110 lines
6.7 KiB
Markdown
110 lines
6.7 KiB
Markdown
# Independent Process removal policy critique
|
||
|
||
Local-only review for parent session issue 29. Base inspected:
|
||
`c62622cce71e06f0beae49bc3b4fe8e890eba951`; policy and concurrent planner work were
|
||
uncommitted. Read-only inspection apart from this note; no Cargo, UI, Gitea or
|
||
production edits. This is policy/source review, not runtime acceptance.
|
||
|
||
## P1: interpretation-only caller closure misses ordinary topology changes
|
||
|
||
**Status:** reported promptly; parent accepted and instructed planner/App to add
|
||
`affected_uses` independently of interpretation changes. Concurrent planner
|
||
source now contains that collection, but this review does not verify the final
|
||
implementation or tests.
|
||
|
||
The initial policy computed caller closure only for changed `local_order`,
|
||
`expanded_order` or transitive contextual-presence flags. Those facts detect
|
||
implicit-order changes and diagnostic mode changes, but do not cover ordinary
|
||
explicit-to-explicit topology changes. A caller's record can remain unchanged
|
||
while its reused graph changes substantially.
|
||
|
||
Literal discriminator, separately instantiated for OA and SA:
|
||
|
||
- P owns Action A, Action B, Action C and links L1=A→B, L2=B→C.
|
||
- Q owns R1(P) and R2(P); T owns RT(Q).
|
||
- Remove L1. P's `steps` is still [A,B,C], both implicit-order facts remain
|
||
`None`, contextual presence remains false. Removed IDs are exactly {L1}; L2,
|
||
all actions, both Q references, T's reference, and all work definitions survive.
|
||
- Nevertheless P's intrinsic entries change from {A} to {A,B}; expanding either
|
||
Q reference adds synthetic connectivity from that reference's entry to B.
|
||
Expected affected caller definition set for P is exactly {Q,T}.
|
||
- Removing A instead also changes Q/T while the three interpretation facts can
|
||
remain equal. Removing one ContextualLink while another remains yields the
|
||
same kind of false negative for a contextual-presence-only detector.
|
||
|
||
Source: `crates/oa-core/src/topology_context/analysis.rs:262–298` expands callee
|
||
entries/exits into synthetic edges; `:412–425` derives intrinsic boundaries from
|
||
remaining precedence. `docs/language.rst:632–640` separates synthetic connectivity
|
||
from authored degree and forbids complete-looking results from incomplete
|
||
analysis. The multiple-selection contract requires aggregate removal impact.
|
||
|
||
Bounded correction: derive changed definition owners from actual removed/changed
|
||
contribution and maintained-link records in both candidates; find surviving
|
||
caller definitions using before/after reverse reuse closure. Keep interpretation
|
||
facts as additional, more precise effects. Label the former “uses changed
|
||
definition”; explain that reused topology, entry/exit connectivity and
|
||
diagnostics can change. No full expanded graph is needed to establish this
|
||
conservative affected set. Do not equate “no newly created stored identity” with
|
||
“no new effective connectivity.”
|
||
|
||
## P2 wording conditions: empty definitions and repeated uses
|
||
|
||
These are review conditions, not verified defects in the unfinished App.
|
||
|
||
1. Empty expanded definition: `Builder::expand` returns an incomplete-analysis
|
||
notice immediately when children are empty (`analysis.rs:212–221`), before
|
||
the exchange-only discriminator at `:384`. Representing an empty classifier
|
||
as `Some([])` is useful to distinguish it from explicit mode, but does not
|
||
establish a valid implicit flow or any entry/exit. Literal discriminator:
|
||
P has only A; remove A; review says no remaining contributions/no ordered
|
||
pair, and does not promise connected or executable flow. Core incomplete
|
||
diagnostics remain authoritative. The policy already disclaims full graph
|
||
analysis; user-visible wording must carry that distinction.
|
||
2. Caller-owner closure is not a use-instance count. In the P/Q/T discriminator
|
||
above, Q is one caller definition containing two references to P. A map
|
||
containing Q once must not say “one use.” “Caller definitions” or “uses changed
|
||
definition” is accurate. No Cartesian expansion is necessary.
|
||
|
||
## Accepted boundaries and why
|
||
|
||
- Comparing both real order predicates is preferable to refusing every model
|
||
where listed desktop and indexed core contributions differ. The inconsistency
|
||
predates this operation: desktop `behavior.rs:1097–1123` looks at listed steps
|
||
and SequenceLinks; core `topology_context.rs:97–145` includes unlisted owned
|
||
contributions and ContextualLinks. Reporting both actual facts is sufficient
|
||
for this bounded operation, provided it claims neither full graph preservation
|
||
nor complete expanded analysis. Selected unlisted cards remain ineligible.
|
||
- The actual final candidate and all changed surviving records are the correct
|
||
authority for global stored impact. `references.rs:325–427` propagates every
|
||
typed ContextualLink dependency, descendants, traces, attachments and embedded
|
||
placements; `:459` onwards clears/prunes surviving records. A caller-owned
|
||
ContextualLink must be identified by explicit owner, not leaf parent.
|
||
- Occurrence-root cascade union plus uncovered selected relation commands is
|
||
valid for the admitted kinds. These occurrences do not own one another;
|
||
maintained Process relations cannot delete their contribution endpoints or
|
||
another admitted maintained relation. Selected links covered by occurrence
|
||
cascade remain selected review subjects. Control-flow cycles do not introduce
|
||
deletion-dependency cycles. Generalizing admitted kinds requires revisiting
|
||
this argument. The final Batch remains authoritative for compound effects.
|
||
- ContextualLink Exchange/CommonWork removal is assembly impact, not necessarily
|
||
precedence removal. Underlying work/exchange definitions survive. Qualified
|
||
local ContextualLink endpoints do not make the caller-owned relation read-only;
|
||
qualified preview occurrences/links are a different target class.
|
||
- Capturing document/revision/owner/epoch plus selection membership, primary and
|
||
generation is the right lifetime boundary. `diagram_selection.rs:169–175`
|
||
explicitly handles remove/re-add and primary-change/restore ABA. Final
|
||
admission must use rendered visibility and the current tool/draft/gesture
|
||
gates, not just UUID existence. Token scoping prevents old modal packets from
|
||
mutating the next review. This policy is sufficient; unfinished App execution
|
||
was not independently verified here.
|
||
|
||
## Remaining verification focus
|
||
|
||
Literal tests should include the explicit-to-explicit caller case above,
|
||
repeated-reference owner counting, empty definitions, mixed occurrence/link
|
||
cascade normalization in reverse click/UUID order, and a secondary-selection
|
||
ABA with the primary restored. Native review should inspect truthful meaning,
|
||
all impact pages/search, input focus and Enter behavior, stale packets, Cancel,
|
||
source-write failure and exact Undo/Redo/save/reopen. This critique does not
|
||
substitute for those checks.
|