ARCADIA-Studio/harness/scenario-group-removal-evidence-20260925/adapter-review.md

Scenario aggregate removal independent source review

Reviewed source: ed6eaaa73ee4 (parent-supplied frozen gate identity). Read-only inspection; no Git, Cargo, native UI, or gate execution. The reviewer authored app/scenario_removal/view.rs; that file and its visual behavior are explicitly excluded from this review.

Result

No blocking correctness defect established in the reviewed planner, App adapter, or entry routes. This is a source review, not a passing-test or native-acceptance claim.

One bounded performance issue is confirmed: scenario_removal_matches calls multiselect_target_visible for each captured target, regenerating the Scenario presentation per member. Parent has already identified this and plans one selection::visible enumeration per admission followed by whole-set membership checks after the frozen gate closes. This review does not claim that future patch is present or verified.

Semantic transaction

• group_removal::prepare rejects non-Scenario targets, duplicate identities, empty sets, invalid baseline models, missing/foreign subjects and reusable definitions. It validates complete actual sequence/operand reachability, parent and layer consistency before reducing selected descendants covered by selected ancestors. Cross-operand groups are admitted without importing semantic reorder's same-parent restriction.
• The command is one Batch of deterministic root Deletes. execute_batch clones the project, applies the commands, finishes deferred cascades and validates the final candidate. The adapter later sends that Batch through one Document execution. There is no series of singleton Document changes or partially admitted selection.
• Core cascade inspection (references::deletion_impact_inner, remove_objects) confirms that local occurrence/participant removal follows owned descendants and incoming dependents rather than deleting the reusable definitions those occurrences refer to. Surviving references are cleared, owner lists are pruned, and saved-view layout entries are pruned. Removing a call can retain its reply as a warning-admitted draft; this is explicitly tested rather than silently recast as automatic reply deletion.
• Impact is computed from actual before/candidate identity sets. Changed surviving records are compared across elements, relations, diagrams, artifact links, traces and embedded placements; containing diagrams also account for layout/route changes. A final selected-subset-of-removed check prevents a partial result from reaching review.

Captured admission and lifetime

• Begin checks exact Scenario Context and full Selection snapshot, actual visibility, group size, clean edit state, Select tool and exclusive input ownership before the shared source boundary. It retires the canvas epoch and captures fresh context/snapshot for the review. An older Begin cannot reopen over a later review.
• Review confirmation is stamped with the menu sequence token. App dispatch rejects mismatched confirmation tokens before shared handling and intercepts group confirmation before legacy singleton deletion. Stamped Cancel, Query and Page target only the matching aggregate review. Legacy unstamped CancelDelete is prevented from closing a current group review.
• Confirmation checks exact document/revision/epoch/representation/visit, selection generation/membership/primary, selected subject, dirty editor guards, busy state and competing reorder/spacing/tool state. An expired matching review closes without executing its command and retires its epoch. Stale different-token confirmation does not close a newer review.
• Success updates the selection owner only after Document execution, syncs and reconciles removed selection identities. Failure leaves the model/source/selection transition unperformed; only the review lifetime and status are retired. Cancellation leaves source/history/selection unchanged. Exact source-history assertions exist for success/Undo/Redo, but no real App source-write failure was executed or established by this review.

Entry routes

• Header Remove is available for a group and uses a captured Begin. Canvas Delete/Shift+Delete require Select mode, editable ownership, no pending gesture, and repeat: false; group dispatch carries the entire Scene snapshot. The singleton remove path is bypassed for groups.
• Group menu entry uses the captured current selection even when the right-clicked subject is outside it. Menu Invoke removes/validates the menu, then routes ScenarioRemoval directly before the ordinary clicked-object selection path. This avoids primary replacement or an unselected-subject deletion.
• Begin's keyboard-owner eligibility blocks existing menus/modals, dirty editors and busy/competing operations. Modal handling blocks ordinary authoring commands while review is open. Passive resize or loaded revision can expire the review, and exact confirmation validation prevents applying its old plan.
• Mounted test source exercises actual canvas Delete and Shift+Delete, checks full captured targets/primary, rejects singleton emissions, and checks repeat does not confirm. No automatic destructive Enter handler was added in these reviewed routes. Visual panel controls are outside this reviewer’s independence scope.

Evidence and remaining boundaries

Read planner tests for OA/SA message removal, mixed lifeline/message reference clearing, both saved views, calls/replies, nested ancestor/descendant selection, independent operands, ScenarioUse definition preservation, placement/artifact/trace impact, malformed/foreign/duplicate input, and existing redo preservation. The shared test helper compares literal expected whole projects, reopened authored source, one Undo and one Redo, rather than testing only counts.

Read adapter tests for Derived/Saved exact transactions, stale modal packets across a new review, document/revision/epoch/visit/selection-ABA expiration, cancellation with redo, competing live reorder/spacing, selected/unselected contextual subjects, dirty properties, legacy singleton refusal, and mounted Delete/repeat routing. These are inspected assertions only while the parent gate runs; their runtime outcome is not asserted here.

