kayg/calternal

Watch

Fork 0

feat(tasks): delete, promote and duplicate (B3) #798

Closed

kayg wants to merge 1 commit from feat/tasks-delete-promote-duplicate into dev

kayg commented

2026-10-31 17:37:45 +00:00

Owner

round 2 final fix

Shared actor byte/kind validation guards task splices and Trash; structural child markers cannot hide owners, and promotion scans the full block extent before claiming a task. Both reported P1 probes are permanent regressions. Final gates pass: 598 package tests, 23 task-operation tests, fmt, clippy, contract and action types. Never merged; ready for final independent review.

Full status, exact commands, decisions and limits: round 2 fix report.

Tasks B3 implementation plan

Base: origin/dev; no B1/B2 stack required. Backend only.

Add typed delete, promote and duplicate actions following tasks.create job keys and notes bulk plans.
Reuse backend Markdown parsing through notes; use the notes job/room boundary for durable multi-file changes. Promotion preserves parent prose and children, writes a child link and quoted origin. Resolve an existing owner before allocating another.
Delete owning checkbox lines everywhere and only task relationship bullets from sessions. Persist exact removed spans, source identity/version, surrounding anchors and target bindings in the plan and Trash replay record. Restore by identity, then surviving anchors, then today's daily note. Undo uses the same restore path.
Duplicate with fresh note/block identities and origin; clear outcome/source authority and hidden blocks. Preserve ordinary shared references.
Add action integration tests for byte preservation, exact Undo, moved anchors, replay/retry, isolation and duplicate identities. Run all gates on a free dev VM using Nix and the build slot wrapper.

Expected size: L, at most 1,500 application lines plus tests. Planning scans backlink candidate notes; current bound is O(items × candidate bytes + items²) because ownership checks reuse the existing link reader. Restore searches parsed block identities Home-wide, O(removed spans × Home bytes). No performance result is claimed. Each job holds one Home job lock and uses existing room/version and step receipts.

Failure	Effect	Detection	Recovery	Test
Crash after plan or room write	Partial file graph	Stored running job and step receipt	Replay same identities/steps	Crash boundaries and repeat action
Retry or concurrent Track	Duplicate owner risk	Resolve current checkbox ownership under job lock	Return original owner	Two request keys
Source edited or renamed	Stale position/path	Note UUID, version and anchors	Surviving anchor placement; retain other bytes	Edited/renamed source
Block moved before Restore	Duplicate line risk	Home-wide marker search	Reuse moved identity	Moved anchor/line
Source deleted	No insertion destination	Missing source UUID	Daily fallback plus report	Deleted source
Malformed/unsupported metadata	Unsafe rewrite risk	Validate before durable plan	Refuse without changes	Preservation fixtures
Duplicate carries source authority	Second upstream identity	Explicit cleared property set and fresh markers	New local task only	Duplicate source/log/IDs

Gates (dev-01, slot, Nix): cargo fmt --all -- --check; cargo clippy -j4 -p calternal-tasks -p calternal-notes -p calternal --all-targets -- -D warnings; cargo test -j4 -p calternal-tasks -p calternal-notes -p calternal; contract tests from the repository runner. No merge.

Implementation decisions:

Reuse the existing backend pulldown-cmark parser used by the task index, and the notes::props writer. The web editor uses Lezer; no JavaScript parser runtime is added to the Rust backend.
Refuse unusual frontmatter before promotion/duplication: comments, flow containers, anchors, block scalars, nested maps, and quotes within plain scalars. Accept simple scalars and writer-compatible block lists. No source normalization is attempted.
Refuse ambiguous literal backticks reported by the Markdown parser, including a multiline opener split by a list boundary. Fences, inline code, HTML and reference comments are preservation corpus cases.
Keep unrelated child text and session prose byte-identical. Delete removes only owning checkbox lines and relationship bullets; its Trash record pins exact source spans/version, anchors and target UUID bindings.
Match Undo to the deletion generation, so undoing an older delete cannot restore a later one. Release the lifecycle lock before line restoration may create its fallback daily note.
A duplicate with no owning line receives a new line in today's daily note. Ordinary references remain shared, outcome/source authority is cleared, and original block markers are omitted from the copied body. Its owning line gets a new marker.

