ARCADIA-Studio/harness/saved-group-removal-evidence-20260925/planner-review.md

Saved group removal planner independent review

Final source rereview: 2026-09-24 21:25 PDT (2026-09-25 04:25 UTC), after parent reported writers frozen, formatting passed, and source committed as 7750ecd7. Commit attribution is parent-provided; reviewer did not run Git. Reviewed filesystem hashes below identify the actual source.

Status: no unresolved concrete correctness finding in this bounded pure planner. This does not establish runtime acceptance. Reviewer has not executed Cargo or tests. Parent-executed test gate saved-removal-tests-1 has subsequently been independently inspected; see the closed-evidence section below. Planner is test-gated in diagram.rs and has no application wiring. No App/native, source/history, focus/admission, or review UI acceptance is claimed.

Scope and basis

Read AGENTS.md, harness/saved-group-removal-policy-20260925.md and docs/language.rst section 8.1. Reviewed planner and both test modules; traced saved projection creation, exact State row helper, core deletion impact, deferred cascade cleanup, execute_batch, inherited-reference pruning and identity enumeration. Reviewer performed no Git, Gitea, Cargo, GUI, or implementation edits; only this local report was written.

Finding fixed during review

Original planner silently accepted a repeated exact Target because it only inserted semantic IDs into a set. This contradicted original-target uniqueness before normalization. Reported to parent and planner author. Final source explicitly refuses targets[..index].contains(target); tests include repeated Placement rejection. Resolved.

Correctness assessment

• Complete original-target validation precedes cascade reduction. Saved project validation rejects invalid duplicate placements and malformed identities before projection/admission.
• Placement maps through the captured saved diagram and projected exact placement. Port checks projected owner placement and semantic parent. State rows use the existing exact row helper, including current source and actual row visibility; selected ancestors cannot admit invalid members.
• Stored edge mapping accepts a projected edge with an identity in relations or traces. Current saved projector emits relation identities with trace=false and trace identities with trace=true; model uniqueness validation prevents ambiguity across stores. It emits no inferred synthetic edge reusing a stored identity. Therefore the current combined stored-identity check is sufficient for this projector.
• Cascade normalization uses original deletion_impact coverage with deterministic ID tie-breaking. It does not validate or mutate intermediate planning candidates. Deferred conditional exchange-allocation cleanup remains part of core Batch execution. Coverage is never the final impact oracle.
• execute_batch validates the completed transaction after deferred cleanup and inherited-reference pruning. Planner asserts that every selected semantic identity is actually absent and no identity is created.
• Removed identity diff includes elements, relations, diagrams, embedded placements, traces and artifact links through Project::identities. Changed-survivor comparison covers every record map and embedded placements. Routes, filters, anchors and layouts contribute through their diagram/node records.
• Trace deletion retains endpoint counterparts; State rows resolve to their maintained relation, retaining referenced work except when a different selected subject independently removes it.

Test source assessment

The tests independently author expected whole Projects rather than comparing two planner calls as the outcome oracle. Covered source cases include OA/SA ownership and incident-edge overlap, exact ports and owner mixtures, State rows/internal/external transitions, trace/counterpart preservation, cross-view placements, diagram+embedded-placement cascade, artifact cascade, changed surviving semantic relations/elements and presentation records, invalid/hidden/wrong-association/cross-family input, duplicate targets, and invalid duplicate placements.

Review-requested gaps now have source fixtures:

• Machine deletion removes its saved State diagram and all embedded placements, including its diagram-owned artifact and a placement in another surviving view.
• Hidden State row is refused while a selected collapsed ancestor would cover its semantic deletion.
• Interface deletion alone fails validation while its union with the selected boundary succeeds. A fixed smallest interface identity forces the invalid-alone deletion first, protecting the no-intermediate-validation requirement. Both click orders are checked against a literal expected Project.
• Conditional tests cover two required endpoint allocations with overlapping deferred cascade, and a direct exchange deletion together with those supports. Reversed IDs and click order are exercised. Module is declared in final source.

An initial alternative-support fixture was invalid. Independent source inspection confirms why: duplicate_port_allocation forbids duplicate same-endpoint facts; port_allocation_owner requires the function actual performer to equal the component-port owner; simultaneous direct/reverse mappings therefore require equal boundary owners, forbidden by boundary_owner validation. Final policy and tests correctly preserve these invariants and explicitly reject the invalid counterexample. No union-only alternate-support case is claimed.

Remaining scope boundary

The final policy records that deleting exchanges can alter Process occurrences, implicit order and reused caller interpretation even when a caller stored record is unchanged. The pure planner reports changed stored records; derived caller effects require the future App review adapter. Likewise application focus/draft/modal/selection-generation admission, one Document/source transaction, review presentation, Undo/Redo and native workflows remain downstream obligations. The test-gated integration correctly avoids claiming those are shipped.

