ARCADIA-Studio/harness/process-group-removal-policy-20260925.md

# Process and FunctionalChain group removal

This policy refines the local Process part of the [multiple-selection
contract](multiselect-contract-20260923.md) and the focused-removal semantics in
[language section 8.1](../docs/language.rst). It is an implementation decision,
not runtime, native, integrated or release acceptance.

## Exact admission and one transaction

Remove the complete captured group of local contribution occurrences and
maintained links. An occurrence must be a unique listed direct child of the
active Process or FunctionalChain, with the matching layer and an Action,
Exchange, Control or SequenceReference body. A SequenceLink must connect listed
local contributions of that same owner. A ContextualLink is local when its
explicit owner matches, even if both endpoint addresses are qualified. Its
Precedence, Exchange and CommonWork purposes retain their distinct meanings.

A qualified ProcessOccurrence or ProcessPreviewLink is not an editable local
object. Refuse the whole mixed selection; never strip its reference path, edit
the reused definition, select an outer reference implicitly, or fall back to
the primary. Open the defining sequence to edit its contents. Legacy ordered
arrows have no maintained relation identity and cannot be deleted as links.

Admit every original typed target before normalizing execution. Selected local
occurrences are independent deletion roots. Compute their existing core
deletion-impact union, and omit a selected relation command only when that
relation is already covered by this union. It remains a selected removal in the
review. Blindly deleting both an occurrence and its incident selected link would
fail because the first cascade already removed the second identity.

Evaluate one Batch with the core command engine and final structural validation.
Derive deleted identities and changed surviving records from the actual final
candidate, including embedded diagram placements. All selected identities must
be removed and no identity may be created. Preserve referenced work, exchanges,
sequence definitions, other uses and opposite-layer counterparts. Global
dependent ContextualLinks, attachments and traces follow existing core cascade
rules; never shorten their paths or silently retarget them.

## Order and caller consequences

Deletion can change meaning without creating any new stored record. Given
`[Action A, Exchange E1, Control C, Exchange E2]` and no maintained links,
removing A and C leaves implicit E1-to-E2 order. Removing the last authored
SequenceLink on an exchange-only list likewise restores implicit order, which
may retain a visible connection that the user expected to remove. Removing E2
from legacy `[E1, E2, E3]` creates the implicit E1-to-E3 adjacency. A remainder
with zero or one exchange changes interpretation without adding an edge.

The review therefore compares before/after interpretation for every surviving
Process and FunctionalChain, independently of whether its stored record changed:

- Local implicit order follows the existing desktop listed-step/SequenceLink
  predicate. Explicit mode is distinct from an empty implicit sequence.
- Reused-definition implicit order follows the core contextual expansion
  predicate: indexed contributions (including owned but unlisted contributions)
  must all be exchanges and the definition must have no maintained SequenceLink
  or ContextualLink. This is a definition-level order fact, not a claim that the
  entire expanded graph was analyzed or is connected.
- Contextual analysis follows the core index's transitive contextual-link
  presence. Losing the last such link is reported separately from either order
  predicate; it does not necessarily mean a local explicit-to-implicit switch.

For each changed interpretation, identify surviving direct and transitive
callers through the union of before/after SequenceReference dependencies. Such
callers can be affected while their stored records remain unchanged. Keep these
effects separate from removed/updated record counts and make the full affected
set searchable and pageable, with full names and aliases.

Also seed caller impact from definitions whose contributions or maintained links
are removed or changed, even when all three interpretation fields stay the same.
For example, removing A from explicit A-to-B-to-C changes every use of that
definition while the remaining B-to-C link keeps its mode explicit. Label the
caller effect as using a changed definition; do not imply that complete expanded
connectivity or boundary analysis was performed. Interpretation-only detection
would miss this ordinary case and is rejected.

Explain that reused topology, entry/exit connections and diagnostics may change.
Deleting A-to-B while B-to-C remains can make B a new intrinsic entry and thus
add an effective reference-boundary connection in callers. No new stored
identity does not mean no new effective connection.

Caller rows identify definitions, not individual SequenceReference instances;
two references to P in Q still yield one Q row. Never present that count as the
number of uses. An empty expanded-order classification supplies no edges and
does not establish a valid flow or boundary: core expansion of an empty sequence
is incomplete. Say that no contributions/ordered pairs remain, preserving the
ordinary completeness diagnostics.

Incomplete models may have owned but unlisted contributions. Selected unlisted
cards are ineligible, but other such contributions must not be ignored in impact
computation. The local and expanded predicates can differ; report their actual
results separately rather than falsely treating them as one execution mode.
This operation does not resolve that broader semantic inconsistency or suppress
existing diagnostics.

Alternatives considered: rejecting all interpretation changes prevents normal
editing of valid incomplete models; silently accepting them hides an engineering
consequence; inventing sentinel controls or replacement links manufactures model
objects; a new persisted topology-mode field requires an independent language,
migration and API decision. Explicitly reviewing the existing source-derived
consequences preserves graphical/textual parity without introducing new objects.

## Capture, review and verification

The App captures document, revision, owner, canvas epoch, exact selection
generation, membership and primary, and verifies actual rendered visibility.
Pending source/property/behavior edits, gestures, other modals and non-selection
tools refuse admission. Header, context menu, focused Delete and Shift+Delete
must all capture the complete group before ordinary singleton handlers can act.
Invoking a menu over an unselected object does not replace the existing group.

Only explicit confirmation of the current token commits one Document
transaction. Recheck complete admission before applying it. Search, page,
Cancel and Confirm packets belong to their review token. Enter in search does
not implicitly confirm deletion. Cancel, stale/refused events and source-write
failure preserve the accepted model/source/history, selection and camera.
Success returns inspection to the owner and retires removed transient selection;
one model Undo/Redo restores the exact complete source and model.

Required discriminators include OA and SA mixed occurrence/link groups;
cascade-covered selected links in different click/UUID orders; repeated reuse
and globally dependent links; all ContextualLink purposes; local plus qualified
whole-set refusal; explicit-to-implicit and legacy adjacency changes; zero/one
remainders; contextual-analysis-only changes; surviving transitive callers;
owned-unlisted contributions; stale secondary selection and tokens; pending
drafts; exact cancel/failure/Undo/Redo/save/reopen behavior. Tests must compare
literal expected identities and models, not only counts or the planner's own
output. Native acceptance must inspect meaningful review wording, full impact
reachability, focus, compact layout, cancellation and persistence.