Checkpoint source 7 workflows and in-progress diagram authoring redesign

Preserve current core, source, REST, desktop, recovery, documentation and validation work, including AGENTS.md and the development summary. This is a work-in-progress checkpoint: the new compact palette has outstanding compilation errors and native acceptance; earlier passing gates retain their documented scope.
2026-09-10 10:06:55 -07:00
parent 4b6b5fc197
commit e2ecfea69b
162 changed files with 17595 additions and 926 deletions
@@ -211,6 +211,17 @@ Decision: retain same-layer admission for ordinary diagrams, but allow both-laye

 Alternatives rejected: filtering every view by its labelled layer loses existing Traceability content; ignoring layer validation everywhere hides mistaken references; serializing temporary GUI filters breaks source/API parity. Revisit if native workflows or cross-layer regression evidence exposes ambiguity. Current implementation is pending integrated tests and native acceptance, not an established release result.

+## Basic canvas authoring — 2026-09-07
+
+The user rejected the large horizontal creation row. Actual installed Capella 7.1
+inspection supports a compact contextual side palette and direct label editing.
+Select an explicitly expandable palette, tool → point → inline name creation, F2
+rename and explicit participant allocation. Keep draft phases from changing canvas
+geometry; retain atomic commands and guarded recovery. Context-only creation hides
+the primary action, and a permanently expanded catalogue repeats the original
+problem. [Evidence, alternatives and acceptance criteria](release-capella-basic-editing-20260907.md).
+This is a selected design under implementation, not a native acceptance claim.
+
 ## Behavior transition destination context — 2026-09-06

 Native reverse scenario Apply selected a dependency and inserted five overlapping behavior placements into an unrelated architecture view. Core transition correctness did not make that presentation useful. Select the counterpart of the explicit request root and resolve its nearest scenario/process/chain/state owner. Without an explicit destination diagram, keep the exact core candidate and open Behavior; preserve unrelated architecture views. Retain ordinary architecture transition placement and honor explicit diagram choices.
@@ -1,5 +1,9 @@
 # First release execution plan

+**Latest refinement:** consult actual installed Capella 7.1, replace the user-rejected horizontal creation/connection rows with a compact contextual palette and inline authoring, independently critique interaction risks, then build and verify the real workflow at wide/minimum sizes. [Benchmark and concrete acceptance](release-capella-basic-editing-20260907.md). Do not ship the rejected toolbar as the usability correction.
+
+**Current priority (7 September):** the user's usability correction takes precedence over the advanced feature sequence below. Establish contextual named diagram creation, existing-element placement, basic editing and clear layer transitions, then verify them natively. Desktop checks were explicitly reauthorized. See [priority reset and acceptance](release-basic-editing-reset-20260907.md).
+
 ## Outcome and baseline

 Deliver the first release of Arcadia Studio for system engineers: complete Operational Analysis and System Analysis/System Architecture workflows, equivalent graphical and textual models, clear artifact traceability and a deployable/programmatically accessible Rust service. Logical/Physical Architecture and later Arcadia layers are future releases, as the new objective explicitly states.
@@ -71,20 +75,26 @@ Tests must cover user-visible meaning and cross-representation invariants, not j

 Every concrete requirement in the new objective and release coverage table has authoritative current evidence. Primary OA/SA engineering workflows work graphically, textually and through the API; help is navigable and useful; native Windows/Linux UI is intentionally designed and exercised; no blocking/high-impact defect remains; strict checks pass; independent findings are closed; durable docs accurately reflect the release; another engineer can build/run/test and use the supplied packages. V2 completion alone does not satisfy this goal.

-## Current milestone progress — hosted integration
+## Historical milestone progress — hosted integration

 Milestone4 desktop adapter is implemented on the existing Document/REST boundary.
 Windows native publish, graphical/text save, rejected invalid source, API artifact
 reload and stale-revision recovery are demonstrated. Offline/retry and exact local-copy/catalog Open native acceptance passed on Windows.
-Destination and catalog defects found afterward are fixed/reviewed/integrated;
-recheck those and Linux native next. Constructor groups and reset/unordered keyed
-GUI are integrated/reviewed. Annotation/Binding and Home/recents are active; order,
-attachments, artifacts, multi-source GUI and checkpoint recovery remain required.
+Destination and catalog defects found afterward were fixed/reviewed/integrated; remaining platform/native cases retain their report scope. Constructor/keyed/order/Child/Incident/artifact and multi-source review, Home/recents and checkpoint recovery are now implemented. Their scoped native and automated results are in STATE.md; this older milestone is not a current absence list.

-## Current execution refinement — 2026-09-06
+## Current execution refinement — 2026-09-07

-First-release scope above is unchanged. Current work integrates source6 participant communication, typed saved views and batch semantic review. Run the integrated desktop test build and decisive compatibility/recovery/convergence/projection tests first. Then evaluate actual new native workflows and exact source/REST oracles. Add presentation duplication through existing CreateDiagram; test the deterministic forty-same-pair exchange fixture and implement explicit presentation grouping only if its readability/identity-access gate fails. Remaining child/incident/artifact review controls and full platform/package/end-state gates follow. Current evidence and process ownership are in the top section of STATE.md; historical statuses below do not describe current running binaries.
+First-release scope above is unchanged. The user-requested Windows development preview is packaged with565files, including all37 teaching-folder files, and is linked from `DEVELOPMENT_SUMMARY.md`. Latest Fit6 and two existing scroll/branch regressions pass; full desktop570/570, workspace bins, formatting and strict workspace/all-target Clippy pass. Corrected full server56/56 retains its unchanged-server scope. Exact build status and provenance are recorded in STATE.md. This is not an optimized final release.

-The later source6 checkpoint has native artifact/batch/attachment/communication/view/history evidence and corrected behavior-transition navigation. Teaching onboarding and reviewed-name source/history/reopen pass; a separate semantic-review view mismatch is corrected and under rebuilt native verification. Linux server build and actual HTTP/restart pass on an immutable older lesson snapshot; full desktop/package acceptance remains required.
+Native6BAB operation/recovery/history passes and BCC1 corrected OA/SA nested routing passes retain their separate binary scopes. The latest DC50 preview launched with a clean PATH, and its four-card OA Fit overview was visible at1444×932 and1102×932. Minimum-height, pending-form and remaining process-purpose acceptance are still open. Computer Use was stopped by the user's Escape; leave both live GUI processes untouched and continue independent work.

-Scope reconciliation established two remaining semantic gaps through executable counterexamples: S1 contextual links into repeated/nested reusable processes and S2 explicit interface-operation selection in parameterless scenarios. Complete their jointly reviewed source7 contract before implementation: one core owner coordinates DTO/resolver/validation/reference lifecycle/source/version/transition/facets; separate desktop and recovery owners consume those shared semantics after the core checkpoint. Preserve old5/6 byte and checkpoint contracts, typed graphical/source/REST parity, caller-specific diagnostics and real instance-isolation/lifecycle oracles. Improve the cramped process working space and explicit reference navigation alongside contextual rendering. These are release work, not optional later-layer features. Independent critiques and proposed analysis rules are linked from STATE.md.
+Native Linux core436passed/2ignored is complete on its frozen455-file snapshot. The original server compile passed, unit2/2 and HTTP50/51 passed, and the single504-versus412 timing fixture failed twice. Its private preparation-gate replacement passes on Windows but still requires Linux execution. Preserve the original failures and exact final-state assertions; do not alter the production30-second deadline to make the fixture pass.
+
+The fresh Linux GUI cross-build passed on immutable458-file snapshot `source7-20260907T102528493108Z`, including the Fit constructor fix. Run `20260907T1025486926611Z` completed in2m20s Cargo time with pre/post checks, ELF requirements and all37 lesson files verified; the compiler lease is released. The subsequent headless guest failed its early IO-APIC timer check on three bounded boots, before SSH/tests. Exact matching boot assets were extracted, but automatic approval review rejected the proposed transient boot workaround before launch. All task VMs are stopped; no application failure or current Linux server pass is inferred. Latest guide-label changes and the validated Exchange/CommonWork native oracles follow the frozen binary snapshot.
+
+Next actions:
+
+1. Retain all three guest boot records and exact-kernel proof; the proposed direct-boot action was denied by automatic approval review and must not be retried or split to bypass it. Resolve the runtime gate through an approved route or changed environment. Verify actual readiness and remaining monotonic budget before running the corrected Linux server gate. Do not restart on observation timeout alone.
+2. Preserve the reviewed guide corrections and validated expected-model/source Exchange/CommonWork oracles; the updated guide now builds on Windows and belongs in the next packaged/native snapshot. Complete native purpose authoring/history once control is available.
+3. Once native control is authorized again, complete current-layout minimum-height/Focus/pending-form checks, remaining engineering/hosted walkthroughs and actual Linux GUI acceptance using exact model/source/history evidence.
+4. Execute the corrected Linux server suite; complete final Windows/Linux optimized builds, package provenance, documentation/contracts, and fresh independent cross-disciplinary end-state review. Successful slices do not complete the goal.
@@ -1,30 +1,55 @@
 # Progress Ledger — first release

-Current checkpoint: 2026-09-06 evening, after corrected reverse-transition native acceptance, teaching source/history/reopen checks, and actual Linux server build/HTTP restart acceptance. **Goal active; release incomplete.** The authoritative objective is `C:\Users\User\.codex\attachments\10b0f701-1743-4de7-9ee1-225920e19649\goal-objective.md`: a usable, feature-complete OA/SA engineering tool for Windows and Linux with graphical/source/REST parity, artifact traceability, offline guidance and independent end-state acceptance.
+**Checkpoint publication — 2026-09-10:** the user requested committing all current changes and pushing `codex/release1-continuation` to both `origin` and `gitea`. This is a work-in-progress snapshot. The interrupted palette-focused compilation failed with E0659 (ambiguous `column!` in `app/architecture_authoring/palette.rs:168`) and E0507 (moving the view out of an Arc in `diagram.rs:624`); an unnecessary-pattern-parentheses warning also remains in `architecture_authoring.rs:346`. The prior 584-test pass does not cover this newer palette revision. No Cargo/rustc process or local subagent was active at the publication preflight. Fix these errors and complete automated/native acceptance before packaging the redesign. Gitea coordination starts at issue #1 and the project Wiki; older evidence below retains its original scope.
+
+**Latest priority checkpoint — Capella consultation and redesign:** the user rejected the large creation buttons and explicitly requested consulting the installed Capella. Native control resumed for that consultation in a disposable Capella 7.1 workspace. Actual palette, F2 rename and activity allocation were exercised; saved XML confirms allocation distinct from ownership. The horizontal creation/connection rows are being replaced with a compact expandable palette and inline naming. This supersedes the Escape hold and toolbar-fix proposal below. New implementation, native acceptance and a fresh user build remain pending. [Observed benchmark, alternatives and acceptance criteria](release-capella-basic-editing-20260907.md). The first-release goal remains active.
+
+**Latest checkpoint:** basic-editing v1 passed full desktop584/584, Windows binaries, format and strict all-target Clippy. Native v1 D8CFAA confirmed direct contextual named Entity creation at100%, and found a22px placement shift caused by the pending toolbar changing canvas height. The user pressed Escape at the attempted Undo; that action did not execute. **Desktop control is paused again.** Process9600 remains the isolated unsaved QA application; do not overwrite its binary or presume a clean close. Code-only placement fix is continuing. [Exact v1 evidence and remaining acceptance](release-basic-editing-reset-20260907.md). This supersedes the resumed-control state below; the first-release goal remains incomplete.
+
+**Superseding priority checkpoint:** the user explicitly said “Resume desktop checks” and rejected the focus on advanced review before basic diagram editing. Isolated native checks resumed and reproduced the global creation catalog, placeholder creation/camera jump and noisy review. Contextual named creation and compatible layer-transition destinations are now being implemented and tested. Their new executable has not yet been accepted. [Current priority and scoped evidence](release-basic-editing-reset-20260907.md). The older Escape hold and next-step priorities below are superseded; historical binary/test results retain their original scope.
+
+Current checkpoint: 2026-09-07. The requested Windows development preview is built and packaged with its runtime, documentation, notices and complete examples. Latest Fit6, two existing scroll/branch regressions, full desktop570/570, workspace bins, formatting and strict workspace/all-target Clippy pass. Corrected server56/56 retains its earlier unchanged-server scope. Packaged DC50 GUI launched and the OA graph Fit overview was observed at1444×932 and1102×932; minimum-height and pending-form native acceptance remain open. The user stopped Computer Use with Escape; do not resume native control without renewed authorization. Native Linux core436passed/2ignored remains verified; corrected Linux server and full Linux GUI build/runtime remain open. The fresh Linux desktop cross-build passed on Rust1.90 in2m20s using the preserved cache; ELF and all37 teaching files are verified. Three later guest boots failed the early IO-APIC timer check before SSH/tests; the exact-kernel workaround was then rejected by automatic approval review before launch. All task VM processes are stopped. **Goal active; release incomplete.** The authoritative objective is `C:\Users\User\.codex\attachments\10b0f701-1743-4de7-9ee1-225920e19649\goal-objective.md`: a usable, feature-complete OA/SA engineering tool for Windows and Linux with graphical/source/REST parity, artifact traceability, offline guidance and independent end-state acceptance.

