Integrate contextual source creation with lifecycle rendering

2026-09-11 10:38:05 -07:00
parent 4da92ab481
commit 321897fd55
21 changed files with 4250 additions and 471 deletions
@@ -1,6 +1,6 @@
 # Integrated checkpoint — 2026-09-11

-Codex-ytr83r, branch `codex/release1-ytr83r`. The full [user goal](../PROJECT_GOAL.md) remains incomplete. Live priorities, ownership and handoffs are in [Gitea issue 1](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/1#issuecomment-410) and [issue 2](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/2). This file scopes integrated code and evidence.
+Codex-ytr83r, branch `codex/release1-ytr83r`. The full [user goal](../PROJECT_GOAL.md) remains incomplete. Live integration/acceptance work is in [Gitea issue5](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/5); the [project overview](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/1) and [process/scenario requirement](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/2) link other work. This file scopes integrated code and evidence.

 ## Verified code and capabilities

@@ -13,6 +13,8 @@ B4 renders local lifetimes, branch-local activation termination, neutral incompl
 - [Lifecycle implementation and independent findings](release-lifecycle-render-ytr83r-20260911.md).
 - [Creation and source integration evidence](release-staged-source-integration-ytr83r-20260911.md).

+The current candidate also integrates the published contextual source-creation/minimum-card corrections from b2c3e540, preserving the complete local B4 Scene implementation. Its own desktop/native acceptance is pending. [Exact selective integration and independent union review](release-contextual-integration-update-ytr83r-20260911.md).
+
 ## Verification scope

 On this Windows host, core all-targets passed433 tests with one intentionally ignored scaling probe; that probe separately passed with unoptimized timings. Production29084050 passed focused lifecycle22 and full desktop675 tests (the22 are included in675), and the ordinary GUI build/launch. An equivalent test-helper let-chain correction subsequently passed strict workspace/all-targets Clippy and its focused regression1/1. These results predate the newly identified header-rendering correction.
@@ -24,7 +26,7 @@ On this Windows host, core all-targets passed433 tests with one intentionally ig

 ## Material limitations

-Native wide Latin/CJK checks found neutral lifeline header text overflowing its card; Create labels remained contained. Corrected production/native acceptance is not yet established. Combining/emoji native appearance and passive-save equality for the typography variants remain unverified. Current-host server/CLI transport/restart and matching optimized packages are not accepted by the desktop fixture results.
+Native wide Latin/CJK checks found neutral lifeline header text overflowing its card; Create labels remained contained. Corrected production/native acceptance is not yet established. Combining/emoji native appearance remains unverified. The wide Latin/CJK variant’s passive Save passed complete independent identity/model/source/file equality on the pre-correction GUI. Current-host server+CLI all-targets subsequently passed68 tests across7 targets, and the semantic schema checker passed72 fixtures/204 schemas. Matching standalone transport/package checks remain separate from these results.

 Coherent contextual source/chooser/canvas contributions from other branches require integration and verification here. Calculations, quantities/units, maintained libraries, practical large-model textual workflows, complete OA↔SA engineering parity, documentation and fresh cross-disciplinary review remain full-goal requirements. See the [analysis proposal](release-analysis-semantics-design-20260910.md), [library proposal](release-libraries-semantics-design-20260910.md), [text-authoring design](release-textual-authoring-design-20260911.md) and [decisions](DECISIONS.md) for attributed design evidence, not completed implementation claims.

