[sjungwon03]

Summary

The client can apply individual code suggestions but cannot send the documented batch operation. Add GitLabClient.suggestions.applyBatch with a single request and strict confirmation of every requested global suggestion identity before returning success.

Closes #590

Behavior

• Reject empty, nonpositive or duplicate IDs before dispatch. Snapshot the list before awaiting so caller mutation cannot change the write or its confirmation. Preserve input order and exact optional commit messages; omit null messages.
• Use the injected account/self-hosted routing and PAT/OAuth authentication. Disable redirects and automatic authentication refresh/replay; never fall back to individual application calls.
• Require HTTP 200 and a complete exact identity set with each returned applied=true. Reject missing, extra, duplicate, malformed or unapplied members without exposing partial results. Preserve server response order in an immutable list.
• Reuse strict metadata validation before generated parsing, retaining nullable/empty patch content and both applicability aliases. Map HTTP status before decoding and sanitize malformed/transport errors. No inferred permission, commit count, branch SHA or atomicity guarantee.
• Update suggestion documentation and the parity tracker with the API/UI boundaries.

Validation

• TDD: missing method failed first; the minimal unsafe implementation failed 130 of 149 behavior contracts before fixes.
• All 149 new batch cases and 254 existing single-application/metadata regressions pass together.
• Full workspace gate: 5,514 tests passed (app 3,015; design system 121; API 2,201; models 172; secure storage 5), 897 Dart files formatted and analysis clean.
• No DTO, generated code, UI, localization or dependency changes.
• English documentation, dev target, linked issue, Conventional Commits and DCO sign-off.
• Live GitLab/physical-device validation (not performed).

Notes for reviewers

An incomplete response can follow accepted server writes. The caller must inspect all selected discussions and require renewed confirmation before manual retry. This API does not implement batch selection, MR grouping, multi-patch confirmation or recovery UI; the app retains its reviewed single-suggestion application flow. Multiline review remains separate.

Official reference: https://docs.gitlab.com/api/suggestions/#apply-multiple-suggestions

[sjungwon03-ai]

Review of commit ff96608: No blocking findings on the exact reviewed head. Reviewed the documented single PUT /suggestions/batch_apply operation, positive nonempty unique global input identities, caller-list snapshot before the first await, exact optional commit messages and injected account/self-hosted routing. The write disables redirects and automatic OAuth refresh/replay with no fallback to individual application calls. Confirmed success requires HTTP 200, a strictly validated array, exact complete requested identity set without duplicates or extra members, and applied=true for every returned suggestion. Immutable results preserve server order, including reordered responses; nullable and empty patch content and legacy/documented applicability aliases remain intact. Shared metadata validation precedes generated numeric parsing and preserves type, coordinate/range and alias boundaries. Status-first HTTP mapping and malformed/transport errors are typed and sanitized. No partial confirmation, inferred commit count, branch SHA, permission or atomicity guarantee is exposed. Caller mutation cases and all returned member positions are covered. Test-first evidence showed missing-method failure, then 130 failing contracts against a minimal unsafe implementation before fixes; all 149 new batch cases plus 254 single-application/metadata regressions pass. The complete workspace gate passed 5,514 tests (app 3,015; design system 121; API 2,201; models 172; storage 5), 897-file formatting and clean analysis, and all four required CI jobs passed on this exact head. No DTO, generated, UI, localization or dependency changes. An unconfirmed response can follow accepted server writes, so batch selection, multi-patch user confirmation and complete fresh-state recovery remain required UI follow-up work. No live GitLab or physical-device validation claimed.