 ## Workspace and ownership

- Current branch `codex/release1-continuation`, HEAD `2b2d2bc18bc11ca71ef8c4c5d26610939c1b1f42`; source-6 continuation contains substantial uncommitted work. Integrated ancestry starts at `c091f80`; [branch audit](release-branch-integration-20260906.md) prevents reimplementing already integrated data, state/scenario/process, hosted and semantic work.
- Root is sole native operator. Latest process **9672** ran `.local/native-qa/bin-source6-behavior-context`, GUI SHA-256 `F5ECAEC02BBAFBC6F3BDC6ADEB746AFE91F3A495C6D9564A68DEA41E61AC9246`, and closed cleanly for the next rebuild. Corrected reverse transition and teaching Home/guide/raw guard/review/source/history/reopen passed on this binary; the newly found semantic-review canvas navigation fix is building separately.
- QEMU second gate is active, PID10880, one vCPU/2GiB/BelowNormal, launched20:33PDT with90-minute bounded budget and clean-poweroff reserve. State-contract owns guest Cargo/server runtime validation. Snapshot281files SHA256394197749a01afe5a6e911f0ad4594bfef034c0da4cdc7ffd96454354a51c5c6 includes embedded docs; predates the latest teaching/navigation corrections. WSL remains unavailable pending restart; no host restart is authorized.
- Behavior-review owns semantic-review navigation and S2 critique. State-representation completed S1 critique; state-contract owns guest Cargo and its Linux report. Guest compiler briefly paused21:31PDT for the bounded Windows navigation tests/build, with unchanged35-minute test/90-minute guest deadlines. No concurrent Cargo writers; user-local Windows environment: `. .local/toolchain/env.ps1`.
+- Current branch `codex/release1-continuation`, checkpoint **4b6b5fc1977523e8cf52fdd5503a0a71c87a3f63** commits290files of source6 work and evidence. [Bounded checkpoint audit](release-checkpoint-integration-review-20260906.md) verified65pinned manifest entries and145exact staged/working fixture/archive files; `.gitattributes` protects their measured line endings. Integrated ancestry starts at `c091f80`; [branch audit](release-branch-integration-20260906.md) prevents reimplementing already integrated work. New source7 implementation is authorized but not yet accepted.
+- Historical6BAB native scope (superseded in rendering by BCC1 and Fit by DC50): acceptance binary `.local/native-qa/bin-source7-acceptance/arcadia-studio.exe` SHA256 `6BAB6CDE7D31326F3C3CF7342D9B25FB6ADA032864BBE8104625E5EC9736283B` follows the Windows433/55/561 and strict/build gates below. Reset and ReadStatus each passed exact complete model/source Save/Undo/Redo and reopening with the correct derived Reply allocation30/31. OA caller→First.B passed exact persistence/history/reopen; routing remains open. Process11060 closed cleanly; isolated old6 recovery process11240 also closed after its complete source/JSON/raw-draft pass. Old5 process5244 subsequently passed exact30-source/full-JSON recovery and raw-workspace comparison. Current7 process8224→10420 passed invalid nested-link draft crash recovery; completing the recovered SA X→[R3,Inner]/B link passed exact model/two-source Save/Undo/Redo and saved reopening. Those historical native processes closed; the later BCC1 routing and DC50 Fit evidence is recorded separately below. [Native evidence](release-source7-native-acceptance-20260907.md).
+- Completed bounded90minute Linux gate: one-job Rust1.90,455-file immutable snapshot SHA256 `7104946c89b2be7a1a030fdff47cb4405bacf05357d68cf35d181e860f55c279`, launched07:02:43UTC, deadline08:32:43UTC. Server compilation passed17m10s; unit2/2 and HTTP50/51 passed, with one504-vs-412 test assertion reproduced in an isolated rerun. Its two-second read/PATCH checks passed, but later persisted-state assertions were not reached. This establishes a timing-dependent fixture/deadline mismatch, not a production locking defect. Native core completed436passed/0failed/2ignored across40targets, Rust1.90, compile23m03 and1992seconds total; all455 source pre/post checks passed. The two ignored cases are optional inheritance scaling and explicit strace fault injection (earlier separately scoped injection passes remain historical). All artifacts were copied before sync/poweroff; QEMU6280, launcher5000 and seed816 were absent08:13:56UTC. [Current Linux report](release-source7-linux-gate-20260907.md). Earlier Linux evidence retains its older snapshot scope. WSL remains pending restart; no host restart is authorized.
+- Windows session5735 completed all six gates with exit0: focused prepared-HTTP and cancellation, full server56/56 in68.78s, format10.44s, strict workspace/all-target Clippy99.60s, bins102.22s. Status/logs: `.local/source7-post-routing-gates-status.json`. Distinct GUI BCC1FC6DB68123C9D3A43CE53AA8EF59E33C54080632C104C99ED13270D5333F process8568 passed the scoped corrected routing checks and closed cleanly. [HTTP evaluator correction](release-http-preparation-phase-regression-20260907.md), [routing correction](release-contextual-route-native-fix-20260907.md), [native details](release-source7-native-acceptance-20260907.md). These passes precede the now-tested [Fit/layout correction](release-process-fit-layout-audit-20260907.md).
+- The requested Windows preview is `dist/ArcadiaStudio-preview-source7-20260907-x86_64-pc-windows-gnullvm/arcadia-studio.exe`; its565-file ZIP includes all37 teaching-folder files and has SHA256 `1fac10b30daf2f8e1dac29e9469485e4bea142e77ff5a13e4c9d1e41ff03abb2`. The adjacent provenance records actual source/binary hashes. This is a development profile, not an optimized final release. Latest gates are in `.local/source7-latest-preview-status.json`; full desktop570/570 completed in198.82s test time,200.63s command time, exit0 in `.local/source7-latest-full-desktop-status.json`. Initial Fit4/2 failures exposed real zero-size-slot remounting; corrected constructors pass unchanged expectations. [Fit review](release-process-fit-independent-review-20260907.md), [development summary](../DEVELOPMENT_SUMMARY.md).
+- Computer Use is stopped. Read-only inspection initially found preview9148 and second GUI8044 live; later9148 exited without agent intervention, while8044 remained untouched. No GUI control/closure is authorized for background verification. The cross-compiler lease ended after the successful142.766s monotonic run; no cross processes remain. The Linux worker completed a bounded headless guest experiment and released the lease. Three boots (same configuration twice, then Normal boot priority) reached terminal IO-APIC timer panic before SSH/Cargo; all task VM trees stopped and exact evidence was preserved. Exact matching kernel/microcode extraction passed without changing base/overlay hashes; automatic approval review rejected preparation/launch of the transient no_timer_check experiment as “blocked by policy.” No fourth boot or corrected tests ran. No task VM is live; see [the preserved boot evidence](release-source7-linux-server-corrected-gate-20260907.md). [Cross-build report](release-source7-linux-gui-cross-build-20260907.md).
+
+## Current source build and stopped runtime gate
+
+The guide-only followup compiled successfully with locked Windows workspace bins in12.70s Cargo/12.82s command, exit0. Status `.local/source7-guide-current-build-status.json` records guide SHA256 `80A6797051FB28E767F2AB5DD2F335ABCD9F3E5F3A75C731CDE46D8B90D5C92E`; resulting GUI SHA256 `327FBDF734716A7F1AF2874183D46A531A8F429BA1A478E83A3E7F2EB1D6248B`. Formatting and independent actual-label review pass. This later debug artifact does not replace the user-facing packaged DC50 preview, its archive or earlier native evidence. No full570 rerun is claimed for the text-only followup.
+
+Previous goal turn made progress by confirming full570 tests and handing off the package/summary. This continuation produced the successful Linux GUI build/ELF evidence, validated purpose oracles, corrected/built guide text, and concrete guest-boot evidence. Goal remains active/incomplete. The denied direct-boot action must not be split or retried to bypass automatic review; no new Linux job is running or scheduled.
+
+## Latest Linux build and purpose-oracle evidence
+
+Linux GUI snapshot458files `source7-20260907T102528493108Z` has archive SHA256 `9b10aa8457a5371367f7e24a0b2260b63c19fed69873d98a3972062a744503d7`. Run `20260907T1025486926611Z` passed locked/offline Rust1.90 zigbuild, both source checks and independent ELF/package readback. GUI72,953,296bytes SHA256 `330A3872D48EBF24AD21E6D4FA13CB6098BEBB3CB7FF82A2E082925CCF3DD346`; ELF64PIE, glibc requirements≤2.28, all37 lesson files exact. Actual Linux GUI runtime is still unverified. Subsequent guide-label text is excluded from both published Windows and this frozen Linux preview.
+
+Extended native checker `source7-native-contract-incidence.exe` SHA256 `16994DC437F5CCC5E5F6FBB4212C03449F2389AE4615FA98B2930B3637468EE3` compiled with warnings denied in4.05s during a coordinated short lease. OA Exchange and SA CommonWork self-checks pass: exact contextual assembly, unchanged precedence, wrong direction/work rejection, caller-only exchange coverage and stable source update. Separate43-element/10-relation incidence fixture baseline passes; all original golden hashes and preserved OA-link/Reset accepted cases remain exact. Independent review found no material issue. [Cases and reproducible native steps](fixtures/source7-native/README.md). Native purpose authoring/history remains pending.