Validation on dev-01 (tasks-b3-gates3, exit 0):

cargo clippy -j4 -p calternal-tasks -p calternal-notes -p calternal --all-targets -- -D warnings passed.
cargo test -j4 -p calternal-tasks -p calternal-notes -p calternal passed: 556 tests, 10 existing ignored tests, no failures.
cargo test -j4 -p calternal contract passed: one contract test.
node apps/web/scripts/action-types.mjs --check passed.
cargo fmt --all -- --check passed.

The corpus covers accepted metadata preservation, refused unusual YAML, code spans/fences/comments, BOM/CRLF and no final newline. Job crash tests kill and restart at each planned step; restore tests cover moved anchors, renamed/deleted sources and deletion generations. No latency measurement or independent review is claimed.

Result: registers tasks.delete, tasks.promote and tasks.duplicate with durable job receipts and notes.undo. Promotion retains parent prose and person links, appends a block marker when needed for its backlink, and adds a child link. Delete sends the note to Trash with exact removed-line records. Duplicate creates a fresh note and owning-line identity, stripping copied block IDs and upstream authority.

Limits: YAML support is intentionally narrower than valid YAML, including refusal of nested maps. Markdown handling reuses the existing Rust task-index parser (pulldown-cmark); it does not embed the web editor's Lezer parser. Ambiguous unmatched backticks refuse the action. Planning and restoration scan existing notes as described above; no performance measurement was run. Review pending; never merge as part of this task.

