ARCADIA-Studio/harness/process-group-removal-evidence-20260925/policy-critique.md

Independent Process removal policy critique

Local-only review for parent session issue 29. Base inspected: c62622cce71e06f0beae49bc3b4fe8e890eba951; policy and concurrent planner work were uncommitted. Read-only inspection apart from this note; no Cargo, UI, Gitea or production edits. This is policy/source review, not runtime acceptance.

P1: interpretation-only caller closure misses ordinary topology changes

Status: reported promptly; parent accepted and instructed planner/App to add affected_uses independently of interpretation changes. Concurrent planner source now contains that collection, but this review does not verify the final implementation or tests.

The initial policy computed caller closure only for changed local_order, expanded_order or transitive contextual-presence flags. Those facts detect implicit-order changes and diagnostic mode changes, but do not cover ordinary explicit-to-explicit topology changes. A caller's record can remain unchanged while its reused graph changes substantially.

Literal discriminator, separately instantiated for OA and SA:

• P owns Action A, Action B, Action C and links L1=A→B, L2=B→C.
• Q owns R1(P) and R2(P); T owns RT(Q).
• Remove L1. P's steps is still [A,B,C], both implicit-order facts remain None, contextual presence remains false. Removed IDs are exactly {L1}; L2, all actions, both Q references, T's reference, and all work definitions survive.
• Nevertheless P's intrinsic entries change from {A} to {A,B}; expanding either Q reference adds synthetic connectivity from that reference's entry to B. Expected affected caller definition set for P is exactly {Q,T}.
• Removing A instead also changes Q/T while the three interpretation facts can remain equal. Removing one ContextualLink while another remains yields the same kind of false negative for a contextual-presence-only detector.

Source: crates/oa-core/src/topology_context/analysis.rs:262–298 expands callee entries/exits into synthetic edges; :412–425 derives intrinsic boundaries from remaining precedence. docs/language.rst:632–640 separates synthetic connectivity from authored degree and forbids complete-looking results from incomplete analysis. The multiple-selection contract requires aggregate removal impact.

Bounded correction: derive changed definition owners from actual removed/changed contribution and maintained-link records in both candidates; find surviving caller definitions using before/after reverse reuse closure. Keep interpretation facts as additional, more precise effects. Label the former “uses changed definition”; explain that reused topology, entry/exit connectivity and diagnostics can change. No full expanded graph is needed to establish this conservative affected set. Do not equate “no newly created stored identity” with “no new effective connectivity.”

P2 wording conditions: empty definitions and repeated uses

These are review conditions, not verified defects in the unfinished App.

1. Empty expanded definition: Builder::expand returns an incomplete-analysis notice immediately when children are empty (analysis.rs:212–221), before the exchange-only discriminator at :384. Representing an empty classifier as Some([]) is useful to distinguish it from explicit mode, but does not establish a valid implicit flow or any entry/exit. Literal discriminator: P has only A; remove A; review says no remaining contributions/no ordered pair, and does not promise connected or executable flow. Core incomplete diagnostics remain authoritative. The policy already disclaims full graph analysis; user-visible wording must carry that distinction.
2. Caller-owner closure is not a use-instance count. In the P/Q/T discriminator above, Q is one caller definition containing two references to P. A map containing Q once must not say “one use.” “Caller definitions” or “uses changed definition” is accurate. No Cartesian expansion is necessary.

Accepted boundaries and why

• Comparing both real order predicates is preferable to refusing every model where listed desktop and indexed core contributions differ. The inconsistency predates this operation: desktop behavior.rs:1097–1123 looks at listed steps and SequenceLinks; core topology_context.rs:97–145 includes unlisted owned contributions and ContextualLinks. Reporting both actual facts is sufficient for this bounded operation, provided it claims neither full graph preservation nor complete expanded analysis. Selected unlisted cards remain ineligible.
• The actual final candidate and all changed surviving records are the correct authority for global stored impact. references.rs:325–427 propagates every typed ContextualLink dependency, descendants, traces, attachments and embedded placements; :459 onwards clears/prunes surviving records. A caller-owned ContextualLink must be identified by explicit owner, not leaf parent.
• Occurrence-root cascade union plus uncovered selected relation commands is valid for the admitted kinds. These occurrences do not own one another; maintained Process relations cannot delete their contribution endpoints or another admitted maintained relation. Selected links covered by occurrence cascade remain selected review subjects. Control-flow cycles do not introduce deletion-dependency cycles. Generalizing admitted kinds requires revisiting this argument. The final Batch remains authoritative for compound effects.
• ContextualLink Exchange/CommonWork removal is assembly impact, not necessarily precedence removal. Underlying work/exchange definitions survive. Qualified local ContextualLink endpoints do not make the caller-owned relation read-only; qualified preview occurrences/links are a different target class.
• Capturing document/revision/owner/epoch plus selection membership, primary and generation is the right lifetime boundary. diagram_selection.rs:169–175 explicitly handles remove/re-add and primary-change/restore ABA. Final admission must use rendered visibility and the current tool/draft/gesture gates, not just UUID existence. Token scoping prevents old modal packets from mutating the next review. This policy is sufficient; unfinished App execution was not independently verified here.

Remaining verification focus

Literal tests should include the explicit-to-explicit caller case above, repeated-reference owner counting, empty definitions, mixed occurrence/link cascade normalization in reverse click/UUID order, and a secondary-selection ABA with the primary restored. Native review should inspect truthful meaning, all impact pages/search, input focus and Enter behavior, stale packets, Cancel, source-write failure and exact Undo/Redo/save/reopen. This critique does not substitute for those checks.