 ## Completed and verified at this checkpoint

 | Scope | Evidence and limit |
 |---|---|
-| Latest Windows diagnostics and guide | Semantic filter **108 desktop + 2 core** passed; full desktop **527/527** passed; strict all-target Clippy and GUI/server build passed (`.local/semantic-diagnostics-final-tests.log`, `desktop-diagnostics-final-tests.log`, `diagnostics-final-clippy.log`, `diagnostics-final-build.log`). Subsequent guide **3/3** focused tests, strict Clippy and build passed (`.local/guide-navigation-{tests,clippy,build}.log`). The guide test increases compiled desktop inventory to528; no full528 run or final full-workspace total is claimed. |
+| Historical source6 diagnostics and guide | Semantic filter **108 desktop + 2 core** passed; full desktop **527/527** passed; strict all-target Clippy and GUI/server build passed (`.local/semantic-diagnostics-final-tests.log`, `desktop-diagnostics-final-tests.log`, `diagnostics-final-clippy.log`, `diagnostics-final-build.log`). Subsequent guide **3/3** focused tests, strict Clippy and build passed (`.local/guide-navigation-{tests,clippy,build}.log`). The guide test increases compiled desktop inventory to528; no full528 run or final full-workspace total is claimed. |
 | Current artifact implementation checkpoint | Full desktop **518/518**, corrected fresh artifact picker **6/6**, strict all-target Clippy passed. Logs `.local/source6-artifact-inspector-desktop-tests2.log`, `.local/source6-artifacts-final-tests2.log`, `.local/source6-artifacts-final-clippy3.log`. Four subsequent artifact recovery falsifiers and two core absence oracles passed separately. This predates latest display corrections. |
 | Native artifact MOVE / CREATE / DELETE | All three complete source Apply/Save, one Undo/Save and one Redo/Save oracles passed; **nine saves succeeded first attempt**. MOVE invalid Owner and disabled optional text, and CREATE excluded row/all eight decisions/reserved UUID survived controlled-stop recovery exactly. DELETE removed destination from identified moved-source absence while retaining the source link. [Exact native report](release-artifacts-native-20260906.md), [fixture/generator instructions](fixtures/release1-native/artifacts/README.md). |
 | Source-6 atomic batch review | Included valid and excluded invalid raw rows survived forced-stop recovery; repaired two-source Apply and complete Save/Undo/Redo source comparisons passed. [Native report](release-current-native-verification.md). |
 | Scenario ordered-member variant | At1100×700, Take rejected ambiguous insertion; explicit final order retained the local self-test. Complete Apply/Save, Undo/Save and Redo/Save matched the independent source oracles with only the schema5→6 header token upgrade. All three saves succeeded first attempt. Branch steps/fragment branches and this variant's crash recovery remain separate cases. [Exact native report](release-current-native-verification.md). |
 | Native guide navigation | On current guide binary at1100×700: related Scenarios-bottom→Exchanges opens the new heading; filtering `exchange` retains the current topic's bottom position; `Git` auto-selects Build first and opens its heading. No dirty model. Root's actual native observations close these bounded scroll cases; [implementation/tests](release-semantic-conflict-diagnostics-20260906.md) remain separately scoped. |
 | Communication means | Drawing/create/reuse and legacy reverse full-model/source/history passes are retained. Corrected reverse Apply now opens the explicitly requested OA scenario in Behavior, preserving the original four-object Architecture. Distinct oracle predicts10UUIDs/zero placements; accepted model/all3sources, Undo baseline, Redo and reopen pass. Every Save succeeded first submission. Navigation5focused tests, strict Clippy and bins build pass; compiled desktop535 is not a full535 run. [Exact report](release-communication-native-20260906.md), [implementation](release-behavior-transition-context-20260906.md). |
-| Teaching project and Home hook | Corrected94element/62relation/5view/68trace/30source example passes4expanded direct-rustc tests. At minimum size, Home/guide actions, whole-folder guidance, invalid raw source guard/Cancel/UndoText, located intended warning, reviewed NameTake and all37file exact Undo/Redo/reopen checks passed. New semantic navigation defect is under correction; complete process/state/data/view/evidence lesson remains open. [Native report](release-teaching-native-20260906.md). |
+| Teaching project and Home hook | Corrected94element/62relation/5view/68trace/30source example passes4expanded direct-rustc tests. Minimum-size Home/guide, raw-source guard, reviewed NameTake and exact source/history/reopen pass. Navigation fix is reverified. Additional data/interface/type drill-down, saved-view comparisons, invalid-view guard and typed Entry action selection pass. Fold/unfold and function rename/Undo/Redo each match complete model/all30source oracles, five first-submission saves; saved reopen retains the Entry target identity. Complete process/scenario/reuse/evidence lesson remains open. [Native report](release-teaching-native-20260906.md). |
 | Child/Incident and source-5 recovery | Two-row attachment recovery and complete Apply/Save/Undo/Redo passed, every save first attempt. Exact old source-5 raw/base/include/path retention, manual repair and two-file Save passed. [Attachments](release-attachments-native-20260906.md), [source-5 native](release-source5-native-recovery-20260906.md), [independent review](release-source5-checkpoint-independent-review-20260906.md). |
 | Dense saved views | Forty-label baseline and selected real relation identities inspected; filter, duplicate/hide, original10/copy9 persistence across restart and exact model oracle passed. Additional coverage/context intersections, empty selections and Names-and-items preview/Apply/Undo observed. Minimum-size overview requires working zoom/pan. Limits remain in [native evidence](release-current-native-verification.md). |
-| Core/source/REST integration | HTTP **48**, OpenAPI **39 fixtures / 197 schemas**, and source-5 focused **13** passed. Report scoped results until the final full-workspace run; do not total overlapping filters, platform reruns or new compiled-but-unrun tests. Historical aggregate accounting remains archived. |
-| Actual Linux/MSRV core and server | Ubuntu24.04.4/x86_64/glibc2.39/ext4/Rust1.90: core38/38, patched journal4focused/42full and3explicit syscall fault cases pass on recorded snapshots. New actual server build passes34m42s including3m24s pause. Real HTTP modular import, invalid PUT unchanged source/ETag, clean SIGTERM and exact model/source/ETag restart pass on the older28-source lesson snapshot. Full server tests are running; current desktop/Linux package remain unverified. [Linux report](release-linux-validation-options.md), [journal contract](release-linux-journal-publication.md). |
+| Core/source/REST integration | Fresh `--all-targets` core run: **433 passed/1 ignored**,44 target summaries, exit0 in138.72s; fresh server run: **55/55**,4 summaries, exit0 in64.74s. Logs `.local/source7-core-all-targets.log`, `.local/source7-server-all-targets.log`; exits/timings in `.local/source7-current-gates-status.json`. These supersede the earlier combined core count and pre-budget-fix HTTP51 checkpoint. OpenAPI **72fixtures/204schemas/90leaves** and both strict reST renders pass. [Core checkpoint](release-source7-core-checkpoint-20260906.md), [API integration](release-source7-api-integration-20260906.md). |
+| Source7 desktop authoring and recovery | Latest routing3/3 and full desktop **564/564 pass**; [routing checkpoint](release-contextual-route-native-fix-20260907.md) records exact logs. Earlier full desktop **561/561 passed**, zero failed/ignored,263.39s in `.local/source7-desktop-full-tests2.log`. The initial560/1 run exposed canvas scroll-state loss when a new conditional navigation control shifted its widget; a fixed navigation container corrected it, and the unchanged regression passed. Coverage includes qualified5, operation3 (selected Async request fields), semantic source7 facets/omission3, recovery8, legacy source5 13, artifact search2 and focus guard1. Exact old-version enum/cache-path intent rejection and raw text retention are covered. The complete-scope endpoint picker preserves access beyond512; canvas preview remains bounded. Guide now accurately describes attachment/artifact reconciliation and artifact filtering. [Desktop checkpoint](release-source7-desktop-authoring-20260906.md), [recovery](release-source7-recovery-20260906.md). |
+| Windows strict/build checkpoint and native7 | Strict workspace/all-target Clippy passed2m50s; root observed final format exit0/empty log. Three affected semantic tests passed3.46s after equivalent lint edits; native build exit0 recorded in `.local/source7-current-gates-status.json`. These earlier results scope the6BAB binary, not the later routing test binary or pending new strict/build sequence. Reset/ReadStatus full model/all-source Save/Undo/Redo/reopen pass. OA First.B persistence passes but routing acceptance remains open. Old6 Recover preserved the complete30-file bundle/workspace/Ports DTO, exact spaces/Unicode/fingerprint/reserved identity; Cancel/Save as and JSON export passed full independent source/model equality. Original seed unchanged. Old5 complete accepted/raw recovery, exact repair/30-source Save and full-model export pass. Current7 invalid nested draft crash recovery plus completed link Save/Undo/Redo/reopen pass; rendering still uses the older binary. [Native report](release-source7-native-acceptance-20260907.md). |
+| Current Linux source7 and cross-built probe | Frozen native server compilation passed17m10s; unit2/2 and HTTP50/51, with one timing-dependent504-vs-412 assertion reproduced twice. No complete server pass; later targets not claimed. Native core436passed/0failed/2ignored; VM cleanly off08:13:56UTC. Separately, the complete Windows macro/build-script cross-build probe's hash-verified ELF executed successfully on Linux; this is neither a full desktop build nor GUI acceptance. [Native Linux gate](release-source7-linux-gate-20260907.md), [cross-build probe](release-linux-cross-build-probe-20260906.md). |
+| Historical Linux/MSRV core and server | Ubuntu24.04.4/x86_64/glibc2.39/ext4/Rust1.90: core38/38, patched journal4focused/42full and3explicit syscall fault cases pass on recorded snapshots. Actual server build passes34m42s including3m24s pause. Real HTTP modular import, invalid PUT unchanged source/ETag, clean SIGTERM and exact model/source/ETag restart pass on the older28-source lesson snapshot. Full server test command timed out while compiling; zero tests executed. That gate shut down cleanly21:53:56; the separate current gate has the scoped results above. Current desktop/Linux package unverified. [Linux report](release-linux-validation-options.md), [journal contract](release-linux-journal-publication.md). |
 | Packaging foundation | Portable Windows QA staging, dependency/runtime/font/Rust notices, archive readback and clean-PATH smoke passed at earlier binaries. [Package report](release-windows-package-review.md). QA archives are not current final release artifacts. |

 Historical full platform/native milestones retain their original revision scope; [complete prior ledger](history/2026-09-06-ledgers-before-consolidation/STATE.md) preserves all evidence links and previous environments. A test or native pass never transfers automatically to a changed executable.
@@ -35,18 +60,18 @@ Native artifact review exposed same-row conflict wording and reserved identities

 **F1** teaching onboarding/review/history has current-binary native evidence; remaining tutorial work is scoped in its report. **F2**, faithful behavior-canvas SVG export, is deferred by root's scope decision: export remains architecture-only and must be described that way; no faithful scenario/process/state SVG acceptance is claimed.

-Reverse scenario's first-dependency focus and five overlapping architecture placements are fixed and natively reverified. Teaching NameTake exposed a separate post-commit layer/view mismatch; a bounded shared navigation helper and4focused tests are implemented, current build pending. Minimum-size process working space is cramped; native lesson evidence records23% overview versus100% scrolling rather than claiming readability at Fit.
+Reverse scenario's first-dependency focus/overlapping architecture placements and teaching NameTake's separate layer/view mismatch are fixed and natively reverified. Latest NameTake4focused tests, strict alltargetClippy28.26s and binsbuild50.50s pass; no full539desktop pass is claimed. [Navigation evidence](release-semantic-review-navigation-20260906.md). Minimum-size process working space is cramped; native lesson evidence records23% overview versus100% scrolling rather than claiming readability at Fit.

-Independent scope reconciliation verified **S1** missing contextual assembly into repeated/nested process references and **S2** missing maintained interface-operation identity in parameterless messages. Isolated existing-core probes falsify the proposed workarounds. Proposed source7 contracts are not production features. Independent critique requires deterministic cache-independent admission, explicit whole-link deletion, purpose-specific analysis, and one frozen old5/6 message/checkpoint migration shared by both additions. [Scope reconciliation](release-scope-reconciliation-20260906.md), [S1 contract](release-chain-assembly-contract-probe-20260906.md), [S1 critique](release-chain-assembly-contract-independent-review-20260906.md), [S2 contract](release-interface-operation-contract-20260906.md).
+Independent scope reconciliation verified **S1** missing contextual assembly into repeated/nested process references and **S2** missing maintained interface-operation identity in parameterless messages. Isolated existing-core probes falsify the proposed workarounds. Root ratified the jointly critiqued [source7 integration decision](release-source7-integration-decision-20260906.md), including deterministic cache-independent admission, whole-link deletion, purpose-specific analysis, exact Call-derived operation/Reply identity and one frozen old5/6 checkpoint migration. These contracts now have implemented core/source/REST/desktop/recovery paths and the current automated gates above; remaining native7 and current Linux acceptance remain incomplete. [Scope reconciliation](release-scope-reconciliation-20260906.md).

 Linux ordinary rename's empty-target replacement was independently reproduced and corrected using `renameat2(RENAME_NOREPLACE)` without fallback. Exact errno/no-write assertions now pass under actual syscall injection. This establishes the ext4 publication invariant, not power-loss durability, hostile ancestor protection or model-file compare-and-swap. Windows retains its no-replace API and bounded scanner retries.

 ## Remaining gates and next actions

-1. Finish semantic-review navigation tests/rebuild/native replay; preserve completed reverse/teaching oracles. Synthesize independently critiqued S1/S2 contracts before coordinated core/source7 implementation, then provide complete graphical/source/REST/recovery parity. Native-check revised reserved labels and same-row conflicts; complete uncovered tutorial workflows.
+1. Fit implementation/review and automated gates are complete, including full570 desktop tests. Finish its native minimum-height/Focus/pending-form checks when native control resumes. Preserve completed BCC1 routing and old5/old6/current7 recovery/source/history oracles. Complete remaining current-binary S1/S2 purpose workflows and teaching cases; operation allocation deletion remains subject to independent channel validation. Native-check revised reserved labels and same-row conflicts. The later guide-only control-label correction passed formatting, independent review and the fresh workspace-binary build; it awaits the next packaged/native release snapshot.
 2. Close uncovered selective-view lifecycle cases; advanced ordered/process/scenario/fragment variants beyond the accepted Scenario case; typed state actions and pending Linux data/hosted/compact workflows. Implemented semantics must not be called missing merely because acceptance is outstanding; [coverage audit](release-current-coverage-20260906.md) is the baseline map, newer scoped reports supersede its old gap claims.
 3. Verify complete current Linux integration suites and desktop/server build/runtime, then supported-size native workflows. The successful core/MSRV pilot is a reusable starting point, not application acceptance.
-4. Run optimized/MSRV/final platform gates, strict reST/docs/example/source/OpenAPI checks, actual hosted transport variants and final migration/package checks. Rebuild portable distributions from the accepted exact tree, validate notices/runtime/content/checksums and clean-environment launch before replacing old bundles.
+4. Preserve current strict Clippy/format/reST/example/source/OpenAPI results and rerun affected checks after changes. Complete optimized/MSRV/final platform gates, actual hosted transport variants and final migration/package checks. Rebuild portable distributions from the accepted exact tree, validate notices/runtime/content/checksums and clean-environment launch before replacing old bundles.
 5. Conduct fresh independent requirements/domain/parity/architecture/runtime/UX/end-state reviews; resolve material findings. Commit/integrate authorized source with reviewable scope; remote publication is not requested. Only complete the goal when its applicable criteria are met.

 Meaningful progress continues: native lifecycle and Linux no-replace uncertainty have been resolved with exact oracles. The highest-value work is current-binary validation and closing uncovered engineering workflows, not accumulating repeated historical headings or treating aggregate test counts as release completion.
@@ -1,6 +1,12 @@
 # Task Ledger — first release

-Updated 2026-09-06 evening after corrected reverse-transition native acceptance, teaching source/history/reopen and Linux server/HTTP restart passes. [STATE.md](STATE.md) owns current execution/evidence and leases. [PLAN.md](PLAN.md) owns the release plan; [DECISIONS.md](DECISIONS.md) preserves architectural rationale. Full pre-consolidation contents, including superseded requirements interpretations and evidence, remain [archived byte-for-byte](history/2026-09-06-ledgers-before-consolidation/TASK_LEDGER.md).
+**Superseding user direction:** large horizontal creation buttons were rejected as intrusive and unprofessional. The user explicitly authorized consulting the installed Capella; that consultation has resumed and established actual compact palette, inline rename and explicit activity-allocation behavior. See [Capella 7.1 evidence and selected redesign](release-capella-basic-editing-20260907.md). The current candidate replaces creation/connection rows with one compact expandable palette and an in-place name editor. Native acceptance of the redesigned executable is pending; compactness is not assumed to prove usability. The earlier Escape hold and proposed toolbar-only correction below are superseded.
+
+**Latest evidence:** basic editing full desktop584/584, bins, formatting and strictClippy passed. Native named Entity creation works at100%, but changing pending-toolbar height moves the screen placement22px. User Escape stopped the attempted Undo; native checks are paused again. Code-only toolbar correction proceeds. [Current findings](release-basic-editing-reset-20260907.md). The previous goal turn made concrete progress through implementation, integration gates and a native-discovered defect; this is not a no-progress blocker turn.
+
+**Current steering:** basic diagram authoring and understandable OA/SA transitions come first. The user explicitly reauthorized desktop checks; root resumed the isolated test build and reproduced the reported usability problems. Creation, transition and independent fixture work is underway. No new basic-editing native pass is claimed. See [priority reset](release-basic-editing-reset-20260907.md); older execution priorities and Escape hold are superseded.
+
+Updated 2026-09-07 after source7 Reset/ReadStatus and old6 recovery native passes, OA contextual persistence with rendering open, and reproducible Linux server test deadline evidence. Native Linux core now passed436/0failed/2ignored and its guest shut down cleanly. Old5 full recovery and source7 pending nested-link crash recovery/history/reopen also passed; routing3/3 and full desktop564/564 now pass. Root's private-server/full-server/format/strict-Clippy/bins sequence is running with results pending. [STATE.md](STATE.md) owns current execution/evidence and leases. [PLAN.md](PLAN.md) owns the release plan; [DECISIONS.md](DECISIONS.md) preserves architectural rationale. Full pre-consolidation contents, including superseded requirements interpretations and evidence, remain [archived byte-for-byte](history/2026-09-06-ledgers-before-consolidation/TASK_LEDGER.md).