## round 2 final fix Shared actor byte/kind validation guards task splices and Trash; structural child markers cannot hide owners, and promotion scans the full block extent before claiming a task. Both reported P1 probes are permanent regressions. Final gates pass: 598 package tests, 23 task-operation tests, fmt, clippy, contract and action types. Never merged; ready for final independent review. Full status, exact commands, decisions and limits: [round 2 fix report](https://git.kayg.org/kayg/calternal/pulls/798#issuecomment-71378). # Tasks B3 implementation plan Base: `origin/dev`; no B1/B2 stack required. Backend only. 1. Add typed delete, promote and duplicate actions following tasks.create job keys and notes bulk plans. 2. Reuse backend Markdown parsing through notes; use the notes job/room boundary for durable multi-file changes. Promotion preserves parent prose and children, writes a child link and quoted origin. Resolve an existing owner before allocating another. 3. Delete owning checkbox lines everywhere and only task relationship bullets from sessions. Persist exact removed spans, source identity/version, surrounding anchors and target bindings in the plan and Trash replay record. Restore by identity, then surviving anchors, then today's daily note. Undo uses the same restore path. 4. Duplicate with fresh note/block identities and origin; clear outcome/source authority and hidden blocks. Preserve ordinary shared references. 5. Add action integration tests for byte preservation, exact Undo, moved anchors, replay/retry, isolation and duplicate identities. Run all gates on a free dev VM using Nix and the build slot wrapper. Expected size: L, at most 1,500 application lines plus tests. Planning scans backlink candidate notes; current bound is O(items × candidate bytes + items²) because ownership checks reuse the existing link reader. Restore searches parsed block identities Home-wide, O(removed spans × Home bytes). No performance result is claimed. Each job holds one Home job lock and uses existing room/version and step receipts. | Failure | Effect | Detection | Recovery | Test | | --- | --- | --- | --- | --- | | Crash after plan or room write | Partial file graph | Stored running job and step receipt | Replay same identities/steps | Crash boundaries and repeat action | | Retry or concurrent Track | Duplicate owner risk | Resolve current checkbox ownership under job lock | Return original owner | Two request keys | | Source edited or renamed | Stale position/path | Note UUID, version and anchors | Surviving anchor placement; retain other bytes | Edited/renamed source | | Block moved before Restore | Duplicate line risk | Home-wide marker search | Reuse moved identity | Moved anchor/line | | Source deleted | No insertion destination | Missing source UUID | Daily fallback plus report | Deleted source | | Malformed/unsupported metadata | Unsafe rewrite risk | Validate before durable plan | Refuse without changes | Preservation fixtures | | Duplicate carries source authority | Second upstream identity | Explicit cleared property set and fresh markers | New local task only | Duplicate source/log/IDs | Gates (dev-01, slot, Nix): `cargo fmt --all -- --check`; `cargo clippy -j4 -p calternal-tasks -p calternal-notes -p calternal --all-targets -- -D warnings`; `cargo test -j4 -p calternal-tasks -p calternal-notes -p calternal`; contract tests from the repository runner. No merge. Implementation decisions: - Reuse the existing backend `pulldown-cmark` parser used by the task index, and the `notes::props` writer. The web editor uses Lezer; no JavaScript parser runtime is added to the Rust backend. - Refuse unusual frontmatter before promotion/duplication: comments, flow containers, anchors, block scalars, nested maps, and quotes within plain scalars. Accept simple scalars and writer-compatible block lists. No source normalization is attempted. - Refuse ambiguous literal backticks reported by the Markdown parser, including a multiline opener split by a list boundary. Fences, inline code, HTML and reference comments are preservation corpus cases. - Keep unrelated child text and session prose byte-identical. Delete removes only owning checkbox lines and relationship bullets; its Trash record pins exact source spans/version, anchors and target UUID bindings. - Match Undo to the deletion generation, so undoing an older delete cannot restore a later one. Release the lifecycle lock before line restoration may create its fallback daily note. - A duplicate with no owning line receives a new line in today's daily note. Ordinary references remain shared, outcome/source authority is cleared, and original block markers are omitted from the copied body. Its owning line gets a new marker. Validation on dev-01 (`tasks-b3-gates3`, exit 0): - `cargo clippy -j4 -p calternal-tasks -p calternal-notes -p calternal --all-targets -- -D warnings` passed. - `cargo test -j4 -p calternal-tasks -p calternal-notes -p calternal` passed: 556 tests, 10 existing ignored tests, no failures. - `cargo test -j4 -p calternal contract` passed: one contract test. - `node apps/web/scripts/action-types.mjs --check` passed. - `cargo fmt --all -- --check` passed. The corpus covers accepted metadata preservation, refused unusual YAML, code spans/fences/comments, BOM/CRLF and no final newline. Job crash tests kill and restart at each planned step; restore tests cover moved anchors, renamed/deleted sources and deletion generations. No latency measurement or independent review is claimed. Result: registers `tasks.delete`, `tasks.promote` and `tasks.duplicate` with durable job receipts and `notes.undo`. Promotion retains parent prose and person links, appends a block marker when needed for its backlink, and adds a child link. Delete sends the note to Trash with exact removed-line records. Duplicate creates a fresh note and owning-line identity, stripping copied block IDs and upstream authority. Limits: YAML support is intentionally narrower than valid YAML, including refusal of nested maps. Markdown handling reuses the existing Rust task-index parser (`pulldown-cmark`); it does not embed the web editor's Lezer parser. Ambiguous unmatched backticks refuse the action. Planning and restoration scan existing notes as described above; no performance measurement was run. Review pending; never merge as part of this task.

kayg added 1 commit

2026-10-31 17:37:46 +00:00

docs: plan tasks delete promote and duplicate

CI / server (pull_request) Has been cancelled

Details

CI / rust (pull_request) Has been cancelled

Details

CI / web (pull_request) Has been cancelled

Details

3890fa905d

kayg changed title from ~~WIP: tasks delete, promote and duplicate (B3)~~ to feat(tasks): delete, promote and duplicate (B3)

2026-10-31 18:03:59 +00:00

kayg commented

2026-10-31 18:12:51 +00:00

Author

Owner

Independent review, round 1

Verdict: fix first. Reviewed head 7e063cf02afd61a1f3d762752bd3b6559d60b64c against the PR plan, ADRs 0066/0056/0068/0067 (including the → amendment), and the tasks decision memory. No P0 findings. Four P1 findings and one P2 finding below are reproduced by independent probes.