@@ -0,0 +1,52 @@
+# Staged prerequisite source creation: frozen native contract
+
+Codex-9e8r6t /root/palette_finish,2026-09-11. Prepared before inspecting any produced staged-source output. The standalone core-only evaluator is `harness/staged-source-authoring-contract.rs`. Root subsequently granted a direct-rustc window: warnings-denied compilation, self-check and exact baseline check **passed**. This validates the evaluator/fixture, not native staged-source creation. Existing immutable CLI admission of this starting fixture also succeeded with three ordinary completeness warnings. Build/provenance is in `harness/release-staged-source-authoring-oracle-20260911.md`.
+
+Copy the whole `base` directory into a new isolated native work directory. Do not edit these source fixtures or overwrite an earlier checkpoint. Baseline has a root project, an empty explicit OA OperationalActivity scenario, an empty SA Functional chain and an independent Unicode comment include. All three persistent IDs are explicit; there are no existing activities/functions/participants, views, relations or traces.
+
+| File | Bytes | SHA256 before native output |
+| --- | ---: | --- |
+| `base/project.arcadia` |593|`AA844950EC4FB86F262A257E1FC370A26557EA7978D8A4CAB78265037660234C`|
+| `base/notes.arcadia` |63|`AD9DE02963C20D1F43856455A797DEB05CA674659E45F2C4B96B52783024F8BD`|
+
+## Exact cumulative native actions
+
+1. OA Behavior → **Operational assessment**. The viewpoint is already **OperationalActivity**; use the semantic empty-state **Add first lifeline** action. Name the lifeline **Assessment lifeline**. Open **Create new source**, choose/retain Activity and layer-root semantic parent, and name it **Assess incident work**. Child **Use** returns to the retained parent. Verify the two distinct names, then apply the parent once. Only one root Activity plus one lifeline owned by the existing scenario, representing that Activity, should be created. Scenario steps remain empty; no occurrence, allocation, relation or view is implicit.
+2. SA Behavior → **System assessment**. Use **Add first function contribution**. Name the contribution **Classify this request**. Open **Create new source**, choose/retain Function and layer-root semantic parent, name it **Classify request**, and **Use**. Apply the retained parent once. Only one root Function and one Action occurrence under the existing chain should be created; the chain steps become exactly `[NEW_CONTRIBUTION]`. Its action is the new Function, lifeline is absent, conditions are empty. An isolated first contribution has no sequence link or allocation.
+3. SA Behavior → **New → State machine**. Name it **Field team operating modes**. Open **Create new owner**, explicitly select **SystemActor**, retain layer-root parent, name it **Field rescue team**, and **Use**. Check **Create the first state view**, then **Create and open** once. Only the root actor, its owned machine, and the opt-in diagram/root placement should be created. The diagram is **Field team operating modes · states**, SA StateMachine projection; default options, no routes/regions/states. Root placement is independently specified at60,60,size336×104 and passed through the shared core Layout command.
+
+After each creation, Save and preserve a fresh whole-directory **first-commit** checkpoint. Undo **once**, Save and preserve another directory; Redo **once**, Save and preserve another. After all three, use the real file picker to reopen the final project, Save and preserve a final directory.
+
+For an optional staged-only check after child **Use**, inspect or read a snapshot **before any Save**, or explicitly **Cancel the parent draft**, then Save and compare with the preceding accepted stage. Save/Save As is not a passive draft checkpoint: the existing App Save handler applies valid behavior, source and property drafts before saving. Save after Use can therefore atomically adopt the valid parent and its staged prerequisite. That is a Save-adoption route, not evidence that child Use committed early.
+
+Root's native 52DE82 Lifeline trial followed that Save-adoption route: Use returned to the retained parent with two accepted objects and staged **New Activity**; Ctrl+S then adopted Activity plus Lifeline and saved three files. The unchanged complete Lifeline oracle passed. A single Undo returned to two objects; persisted history checks were still ongoing at that observation. The prescribed direct parent Apply/Create route remains a separate native check. All exact source, name, ownership and identity expectations remain unchanged.
+
+All source/consumer names, ownership, references, defaults, membership and view geometry above are fixed expectations. The oracle borrows only unique fresh UUIDv4 roles by exact kind/layer/name (plus view projection and placement target). It never copies observed aliases, descriptions, parents, bodies, geometry, source text or diagrams wholesale. Every existing source byte and complete model field is compared after constructing the expected core-command result.
+
+## Checker invocation and identity authority
+
+After a root-authorized direct-rustc build using a matching completed `oa_core` rlib and `--edition2024 -D warnings`, let `$oracle` identify that immutable executable and `$base` the frozen baseline entry. Other variables below are preserved entry-file paths:
+
+Run the Windows gnullvm oracle with its matching verified runtime available, either beside the executable or through a process-scoped PATH containing the verified runtime directory and Windows system directories. Do not assume the standalone oracle directory includes `libunwind.dll`. Check the process exit status as well as its output: root's initial invocation without the runtime failed in the loader with `-1073741515` and no oracle log. A scoped PATH to the verified native 52DE82 bin plus Windows allowed the unchanged oracle to run and pass the Lifeline check. No machine-wide PATH change or oracle rebuild is required.
+
+```powershell
+& $oracle self-check $base
+& $oracle check baseline $base $base
+& $oracle check lifeline $base $firstLifeline $firstLifeline
+& $oracle same $base $undoLifeline $firstLifeline
+& $oracle check lifeline $base $redoLifeline $firstLifeline
+& $oracle check chain $base $firstChain $firstLifeline $firstChain
+& $oracle same $firstLifeline $undoChain $firstChain
+& $oracle check chain $base $redoChain $firstLifeline $firstChain
+& $oracle check machine $base $firstMachine $firstLifeline $firstChain $firstMachine
+& $oracle same $firstChain $undoMachine $firstMachine
+& $oracle check machine $base $redoMachine $firstLifeline $firstChain $firstMachine
+& $oracle check machine $base $reopen $firstLifeline $firstChain $firstMachine
+& $oracle same $redoMachine $reopen
+```
+
+Every stage supplies **all preceding original first-commit role carriers separately**. Those carriers are themselves checked against the cumulative contract. A later creation therefore cannot replace a prior stage's UUID and declare the replacement its own role authority; Redo and reopen cannot borrow new identities from their own output. The baseline source bytes are embedded in the checker at build time, so replacing the runtime fixture does not change its expected input.
+
+The retained-file rule matches the corrected creation-v2 harness: normal checkpoints must have exactly reachable `.arcadia` files. `same EXPECTED ACTUAL UNDO_FROM` requires complete Project and reachable SourceBundle equality, and exact physical bytes equal to the explicitly proven first-commit disk map overlaid with EXPECTED's restored reachable files. Only those known detached files may remain. Unknown, changed or missing retained files fail. No file is taken from actual Undo output to define its own expected bytes. There is no broad orphan-file exemption.
+
+Self-check prepares deliberately false metadata/geometry role carriers, full source fixed points, complete model/byte-drift falsifiers, exact repeated-command refusal, one core-session Undo/Redo, retained-file falsifiers and independent earlier-stage identity pinning. These **passed as evaluator checks**, not native acceptance. Predicted reachable-file counts are3 after Lifeline,4 after Chain and6 after Machine. Native focus, first-action discoverability, preserved raw parent/child drafts, selection, minimum/wide layout and real one-step history still require separate observation.
@@ -0,0 +1 @@
+// Preserve this independent engineering note: secours 雨 Δ.
@@ -0,0 +1,15 @@
+arcadia 7;
+project contextual_source_acceptance "Contextual source acceptance" id "d1510000-0000-4000-8000-000000000001" {
+    include "notes.arcadia";
+
+    // The viewpoint is explicit before any lifeline exists.
+    oa_scenario operational_assessment "Operational assessment" id "d1510000-0000-4000-8000-000000000002" {
+        viewpoint OperationalActivity;
+        steps [];
+    }
+
+    // Contributions are occurrences; root Functions are separate sources.