 ## Goal and success criteria

@@ -12,22 +18,24 @@ The authoritative user objective is `C:\Users\User\.codex\attachments\10b0f701-1
 - Both-layer transitions and reviewed counterpart reconciliation must be intuitive and precise. Behavior/scenario diagrams must be directly editable and preserve selection/camera/task context.
 - Human/AI/Git-friendly modular source, comments/includes, complete graphical/source/API parity and clear rejection are required. One validated model/history boundary must govern every representation.
 - User permits autonomous reversible engineering, experiments, independent agents and authorized native work. Root is the sole native operator in this collaboration. Do not run concurrent shared Cargo writers. No remote push, usage reset, broad target deletion or host restart is implied by current task authorization.
- User permits isolated Linux work. WSL remains unavailable on this host; a task-local QEMU core pilot completed and shut down cleanly, and a second bounded server/application gate is active. Historical external worktrees/toolchains are not present on this machine.
+- User permits isolated Linux work. WSL remains unavailable pending restart; earlier task-local QEMU core and server gates completed and shut down cleanly; the separate source7 core gate also completed and shut down cleanly, as recorded below. The server built and passed real HTTP/restart checks; its full test command timed out during compilation before any test executed. Historical external worktrees/toolchains are not present on this machine.

 ## Verified facts

+- Latest superseding checkpoint: Fit6 and both existing scroll/branch regressions, full desktop570/570, workspace bins, format and strict workspace/all-target Clippy pass. Windows preview565-file ZIP and complete examples are verified; current server56/56 also passed. Native BCC1 OA/SA nested routing and unchanged-source oracles passed, followed by bounded DC50 packaged Fit overview. Earlier pending-build/routing claims below retain their historical scope and are superseded by these exact current results in STATE.md.
+
 - Branch/patch/tree audit established that direct state/scenario/process, data contracts, hosted editing and earlier semantic review are already integrated; no required production transplant was found. [Branch evidence](release-branch-integration-20260906.md).
 - Capella's function input/output exchange endpoints and component Standard/Flow ports are distinct; explicit allocation connects them. Preserve that domain distinction. [Native benchmark](release-capella-workflow-benchmark.md).
- Current source-6 implements participant CommunicationMean, typed explicit transition endpoint decisions, saved exchange categories/view selectors, completeness warnings and presentation duplication. Older audit absence claims are superseded; native acceptance remains scoped by reports.
+- Source6 introduced participant CommunicationMean, typed explicit transition endpoint decisions, saved exchange categories/view selectors, completeness warnings and presentation duplication; current source7 retains them. Older audit absence claims are superseded; native acceptance remains scoped by reports.
 - Semantic review includes independent scalar/constructor/keyed/order/Child/Incident/artifact facets and multiple source rows. One frozen accepted base, explicit mappings, unique merged candidate slots and one atomic command preserve raw excluded/rejected drafts. Recovery replans; it never restores an unchecked serialized command. [Batch design](release-semantic-batch-foundation-design.md), [artifact contract](release-semantic-artifacts.md).
 - Native Windows artifact MOVE/CREATE/DELETE passed exact complete Save/Undo/Redo oracles, nine first-attempt saves. MOVE invalid raw optional state and CREATE exclusion/reserved identity survived controlled-stop recovery exactly. Destination-only retention is automated evidence, not separately native-applied in that run. [Native report](release-artifacts-native-20260906.md).
 - Native batch, Child/Incident and source-5 checkpoint workflows have scoped exact source/recovery/history evidence. Dense views have persistence/duplicate/hide and bounded readability evidence. Current counts, binaries and remaining cases are in STATE.md; these are not universal usability claims.
 - Native communication means drawing, explicit create/reuse ports and reverse Call/Reply pass independent complete model/source and exact Undo/Redo checks. The reverse navigation/overlapping-placement defect is fixed and reverified against a distinct oracle:10newUUIDs,zero implicit placements, correct Behavior owner and preserved Architecture. [Exact evidence](release-communication-native-20260906.md).
- Windows semantic108desktop+2core/full527desktop passes remain scoped. Subsequent guide/home and behavior navigation slices passed focused tests/strict Clippy/build; the latter compiled535desktop tests without claiming a full535run. A separate semantic navigation correction is under current verification. Keep counts scoped until final full-workspace verification.
+- Windows semantic108desktop+2core/full527desktop passes remain scoped. Subsequent guide/home and behavior navigation slices passed focused tests/strict Clippy/build; semantic navigation is also natively reverified. Fresh source7 core all-targets433passed/1ignored across44 summaries and server55/55 across4 summaries have recorded exit0. Full desktop561/561 passed263.39s after a real scroll-state regression was fixed with a stable navigation Column; the unchanged test passed. Strict workspace/all-target Clippy and root-observed final format exit0 pass;3 affected semantic tests passed after equivalent lint edits. Subsequent routing3/3 and full desktop564/564 pass; new standalone build and strict/server results remain pending. Logs and exact scope are in STATE.md; do not add affected reruns to full-suite totals.
 - Native Scenario ordered review passed ambiguity rejection, explicit retained-local final order and complete Save/Undo/Redo source oracles at1100×700. Current guide binary passes related-topic heading reset, same-topic search scroll retention and Git auto-selected-topic reset without dirtying the model. Branch/fragment order variants and revised artifact diagnostic rendering remain separate gates. [Native ordered evidence](release-current-native-verification.md), [guide/diagnostic implementation](release-semantic-conflict-diagnostics-20260906.md).
- Windows user-local GNU/LLVM builds and isolated clean-PATH native launch work. Actual Ubuntu24.04.4/Rust1.90 core/journal tests pass on hashed snapshots. Actual Linux server build and real HTTP modular import/invalidPUT/cleanrestart exact source/model/ETag pass on the older28-source lesson snapshot. Full server tests are running; current desktop/Linux package remain unverified. [Linux evidence](release-linux-validation-options.md).
- Corrected30-source/37-file teaching project passes minimum-size Home/guide/dirty-source guard, located initial warning, reviewed NameTake and complete exact source/Undo/Redo/reopen checks. The review revealed a separate layer/canvas mismatch; the process workspace is cramped at minimum size. These findings and remaining tutorial tasks are explicit in [native evidence](release-teaching-native-20260906.md).
- Scope reconciliation established two real semantic gaps using concrete OA/SA models: caller-context links into repeated/nested reusable chains (**S1**) and a maintained interface-operation selection for parameterless messages (**S2**). Existing sequence/functional-refinement workarounds change the intended engineering facts. Contracts/probes/independent critiques exist; production additions are pending. [Scope reconciliation](release-scope-reconciliation-20260906.md).
+- Windows user-local GNU/LLVM builds and isolated clean-PATH native launch work. Actual Ubuntu24.04.4/Rust1.90 core/journal tests pass on hashed snapshots. Actual Linux server build and real HTTP modular import/invalidPUT/cleanrestart exact source/model/ETag pass on the older28-source lesson snapshot. Its full server test command timed out during compilation with zero tests executed, then that gate shut down cleanly. The current frozen source7 gate compiled the server in17m10s and passed unit2/2 plus HTTP50/51; the sole504-vs-412 timing assertion failed again alone. Its final persisted-state checks were not reached. Native core436passed/0failed/2ignored and the VM shut down cleanly08:13:56UTC; full desktop/Linux package remain unverified. [Linux evidence](release-linux-validation-options.md).
+- Corrected30-source/37-file teaching project passes minimum-size Home/guide/dirty-source guard, located initial warning, reviewed NameTake and complete exact source/Undo/Redo/reopen checks. The layer/canvas mismatch is corrected and natively reverified. Data/interface/type navigation, saved-view distinctions, invalid-view draft guard and typed state Entry fold/rename/history/reopen pass. The process workspace is cramped at minimum size and artifact navigation required excessive scrolling; targeted source7 UI improvements await native observation. [Native evidence](release-teaching-native-20260906.md).
+- Scope reconciliation established caller-context links into repeated/nested reusable chains (**S1**) and maintained interface-operation selection for parameterless messages (**S2**) as real missing semantics. Their ratified source7 implementation now has fresh full core/server/desktop gates, OpenAPI72 fixtures and strict reST evidence. Old5/6 compatibility and current7 raw recovery tests pass. Root's native Reset and ReadStatus cases passed complete Save/Undo/Redo oracles and reopened with explicit derived allocation30/31. OA First.B persistence/history/reopen passed but rendering is open; old6 recovery passed full30-source/model JSON and exact raw workspace/Ports DTO comparison. Old5 complete raw/accepted recovery, exact repaired30-source save/full-model export pass. Current7 invalid nested draft crash recovery and completed link Save/Undo/Redo/reopen also pass; corrected rendering and remaining native7/Linux workflows remain open. [Native report](release-source7-native-acceptance-20260907.md). [Scope reconciliation](release-scope-reconciliation-20260906.md), [integration decision](release-source7-integration-decision-20260906.md).

 ## Decisions and candidate designs

@@ -35,7 +43,7 @@ Retain three Rust crates, one typed Project and validated atomic Command. Keep s

 Semantic reconciliation uses finite typed facets and separate member/presence/order decisions. Compare actual destination slots before constructing the core's complete candidate; two rows never become sequential Apply. Missing identities are not inferred by names. Raw constructor/numeric/keyed/optional drafts survive rejection, exclusion and checkpoint recovery. Artifact Presence means attachment to the reviewed owner; an identified source moved away can delete the destination, whereas a source key of None preserves destination-only membership. No invented tombstone or silent seed acknowledgment.

-Source updates preserve lexical ownership/comments/includes and exact history. Checkpoint source-5 upgrade admits only the established token/typed migration contract, validates old base fingerprints and resets transient approvals; it does not silently rebase authored drafts. Hosted saves remain explicit and conditional on the resource/ETag; credentials stay in memory.
+Source updates preserve lexical ownership/comments/includes and exact history. Checkpoint source5/6→7 upgrade admits only the established token/typed migration contract, validates old base fingerprints and resets transient approvals; it does not silently rebase authored drafts. Hosted saves remain explicit and conditional on the resource/ETag; credentials stay in memory.

 For Linux journal publication, ordinary rename lost the empty-target ownership invariant in a real ext4 probe. Selected `renameat2(RENAME_NOREPLACE)` through existing locked libc with no fallback; syscall errors fail before model writes. Alternative overwrite fallback was rejected by that falsifier. Windows native no-replace/retry behavior is retained; other OS behavior is explicit. [Contract, alternatives and measured limits](release-linux-journal-publication.md).

@@ -47,10 +55,14 @@ Behavior-root transition Apply should focus the explicitly requested counterpart

 - Nested source and contextual editors should reduce authoring effort; additional shorthand/grouping must justify grammar or interaction complexity through real tasks. Dense-view path overlap is not itself a failure when every actual identity remains accessible; arbitrary crossing-free layout is not promised.
 - Remaining native variants must establish useful engineering workflows: CM transitions, advanced OA process/SA chain/scenario reuse/fragment/order, typed state actions, compact/Linux/hosted cases, and uncovered saved-view lifecycle combinations. Do not expand or shrink required OA/SA scope merely to fit implementation convenience.
- Latest diagnostic/reserved-label corrections have independent review and completed semantic/full-desktop/Clippy/build checks; their new-binary artifact rendering still needs native verification. Latest native process9672/GUIF5ECAE…9246 closed cleanly for the semantic-navigation rebuild; its exact scope is in STATE.md.
- Current Linux evidence includes x86_64/glibc2.39/ext4 core/MSRV and server/HTTP runtime. Full current desktop, packaging and GUI acceptance remain required. Syscall failure tests do not establish power-loss durability, network-filesystem behavior or cross-process model CAS.
+- Latest diagnostic/reserved-label corrections have independent review and completed semantic/full-desktop/Clippy/build checks; their revised artifact rendering still needs native verification. The historical source6 process3012 closed cleanly. The6BAB source7 native build passed the scoped cases above;11060 and old6 recovery11240 closed cleanly. Old5 recovery/repair/save/model and current7 nested draft recovery/history/reopen pass on that binary. Later routing/hit-priority changes passed3focused/full564 desktop tests; root is running the server/format/strict/build sequence with results pending, and no corrected-render native acceptance is transferred. Exact binary scope is in STATE.md.
+- Historical Linux evidence includes x86_64/glibc2.39/ext4 core/MSRV and server/HTTP runtime. Current455-file snapshot SHA256 `7104946c89b2be7a1a030fdff47cb4405bacf05357d68cf35d181e860f55c279` is frozen; core completed436passes/2ignored before clean VM shutdown08:13:56UTC; its original08:32:43UTC deadline was not reached. The hash-verified cross-built probe executed successfully on Linux, including its Windows macro/build-script build path, but no complete Linux GUI has been built. Syscall failure tests do not establish power-loss durability, network-filesystem behavior or cross-process model CAS. [Current Linux gate](release-source7-linux-gate-20260907.md).
 - Earlier Windows QA packages include runtime/notices and verified archive contents; final accepted-tree optimized distributions and exact provenance/checksums remain a release gate. [Packaging evidence](release-windows-package-review.md).