P1: delete removes ordinary reference bullets, not just owners and session relationships. crates/notes/src/task_ops.rs:173–177. A note containing # Reference reading followed by a top-level - [Task](<Task.md>) loses that bullet when Task is deleted. There is no owning checkbox or event/session parent. The non-checkbox branch checks only the link target, so unrelated lists are edited. Fix: classify the parent/container and remove standalone relationship bullets only under an owning checkbox or a supported session; preserve ordinary references. Probe: review_r1_delete_keeps_ordinary_reference_bullets.
P1: duplicate reuses block IDs on paragraph continuation lines. crates/notes/src/task_blocks.rs:111–121, consumed by crates/notes/src/task_ops.rs:516–530. A task body first line\nlast line ^bbbbbbbbbbbbbbbb\n is copied with that exact ID still present. marker_blocks examines only each parsed block's first physical line, so the copy filter misses this marker and creates a second Home-wide identity. The same omission affects hidden-block filtering. Fix: recognize marker positions throughout supported block ranges with the shared marker rules, and remove/re-key copied identities; otherwise refuse unsupported marker layouts before creating anything. Probe: review_r1_duplicate_multiline_block_id_is_fresh.
P1: a stale promotion still mutates the source and reports success. crates/notes/src/task_ops.rs:100–105,122–129; crates/notes/src/bulk/steps.rs:108–125. Pause at splice-before-turn, change - [ ] Task ^bbbbbbbbbbbbbbbb to - [ ] Changed ^bbbbbbbbbbbbbbbb, then resume. The job returns state: done and inserts the old [Task] relationship beneath Changed. For an existing marker the splice is insertion-only, so the destructive-undo guard has no deleted span to validate; the original source hash/version is never rechecked at mutation time. Fix: enforce the source block/version precondition inside the actor turn for insertion-only promotion too, propagate refusal rather than a successful kept result, and ensure a failed source claim cannot publish an orphan owner. Probe: review_r1_promote_stale_source_must_not_report_success.
P1: delete Undo is not byte-exact even without intervening edits. crates/notes/src/task_ops/restore.rs:202–222. Starting with - [Task](Task.md), delete then notes.undo restores - [Task](<Task.md>). Every bound link is unconditionally regenerated despite unchanged source/target paths, so the stored exact span is not actually restored. Fix: reuse the saved raw link spelling when it still resolves to the retained UUID; rewrite only destinations that must change after relocation/path reuse, preserving other bytes. Probe: review_r1_delete_undo_preserves_link_spelling.
P2: the YAML refusal guard still has the plain-list interior-quote bypass. crates/notes/src/task_ops.rs:575–578. custom:\n - has "quote" within\n passes simple_frontmatter; the scalar branch rejects interior quotes, but the list branch merely compares the existing writer's rendering. That writer also emits interior quotes bare, so round-trip equality is not a safety proof. This contradicts the plan's refusal policy and leaves the specifically requested calendar-regression bypass open. Fix: apply lexical checks to each raw plain list item too, including quote/comment interactions; accept properly quoted supported scalars or refuse before planning. Probe: review_r1_yaml_list_quotes_must_refuse.

Validation

All commands ran on dev-02 in an isolated, uncommitted worktree, using Nix and ~/bin/slot; no code was pushed.

cargo test -j4 -p calternal-notes task_ops::tests -- --skip review_r1: 4 passed, including kill-9/replay, deletion generations, renamed/deleted sources and moved anchors.
cargo test -j4 -p calternal-tasks mutation_tests: 7 passed, including the existing YAML/code/comment corpus and BOM/CRLF/exact-undo fixture.
cargo test -j4 -p calternal-notes review_r1 -- --nocapture: 2 passed, 5 failed. The passing independent cases cover exact restore around surviving children and promotion with an existing descriptive → child, including a second request returning the same owning task.