Final reviewed SHA256 values

File	SHA256
crates/oa-desktop/src/diagram/group_removal.rs	C94C0C6917AE6A726E42CAA44CF312F5D57721ABEFEA169663167CE00F09FD77
crates/oa-desktop/src/diagram/group_removal/tests.rs	1154DB09D7F9984BFB5ABD8AE35B4AFD9BAB7F971DDBC22070ADAEB434069F7C
crates/oa-desktop/src/diagram/group_removal/conditional_tests.rs	78EEF99FF71352A2DC881D54F2605076BE035BF41547830D4EB10E43028EC910
crates/oa-desktop/src/diagram.rs	2977885208E03F343E7D5B9A1D0B285EC62F8CF79DE4480C5295CFD054E44429
harness/saved-group-removal-policy-20260925.md	13E9B78C2AF8411D5F3DABCE266B6EAA7DEC342020AFE12E9A6C1E5B898F015A
docs/language.rst	E54EC50AB110A6875C78A44DFD10CB860951B4CEB2D337F381A3FF8317AAA9DB

Supporting core/helper source read during review: references.rs B6D2C388815C51469DD73EB62628C77EA6D95D20324C83E184B2B9F896AA8A4A; session.rs 8A54B3F8841EDB894A9D250BE6E95B280CC87A7AF2FE43005D298A717B1CBA65; projection.rs 3521BF3041502F3A3A970D7799894A5AE16C1E8DA754DEEEA5290AC1F8BA11E8; state_canvas.rs 9CCF0682BF1B97DB408662A750D9C29B627EB7DC51CB61056E11CEEAC62BAF88.

Closed parent-executed test evidence inspected

After the source review, independently read saved-removal-tests-1/result.json, source-proof.json, stdout.log and stderr.log under .local/scenario-group-gates. This is review of parent-executed evidence; reviewer did not invoke Cargo or rerun the test suite.

• Command: cargo test -p oa-desktop --message-format=json -- diagram::group_removal --test-threads=1.
• Windows stable-x86_64-pc-windows-gnullvm, Rust/Cargo 1.98.1. Closed capture 2026-09-25 04:24:52–04:27:24 UTC; exit 0; inputsUnchanged=true; capture duration 152.272975 seconds.
• Raw stdout lists all 12 planner tests passing: 12 passed, 0 failed, 0 ignored, 1656 filtered, 0.06 seconds. Raw stderr reports successful compilation and test-binary launch without warning/error output.
• Parent source proof states PASS exact captured input inventory and Git blob bytes for commit 7750ecd751, 835 captured inputs. Reviewer inspected this proof but did not independently execute the Git comparator.
• Reviewer independently hashed stdout, stderr, result, input map and input archive and matched their corresponding recorded SHA256 values. Reviewer also compared the actual planner, both test files, diagram.rs and language.rst against the captured inputs.json hashes; all matched. Final source hashes above therefore identify the files present during this test gate.
• stdout SHA256: 7a39a4b458bdee718918060affcac4c2ad5d96234eca68fac6872fcae166fd52.
• stderr SHA256: f27427a907f6f524a2bbca8639baef6d0bff8bfcfca2a8d5fb3205a844142bde.
• result.json SHA256: 4e6ab4ba207e30991718505743534d24e1b2726f141cf276cd0e0b7a52ac0358.
• inputs.json SHA256: 5f2f069fc1bf15f08405c1d4ed9b1cb97f1cb7ec4288b051823f12fba9f287d9.
• inputs.zip SHA256: 784d760955942242770107c37439470b18012c3425a24fa12d0f4a19288664b3.

Strict Clippy was subsequently closed and independently inspected, as recorded below. Native/App acceptance limitations remain unchanged.

Foundation report and format evidence

Read harness/saved-group-removal-foundation-20260925.md. Its test-only implementation and downstream App/native/source-history boundaries match reviewed source. Suggested one wording refinement: the twelve regressions include refusal-only checks; successful plans, specifically, use full independently authored expected Projects and exact impact sets. No additional substantive claim issue found.

Read saved-removal-fmt-1/result.json, source-proof.json and both raw logs. Parent-executed cargo fmt --all -- --check closed exit 0 at 2026-09-25 04:28:51 UTC, inputsUnchanged=true, 7.428614 seconds, empty stdout/stderr. Source proof states same 835-input inventory and commit 7750ecd7510ae39e4170f37e4aa7e101cf392f66; input-map and archive hashes match the independently checked test capture. Reviewer did not rerun formatting or source comparator.

Final Clippy and package audit — frozen review

Independently read closed saved-removal-clippy-1 result, source proof and raw logs. Parent command cargo clippy -p oa-desktop --all-targets --message-format=json -- -D warnings closed exit 0 with unchanged inputs at 2026-09-25 04:29:17 UTC (91.375469 seconds). Source proof identifies the same 835-input commit. Independently parsed raw Cargo JSON: build-finished success=true and no warning/error compiler diagnostics. stderr reports successful checking and completion.

Executed the published checks/verify.py with bundled Python, without running archived inputs, Cargo, Git comparator, tests, or binaries. Offline verification PASS: 3 runs, 0 recorded failures, 27 logical files, 23 stored members, 1 source capsule pair, 3 source proofs. This establishes package consistency, not historical execution independently reproduced.

Separately performed an independent byte audit from original local raw captures/helpers/comparator to every logical ZIP mapping. All 27 originals are byte-identical to their packaged members. Exact outer inventory (six files), all three original raw directory inventories (eight files each), logical inventory, and ZIP stored inventory (23 unique members) match. Recorded pins cover all package files. Output: .local/saved-removal-package-audit.json. This audit did not rely on prepare.py for the byte comparison.

Review is now frozen. No unresolved concrete bounded-planner finding. Parent-executed Windows tests, format, and strict Clippy have independently inspected closed evidence. Application behavior remains unchanged because the planner is cfg(test)-only; no production GUI, source/history, native, release, Linux, or derived-caller review acceptance is claimed.