 ## Current strategy

-Finish the semantic-review navigation correction and native replay. Freeze the independently critiqued S1/S2 contracts together, including exact old5/6 checkpoint/message compatibility, before coordinated source7/core implementation and graphical/source/REST parity. Complete the remaining tutorial/artifact/view/process/state/hosted workflows while bounded Linux validation progresses. Then run full-workspace, complete Linux and optimized/MSRV/REST/docs/package gates and fresh independent end-state review. Preserve exact revision/binary/platform scope; successful slices and architecture-only SVG export do not complete the broader goal.
+The requested Windows preview and whole-run development summary are delivered; the summary is being refreshed with the confirmed package, full570/570 desktop result and final Fit/strict/build gates. Preview DC50 has bounded native launch/overview evidence, not complete minimum-height/pending-form acceptance. Computer Use stopped on user Escape, so leave live GUI processes untouched and advance independent verification.
+
+Preserve the successful immutable458-file Linux GUI cross-build with the Fit fix, exact ELF/package evidence and released compiler lease. Three subsequent guest boots reached terminal IO-APIC timer panic before any tests; exact-kernel extraction succeeded but automatic approval review denied the proposed transient workaround. All task VMs are stopped. Preserve the denied action and evidence without bypassing review. Its snapshot/run/hashes and actual process status belong in STATE.md and the cross-build report. Preserve the original interrupted runs, cache, native core436/2ignored and failed Linux timed-server fixture. The replacement private HTTP preparation test and full server56 pass on Windows; Linux execution remains required.
+
+Guide steps now name Tools/Selection details/Restore panels and the exact Reply label; formatting, independent label review and a fresh Windows workspace-binary build pass. The user-facing preview retains its original tested bytes. Independent full-model/source purpose oracles compiled and passed both self-checks and preserved baseline cases; complete their native authoring/history steps when control resumes. Complete current native OA/SA teaching, artifact, saved-view, process/scenario and hosted cases once control is available. Retain caller-specific budgets, actual port proof, independent channel validation and exact old5/6 recovery bytes. Final optimized packages, current platform gates and fresh independent end-state review remain open; architecture-only SVG and passing slices do not redefine completion.
@@ -0,0 +1,514 @@
+//! Independent native basic-editing fixture and complete source7 oracle.
+//! generate DIR | check baseline|entity|basic|transition ENTRY
+use oa_core::{source_project::*, transitions::*, *};
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    fs,
+    path::Path,
+};
+
+fn id(n: u128) -> Id {
+    Id::from_u128(0xb451c000000040008000000000000000 + n)
+}
+fn seed(p: &mut Project, n: u128, kind: Kind, layer: Layer, name: &str, parent: Option<Id>) -> Id {
+    let mut e = p.make_element(kind, layer, name, parent).unwrap();
+    e.id = id(n);
+    e.alias = format!("basic_{n}");
+    p.elements.insert(e.id, e);
+    id(n)
+}
+fn fixture() -> Project {
+    let mut p = Project::empty();
+    p.id = id(1);
+    p.alias = "basic_editing".into();
+    p.name = "Basic rescue architecture".into();
+    let machine = seed(
+        &mut p,
+        20,
+        Kind::StateMachine,
+        Layer::Sa,
+        "Decoy operating modes",
+        None,
+    );
+    let region = seed(&mut p, 22, Kind::Region, Layer::Sa, "Main", Some(machine));
+    seed(&mut p, 21, Kind::State, Layer::Sa, "Standby", Some(region));
+    seed(&mut p, 30, Kind::Activity, Layer::Oa, "Report status", None);
+    seed(
+        &mut p,
+        31,
+        Kind::Capability,
+        Layer::Oa,
+        "Rescue capability",
+        None,
+    );
+    seed(
+        &mut p,
+        32,
+        Kind::Function,
+        Layer::Sa,
+        "Unrelated function",
+        None,
+    );
+    for (n, layer, projection, name) in [
+        (
+            2,
+            Layer::Sa,
+            ProjectionKind::StateMachine { machine },
+            "A · Operating modes (not an architecture destination)",
+        ),
+        (
+            3,
+            Layer::Sa,
+            ProjectionKind::Capabilities,
+            "B · Capabilities (not an allocation view)",
+        ),
+        (
+            4,
+            Layer::Oa,
+            ProjectionKind::Allocation,
+            "Operational rescue architecture",
+        ),
+        (
+            5,
+            Layer::Sa,
+            ProjectionKind::Allocation,
+            "System rescue architecture",
+        ),
+    ] {
+        p.diagrams.insert(
+            id(n),
+            Diagram {
+                id: id(n),
+                alias: format!("basic_view_{n}"),
+                name: name.into(),
+                description: String::new(),
+                layer,
+                projection,
+                routes: vec![],
+                view_options: Default::default(),
+                nodes: BTreeMap::new(),
+            },
+        );
+    }
+    execute_batch(&p, &[]).unwrap()
+}
+fn bundle(p: &Project) -> CompiledSourceProject {
+    let source = language::format(p).replacen("{\n", "{\n    include \"rationale.arcadia\";\n", 1);
+    let bundle = SourceBundle {
+        entry: "project.arcadia".into(),
+        files: BTreeMap::from([
+            ("project.arcadia".into(), source),
+            (
+                "rationale.arcadia".into(),
+                "// Preserve this included engineering note: rescue 雨.\r\n".into(),
+            ),
+        ]),
+    };
+    let result = compile_bundle(&bundle, ProjectLimits::default()).unwrap();
+    assert_eq!(result.bundle, bundle);
+    assert_eq!(&result.decoded.project, p);
+    result
+}
+fn load(entry: &Path) -> CompiledSourceProject {
+    let files = source_files::load_project(entry, ProjectLimits::default()).unwrap();
+    let raw = files.reachable_bundle();
+    let result = compile_bundle(&raw, ProjectLimits::default()).unwrap();
+    assert_eq!(
+        result.bundle, raw,
+        "No source migration or normalization is permitted"
+    );
+    execute_batch(&result.decoded.project, &[]).unwrap();
+    result
+}
+fn advance(base: &mut CompiledSourceProject, commands: &[Command]) {
+    let expected = execute_batch(&base.decoded.project, commands).unwrap();
+    *base = update_bundle(base, &expected, ProjectLimits::default()).unwrap();
+}
+struct Roles<'a> {
+    actual: &'a Project,
+    seed: Project,
+    used: BTreeSet<Id>,
+}
+impl Roles<'_> {
+    fn fresh(&mut self, candidates: Vec<Id>, role: &str) -> Id {
+        assert_eq!(candidates.len(), 1, "Exactly one identity for {role}");
+        let key = candidates[0];
+        assert_eq!(
+            key.get_version_num(),
+            4,
+            "{role} must be a native fresh UUIDv4"
+        );
+        assert!(
+            !self.seed.contains(key),
+            "{role} cannot reuse a seed identity"
+        );
+        assert!(
+            self.used.insert(key),
+            "Fresh roles must be distinct: {role}"
+        );
+        key
+    }
+    fn element(&mut self, kind: Kind, layer: Layer, name: &str) -> Id {
+        self.fresh(
+            self.actual
+                .elements
+                .values()
+                .filter(|e| e.kind() == kind && e.layer() == layer && e.name == name)
+                .map(|e| e.id)
+                .collect(),
+            name,
+        )
+    }
+    fn node(&mut self, diagram: Id, element: Id) -> Id {
+        self.fresh(
+            self.actual.diagrams[&diagram]
+                .nodes
+                .values()
+                .filter(|n| n.element == element)
+                .map(|n| n.id)
+                .collect(),
+            "exact diagram/element placement",
+        )
+    }
+    fn relation(&mut self, kind: RelationKind, source: Id, target: Id) -> Id {
+        self.fresh(
+            self.actual
+                .relations
+                .values()
+                .filter(|r| r.kind() == kind && r.body.endpoints() == (source, target))
+                .map(|r| r.id)
+                .collect(),
+            "exact typed relationship endpoints",
+        )
+    }
+}
+fn place(p: &Project, diagram: Id, element: Id, key: Id, x: f32, y: f32) -> Command {
+    Command::CreateNode {
+        diagram,
+        node: NodePlacement {
+            id: key,
+            alias: p.fresh_alias(&format!("view_{}", p.named(element)), "node", key),
+            element,
+            position: Position { x, y },
+            size: Size {
+                width: 224.,
+                height: 94.,
+            },
+            collapsed: false,
+            port_anchors: vec![],
+        },
+    }
+}
+fn create(
+    base: &mut CompiledSourceProject,
+    roles: &mut Roles<'_>,
+    kind: Kind,
+    name: &str,
+    x: f32,
+    y: f32,
+) -> Id {
+    let final_name = if name == "Assess incident" {
+        "Assess rescue incident"
+    } else {
+        name
+    };
+    let key = roles.element(kind, Layer::Oa, final_name);
+    let node = roles.node(id(4), key);
+    let mut element = base
+        .decoded
+        .project
+        .make_element(kind, Layer::Oa, name, None)
+        .unwrap();
+    element.id = key;
+    let mut scratch = base.decoded.project.clone();
+    scratch.elements.insert(key, element.clone());
+    advance(
+        base,
+        &[
+            Command::CreateElement(element),
+            place(&scratch, id(4), key, node, x, y),
+        ],
+    );
+    key
+}
+fn relation(
+    base: &mut CompiledSourceProject,
+    roles: &mut Roles<'_>,
+    kind: RelationKind,
+    name: &str,
+    source: Id,
+    target: Id,
+) {
+    let key = roles.relation(kind, source, target);
+    let p = &base.decoded.project;
+    let record = Relation {
+        id: key,
+        alias: p.fresh_alias(name, "relation", key),
+        name: name.into(),
+        description: String::new(),
+        body: RelationBody::new(kind, source, target),
+    };
+    advance(base, &[Command::CreateRelation(record)]);
+}
+fn expected(mode: &str, actual: &Project) -> CompiledSourceProject {
+    let initial = fixture();
+    let mut result = bundle(&initial);
+    if mode == "baseline" {
+        return result;
+    }
+    let mut roles = Roles {
+        actual,
+        seed: initial,
+        used: BTreeSet::new(),
+    };
+    let entity = create(
+        &mut result,
+        &mut roles,
+        Kind::Entity,
+        "Rescue team",
+        120.,
+        120.,
+    );
+    if mode == "entity" {
+        return result;
+    }
+    create(
+        &mut result,
+        &mut roles,
+        Kind::Actor,
+        "Control centre",
+        680.,
+        120.,
+    );
+    let activity = create(
+        &mut result,
+        &mut roles,
+        Kind::Activity,
+        "Assess incident",
+        160.,
+        300.,
+    );
+    let node = roles.node(id(4), id(30));
+    let command = place(&result.decoded.project, id(4), id(30), node, 680., 300.);
+    advance(&mut result, &[command]);
+    relation(
+        &mut result,
+        &mut roles,
+        RelationKind::Allocation,
+        "Performs",
+        entity,
+        activity,
+    );
+    relation(
+        &mut result,
+        &mut roles,
+        RelationKind::Interaction,
+        "Interaction: Assess incident → Report status",
+        activity,
+        id(30),
+    );
+    // Rename retains the creation-time alias; do this after drawing Interaction.
+    let mut renamed = result.decoded.project.elements[&activity].clone();
+    renamed.name = "Assess rescue incident".into();
+    advance(&mut result, &[Command::EditElement(activity, renamed)]);
+    if mode == "basic" {
+        return result;
+    }
+    assert_eq!(mode, "transition");
+    let p = &result.decoded.project;
+    let mut request = TransitionRequest::new(TransitionDirection::OaToSa, vec![entity]);
+    request.scope = DependencyScope::SelectedOnly;
+    request.destination_diagram = Some(id(5));
+    request.mappings.push(TransitionMapping {
+        source: entity,
+        target: None,
+        target_kind: Some(Kind::SystemActor),
+    });
+    let plan = plan_transition(p, &request).unwrap();
+    assert!(plan.conflicts.is_empty(), "{:?}", plan.conflicts);
+    let mut target = apply_transition(p, &plan).unwrap();
+    let generated = plan
+        .changes
+        .iter()
+        .find(|c| c.source == entity)
+        .unwrap()
+        .target;
+    let counterpart = roles.element(Kind::SystemActor, Layer::Sa, "Rescue team");
+    reidentify(&mut target, generated, counterpart).unwrap();
+    let trace = roles.fresh(
+        actual
+            .traces
+            .values()
+            .filter(|t| t.oa == entity && t.sa == counterpart)
+            .map(|t| t.id)
+            .collect(),
+        "counterpart trace",
+    );
+    let generated_trace = target
+        .traces
+        .values()
+        .find(|t| t.oa == entity && t.sa == counterpart)
+        .unwrap()
+        .id;
+    reidentify(&mut target, generated_trace, trace).unwrap();
+    let placement = roles.node(id(5), counterpart);
+    let generated_node = target.diagrams[&id(5)]
+        .nodes
+        .values()
+        .find(|n| n.element == counterpart)
+        .unwrap()
+        .id;
+    // The OA placement already owns view_rescue_team. Its SA counterpart's
+    // collision suffix is derived from the new placement UUID, never adopted
+    // from the observed alias or left at the planner's temporary UUID.
+    target