Native compact layout, review search/paging usability, true source-write failure recovery, and broader platform execution remain separate validation work. No production files were changed during this review.

Addendum: closed gates at 35be9ae133

Inspected the read-only Git diff from ed6eaaa73ee4 to this tested commit. The single visibility enumeration fix has landed: identity/context/snapshot mismatch returns first, then one selection::visible result is checked against every original target. Whole-set admission is retained and the repeated presentation construction noted above is resolved. No planner change occurred in this diff.

The other changes preserve the acceptance boundary. The legacy singleton refusal now directs users to Reorder or Remove. The strict menu test permits exactly one additional aggregate action, requires its exact Begin variant, current Context and complete Snapshot, and continues rejecting other singleton model actions. The redo/cancel fixture now restores the real two-member group through production Selection events after Rename/Undo changed the inspected subject, explicitly verifies redo still exists, then performs the original cancellation/history assertions. Stale-token and context/selection-ABA tests were not relaxed.

Independently read the existing closed result, stdout, stderr and source-proof files in:

• .local/scenario-group-gates/removal-app-scenario-3: exit 0; stdout reports 333 passed, 0 failed, 1 ignored, 1296 filtered. The ignored test is the existing diagnostic-only spacing timing test. Named stale-modal, expiration, contextual-menu and redo/cancel tests report ok.
• .local/scenario-group-gates/removal-app-removal-1: exit 0; stdout reports 53 passed, 0 failed, 0 ignored, 1577 filtered.

Both receipts identify the full commit above, inputsUnchanged: true, and 823 captured inputs. Both source-proof records report PASS exact captured input inventory and Git blob bytes at that commit. The shared input-map SHA-256 is fb5d17f3841c3a525109136cd71a07d56db26602e3b49e6f92fbf6112b7b66a4; captured archive is 3,289,235 bytes, SHA-256 ae89bbdfe2d81b977ceb81ae834178a3f7d9891005d376bda8c4795c2698abfd. This reviewer additionally rehashed each run's stdout, stderr and inputs.json and checked byte counts against its result receipt; all six pairs matched. The existing source comparator was read, not rerun.

These are verified recorded outcomes from parent-run gates, not tests run by this reviewer. No new blocking source finding arose. Native validation is still pending, and the source-write failure and platform limitations above remain. The authored view remains excluded from independent self-review.

Final delta and limited panel self-review at 43340b94

Before reviewing, read-only Git commands reported branch codex/scenario-multiselect-9e8r6t-20260924, HEAD 43340b94a13f192c3b5d3c3112dbe87246790a44. Inspected the complete source delta from 35be9ae133f3a32434c4d84edcdb0764044b7539: four files, five insertions/five deletions. Begin now holds Box<Snapshot>; both production constructors and the fixture constructor wrap the same captured snapshot, and the menu assertion dereferences it. Admission comparisons, selection capture, token handling, command construction and Document execution are unchanged. No new blocking correctness issue is established by this delta. This inspection does not extend the earlier commit's recorded test results into an unverified claim about final-commit gates.

At parent's request I also reread the current panel. This is self-review, not independent review: I authored app/scenario_removal/view.rs. The source enumerates every removed and changed identity, distinguishes selected/additional removal from preserved-but-updated records, searches full labels/aliases, clamps page index, renders six rows per page, and keeps overall impact counts separate from filtered matches. The fixed footer uses stamped Cancel and validity-gated Confirm; there is no query submit handler. Long row labels use WordOrGlyph and the scroll body reserves an 8px gutter. The 732px window calculation gives 570px content plus 52px modal padding; actual layout remains a native observation, not established by arithmetic alone.

Concrete native checks suggested to the integration owner:

1. At 1104×732, inspect long unbroken aliases at the right scroll edge, the fixed Cancel/Remove footer and the expiry notice together; verify scrolling never clips or hides actions.
2. Scroll an impact page to the bottom, then choose Next/Previous or change search. The persistent scroll widget may retain its offset, so verify the first matching row remains discoverable and no page appears falsely empty.
3. Search for one record and for no matches. Confirm that the title and total removed/updated counts still communicate the entire operation; filtering is review-only and must not be mistaken for deleting only matches.
4. Resize with a live review and observe disabled Remove plus the explicit expiry notice, then cancel and reopen. Confirm cancellation preserves both the selected group and preexisting Undo/Redo history.
5. From a focused query, try Enter and repeated Delete, then Escape. These must not perform removal; an explicit enabled confirmation is required. Ordinary Iced footer buttons do not provide the custom canvas Control focus integration, so no keyboard-only confirmation accessibility claim is made.
6. Compare one mixed participant/message or nested-parent impact against saved source after confirmation and one Undo, including additional removed dependents and updated views/references rather than only visible selected bodies.

No source edits, build, commit, or GUI operation were performed for this final review. Parent native work remains in progress; its results must be attached separately.