feat: fmt --check, batch mutation, migrate, slice-tag export, SVG render policy

[yangsi7]

Batch C — authoring ergonomics (ADOPTION-HARDENING)

Five features from the adoption-hardening backlog, all TDD, all keeping the house rules
(byte-stable --json, 0/1/2 exit codes, native/wasm cfg gates, per-verb tests).

T3a — fmt canonicality verb

• maapp fmt <graph> rewrites to canonical form atomically; maapp fmt <graph> --check exits 1
  naming the offending file path (gofmt -l style) when non-canonical, writing nothing.
• Canonical form is byte-identical to the mutation verbs' output, so a hand edit is detectable.
• Wired into the init CI-gate template (a hard fmt --check step) and the CLAUDE.md/AGENTS.md
  routing-patch maintenance loop.
• Evidence: tests/fmt.rs (5 tests: check pass/fail + writes-nothing, rewrite→fixed-point,
  equals mutation canonical form, missing-file exit 2); tests/init.rs::ci_gate_and_routing_patch_wire_fmt_check.

T3b — batch update-node / remove-node

• Both accept multiple slugs OR a --where key=value selector (matches kind, refs.<k>,
  attrs.<k>), applying the change to every selected node in ONE atomic all-or-nothing write.
• An unknown slug or empty --where match fails the whole batch before any write (exit 2, file
  untouched); without --cascade, remove-node refuses on the first still-edged node.
• Single-slug behavior is unchanged (the existing single-slug tests pass as-is; the single verbs
  are thin wrappers over the batch fns).
• CLI parsing is hand-rolled (like query/render) so slugs, an optional trailing file, and flags
  can appear in any order; the file token is disambiguated from slugs (.json suffix or no :).
• Evidence: tests/mutate.rs (+8 batch tests: multi-slug set, atomic unknown-slug, --where kind,
  --where refs.slice, empty match, slug/--where conflict, batch cascade, first-offender refusal).

T5 — migrate verb + W_VERSION_BEHIND advisory

• maapp migrate <graph> [--to <minor>] mechanically upgrades a behind-schema graph to the
  engine's latest known minor (or --to). The 1.3→1.4 delta is additive (meta.flows,
  Trigger.attrs.cause, attrEnumRegistry are all optional), so the upgrade is a minimal in-place
  version bump that preserves the document's existing order — a version upgrade must never
  wholesale-reorder an authored file (run fmt for that) — guarded by the mutation verbs'
  no-regression rule.
• No-op when already at target (no write); refuses downgrade / cross-major / unknown-future target /
  no-parseable-version (exit 2, file untouched). Evidence: tests/migrate.rs (8 tests).
• validate behind-arm hint: the previously-silent behind-arm now emits W_VERSION_BEHIND
  (advisory, exit 0) pointing at maapp migrate when a graph's minor is behind the engine.
  Evidence: tests/validate.rs::behind_minor_version_warns_with_migrate_hint +
  current_minor_version_emits_no_version_advisory.
• Reference corpus bumped 1.3 → 1.4 by dogfooding maapp migrate (the verb's end-to-end proof;
  a stale reference corpus that self-warns is the exact theme-1 cold-start noise this backlog kills).
  The 6 shipped examples were upgraded by running the new binary on each:

  for f in examples/chat.json examples/checkout.json examples/dashboard.json \
           examples/maps.json examples/media.json examples/wizard.json; do
    maapp migrate "$f"   # MIGRATED <f> 1.3 -> 1.4  (clean 1-line version bump)
  done
  

  The 5 internal tests/fixtures/lifecycle/*.json were deliberately LEFT at 1.3 (they are stored in
  a compact format migrate would reformat into noise, they are not adopter-facing, and their tests
  assert errors / semantic diffs, not clean-with-zero-warnings — export.rs even asserts the slice
  is 1.3). Regenerated the 7 render snapshots that embed the schema version (v1.3 → v1.4); bumped
  2 inline clean-assertion test docs to 1.4 (kept STRICT — genuinely clean, no W_ tolerance).

T6 — slice-tag export

• maapp export --slice-tag <tag> emits a complete, valid sub-graph of every node carrying
  refs.slice == <tag> plus interconnecting edges — same contract as --slice, meta.slice_of
  stamped slice-tag:<tag>. Mutually exclusive with --slice; a tag matching nothing is exit 2.
• Evidence: tests/export.rs (+5 tests).

T8 — SVG render policy (chose the docs-correct path, not an emitter)

• Investigated real SVG emitters for storyboard/spine: there is NO reusable server-side SVG code
  (the render html template's SVG is client-side JS over the embedded graph JSON), so building a
  from-scratch layout→SVG pipeline for both views far exceeds the bounded budget. Chose the policy:
  render storyboard|spine --out *.svg now exits 2 pointing at render html, instead of silently
  writing ASCII into a .svg file. --out to a non-.svg file still writes the ASCII text.
• Docs: no README/INTEGRATIONS line actually claimed SVG export on the public tree; clarified the
  render command help to state storyboard/spine are ASCII and only render html emits SVG.
• Evidence: tests/render.rs (+4 tests).

Verification

• cargo test --locked (full suite): 398 passed, 0 failed.
• cargo clippy --all-targets --locked -- -D warnings: clean.
• cargo fmt --check: clean.
• cargo build --release --locked and cargo build --target wasm32-unknown-unknown --locked: green.
• Public-safety deny-sweep of the diff: 0 hits.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.