+    sa_functional_chain system_assessment "System assessment" id "d1510000-0000-4000-8000-000000000003" {
+        steps [];
+    }
+}
@@ -0,0 +1,121 @@
+# Published contextual-source integration update — 2026-09-11
+
+Codex-ytr83r /root/wsl_startup_review. Read-only preflight; root owns integration and validation. Import the cumulative **13 desktop paths** below from the parent of df6 through b2c, plus the **unchanged oracle and three-file fixture at b2c**. Merge two narrow conflicts while preserving B4 and the header correction. No later semantic dependency was found. This updates the old [df6 preflight](release-staged-source-integration-ytr83r-20260911.md); it does not execute or accept the merged application.
+
+## Frozen references and ancestry
+
+- Published implementation: `b2c3e54001fc19a05423bcd5808ceea78d13ff59` (b2c).
+- Exact packaged-input reconstruction: `d5650309a93f3d590a41f8a8f0322c6500568f69` (d565), direct child of b2c.
+- Original contextual commit: `df6f59562643b7771ecf0c972f8655f3e3f1c4da`; its parent and cumulative patch base is `07eb3cd12b5d0f2fa19d94ea1f5d2f8aade240ec`.
+- Linear df6 → b2c ancestry: `d95b1ab17852c2dbf8ff9cd1f47507b12493054e` → `c4bad4b8de4851be4d800104be8f019b99f54f78` → `ca53f574e57381a523e946d5277b4081cff74355` → b2c. First two add historical publication/native records, not production source. ca53 changes creation.rs and source_draft.rs; b2c subsequently changes source_draft.rs. Do not stop at the WIP ca53 snapshot.
+- Local starting HEAD was `fe8364e7eb47b9452b079bbf2507947dfe10b13e`, with the header-only working correction present. During review root froze that correction as `4da92ab481a2f5f9fcd88f29c90fa4785ac17c3a`, which was directly read back as HEAD; root separately reported evidence checkpoint `7831abe`. Merge base of the original local HEAD and b2c: `b6b76efc0d6092d96e793feadf529e281017c5a9`.
+- Read current issue 2 comments including [publication #406](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/2#issuecomment-406), `ContextualSourceDrafts20260911` and `Authoring20260911` Wiki. Publication supersedes the Wiki's earlier packaging-pending wording. The milestone tag is `v0.2.0-preview.contextual.20260911`, pointing to b2c; d565 reconstructs packaged raw inputs. This review did not download/reverify release assets.
+
+Missing commit objects were fetched with `git -c gc.auto=0 fetch --no-tags --no-write-fetch-head --no-auto-maintenance gitea b2c3e54001fc19a05423bcd5808ceea78d13ff59 d5650309a93f3d590a41f8a8f0322c6500568f69` (exit 0). No ref, FETCH_HEAD, config, source or intentional index update was performed. Git read/check operations subsequently used `--no-optional-locks`; no formal before/after index hash was taken.
+
+## Exact minimum source import
+
+Use a path-scoped cumulative diff from 07eb to b2c, not an unqualified commit-range import. All paths below are relative to `crates/oa-desktop/src/` and form one coherent implementation:
+
+| Path | b2c blob bytes | b2c SHA256 | Current apply check |
+|---|---:|---|---|
+| app.rs | 210565 | B10BFA57F331DA3928D5FE27D2AEBDB13F6054C6E3D48C4CFD24FF81726094AD | pass |
+| app/checkpoints.rs | 29576 | 55E5BABDCABEF767AF3BC8BE9CC3153B3F5CC0695701B890820EC0225643852E | pass |
+| behavior.rs | 131449 | C9E0AEA6A24CC982D0D82EE2B9B66F250CDFAC037B36BF6B1B9D7DD38246CD3C | module hunk conflict |
+| behavior/contextual_source_tests.rs | 49386 | 5F05318A6533503B9D6FEBF1EC4DD7256F192394BC1B952A7904C8175BD8DDAE | pass |
+| behavior/creation.rs | 29301 | 438A245EAD397060767C790C51A8F21CD5021342627999DEB4695CF3BD22091A | pass |
+| behavior/scenario.rs | 149092 | D12A4B1CAA61C08F69C4D2A64BD15568C4B7158DEA91AAC5A52A58A35ADB863C | pass |
+| behavior/scenario/workspace.rs | 31975 | 790A2917D7E7102BEEAE68FF43EF1693D11132573651265DB490B560E14B7062 | pass |
+| behavior/source_draft.rs | 39485 | 85D543CC288E48B4C13001E4E386B5B54D9B1E349A5AC31E4E307572F2D8FB3C | pass |
+| behavior/topology.rs | 83845 | D06B2F0FC39B4814E94200297E148F1D4D97E04CB167766030AC9DF18689E3B0 | pass |
+| behavior/topology/contextual.rs | 28320 | 231610428B9066A92D7405C44E2474FCFE2350FA2998926E8CF502F3392C0A07 | pass |
+| behavior/topology/direct.rs | 32036 | 413AA2009EE4CBA0941836B43E41F16A04C8FC8568B6E92DB5BB08516E95C287 | pass |
+| behavior/topology/view.rs | 29176 | A7D806CD621BDF857C4E4861685CD3EB556B320DE3985B9CC3D9D131DAD370DC | pass |
+| guide.rs | 112981 | 51F1ACDE885635E4D9B783B56A0251B3E7315DDE4C1C05317DB55D54A857B715 | scenario walkthrough conflict |
+
+The exact selector is `git --no-optional-locks diff --binary 07eb3cd12b5d0f2fa19d94ea1f5d2f8aade240ec b2c3e54001fc19a05423bcd5808ceea78d13ff59 --` followed by those 13 full paths. This excludes all packaging, harness/docs, live ledgers, platform evidence and peer navigation proposals. The entire range changes no other crates, Cargo files or generated API content. Its unqualified full-tree diff does include unrelated history and must not be used as the minimum import.
+
+Checks used each exact binary diff in memory as stdin to `git --no-optional-locks apply --check --whitespace=nowarn -`, without applying it or writing a temporary patch. Eleven passed; behavior.rs failed at original line 14, guide.rs at original line 490. A final quiet diff confirms the other ten existing target files did not change between fe8364e and 4da92ab. The two new source paths were absent and their addition checks passed. Local behavior.rs with the checked clipping correction hashes `B47E1DF6F88282D907CD5726A03DB0BF066B60B134962A223F11842482E75946`.
+
+### Exact conflict resolution requirements
+
+In behavior.rs, preserve `mod scenario_lifecycle` and add `#[cfg(test)] mod contextual_source_tests` and `pub(crate) mod source_draft` alongside existing modules. The other peer hunks add source-event predicates, source-state adapters, and the retained unavailable-owner view. They do not touch Scene drawing, the lifecycle implementation, `box_text_clip`, or the corrected `with_clip` title/detail rendering. Do not replace the complete peer behavior.rs over B4. Keep root's header rendering and new render/workspace regressions.
+
+In guide.rs, keep current text and apply the peer's four subject changes: the two process/chain walkthrough sentences; contextual Lifeline source creation; the machine-owner paragraph plus adjacent new-owner sentence; and the existing draft explanation's child Back/Use/recovery prefix. The sole conflicting scenario hunk needs only this replacement of the current `Use + Lifeline...` sentence:
+
+> Use Add first lifeline on an empty scenario, or + Lifeline. Choose existing work/participant or Create new source. The explicit viewpoint limits its kinds; choose participant kinds deliberately. Source name and lifeline name are separate, and the source semantic parent is independent of the scenario. No allocation or capability involvement is inferred.
+
+Preserve all current surrounding message-tool gestures, clicked fragment/operand placement, Add action/Observe state/Reuse scenario actions, Open definition/Back navigation, lifeline lifetime keywords, capsule/X selection, uncertain `?` versus unanswered-call `…`, and stored-history guidance. Whole-file replacement would restore obsolete Draw message/Destination wording and lose B4 instructions. Current direct-canvas/F2 guide content also stays.
+
+Keep workspace identity/reset, retained pending-source invocation, and existing same-size/new-owner viewport protections. No peer956 canvas/chooser or peer9e8 uncommitted/current text-navigation implementation belongs to this import.
+
+## Corrections after df6 and reconstruction boundary
+
+Only two production files differ df6 → b2c (589 insertions, 38 deletions including tests). source_draft.rs places compact heading, Name, wrapped explicit kind choices and semantic-parent summary before explanatory text. A single permitted kind replaces its redundant button only when it equals the actual draft selection; incomplete recovery retains an explicit repair choice. Full long-parent text remains scrollable and the Back/Use footer stays pinned. Three tests use real Iced Paragraph measurement and a composed 340/500 × 215 host, exercise initial visibility, long-parent overflow and recovered raw names, and dispatch actual kind mouse events/Unicode Name input. The final test uses 32 repeated parent segments to establish actual overflow; an earlier eight-repeat fixture failed that condition and was corrected without weakening the containment checks.
+
+creation.rs changes only the displayed existing-owner picker alternative when its selected ID exactly matches the staged owner: it suppresses a false missing accepted-catalog label, keeps the explicit New owner label and identifies existing participants as an alternative. Genuine missing accepted-owner and Context paths remain distinct. The layout correction does not alter source planning, ownership guards, tokens, accepted model, FormShown or canvas geometry.
+