+        .diagrams
+        .get_mut(&id(5))
+        .unwrap()
+        .nodes
+        .get_mut(&generated_node)
+        .unwrap()
+        .alias = p.fresh_alias("view_Rescue team", "node", placement);
+    reidentify(&mut target, generated_node, placement).unwrap();
+    assert_eq!(
+        target.diagrams[&id(2)],
+        p.diagrams[&id(2)],
+        "State-machine decoy must remain untouched"
+    );
+    assert_eq!(
+        target.diagrams[&id(3)],
+        p.diagrams[&id(3)],
+        "Capability decoy must remain untouched"
+    );
+    result = update_bundle(&result, &target, ProjectLimits::default()).unwrap();
+    result
+}
+fn self_check() {
+    // Role carrier supplies identities only. Deliberately wrong geometry must
+    // never become the expected placement: the oracle predicts literal values.
+    let mut carrier = fixture();
+    let mut keys = vec![];
+    for (kind, name) in [
+        (Kind::Entity, "Rescue team"),
+        (Kind::Actor, "Control centre"),
+        (Kind::Activity, "Assess rescue incident"),
+    ] {
+        let e = carrier.make_element(kind, Layer::Oa, name, None).unwrap();
+        keys.push(e.id);
+        carrier.elements.insert(e.id, e);
+        carrier.place(id(4), *keys.last().unwrap(), Position { x: 999., y: 999. });
+    }
+    carrier.place(id(4), id(30), Position { x: 999., y: 999. });
+    carrier.relate(
+        RelationKind::Allocation,
+        "identity carrier only",
+        keys[0],
+        keys[2],
+    );
+    carrier.relate(
+        RelationKind::Interaction,
+        "identity carrier only",
+        keys[2],
+        id(30),
+    );
+    let basic = expected("basic", &carrier);
+    assert_ne!(
+        basic.decoded.project, carrier,
+        "Carrier metadata must not be adopted"
+    );
+    assert_eq!(
+        expected("basic", &basic.decoded.project).bundle,
+        basic.bundle
+    );
+    let mut r = TransitionRequest::new(TransitionDirection::OaToSa, vec![keys[0]]);
+    r.mappings.push(TransitionMapping {
+        source: keys[0],
+        target: None,
+        target_kind: Some(Kind::SystemActor),
+    });
+    r.destination_diagram = Some(id(5));
+    let plan = plan_transition(&basic.decoded.project, &r).unwrap();
+    assert!(plan.conflicts.is_empty(), "{:?}", plan.conflicts);
+    let transitioned = apply_transition(&basic.decoded.project, &plan).unwrap();
+    let oracle = expected("transition", &transitioned);
+    assert_eq!(oracle.decoded.project, transitioned);
+    assert_eq!(
+        expected("transition", &oracle.decoded.project).bundle,
+        oracle.bundle
+    );
+    r.destination_diagram = Some(id(2));
+    let invalid = plan_transition(&basic.decoded.project, &r).unwrap();
+    assert!(
+        !invalid.conflicts.is_empty(),
+        "State-machine decoy must reject a foreign SystemActor"
+    );
+    // Capabilities legitimately includes participants. It is an unchosen,
+    // non-Allocation view, not an invalid type; explicit selection wins over it.
+    r.destination_diagram = Some(id(3));
+    assert!(
+        plan_transition(&basic.decoded.project, &r)
+            .unwrap()
+            .conflicts
+            .is_empty()
+    );
+    let mut altered = transitioned.clone();
+    altered.elements.get_mut(&keys[1]).unwrap().description = "unrequested modification".into();
+    assert_ne!(expected("transition", &altered).decoded.project, altered);
+    println!(
+        "PASS self-check: complete basic/transition source fixed points, independent geometry/metadata, state-view refusal and unchanged unchosen Capabilities view"
+    );
+}
+fn main() {
+    assert_eq!(SCHEMA_VERSION, 7);
+    let args: Vec<_> = std::env::args().collect();
+    if args.get(1).is_some_and(|s| s == "self-check") {
+        self_check();
+        return;
+    }
+    if args.get(1).is_some_and(|s| s == "generate") {
+        assert_eq!(args.len(), 3);
+        let dir = Path::new(&args[2]);
+        assert!(
+            !dir.exists(),
+            "Generate into a new directory; existing evidence is immutable"
+        );
+        let p = fixture();
+        let base = bundle(&p);
+        fs::create_dir_all(dir).unwrap();
+        for (name, bytes) in base.bundle.files {
+            fs::write(dir.join(name), bytes).unwrap();
+        }
+        fs::write(
+            dir.join("expected-baseline.json"),
+            serde_json::to_vec_pretty(&p).unwrap(),
+        )
+        .unwrap();
+        println!(
+            "PASS generated independent baseline: {} elements, {} diagrams; user objects absent",
+            p.elements.len(),
+            p.diagrams.len()
+        );
+        return;
+    }
+    assert_eq!(
+        args.len(),
+        4,
+        "check baseline|entity|basic|transition ENTRY"
+    );
+    assert_eq!(args[1], "check");
+    let actual = load(Path::new(&args[3]));
+    let prediction = expected(&args[2], &actual.decoded.project);
+    assert_eq!(
+        actual.decoded.project, prediction.decoded.project,
+        "Complete model differs from typed role-based prediction"
+    );
+    assert_eq!(
+        actual.bundle, prediction.bundle,
+        "Complete source bundle differs (including comments and included bytes)"
+    );
+    println!(
+        "PASS {}: complete model and {} exact sources; only fresh role-proven UUIDs borrowed",
+        args[2],
+        actual.bundle.files.len()
+    );
+}
@@ -0,0 +1,56 @@
+# Basic editing native contract
+
+Status: standalone `-D warnings` compilation, self-check, generation and exact baseline check passed on 2026-09-07. Native execution remains pending. This fixture does not establish acceptance by itself.
+
+`harness/basic-editing-contract.rs` owns an independent UUID namespace. It generates six seed elements and four views, with **none** of the Entity/Actor/new Activity/counterpart the operator must create. The first view UUID is a valid SA StateMachine view with an actual machine, region and state; the next is SA Capabilities. The desired OA and SA Allocation views follow. Capabilities legitimately admits SystemActor, but is an unchosen nonpreferred view; the state view is the strong incompatible-destination counterexample. The unplaced OA Activity **Report status**, unrelated OA capability and SA function distinguish context filtering from global browsing. A second source retains a Unicode comment and CRLF bytes.
+
+Build the standalone checker only after the root grants a brief direct-rustc lease; it does not write Cargo outputs. Use the currently verified matching `oa_core` and `serde_json` rlibs, the toolchain's clang linker, `--edition 2024 -D warnings`, and output `.local/native-qa/basic-editing-contract.exe`. Then:
+
+```powershell
+. .local/toolchain/env.ps1
+.local/native-qa/basic-editing-contract.exe self-check
+.local/native-qa/basic-editing-contract.exe generate harness/fixtures/basic-editing/base
+.local/native-qa/basic-editing-contract.exe check baseline harness/fixtures/basic-editing/base/project.arcadia
+```
+
+Generation refuses an existing directory. Copy the **whole** generated base directory into a fresh native working directory. Preserve the base and all measured Save checkpoints. Do not edit an expected payload to match observed output.
+
+## Minimal native sequence
+
+Use the **Operational rescue architecture** view at 1100 × 700. Set 100% and note the camera and canvas origin. The selected redesign uses a **36 px contextual side palette**, explicitly expandable to **156 px**, with tooltips and selected-tool feedback. Entity, Actor, Activity and applicable connections belong here; advanced general inventory remains available elsewhere. Only explicitly expanding/collapsing the palette may resize the canvas. Arming a tool, choosing a point, editing a name, validation, commit and cancellation must retain its origin and camera. This interaction contract follows [the native benchmark and redesign decision](../../release-capella-basic-editing-20260907.md); it does not imply the new executable has passed.
+
+1. Choose **Entity** in the palette, click the intended canvas point, type **Rescue team** in the in-place name editor and press **Enter**. No placeholder element is accepted before Enter. Observe the clicked position and stable origin through all four phases. Set its placement properties to **x=120, y=120** for the exact persisted oracle. Save a copy; `check entity ENTRY` must pass. Undo creation before changing properties, or capture the exact command boundary separately: creation itself must be one model+placement undo. A second cancelled creation must add nothing.
+2. Choose **Actor**, click a blank canvas point, name **Control centre**, Enter; then use ordinary **Activity** creation for **Assess incident**, in that order. After each creation, explicitly set placement coordinates respectively **680,120** and **160,300**. These are ordinary root creations and remain unallocated. Do **not** use the participant's contextual **Add activity** in this oracle sequence: that separate action intentionally creates work plus an Allocation atomically and is covered by the supplementary matrix below.
+3. Use Add existing from this view; find **Report status** by name/alias. The SA function and OA capability must not appear as suggested compatible choices. Place the existing Activity and set its placement to **680,300**. Its seeded identity `b451c000-0000-4000-8000-00000000001e` must remain unchanged. Showing already placed entries must offer Locate instead of a duplicate placement.
+4. Explicitly create Allocation **Rescue team → Assess incident**, naming it **Performs** in the relationship form. Choose **Interaction** from the same contextual palette and draw **Assess incident → Report status**; retain its generated engineering name **Interaction: Assess incident → Report status**. Then select the Activity, press **F2**, enter **Assess rescue incident** in place and press **Enter**; its original alias and the authored Interaction name remain unchanged. Save; `check basic ENTRY` must pass.
+5. Select **Rescue team**, create its SA counterpart, explicitly choose **SystemActor**, **Selected only**, and destination **System rescue architecture**. Apply must reveal this Allocation view, select the resulting **Rescue team** SystemActor and retain a typed trace. Both decoy views remain byte-for-byte unchanged. Save; `check transition ENTRY` must pass. The core's explicit destination placement starts at **60,60**, size **224×94**; no observed geometry is imported into the prediction.
+6. Undo the whole transition and Save: `check basic ENTRY`. Redo and Save: `check transition ENTRY`. Reopen that entry and run the same check. Reopening counterpart creation should expose the existing counterpart, not silently create a duplicate.
+
+Run one meaningful move at 100% and one with pan/zoom, restoring the declared coordinates before the final oracle. Check one rejected raw property or creation draft: typing Delete/arrows must stay inside its focused text field; attempted unrelated selection/action must retain its raw text and a reachable correction/cancel route. These camera, focus and click-position observations are separate native evidence, not implied by saved JSON.
+
+## Supplementary redesign acceptance
+
+Run these on fresh copies or restore the preserved main-sequence state afterwards. The existing checker remains unchanged. **Supplementary accepted model changes need their own independently prepared expected model and source bundle before any exact-data claim.** UI observations and before/after byte equality for a cancelled action are narrower evidence; they do not prove a new model-producing workflow.
+
+| Case | Native action and observable result | Exact-data boundary |
+| --- | --- | --- |
+| F2 and keyboard focus | Select an existing node, F2, edit its label, Enter; one rename undo. Repeat F2 with a long name, arrow/Delete editing and Escape; original label retained, no canvas deletion or movement. | Main step 4 covers the declared Activity rename. Additional committed names require a separate expected edit; cancellation must retain the prior model and source bytes. |
+| Escape before and after point | Arm Entity then Escape before clicking; separately arm, click, type a partial name and Escape. Neither accepts a placeholder or placement; Select/move becomes reachable. | Compare each cancelled case with its complete pre-case bundle. No new expected object is allowed. |
+| Explicit allocated work | On OA Entity/Actor choose **Add activity**; on SA System/SystemActor choose **Add function**. The editor names the performer; Enter creates root work, its graphical presence and an explicit Allocation as one undoable action. Compare with ordinary palette work creation, which stays unallocated. | These participant actions are **not** represented by the existing `basic` oracle. Prepare independent expected identities, relation metadata and placement policy before claiming exact Save/Undo/Redo. Do not silently substitute them for step 2. |
+| Fixed canvas origin | At wide size and 1100 × 700, record canvas origin at idle, tool armed, point chosen, name edited/rejected, Enter and Escape. Repeat with the palette held at 36 px and at 156 px; only its explicit width toggle may resize the canvas. | Visual/pointer evidence must establish stable origin and clicked position. Existing final world coordinates stay literal; do not adjust them from observed rendering. |
+| Long names and edge placement | Choose a point near each relevant canvas edge, type a long name and inspect editor clamping, readable text, Enter/Escape and access to the chosen point. | Cancellation compares against the pre-case bundle. Committed extra objects require a separate expected model, not the current fixture oracle. |