Probe source: cua@calternal-dev-02-std:~/Developer/Worktrees/review-798-r1/crates/notes/src/task_ops/tests.rs (uncommitted). Logs: ~/review-798-r1-finalprobes.log, ~/review-798-r1-existing.log, ~/review-798-r1-actions.log on that VM. Run from the worktree with export PATH=/nix/var/nix/profiles/default/bin:$PATH; nix develop -c bash -c '~/bin/slot cargo test -j4 -p calternal-notes review_r1 -- --nocapture'. Full lint/workspace gates were not rerun for this review.

## Independent review, round 1 **Verdict: fix first.** Reviewed head `7e063cf02afd61a1f3d762752bd3b6559d60b64c` against the PR plan, ADRs 0066/0056/0068/0067 (including the → amendment), and the tasks decision memory. No P0 findings. Four P1 findings and one P2 finding below are reproduced by independent probes. 1. **P1: delete removes ordinary reference bullets, not just owners and session relationships.** `crates/notes/src/task_ops.rs:173–177`. A note containing `# Reference reading` followed by a top-level `- [Task](<Task.md>)` loses that bullet when Task is deleted. There is no owning checkbox or event/session parent. The non-checkbox branch checks only the link target, so unrelated lists are edited. **Fix:** classify the parent/container and remove standalone relationship bullets only under an owning checkbox or a supported session; preserve ordinary references. Probe: `review_r1_delete_keeps_ordinary_reference_bullets`. 2. **P1: duplicate reuses block IDs on paragraph continuation lines.** `crates/notes/src/task_blocks.rs:111–121`, consumed by `crates/notes/src/task_ops.rs:516–530`. A task body `first line\nlast line ^bbbbbbbbbbbbbbbb\n` is copied with that exact ID still present. `marker_blocks` examines only each parsed block's first physical line, so the copy filter misses this marker and creates a second Home-wide identity. The same omission affects hidden-block filtering. **Fix:** recognize marker positions throughout supported block ranges with the shared marker rules, and remove/re-key copied identities; otherwise refuse unsupported marker layouts before creating anything. Probe: `review_r1_duplicate_multiline_block_id_is_fresh`. 3. **P1: a stale promotion still mutates the source and reports success.** `crates/notes/src/task_ops.rs:100–105,122–129`; `crates/notes/src/bulk/steps.rs:108–125`. Pause at `splice-before-turn`, change `- [ ] Task ^bbbbbbbbbbbbbbbb` to `- [ ] Changed ^bbbbbbbbbbbbbbbb`, then resume. The job returns `state: done` and inserts the old `[Task]` relationship beneath Changed. For an existing marker the splice is insertion-only, so the destructive-undo guard has no deleted span to validate; the original source hash/version is never rechecked at mutation time. **Fix:** enforce the source block/version precondition inside the actor turn for insertion-only promotion too, propagate refusal rather than a successful kept result, and ensure a failed source claim cannot publish an orphan owner. Probe: `review_r1_promote_stale_source_must_not_report_success`. 4. **P1: delete Undo is not byte-exact even without intervening edits.** `crates/notes/src/task_ops/restore.rs:202–222`. Starting with ` - [Task](Task.md)`, delete then `notes.undo` restores ` - [Task](<Task.md>)`. Every bound link is unconditionally regenerated despite unchanged source/target paths, so the stored exact span is not actually restored. **Fix:** reuse the saved raw link spelling when it still resolves to the retained UUID; rewrite only destinations that must change after relocation/path reuse, preserving other bytes. Probe: `review_r1_delete_undo_preserves_link_spelling`. 5. **P2: the YAML refusal guard still has the plain-list interior-quote bypass.** `crates/notes/src/task_ops.rs:575–578`. `custom:\n - has "quote" within\n` passes `simple_frontmatter`; the scalar branch rejects interior quotes, but the list branch merely compares the existing writer's rendering. That writer also emits interior quotes bare, so round-trip equality is not a safety proof. This contradicts the plan's refusal policy and leaves the specifically requested calendar-regression bypass open. **Fix:** apply lexical checks to each raw plain list item too, including quote/comment interactions; accept properly quoted supported scalars or refuse before planning. Probe: `review_r1_yaml_list_quotes_must_refuse`. ### Validation All commands ran on dev-02 in an isolated, uncommitted worktree, using Nix and `~/bin/slot`; no code was pushed. - `cargo test -j4 -p calternal-notes task_ops::tests -- --skip review_r1`: **4 passed**, including kill-9/replay, deletion generations, renamed/deleted sources and moved anchors. - `cargo test -j4 -p calternal-tasks mutation_tests`: **7 passed**, including the existing YAML/code/comment corpus and BOM/CRLF/exact-undo fixture. - `cargo test -j4 -p calternal-notes review_r1 -- --nocapture`: **2 passed, 5 failed**. The passing independent cases cover exact restore around surviving children and promotion with an existing descriptive → child, including a second request returning the same owning task. Probe source: `cua@calternal-dev-02-std:~/Developer/Worktrees/review-798-r1/crates/notes/src/task_ops/tests.rs` (uncommitted). Logs: `~/review-798-r1-finalprobes.log`, `~/review-798-r1-existing.log`, `~/review-798-r1-actions.log` on that VM. Run from the worktree with `export PATH=/nix/var/nix/profiles/default/bin:$PATH; nix develop -c bash -c '~/bin/slot cargo test -j4 -p calternal-notes review_r1 -- --nocapture'`. Full lint/workspace gates were not rerun for this review.