+All 11 b2c → d565 content changes compare exactly equal after CRLF-to-LF normalization: creation.rs; scenario/workspace.rs; topology/contextual.rs; guide.rs; semantic_review/{artifacts_view,attachments_view,keyed,keyed_rows,keyed_tests,ordered}.rs; and docs/openapi.json. The twelfth path is .gitattributes with the corresponding 11 `-text` rules. Thus d565 is raw-byte reconstruction, not an additional semantic prerequisite. Do not import unrelated semantic-review/OpenAPI restorations or those source-specific attribute overrides merely to obtain contextual behavior. Keep the branch's source newline convention and record new merged build inputs; the table identifies peer blobs, not expected merged hashes or inherited GUI identity.
+
+## Required oracle, fixture and attributes
+
+Take these four exact b2c paths; this is the complete fixture. The oracle and both baseline files are unchanged since df6:
+
+| Path | Bytes | SHA256 |
+|---|---:|---|
+| harness/staged-source-authoring-contract.rs | 22693 | 9EB9DD3868B6CB772F907D16AE02995AD10A16F85C087012C24948E6E6FE775D |
+| harness/fixtures/staged-source-authoring/README.md | 8380 | 711910A12D5F3960F32DA9AA7BC2E647F31D770C84B7FC26E232DCB3A76F8821 |
+| harness/fixtures/staged-source-authoring/base/project.arcadia | 593 | AA844950EC4FB86F262A257E1FC370A26557EA7978D8A4CAB78265037660234C |
+| harness/fixtures/staged-source-authoring/base/notes.arcadia | 63 | AD9DE02963C20D1F43856455A797DEB05CA674659E45F2C4B96B52783024F8BD |
+
+Merge only these missing preservation rules into the current .gitattributes, retaining all root-owned rules:
+
+```gitattributes
+harness/fixtures/staged-source-authoring/** -text whitespace=cr-at-eol
+harness/staged-source-authoring-contract.rs -text whitespace=cr-at-eol
+```
+
+The corrected README is required knowledge: child Use stages, but App Save/Save As applies valid pending drafts. To prove no adoption, inspect before Save or Cancel the parent before Save. Save-adoption and direct parent Create are separate routes. Run the independently compiled oracle with the matching verified libunwind runtime available in the process-scoped PATH or beside it; inspect its exit, not merely an empty log. No machine-wide PATH change is necessary. Preserve separate first-commit UUID carriers for Undo/Redo comparisons and the exact retained-physical-file rule.
+
+## Pinned provenance; optional archival boundaries
+
+Keep this report as the local integration record. Importing the peer's nine historical reports or ten archives is unnecessary for the minimum source/test import. Their exact b2c versions remain accessible here:
+
+- [Implementation](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/b2c3e54001fc19a05423bcd5808ceea78d13ff59/harness/release-contextual-source-creation-20260911.md) and [creation review](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/b2c3e54001fc19a05423bcd5808ceea78d13ff59/harness/release-contextual-source-creation-review-20260911.md).
+- [Layout review](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/b2c3e54001fc19a05423bcd5808ceea78d13ff59/harness/release-contextual-source-layout-review-20260911.md), [independent layout review](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/b2c3e54001fc19a05423bcd5808ceea78d13ff59/harness/release-contextual-source-layout-independent-20260911.md), and [staged-owner caption](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/b2c3e54001fc19a05423bcd5808ceea78d13ff59/harness/release-staged-owner-label-20260911.md).
+- [Oracle/procedure history](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/b2c3e54001fc19a05423bcd5808ceea78d13ff59/harness/release-staged-source-authoring-oracle-20260911.md), [native v1](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/b2c3e54001fc19a05423bcd5808ceea78d13ff59/harness/release-contextual-source-native-20260911.md), [native v2 plan](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/b2c3e54001fc19a05423bcd5808ceea78d13ff59/harness/release-contextual-source-native-v2-plan-20260911.md), and [completed native v2/full-suite report](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/b2c3e54001fc19a05423bcd5808ceea78d13ff59/harness/release-contextual-source-native-v2-20260911.md).
+
+Optional archives are all under the pinned [b2c harness/experiments tree](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/src/commit/b2c3e54001fc19a05423bcd5808ceea78d13ff59/harness/experiments). Exact directory inventories were enumerated, not copied or fully rehashed:
+
+| Directory | Committed files |
+|---|---:|
+| contextual-source-20260911 | 40 |
+| contextual-source-native-20260911 | 54 |
+| contextual-source-reopen-20260911 | 11 |
+| contextual-source-layout-reboot-20260911 | 15 |
+| contextual-source-layout-postboot-20260911 | 11 |
+| contextual-source-layout-verified-20260911 | 13 |
+| contextual-source-layout-full-20260911 | 10 |
+| contextual-source-recovery-20260911 | 27 |
+| contextual-source-machine-v2-20260911 | 50 |
+| contextual-source-lifeline-v2-20260911 | 25 |
+
+If root later copies any such checksum-bound archive, preserve its exact bytes with that archive's scoped `-text` rule and the corresponding whitespace exceptions from b2c .gitattributes; do not copy the complete attribute file. Some historical .png files are JPEG despite their suffix and must retain their recorded original names/bytes. No archive import is needed now. Exclude peer AGENTS/PROJECT_GOAL/PLAN/STATE/TASK_LEDGER, WSL/capacity/platform evidence, CLI publication records, unrelated OA scenario archives and current navigation proposals.
+
+## Evidence limits and next integration gate
+
+The published GUI is `5657BAB5C841939B66F901EFE6C0FFB2D7CBBE8CC5F111A0CA3DE8073D3846CE`; its test executable is `75AB0E151D85473631D5A145527F3F6B9768A3CD61CE66A0603A574E09557017`. The pinned report records focused 26, full 679 (zero failed/ignored/filtered, exit 0 at 15:47:53 UTC), strict Clippy/fmt/build, minimum-window source visibility/recovery/cancellation, direct Lifeline Create/Save/Undo/Redo, and Machine owner/Create/Save/Undo/Redo/fresh-process reopen. These are peer artifact results, not executed merged results. Older GUI52 and intermediate layout hashes remain historical; they must not replace the final source hashes above.
+
+After root's selective merge, inspect the complete union and conflicts, then run the required combined desktop/focused/full/strict gates once on frozen merged inputs. Preserve B4 lifecycle and header clipping regressions, contextual/admission/recovery and real-layout tests, guide and direct-canvas/workspace regressions. The native merged source/consumer Save/Undo/Redo/reopen acceptance still needs matching runtime and complete Project/reachable SourceBundle/physical file-map/UUID oracles. The unchanged core/server/CLI gate is independent of this 13-path desktop delta; it does not establish desktop acceptance.
+
+After these read-only checks, root reported importing the 13 source paths and four fixture/oracle blobs, preserving the module union and exact guide sentence. Root also reported the independent server/CLI gate exit 0 at 17:28:56 UTC (68 passed across seven targets). Those are subsequent root actions, not this preflight execution; the report does not recheck or accept that now-modified desktop union.
+
+This worker ran no Cargo, native UI, oracle, WSL, network configuration, merge, checkout, staging or source edit. A first attempted in-memory check used unavailable `python` and stopped before checks; the successful checks used .NET byte streams and Git. Only this new report was written. Root retains actual integration, Gitea consolidation, release and remaining workflow ownership.
+
+## Root integration and independent union review
+
+Root applied the eleven clean source patches and merged only the documented behavior module insertion and guide Lifeline sentence. Scoped rustfmt passed. The complete behavior.rs suffix beginning `struct BoxItem`, including lifecycle rendering, marker arbitration, hit testing and the header correction, compares byte-identically with4da92ab. Core/server/CLI/Cargo have no diff. Four oracle/fixture files match the exact b2c bytes in the table above.
+
+A separate GPT-6 Astra reviewer found no material integration issue: preserved B4/guide union, context-bound source Back, modal-first Escape, success-only consumer selection and atomic source/history paths remain coherent. Imported files match peer content; workspace retains only the existing omitted explanatory comment above unchanged sensor identity code. This is static review, not new desktop/native acceptance. The combined source now proceeds to its own frozen Windows desktop gate.
+
+Live coordination moved to [issue5](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/5) following owner issue1/comment421. Issue4 separately tracks the newly reported child-work failure.
@@ -110,7 +110,7 @@ passed exit0 at16:45:59.383UTC in1216.612seconds. The affected scenario workspac