+| Draft recovery | Before Enter, preserve a checkpoint with exact raw name, chosen point and intended tool; recover and inspect the reconstructed in-place editor. Also cover a pending F2 rename and explicit allocated-work draft if implemented. Recovery must not accept a placeholder or execute the pending command. | Independently specify/compare the full pending draft and accepted baseline first. A subsequent committed rename or allocated-work recovery requires its own expected model/source; no such supplementary recovery pass is claimed here. |
+
+## What equality proves
+
+The checker reads new UUIDv4 identities only through exact literal kind/layer/name, relationship endpoint, placement diagram+element and OA/SA trace roles. Each role must be unique, fresh relative to the fixture and distinct from every other role. It constructs every other field through typed core commands, independently fixed names/coordinates/default sizes and an explicit core transition request. The complete Project **and** complete two-file SourceBundle must match, including unused seed records, all placements, aliases, trace baseline, source ordering and included comment bytes. Final equality also rejects any unclaimed extra object or UUID.
+
+No geometry is normalized. Explicit final placement properties make the full persisted comparison reproducible without pretending that coordinates copied from the actual model prove a correct click transform. Separate visual evidence must establish the original clicked spot and stable camera. Save/Undo/Redo checks must preserve distinct copies; checking only the final state does not prove history.
+
+## Frozen seams / review boundaries
+
+The existing oracle pins ordinary root creation: raw name retained exactly, whitespace-only refused, core `make_element` alias, parent `None`, one CreateElement+default CreateNode batch, no insertion layout or implied allocation, exact world point and stable camera. The redesign changes its interaction order to tool → point → in-place name → Enter, not these expected records. Its additional explicit participant Add activity/function action has a separate atomic-allocation contract and must not alter this oracle's ordinary-creation expectations. Existing placement adds only a node. The transition oracle requires the explicit core destination request, not first-UUID fallback. No native pass for the redesign is claimed here.
+
+The self-check supplies deliberately false role-carrier geometry/metadata, verifies the oracle does not adopt it, verifies complete basic and transition source fixed points, rejects an unrelated metadata edit, and checks the actual incompatible state-view counterexample. It also pins the legitimate Capabilities participant admission rather than weakening the core to match an incorrect test assumption. A native placement alias collision uses the UUID-derived suffix predicted from the proven new placement identity; the observed alias is never copied.
+
+Final compilation took 6.691 seconds. Checker SHA256: `EFB96BD5C96F4346474F9DDFA053C53584D5F75E984258E9B8F48DB4837D3FBA`; harness source SHA256: `9AB6C2D0CDED28A7F94A24F01D5E91709BCCE5D6B648C188DA62A7EB66D890F8`. `manifest.json` pins all three generated baseline files. Logs: `.local/native-qa/basic-editing-contract-build5.log` and `basic-editing-contract-selfcheck5.log`; earlier failed attempts remain preserved (missing explicit imports, missing seed Region, temporary-UUID alias collision and the incorrect Capabilities-refusal expectation were harness-only corrections).
@@ -0,0 +1,167 @@
+{
+  "schema_version": 7,
+  "id": "b451c000-0000-4000-8000-000000000001",
+  "alias": "basic_editing",
+  "name": "Basic rescue architecture",
+  "description": "",
+  "elements": {
+    "b451c000-0000-4000-8000-000000000014": {
+      "id": "b451c000-0000-4000-8000-000000000014",
+      "alias": "basic_20",
+      "name": "Decoy operating modes",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Sa": {
+          "Shared": "StateMachine"
+        }
+      }
+    },
+    "b451c000-0000-4000-8000-000000000015": {
+      "id": "b451c000-0000-4000-8000-000000000015",
+      "alias": "basic_21",
+      "name": "Standby",
+      "description": "",
+      "parent": "b451c000-0000-4000-8000-000000000016",
+      "body": {
+        "Sa": {
+          "Shared": {
+            "State": {
+              "kind": "State",
+              "entry": "",
+              "exit": "",
+              "do_activity": ""
+            }
+          }
+        }
+      }
+    },
+    "b451c000-0000-4000-8000-000000000016": {
+      "id": "b451c000-0000-4000-8000-000000000016",
+      "alias": "basic_22",
+      "name": "Main",
+      "description": "",
+      "parent": "b451c000-0000-4000-8000-000000000014",
+      "body": {
+        "Sa": {
+          "Shared": "Region"
+        }
+      }
+    },
+    "b451c000-0000-4000-8000-00000000001e": {
+      "id": "b451c000-0000-4000-8000-00000000001e",
+      "alias": "basic_30",
+      "name": "Report status",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Oa": "Activity"
+      }
+    },
+    "b451c000-0000-4000-8000-00000000001f": {
+      "id": "b451c000-0000-4000-8000-00000000001f",
+      "alias": "basic_31",
+      "name": "Rescue capability",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Oa": "Capability"
+      }
+    },
+    "b451c000-0000-4000-8000-000000000020": {
+      "id": "b451c000-0000-4000-8000-000000000020",
+      "alias": "basic_32",
+      "name": "Unrelated function",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Sa": "Function"
+      }
+    }
+  },
+  "relations": {},
+  "diagrams": {
+    "b451c000-0000-4000-8000-000000000002": {
+      "id": "b451c000-0000-4000-8000-000000000002",
+      "alias": "basic_view_2",
+      "name": "A · Operating modes (not an architecture destination)",
+      "description": "",
+      "layer": "Sa",
+      "projection": {
+        "StateMachine": {
+          "machine": "b451c000-0000-4000-8000-000000000014"
+        }
+      },
+      "view_options": {
+        "hidden_edges": [],
+        "relation_kinds": "All",
+        "work_categories": "All",
+        "participant_categories": "All",
+        "coverage": "All",
+        "work_contexts": "All",
+        "exchange_labels": "Name"
+      },
+      "nodes": {},
+      "routes": []
+    },
+    "b451c000-0000-4000-8000-000000000003": {
+      "id": "b451c000-0000-4000-8000-000000000003",
+      "alias": "basic_view_3",
+      "name": "B · Capabilities (not an allocation view)",
+      "description": "",
+      "layer": "Sa",
+      "projection": "Capabilities",
+      "view_options": {
+        "hidden_edges": [],
+        "relation_kinds": "All",
+        "work_categories": "All",
+        "participant_categories": "All",
+        "coverage": "All",
+        "work_contexts": "All",
+        "exchange_labels": "Name"
+      },
+      "nodes": {},
+      "routes": []
+    },
+    "b451c000-0000-4000-8000-000000000004": {
+      "id": "b451c000-0000-4000-8000-000000000004",
+      "alias": "basic_view_4",
+      "name": "Operational rescue architecture",
+      "description": "",
+      "layer": "Oa",
+      "projection": "Allocation",
+      "view_options": {
+        "hidden_edges": [],
+        "relation_kinds": "All",
+        "work_categories": "All",
+        "participant_categories": "All",
+        "coverage": "All",
+        "work_contexts": "All",
+        "exchange_labels": "Name"
+      },
+      "nodes": {},
+      "routes": []
+    },
+    "b451c000-0000-4000-8000-000000000005": {
+      "id": "b451c000-0000-4000-8000-000000000005",
+      "alias": "basic_view_5",
+      "name": "System rescue architecture",
+      "description": "",
+      "layer": "Sa",
+      "projection": "Allocation",
+      "view_options": {
+        "hidden_edges": [],
+        "relation_kinds": "All",
+        "work_categories": "All",
+        "participant_categories": "All",
+        "coverage": "All",
+        "work_contexts": "All",
+        "exchange_labels": "Name"
+      },
+      "nodes": {},
+      "routes": []
+    }
+  },
+  "artifact_links": {},
+  "traces": {}
+}
@@ -0,0 +1,108 @@
+arcadia 7;
+project basic_editing "Basic rescue architecture" id "b451c000-0000-4000-8000-000000000001" {
+    include "rationale.arcadia";
+    description "";
+
+    sa_state_machine basic_20 "Decoy operating modes" id "b451c000-0000-4000-8000-000000000014" {
+        description "";
+        parent none;
+    }
+
+    sa_state basic_21 "Standby" id "b451c000-0000-4000-8000-000000000015" {
+        description "";
+        do_activity "";
+        entry "";
+        exit "";
+        kind State;
+        parent @basic_22;
+    }
+
+    sa_region basic_22 "Main" id "b451c000-0000-4000-8000-000000000016" {
+        description "";
+        parent @basic_20;
+    }
+
+    oa_activity basic_30 "Report status" id "b451c000-0000-4000-8000-00000000001e" {
+        description "";
+        parent none;
+    }
+
+    oa_capability basic_31 "Rescue capability" id "b451c000-0000-4000-8000-00000000001f" {
+        description "";
+        parent none;
+    }
+
+    sa_function basic_32 "Unrelated function" id "b451c000-0000-4000-8000-000000000020" {
+        description "";
+        parent none;
+    }
+
+    diagram basic_view_2 "A · Operating modes (not an architecture destination)" id "b451c000-0000-4000-8000-000000000002" {
+        description "";
+        layer Sa;
+        projection {
+            StateMachine {
+                machine @basic_20;
+            };
+        };
+        routes [];
+        view_options {
+            coverage "All";
+            exchange_labels "Name";
+            hidden_edges [];
+            participant_categories "All";
+            relation_kinds "All";
+            work_categories "All";
+            work_contexts "All";
+        };
+    }
+
+    diagram basic_view_3 "B · Capabilities (not an allocation view)" id "b451c000-0000-4000-8000-000000000003" {
+        description "";
+        layer Sa;
+        projection Capabilities;
+        routes [];
+        view_options {
+            coverage "All";
+            exchange_labels "Name";
+            hidden_edges [];
+            participant_categories "All";
+            relation_kinds "All";
+            work_categories "All";
+            work_contexts "All";
+        };
+    }
+
+    diagram basic_view_4 "Operational rescue architecture" id "b451c000-0000-4000-8000-000000000004" {
+        description "";
+        layer Oa;
+        projection Allocation;
+        routes [];
+        view_options {
+            coverage "All";
+            exchange_labels "Name";
+            hidden_edges [];
+            participant_categories "All";
+            relation_kinds "All";
+            work_categories "All";
+            work_contexts "All";
+        };
+    }
+
+    diagram basic_view_5 "System rescue architecture" id "b451c000-0000-4000-8000-000000000005" {
+        description "";
+        layer Sa;
+        projection Allocation;
+        routes [];
+        view_options {
+            coverage "All";
+            exchange_labels "Name";
+            hidden_edges [];
+            participant_categories "All";
+            relation_kinds "All";
+            work_categories "All";
+            work_contexts "All";
+        };
+    }
+
+}
@@ -0,0 +1 @@
+// Preserve this included engineering note: rescue 雨.
@@ -0,0 +1,17 @@
+[
+  {
+    "path": "expected-baseline.json",
+    "bytes": 4524,
+    "sha256": "F239E728D650B0AF32BB8F3DCAF6B27C99B9C5041132AC14E51756EA6563D978"
+  },
+  {
+    "path": "project.arcadia",
+    "bytes": 3077,
+    "sha256": "045CB047D7BFBCA72C3FB30DB4C81A30AD463D3AF7FC51604906AD7FA75A1FF8"
+  },
+  {
+    "path": "rationale.arcadia",
+    "bytes": 57,
+    "sha256": "C01867C9DC0D40726853119FAC3C6AD24A40D8D362A93A8B9D20DF04EC2E273F"
+  }
+]
@@ -0,0 +1,115 @@
+# Source7 native acceptance fixture
+
+This is the frozen baseline for separately scoped native cases. Current passes
+and remaining rendering/workflow gates are recorded in the
+[native acceptance report](../../release-source7-native-acceptance-20260907.md);
+fixture generation alone is not native acceptance. `base/project.arcadia` and its included
+`rationale.arcadia` contain43elements and9relations: OA and SA callers each reuse
+an A→B→C procedure twice and through one nested wrapper. A direct X contribution
+allows a caller link specifically into B. The SA boundary has two parameterless
+operations and a correlated Reply. All identities are deterministic.
+
+Copy the complete `base` directory into a fresh working directory per case. Keep
+the baseline unchanged. `harness/source7-native-contract.rs` generates it and
+checks actual saved results against an independently constructed complete model
+and source update. It refuses migration, UUID stabilization or whitespace
+normalization. Current exact baseline generation and comparison passed against
+the source7 core; this does not constitute UI acceptance.
+
+Cases for the actual compiled desktop:
+
+- `operation-reset`: edit the first existing Call (`@operation_probe_43`) to
+  select Reset's exact allocation (`@operation_probe_30`). Reply remains
+  independently identified and derives this Call's operation. No new model
+  records are expected.
+- `operation-status`: on a separate baseline copy, select ReadStatus's allocation
+  (`@operation_probe_31`) on the same Call. Its authored message name is retained.
+- `oa-link` / `sa-link`: in the appropriate `@oa_caller` / `@sa_caller`, create
+  one contextual Precedence from direct `@oa_x` / `@sa_x` into B through the first
+  reference R1. Enter name `First assessment gate` and guard `Check accepted`.
+  Repeated reference R2 and the procedure definition must remain unchanged.
