IDs, and complete preserved
|
||
counterpart/source model. Core cascade behavior has existing independent
|
||
tests, but this new planner's review accounting still needs direct evidence.
|
||
|
||
Other bounded limitations: fixed adversarial UUID ordering is not explicitly
|
||
constructed; source inspection proves occurrence-before-link partitioning, while
|
||
tests reverse click order. App/source-write-failure/visibility/lifetime tests
|
||
belong to the adapter review. Large reuse performance and incomplete expanded
|
||
analysis are not runtime-tested here.
|