 The typography-wide fixture exposed a real neutral-header defect. At minimum80%, the OA receiver card occupied approximately x515–679 while its18-W name extended to about730. Overflow remained at64%,51.2%, minimum Fit69%, and wide100/125/156.25/195.3125%. The Create capsule text stayed contained. Header and Create clicks still selected the distinct original Lifeline102 and occurrence110, with the full18-W name retained in Properties.

-SA displayed the18-CJK-character name with available glyphs at wide100% and125%; its neutral header overflowed while the Create capsule stayed contained. Header102 and Create110 selected correctly and Properties retained the full name. A later attempt to increase CJK zoom was interrupted by the user; no156% outcome is inferred. The user then explicitly reauthorized Computer Use. A fresh main-window capture failed with `window capture timed out: timed out waiting on channel`; the prescribed fresh-window recovery failed with `computer-use request timed out: activate_window`. Root stopped UI input. No wide-fixture passive Save/oracle or combining/emoji native acceptance is claimed.
+SA displayed the18-CJK-character name with available glyphs at wide100% and125%; its neutral header overflowed while the Create capsule stayed contained. Header102 and Create110 selected correctly and Properties retained the full name. A later attempt to increase CJK zoom was interrupted by the user; no156% outcome is inferred. The user then explicitly reauthorized Computer Use. A fresh main-window capture failed with `window capture timed out: timed out waiting on channel`; the prescribed fresh-window recovery failed with `computer-use request timed out: activate_window`. Root stopped UI input at that point. Combining/emoji native acceptance remains unclaimed.