finding	change	regression status
P1 ordinary reference bullets removed	parsed owner/session containers; remove only task relationships and owning prose; preserve ordinary child subtrees, including children below a relationship	pass: `review_r1_delete_keeps_ordinary_reference_bullets`, continuation/child and session cases
P1 continuation IDs copied	inspect every physical prose line within parsed block ranges; rekey copied identities; remove complete hidden blocks; retain literal code	pass: `review_r1_duplicate_multiline_block_id_is_fresh`, hidden/code case
P1 stale promotion succeeds	durable exact-source precondition checked after outside ingestion inside the actor; changed/missing sources fail; claim source before creating owner	pass: `review_r1_promote_stale_source_must_not_report_success`, strengthened to check unchanged source prose and no orphan owner
P1 Undo rewrites link spelling	restore captured raw spans; preserve original links while their destinations still resolve to retained UUIDs; only replace destinations when relocation requires it	pass: `review_r1_delete_undo_preserves_link_spelling`, renamed/deleted-source and moved-anchor cases
P2 YAML list quote bypass	explicit plain-value allowlist applied to scalars and every raw list item; supported JSON quotes checked separately; other formatting refuses before planning	pass: `review_r1_yaml_list_quotes_must_refuse`

gate	exact command	result
operation regressions/replay	`cargo test -j4 -p calternal-notes task_ops::tests -- --nocapture`	pass, 14/14
lint	`cargo clippy -j4 -p calternal-tasks -p calternal-notes -p calternal -p calternal-daily --all-targets -- -D warnings`	pass
package tests, including daily shared vectors	`cargo test -j4 -p calternal-tasks -p calternal-notes -p calternal -p calternal-daily`	pass, 589 passed / 10 existing ignored
action contract	`cargo test -j4 -p calternal contract`	pass
action types	`node apps/web/scripts/action-types.mjs --check`	pass
format	`cargo fmt --all -- --check`	pass

round 1 finding	status	does its regression prove it?
P1 delete removed ordinary reference bullets	verified	yes. `review_r1_delete_keeps_ordinary_reference_bullets` compares exact source bytes; continuation/nested-child and shared-session tests also pass.
P1 duplicate retained continuation-line IDs	verified	yes. `review_r1_duplicate_multiline_block_id_is_fresh` exercises real duplication and rejects the original ID; the hidden-continuation/code fixture also passes.
P1 stale promotion mutated changed prose and reported success	verified	yes. `review_r1_promote_stale_source_must_not_report_success` changes the source at `splice-before-turn`, verifies the changed prose remains, no old relationship or orphan task appears, and success is refused. this does not cover the separate Trash write path below.
P1 delete Undo changed original link bytes	verified	yes. `review_r1_delete_undo_preserves_link_spelling` compares the whole source before/after Undo, including the bare destination spelling. rename/deleted-source/moved-anchor tests also pass.
P2 plain-list interior-quote refusal bypass	verified	yes. `review_r1_yaml_list_quotes_must_refuse` tests single/double interior quotes and the quote/comment interaction. independent expanded refusal probes also pass.