 The [pre-correction archive](lifecycle-header-overflow-before-archive-20260911.md) preserves exactly12 original wide-name screenshots and the affected-test log/status, with complete byte readback. The [bounded correction](lifecycle-header-overflow-correction-ytr83r-20260911.md) adds clipping to the existing shared card text path; it requires its own compile/test and matching GUI verification. Existing model and source checks do not certify corrected pixels.

@@ -119,3 +119,7 @@ Native toolbar steps provide51.2%/100%/195.3125%, plus minimum Fit; exact0.5x/2x
 ## Git evidence preservation

 Before checkpoint commit, root compared the complete index inventory and every Git blob byte against all122 files in the three closed OA/SA/pre-correction archives, plus the preserved historical STATE file:123 exact files,8,470,143 bytes. Nineteen raw logs required explicit inclusion because the repository ignores new log files. The final inventory and all byte comparisons passed; no screenshot or log normalization was accepted.
+
+## Subsequent pre-correction passive Save
+
+After the server/CLI compiler completed, a fresh selected-window capture initially showed an occluding application; root issued no coordinate input against that image. Explicit activation of the already selected Studio window recovered a valid1102×732 Studio capture at125% with the SA CJK header selected. Root clicked Save all, observed `All source files saved`, then froze the complete two-file wide fixture and ran the independent `same` oracle against its immutable admitted typography-wide prediction. Exit0: all identities, fields, reachable source and physical bytes match. The20128-byte project retains SHA2566a18ee1f246321bdf8ab0e7e8e5d4eba134ce486ed5224c4ffd61c7342c3a7d3 and the86-byte rationale retains8509f8d8a136d808cf98a1bb0fe50348b8a24409f30dee4ee65b62bf5cb9e6bf. This remains old production29084050/GUI47332A6E; it proves passive persistence, not corrected clipping or the cause of tool recovery. Original supplemental screenshot/checkpoint/log are preserved separately from the closed12-image archive.
@@ -0,0 +1,635 @@
+//! Independent contextual-source native oracle. No desktop producer is imported.
+//! self-check BASE | check STAGE BASE ACTUAL [FIRST_LIFELINE [FIRST_CHAIN [FIRST_MACHINE]]]
+//! same EXPECTED ACTUAL [UNDO_FROM]
+use oa_core::{source_project::*, *};
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    fs,
+    path::Path,
+};
+
+const ACTIVITY: &str = "Assess incident work";
+const LIFELINE: &str = "Assessment lifeline";
+const FUNCTION: &str = "Classify request";
+const CONTRIBUTION: &str = "Classify this request";
+const ACTOR: &str = "Field rescue team";
+const MACHINE: &str = "Field team operating modes";
+const VIEW: &str = "Field team operating modes · states";
+const SCENARIO: u128 = 0xd1510000000040008000000000000002;
+const CHAIN: u128 = 0xd1510000000040008000000000000003;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
+enum Stage {
+    Baseline,
+    Lifeline,
+    Chain,
+    Machine,
+}
+impl Stage {
+    fn parse(text: &str) -> Self {
+        match text {
+            "baseline" => Self::Baseline,
+            "lifeline" => Self::Lifeline,
+            "chain" => Self::Chain,
+            "machine" => Self::Machine,
+            _ => panic!("Stage must be baseline, lifeline, chain or machine"),
+        }
+    }
+    fn additions(self) -> usize {
+        match self {
+            Self::Baseline => 0,
+            Self::Lifeline => 2,
+            Self::Chain => 4,
+            Self::Machine => 6,
+        }
+    }
+}
+
+type DiskSources = BTreeMap<String, Vec<u8>>;
+fn source_paths(root: &Path, here: &Path, paths: &mut DiskSources) {
+    for entry in fs::read_dir(here).unwrap() {
+        let entry = entry.unwrap();
+        let kind = entry.file_type().unwrap();
+        assert!(
+            !kind.is_symlink(),
+            "Checkpoint files must be ordinary files"
+        );
+        if kind.is_dir() {
+            source_paths(root, &entry.path(), paths);
+        } else if entry.path().extension().is_some_and(|ext| ext == "arcadia") {
+            assert!(kind.is_file());
+            paths.insert(
+                entry
+                    .path()
+                    .strip_prefix(root)
+                    .unwrap()
+                    .to_str()
+                    .unwrap()
+                    .replace('\\', "/"),
+                fs::read(entry.path()).unwrap(),
+            );
+        }
+    }
+}
+fn load_checkpoint(entry: &Path) -> (CompiledSourceProject, DiskSources) {
+    let files = source_files::load_project(entry, ProjectLimits::default()).unwrap();
+    assert!(
+        !files
+            .diagnostics
+            .iter()
+            .any(|d| d.diagnostic.severity == validation::Severity::Error),
+        "Loader errors: {:?}",
+        files.diagnostics
+    );
+    let raw = files.reachable_bundle();
+    let compiled = compile_bundle(&raw, ProjectLimits::default()).unwrap();
+    assert_eq!(
+        compiled.bundle, raw,
+        "No normalization, migration or missing identity is allowed in saved output"
+    );
+    execute_batch(&compiled.decoded.project, &[]).unwrap();
+    let mut disk = BTreeMap::new();
+    let root = entry.parent().unwrap();
+    source_paths(root, root, &mut disk);
+    (compiled, disk)
+}
+fn predicted_disk(reachable: &SourceBundle, undo_from: Option<&DiskSources>) -> DiskSources {
+    let mut files = undo_from.cloned().unwrap_or_default();
+    files.extend(
+        reachable
+            .files
+            .iter()
+            .map(|(path, text)| (path.clone(), text.as_bytes().to_vec())),
+    );
+    files
+}
+fn load(entry: &Path) -> CompiledSourceProject {
+    let (compiled, files) = load_checkpoint(entry);
+    assert_eq!(
+        files,
+        predicted_disk(&compiled.bundle, None),
+        "Ordinary checkpoint has unexpected detached source files; Undo needs an explicit origin"
+    );
+    compiled
+}
+fn baseline(entry: &Path) -> CompiledSourceProject {
+    let base = load(entry);
+    assert_eq!(
+        base.bundle,
+        SourceBundle {
+            entry: "project.arcadia".into(),
+            files: BTreeMap::from([
+                (
+                    "project.arcadia".into(),
+                    include_str!("fixtures/staged-source-authoring/base/project.arcadia").into()
+                ),
+                (
+                    "notes.arcadia".into(),
+                    include_str!("fixtures/staged-source-authoring/base/notes.arcadia").into()
+                ),
+            ])
+        },
+        "Baseline bytes differ from the pre-observation fixture embedded in this executable"
+    );
+    let p = &base.decoded.project;
+    assert_eq!(p.elements.len(), 2);
+    assert!(p.relations.is_empty());
+    assert!(p.diagrams.is_empty());
+    assert_eq!(
+        p.elements[&Id::from_u128(SCENARIO)].name,
+        "Operational assessment"
+    );
+    assert_eq!(p.elements[&Id::from_u128(CHAIN)].name, "System assessment");
+    base
+}
+
+struct Roles<'a> {
+    actual: &'a Project,
+    baseline: &'a Project,
+    used: BTreeSet<Id>,
+}
+impl Roles<'_> {
+    fn fresh(&mut self, ids: Vec<Id>, role: &str) -> Id {
+        assert_eq!(ids.len(), 1, "Exactly one literal role required: {role}");
+        let id = ids[0];
+        assert_eq!(id.get_version_num(), 4, "Fresh role must be UUIDv4: {role}");
+        assert!(!self.baseline.contains(id));
+        assert!(self.used.insert(id));
+        id
+    }
+    fn element(&mut self, kind: Kind, layer: Layer, name: &str) -> Id {
+        self.fresh(
+            self.actual
+                .elements
+                .values()
+                .filter(|e| e.kind() == kind && e.layer() == layer && e.name == name)
+                .map(|e| e.id)
+                .collect(),
+            name,
+        )
+    }
+    fn view(&mut self, machine: Id) -> Id {
+        self.fresh(
+            self.actual
+                .diagrams
+                .values()
+                .filter(|d| {
+                    d.name == VIEW
+                        && d.layer == Layer::Sa
+                        && d.projection == ProjectionKind::StateMachine { machine }
+                })
+                .map(|d| d.id)
+                .collect(),
+            VIEW,
+        )
+    }
+    fn placement(&mut self, view: Id, machine: Id) -> Id {
+        self.fresh(
+            self.actual.diagrams[&view]
+                .nodes
+                .values()
+                .filter(|n| n.element == machine)
+                .map(|n| n.id)
+                .collect(),
+            "first view machine placement",
+        )
+    }
+}
+fn element(
+    project: &Project,
+    id: Id,
+    name: &str,
+    parent: Option<Id>,
+    body: ElementBody,
+) -> Element {
+    Element {
+        id,
+        alias: project.fresh_alias(name, "element", id),
+        name: name.into(),
+        description: String::new(),
+        parent,
+        body,
+    }
+}
+fn stage_commands(before: &Project, stage: Stage, roles: &mut Roles<'_>) -> Vec<Command> {
+    match stage {
+        Stage::Baseline => vec![],
+        Stage::Lifeline => {
+            let source = roles.element(Kind::Activity, Layer::Oa, ACTIVITY);
+            let line = roles.element(Kind::Lifeline, Layer::Oa, LIFELINE);
+            vec![
+                Command::CreateElement(element(
+                    before,
+                    source,
+                    ACTIVITY,
+                    None,
+                    ElementBody::Oa(OaBody::Activity),
+                )),
+                Command::CreateElement(element(
+                    before,
+                    line,
+                    LIFELINE,
+                    Some(Id::from_u128(SCENARIO)),
+                    ElementBody::shared_in(
+                        Layer::Oa,
+                        SharedBody::Lifeline {
+                            represented: Some(source),
+                        },
+                    ),
+                )),
+            ]
+        }
+        Stage::Chain => {
+            let source = roles.element(Kind::Function, Layer::Sa, FUNCTION);
+            let step = roles.element(Kind::Occurrence, Layer::Sa, CONTRIBUTION);
+            vec![
+                Command::CreateElement(element(
+                    before,
+                    source,
+                    FUNCTION,
+                    None,
+                    ElementBody::Sa(SaBody::Function),
+                )),
+                Command::CreateElement(element(
+                    before,
+                    step,
+                    CONTRIBUTION,
+                    Some(Id::from_u128(CHAIN)),
+                    ElementBody::shared_in(
+                        Layer::Sa,
+                        SharedBody::Occurrence {
+                            body: OccurrenceBody::Action {
+                                action: Some(source),
+                                lifeline: None,
+                            },
+                            precondition: String::new(),
+                            postcondition: String::new(),
+                        },
+                    ),
+                )),
+                Command::SetSteps(Id::from_u128(CHAIN), vec![step]),
+            ]
+        }
+        Stage::Machine => {
+            let actor = roles.element(Kind::SystemActor, Layer::Sa, ACTOR);
+            let machine = roles.element(Kind::StateMachine, Layer::Sa, MACHINE);
+            let diagram = roles.view(machine);
+            let placement = roles.placement(diagram, machine);
+            let owner = element(before, actor, ACTOR, None, ElementBody::Sa(SaBody::Actor));
+            let record = element(
+                before,
+                machine,
+                MACHINE,
+                Some(actor),
+                ElementBody::shared_in(Layer::Sa, SharedBody::StateMachine),
+            );
+            let p = execute_batch(
+                before,
+                &[
+                    Command::CreateElement(owner.clone()),
+                    Command::CreateElement(record.clone()),
+                ],
+            )
+            .unwrap();
+            let view = Diagram {
+                id: diagram,
+                alias: p.fresh_alias(VIEW, "state_view", diagram),
+                name: VIEW.into(),
+                description: String::new(),
+                layer: Layer::Sa,
+                projection: ProjectionKind::StateMachine { machine },
+                routes: vec![],
+                view_options: Default::default(),
+                nodes: BTreeMap::from([(
+                    placement,
+                    NodePlacement {
+                        id: placement,
+                        alias: p.fresh_alias(
+                            &format!("{MACHINE} placement"),
+                            "placement",
+                            placement,
+                        ),
+                        element: machine,
+                        position: Position { x: 60., y: 60. },
+                        size: Size {
+                            width: 336.,
+                            height: 104.,
+                        },
+                        collapsed: false,
+                        port_anchors: vec![],
+                    },
+                )]),
+            };
+            vec![
+                Command::CreateElement(owner),
+                Command::CreateElement(record),
+                Command::CreateDiagram(view),
+                Command::Layout(diagram),
+            ]
+        }
+    }
+}
+fn predict(
+    base: &CompiledSourceProject,
+    stage: Stage,
+    carriers: &[&Project],
+) -> CompiledSourceProject {
+    let mut result = base.clone();
+    let mut used = BTreeSet::new();
+    for (index, current) in [Stage::Lifeline, Stage::Chain, Stage::Machine]
+        .into_iter()
+        .filter(|s| *s <= stage)
+        .enumerate()
+    {
+        let mut roles = Roles {
+            actual: carriers[index],
+            baseline: &base.decoded.project,
+            used,
+        };
+        let command = Command::Batch(stage_commands(&result.decoded.project, current, &mut roles));
+        used = roles.used;
+        let plan = prepare_command(&result.decoded.project, &command).unwrap();
+        result = update_bundle_with_identity_map(
+            &result,
+            &plan.project,
+            &plan.identity_map,
+            ProjectLimits::default(),
+        )
+        .unwrap();
+    }
+    assert_eq!(
+        result.decoded.project.elements.len(),
+        base.decoded.project.elements.len() + stage.additions()
+    );
+    assert_eq!(
+        result.decoded.project.diagrams.len(),
+        usize::from(stage == Stage::Machine)
+    );
+    assert_eq!(
+        result.decoded.project.relations,
+        base.decoded.project.relations
+    );
+    assert_eq!(result.decoded.project.traces, base.decoded.project.traces);
+    assert_eq!(
+        result.decoded.project.artifact_links,
+        base.decoded.project.artifact_links
+    );
+    result
+}
+fn equal(a: &CompiledSourceProject, b: &CompiledSourceProject) -> bool {
+    a.decoded.project == b.decoded.project && a.bundle == b.bundle
+}
+fn assert_equal(a: &CompiledSourceProject, b: &CompiledSourceProject) {
+    assert_eq!(
+        a.decoded.project, b.decoded.project,
+        "Complete Project differs"
+    );
+    assert_eq!(a.bundle, b.bundle, "Complete exact SourceBundle differs");
+}
+fn test_id(n: u128) -> Id {
+    Id::from_u128(0xd2520000000040008000000000000000 + n)
+}
+fn false_carrier(base: &Project) -> Project {
+    let mut p = base.clone();
+    for (n, kind, layer, name) in [
+        (1, Kind::Activity, Layer::Oa, ACTIVITY),
+        (2, Kind::Lifeline, Layer::Oa, LIFELINE),
+        (3, Kind::Function, Layer::Sa, FUNCTION),
+        (4, Kind::Occurrence, Layer::Sa, CONTRIBUTION),
+        (5, Kind::SystemActor, Layer::Sa, ACTOR),
+        (6, Kind::StateMachine, Layer::Sa, MACHINE),
+    ] {
+        p.elements.insert(
+            test_id(n),
+            Element {
+                id: test_id(n),
+                alias: format!("false_alias_{n}"),
+                name: name.into(),
+                description: "Never copy this observed metadata".into(),
+                parent: None,
+                body: ElementBody::new(kind, layer).unwrap(),
+            },
+        );
+    }
+    p.diagrams.insert(
+        test_id(7),
+        Diagram {
+            id: test_id(7),
+            alias: "false_view_alias".into(),
+            name: VIEW.into(),
+            description: "Never copy this".into(),
+            layer: Layer::Sa,
+            projection: ProjectionKind::StateMachine {
+                machine: test_id(6),
+            },
+            routes: vec![],
+            view_options: Default::default(),
+            nodes: BTreeMap::from([(
+                test_id(8),