failure	effect	detection	recovery	test
task edited/reclassified during delete	stale destructive write	actor byte/kind guard	failed job, Undo restores removed lines while retaining task edit	permanent r2 delete probe plus partial Undo
child marker or nested task link	second owner	owner-head marker and full-extent link scan	return existing direct owner or refuse	permanent r2 owner probe plus child/nested cases
crash/replay	repeated mutation	durable step receipts and Trash state	resume stored steps	existing kill/replay tests

finding / requirement	implementation	status
P1 changed task still trashed	persist the task snapshot in the Trash step; force guarded Trash through the room actor, including closed notes; ingest outside edits, then call the shared byte/kind guard before moving	pass: permanent `review_r2_delete_changed_task_must_refuse`, strengthened to Undo the partial job and retain the edited task
P1 child marker hides owner	strip the child line's structural marker before standalone-relationship classification, shared by promotion and delete/session cleanup	pass: permanent `review_r2_relationship_marker_retains_owner`
structural mutation guard	one `verify_target(note, expected_source_bytes, expected_kind)` used by guarded splices and Trash; existing daily-note duplicate placement also uses a guarded splice	pass: independent byte/kind test and existing stale-promotion probe
owner identity and full extent	read the parent marker only from its head line; inspect every task link in the parsed block extent; return one existing direct owner or refuse nested/prose/ambiguous bindings	pass: child-marker identity and nested/prose/continuation-link regressions
replay / preservation	retain step receipts, Trash replay detection and exact-span Undo	pass: all task-operation crash/replay and round 1 regressions

requirement / path	status	evidence
round 2: changed task must not be trashed	verified for the reported reproduction	permanent `review_r2_delete_changed_task_must_refuse` passes, including Undo preserving the intervening task edit; guarded Trash enters the room even for closed notes
round 2: child marker must not hide its owner	verified	`review_r2_relationship_marker_retains_owner` passes; relationship classification strips the child marker
parent identity and promotion extent	verified for supplied cases	owner-head identity and nested/prose/continuation task-link refusal regressions pass
initial apply to existing text	guarded	forward `Splice` and `TaskRemove` supply expected bytes; room `undo_edit_retained` calls the shared guard; task Trash supplies expected bytes and explicitly requires Task
flush / recovery publication	incomplete	`room/save.rs` has no shared task guard; its outside-file conflict loop ingests and retries. the new post-guard flush probe returns done after ingesting a changed source
recovery / replay of steps	partly verified	unapplied forward guarded steps retain their expected snapshot; applied receipts intentionally skip reapplying. existing kill-9/replay tests pass. receipt-driven recovery saves use generic save, without the shared guard
promotion / duplication Undo	fails the all-write-path requirement	`bulk/undo.rs` constructs inverse Splice with `expected: None`; the actor consequently skips `verify_target`. the new source-kind-change probe confirms the write proceeds
delete Undo / Trash line restore	byte guard present, semantic recovery unsafe	`task_ops/restore.rs:238` supplies a fresh destination snapshot to the shared guard, but restores planned removals without checking whether their removal actually applied or whether the block now has another owner; new P1 below
YAML bypasses and literal checkboxes	no new finding in exercised corpus	existing scalar/list quote/comment, flow, anchor, multiline, BOM/CRLF refusal matrices and code/fence/HTML/comment/indented-code checkbox matrices all pass

Rows
Columns

feat(tasks): delete, promote and duplicate (B3) #798

round 2 final fix

Tasks B3 implementation plan

Independent review, round 1

Validation

round 1 fixes

Independent review, round 2

round 1 verification

new findings

validation and scope

round 2 fixes, ready for final review

Independent review, round 3 (final)

status

new findings

concrete simpler design

validation

Pull request closed