+                NodePlacement {
+                    id: test_id(8),
+                    alias: "false_placement_alias".into(),
+                    element: test_id(6),
+                    position: Position { x: -123., y: 987. },
+                    size: Size {
+                        width: 77.,
+                        height: 33.,
+                    },
+                    collapsed: true,
+                    port_anchors: vec![],
+                },
+            )]),
+        },
+    );
+    p
+}
+fn self_check(base: &CompiledSourceProject) {
+    let carrier = false_carrier(&base.decoded.project);
+    let mut previous = base.clone();
+    for stage in [Stage::Lifeline, Stage::Chain, Stage::Machine] {
+        let expected = predict(base, stage, &[&carrier; 3]);
+        assert_equal(
+            &expected,
+            &predict(base, stage, &[&expected.decoded.project; 3]),
+        );
+        assert_equal(
+            &expected,
+            &compile_bundle(&expected.bundle, ProjectLimits::default()).unwrap(),
+        );
+        let mut roles = Roles {
+            actual: &carrier,
+            baseline: &base.decoded.project,
+            used: BTreeSet::new(),
+        };
+        let command = Command::Batch(stage_commands(&previous.decoded.project, stage, &mut roles));
+        let mut session = Session::try_new(previous.decoded.project.clone()).unwrap();
+        session.execute(command.clone()).unwrap();
+        assert_eq!(session.project(), &expected.decoded.project);
+        assert!(
+            session.execute(command).is_err(),
+            "Exact repeated creation command must not duplicate identities"
+        );
+        assert_eq!(session.project(), &expected.decoded.project);
+        session.undo();
+        assert_eq!(session.project(), &previous.decoded.project);
+        session.redo();
+        assert_eq!(session.project(), &expected.decoded.project);
+        let mut changed = expected.clone();
+        changed
+            .decoded
+            .project
+            .elements
+            .get_mut(&test_id(1))
+            .unwrap()
+            .description = "unrequested".into();
+        assert!(!equal(&expected, &changed));
+        let mut changed_source = expected.bundle.clone();
+        changed_source
+            .files
+            .get_mut("notes.arcadia")
+            .unwrap()
+            .push_str("// drift\n");
+        let changed = compile_bundle(&changed_source, ProjectLimits::default()).unwrap();
+        assert_eq!(changed.decoded.project, expected.decoded.project);
+        assert!(!equal(&expected, &changed));
+        let committed_disk = predicted_disk(&expected.bundle, None);
+        let undo_disk = predicted_disk(&previous.bundle, Some(&committed_disk));
+        assert!(undo_disk.len() >= previous.bundle.files.len());
+        let mut unknown = undo_disk.clone();
+        unknown.insert("unknown.arcadia".into(), b"// unknown".to_vec());
+        assert_ne!(unknown, undo_disk);
+        let detached: Vec<_> = undo_disk
+            .keys()
+            .filter(|p| !previous.bundle.files.contains_key(*p))
+            .cloned()
+            .collect();
+        assert!(
+            !detached.is_empty(),
+            "Each selected source operation should add a module"
+        );
+        let mut changed = undo_disk.clone();
+        changed.get_mut(&detached[0]).unwrap().push(b' ');
+        assert_ne!(changed, undo_disk);
+        let mut missing = undo_disk.clone();
+        missing.remove(&detached[0]);
+        assert_ne!(missing, undo_disk);
+        println!(
+            "PASS {stage:?}: complete model/source fixed point, false-carrier metadata ignored, repeated-command refusal, one Undo/Redo, comment drift and explicit retained-file falsifiers; {} reachable files",
+            expected.bundle.files.len()
+        );
+        previous = expected;
+    }
+    let expected = predict(base, Stage::Machine, &[&carrier; 3]);
+    let mut wrong = expected.clone();
+    wrong
+        .decoded
+        .project
+        .elements
+        .get_mut(&test_id(2))
+        .unwrap()
+        .body = ElementBody::shared_in(Layer::Oa, SharedBody::Lifeline { represented: None });
+    assert!(!equal(&expected, &wrong));
+    let mut wrong = expected.clone();
+    wrong
+        .decoded
+        .project
+        .elements
+        .get_mut(&test_id(6))
+        .unwrap()
+        .parent = None;
+    assert!(!equal(&expected, &wrong));
+    let mut wrong = expected.clone();
+    wrong
+        .decoded
+        .project
+        .diagrams
+        .get_mut(&test_id(7))
+        .unwrap()
+        .nodes
+        .get_mut(&test_id(8))
+        .unwrap()
+        .position
+        .x += 1.;
+    assert!(!equal(&expected, &wrong));
+    println!(
+        "PASS wrong source binding, machine owner and view geometry rejected; no native acceptance claimed"
+    );
+    let mut changed_prior_role = carrier.clone();
+    let mut changed_activity = changed_prior_role.elements.remove(&test_id(1)).unwrap();
+    changed_activity.id = test_id(91);
+    changed_prior_role
+        .elements
+        .insert(test_id(91), changed_activity);
+    let pinned = predict(base, Stage::Chain, &[&carrier, &changed_prior_role]);
+    assert_equal(&pinned, &predict(base, Stage::Chain, &[&carrier; 3]));
+    assert!(!equal(
+        &pinned,
+        &predict(base, Stage::Chain, &[&changed_prior_role; 3])
+    ));
+    println!("PASS earlier-stage role identities remain pinned independently of a later carrier");
+}
+fn main() {
+    assert_eq!(SCHEMA_VERSION, 7);
+    let args: Vec<_> = std::env::args().collect();
+    match args.get(1).map(String::as_str) {
+        Some("self-check") => {
+            assert_eq!(args.len(), 3);
+            self_check(&baseline(Path::new(&args[2])));
+        }
+        Some("check") => {
+            assert!(
+                args.len() >= 5,
+                "check STAGE BASE ACTUAL [FIRST_LIFELINE [FIRST_CHAIN [FIRST_MACHINE]]]"
+            );
+            let stage = Stage::parse(&args[2]);
+            let stages: Vec<_> = [Stage::Lifeline, Stage::Chain, Stage::Machine]
+                .into_iter()
+                .filter(|s| *s <= stage)
+                .collect();
+            assert_eq!(
+                args.len(),
+                5 + stages.len(),
+                "Supply every stage's original first-commit role carrier separately"
+            );
+            let base = baseline(Path::new(&args[3]));
+            let actual = load(Path::new(&args[4]));
+            let carriers: Vec<_> = args[5..].iter().map(|path| load(Path::new(path))).collect();
+            let projects: Vec<_> = carriers.iter().map(|c| &c.decoded.project).collect();
+            for (index, carrier_stage) in stages.into_iter().enumerate() {
+                assert_equal(&predict(&base, carrier_stage, &projects), &carriers[index]);
+            }
+            let expected = predict(&base, stage, &projects);
+            assert_equal(&expected, &actual);
+            println!(
+                "PASS {stage:?}: complete Project + {} exact source/disk files, original role UUIDs",
+                actual.bundle.files.len()
+            );
+        }
+        Some("same") => {
+            assert!(
+                matches!(args.len(), 4 | 5),
+                "same EXPECTED ACTUAL [UNDO_FROM]"
+            );
+            let expected = load(Path::new(&args[2]));
+            let (actual, disk) = load_checkpoint(Path::new(&args[3]));
+            assert_equal(&expected, &actual);
+            let origin = args
+                .get(4)
+                .map(|path| predicted_disk(&load(Path::new(path)).bundle, None));
+            assert_eq!(
+                disk,
+                predicted_disk(&expected.bundle, origin.as_ref()),
+                "Only exact first-commit retained files are permitted after Undo"
+            );
+            println!(
+                "PASS exact model/identity/{} reachable sources; {} exact disk files ({} proven retained)",
+                actual.bundle.files.len(),
+                disk.len(),
+                disk.len() - actual.bundle.files.len()
+            );
+        }
+        _ => panic!(
+            "self-check BASE | check STAGE BASE ACTUAL [FIRST_LIFELINE [FIRST_CHAIN [FIRST_MACHINE]]] | same EXPECTED ACTUAL [UNDO_FROM]"
+        ),
+    }
+}
				`@@ -0,0 +1 @@`
				`// Preserve this independent engineering note: secours 雨 Δ.`