+- `oa-nested` / `sa-nested`: target B through R3 and its Inner assessment reference.
+  The exact two-component instance path is required.
+- `baseline`: Undo the one accepted edit, save, and compare all model/source
+  bytes. Redo and saved reopen must return the same accepted identity and fields.
+
+For creation checks, exactly one newly allocated v4 relation UUID is permitted.
+Only that fresh nonce is read from the native result; every authored field,
+alias, owner, path, purpose, dependency and complete source update is predicted.
+No existing identity or unrelated record is excluded from comparison. Preserve
+the accepted files/hashes to prove that Redo/reopen retain this allocated UUID.
+
+Build the checker using the current source7 core library and matching serde_json
+library, then run `CHECKER generate NEW_DIRECTORY` or
+`CHECKER check MODE WORKING_DIRECTORY/project.arcadia`. Source6 teaching and
+historical recovery oracles remain in their separate fixture directories.
+
+## Additional purpose cases: validated oracles, native pending
+
+New source in `harness/source7-native-contract.rs` adds two independent incidence
+oracles. Direct-rustc `-D warnings` compilation passed in4.05s during a coordinated
+brief lease; both purpose self-checks passed. Existing base bytes and its manifest
+remain unchanged. Native purpose authoring/history is not yet accepted.
+
+Validated checker: `.local/native-qa/source7-native-contract-incidence.exe`, SHA256
+`16994DC437F5CCC5E5F6FBB4212C03449F2389AE4615FA98B2930B3637468EE3`.
+The original checker remains unchanged at SHA256
+`4AC615A099F23A78F111BAD3966A3CCB808FCA1C5FC46FBAC9A947508A568600`.
+Logs: `.local/native-qa/source7-incidence-{build,selfcheck,generation}.log`.
+Generated separate fixture `.local/native-qa/source7-incidence-base` passed the
+complete baseline check; entry SHA256
+`77C26FD2DD71514AB89C0FA71113825AC8F3DBD8F71A56EFAE8E5430C92D99B8`.
+Regenerated original baseline matched all three manifest hashes; preserved native
+OA-link and operation-Reset accepted cases also passed the extended checker.
+
+To reproduce, build the checker against matching current core/serde libraries, preserving the
+old checker executable, and first run `CHECKER verify-incidence-contract`. This
+constructs expected typed commands, proves complete core analysis with exactly
+one assembly record and unchanged precedence/entries/exits, checks invalid
+direction/work counterfactuals, and checks stable source updates. Native check
+modes predict the entire Project and two-file source bundle; only the new link's
+v4 nonce is taken from actual output, never its name, endpoints, purpose or evidence.
+
+### OA Exchange assembly
+
+Run `CHECKER generate-incidence NEW_DIRECTORY`; this separate deterministic variant
+adds one Interaction, `@oa_assessment_handoff`, **Assessment handoff X to B**,
+from `@oa_work_x` to `@oa_work_b`. It contains43elements/10relations/two sources.
+Do not replace `base` with this variant. Check the clean copy with
+`CHECKER check incidence-baseline NEW_DIRECTORY/project.arcadia`.
+
+In OA caller, choose **Tools → Qualified link / assembly…**. Set source to direct
+X (`[]/oa_x`); Choose target → Enter First assessment → B (`[oa_r1]/oa_b`). Enter
+name **Caller assessment handoff**. Choose **Exchange assembly** and first leave
+evidence empty: Apply must refuse. Then select the exact **Assessment handoff X to B**
+Interaction; Apply should become available. Apply once and Save a fresh copy.
+
+Run `CHECKER check oa-exchange-assembly SAVED/project.arcadia`. Undo/Save uses
+`incidence-baseline`; Redo/Save uses `oa-exchange-assembly` and must preserve the
+same accepted UUID/bytes. The link is incidence: no precedence arrow/guard or
+merged execution is inferred. Core proof checks its exchange contributes to this
+caller’s behavior coverage, not the shared procedure’s global coverage. The
+reversed contextual endpoint counterfactual must be rejected; deleting the
+evidence exchange removes its dependent incidence link (automated oracle only).
+
+### SA Common work incidence
+
+Use a fresh copy of the original unchanged `base`, not the exchange variant.
+In SA caller, choose **Tools → Qualified link / assembly…**. For source Enter
+First assessment → B (`[sa_r1]/sa_b`); for target return Root then Enter Second
+assessment → B (`[sa_r2]/sa_b`). Enter name **Shared assessment work** and select
+**Common work incidence**. Choosing **X · Check authorization** (`@sa_work_x`)
+as evidence must reject; repair to exact **B · Review assessment** (`@sa_work_b`).
+Both full reference paths must remain distinct while the shared work identity is
+the same. Apply once and Save a fresh copy.
+
+Run `CHECKER check sa-common-work SAVED/project.arcadia`. Undo/Save uses `baseline`;
+Redo/Save uses `sa-common-work` and exact accepted UUID/byte comparison. This records
+shared identity; it neither fuses the two occurrences nor creates execution order.
+The complete-model oracle rejects renamed/duplicated work, collapsed instance
+paths, wrong evidence or unrelated record changes.
+
+After compiling, also regenerate original `generate` into a fresh scratch folder
+and compare its three hashes with the existing manifest, then rerun a preserved
+old accepted case. These checks establish that extending the checker did not alter
+the already-measured baseline or existing expected results.
@@ -0,0 +1,936 @@
+{
+  "schema_version": 7,
+  "id": "52060906-0000-4000-8000-000000000001",
+  "alias": "source7_native_contract",
+  "name": "Reusable procedures and operation identity",
+  "description": "",
+  "elements": {
+    "071edc32-5c27-5c1d-91ff-337c80b462d5": {
+      "id": "071edc32-5c27-5c1d-91ff-337c80b462d5",
+      "alias": "sa_work_a",
+      "name": "A · Begin assessment",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Sa": "Function"
+      }
+    },
+    "08ff2083-dac1-5f4b-ad6a-7cc81d7be29d": {
+      "id": "08ff2083-dac1-5f4b-ad6a-7cc81d7be29d",
+      "alias": "oa_x",
+      "name": "X · Check authorization",
+      "description": "",
+      "parent": "2100ac23-79ee-54e1-b3cf-69f3d4f3b30a",
+      "body": {
+        "Oa": {
+          "Shared": {
+            "Occurrence": {
+              "body": {
+                "Action": {
+                  "action": "e78d841a-a37e-5106-8356-b1e3ce6d2501",
+                  "lifeline": null
+                }
+              },
+              "precondition": "",
+              "postcondition": ""
+            }
+          }
+        }
+      }
+    },
+    "14d1133a-697d-5b54-b624-eed0fb04a354": {
+      "id": "14d1133a-697d-5b54-b624-eed0fb04a354",
+      "alias": "sa_a",
+      "name": "A · Begin assessment",
+      "description": "",
+      "parent": "c1d4eda2-fac7-5621-a7ac-25f985911bf5",
+      "body": {
+        "Sa": {
+          "Shared": {
+            "Occurrence": {
+              "body": {
+                "Action": {
+                  "action": "071edc32-5c27-5c1d-91ff-337c80b462d5",
+                  "lifeline": null
+                }
+              },
+              "precondition": "",
+              "postcondition": ""
+            }
+          }
+        }
+      }
+    },
+    "1a215aed-f0b1-521d-b52f-0c1cfbbf1c36": {
+      "id": "1a215aed-f0b1-521d-b52f-0c1cfbbf1c36",
+      "alias": "sa_c",
+      "name": "C · Finish assessment",
+      "description": "",
+      "parent": "c1d4eda2-fac7-5621-a7ac-25f985911bf5",
+      "body": {
+        "Sa": {
+          "Shared": {
+            "Occurrence": {
+              "body": {
+                "Action": {
+                  "action": "6575bce8-4185-519b-a004-d96650da63dc",
+                  "lifeline": null
+                }
+              },
+              "precondition": "",
+              "postcondition": ""
+            }
+          }
+        }
+      }
+    },
+    "1e27be58-3e3e-5869-ad30-e94a28ea2a2e": {
+      "id": "1e27be58-3e3e-5869-ad30-e94a28ea2a2e",
+      "alias": "oa_r2",
+      "name": "Second assessment",
+      "description": "",
+      "parent": "2100ac23-79ee-54e1-b3cf-69f3d4f3b30a",
+      "body": {
+        "Oa": {
+          "Shared": {
+            "Occurrence": {
+              "body": {
+                "SequenceReference": {
+                  "sequence": "af139b27-7e42-5729-9e49-53b2ac62c9e7"
+                }
+              },
+              "precondition": "",
+              "postcondition": ""
+            }
+          }
+        }
+      }
+    },
+    "2100ac23-79ee-54e1-b3cf-69f3d4f3b30a": {
+      "id": "2100ac23-79ee-54e1-b3cf-69f3d4f3b30a",
+      "alias": "oa_caller",
+      "name": "Caller with three assessments",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Oa": {
+          "Process": {
+            "steps": [
+              "08ff2083-dac1-5f4b-ad6a-7cc81d7be29d",
+              "d48951ad-c6db-5eae-923a-edccab97155e",
+              "1e27be58-3e3e-5869-ad30-e94a28ea2a2e",
+              "fc986c5c-eae7-5363-bcd5-b832d565a89a"
+            ]
+          }
+        }
+      }
+    },
+    "25fdfe13-c45d-5822-830a-192ff13f660d": {
+      "id": "25fdfe13-c45d-5822-830a-192ff13f660d",
+      "alias": "oa_work_a",
+      "name": "A · Begin assessment",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Oa": "Activity"
+      }
+    },
+    "273d8df8-83c8-5d75-99d1-59a7c9fdb705": {
+      "id": "273d8df8-83c8-5d75-99d1-59a7c9fdb705",
+      "alias": "oa_nested_definition",
+      "name": "Nested assessment wrapper",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Oa": {
+          "Process": {
+            "steps": [
+              "e16033cd-3184-56ef-b462-5559ad212c84"
+            ]
+          }
+        }
+      }
+    },
+    "3360ccb1-68ac-51cd-8d9a-8893000c80ef": {
+      "id": "3360ccb1-68ac-51cd-8d9a-8893000c80ef",
+      "alias": "sa_work_b",
+      "name": "B · Review assessment",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Sa": "Function"
+      }
+    },
+    "47335738-0876-5f90-b25e-1636c7448e93": {
+      "id": "47335738-0876-5f90-b25e-1636c7448e93",
+      "alias": "oa_work_c",
+      "name": "C · Finish assessment",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Oa": "Activity"
+      }
+    },
+    "4a65dad8-e2a1-51dc-87a0-02ea4ab69384": {
+      "id": "4a65dad8-e2a1-51dc-87a0-02ea4ab69384",
+      "alias": "sa_r3",
+      "name": "Nested assessment",
+      "description": "",
+      "parent": "d4911fd0-52ed-535c-9f87-170e8f5731d2",
+      "body": {
+        "Sa": {
+          "Shared": {
+            "Occurrence": {
+              "body": {
+                "SequenceReference": {
+                  "sequence": "7932ab3a-6b60-5059-a3a0-fca3a2f9a197"
+                }
+              },
+              "precondition": "",
+              "postcondition": ""
+            }
+          }
+        }
+      }
+    },
+    "52060906-0000-4000-8000-00000000000a": {
+      "id": "52060906-0000-4000-8000-00000000000a",
+      "alias": "operation_probe_10",
+      "name": "Operator console",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Sa": "Actor"
+      }
+    },
+    "52060906-0000-4000-8000-00000000000b": {
+      "id": "52060906-0000-4000-8000-00000000000b",
+      "alias": "operation_probe_11",
+      "name": "Valve service",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Sa": "System"
+      }
+    },
+    "52060906-0000-4000-8000-00000000000c": {
+      "id": "52060906-0000-4000-8000-00000000000c",
+      "alias": "operation_probe_12",
+      "name": "Service socket",
+      "description": "",
+      "parent": "52060906-0000-4000-8000-00000000000a",
+      "body": {
+        "Sa": {
+          "Shared": {
+            "Port": {
+              "contract": {
+                "Component": {
+                  "kind": "Standard",
+                  "orientation": "Unset"
+                }
+              },
+              "legacy": null
+            }
+          }
+        }
+      }
+    },
+    "52060906-0000-4000-8000-00000000000d": {
+      "id": "52060906-0000-4000-8000-00000000000d",
+      "alias": "operation_probe_13",
+      "name": "Service socket",
+      "description": "",
+      "parent": "52060906-0000-4000-8000-00000000000b",
+      "body": {
+        "Sa": {
+          "Shared": {
+            "Port": {
+              "contract": {
+                "Component": {
+                  "kind": "Standard",
+                  "orientation": "Unset"
+                }
+              },
+              "legacy": null
+            }
+          }
+        }
+      }
+    },
+    "52060906-0000-4000-8000-000000000014": {
+      "id": "52060906-0000-4000-8000-000000000014",
+      "alias": "operation_probe_20",
+      "name": "Reset",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Sa": {
+          "Shared": {
+            "ExchangeItem": {
+              "kind": "Information",
+              "mechanism": "Operation",
+              "supertype": null
+            }
+          }
+        }
+      }
+    },
+    "52060906-0000-4000-8000-000000000015": {
+      "id": "52060906-0000-4000-8000-000000000015",
+      "alias": "operation_probe_21",
+      "name": "ReadStatus",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Sa": {
+          "Shared": {
+            "ExchangeItem": {
+              "kind": "Information",
+              "mechanism": "Operation",
+              "supertype": null
+            }
+          }
+        }
+      }
+    },
+    "52060906-0000-4000-8000-000000000016": {
+      "id": "52060906-0000-4000-8000-000000000016",
+      "alias": "operation_probe_22",
+      "name": "Valve commands",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Sa": {
+          "Shared": {
+            "Interface": {
+              "supertype": null
+            }
+          }
+        }
+      }
+    },
+    "52060906-0000-4000-8000-000000000028": {
+      "id": "52060906-0000-4000-8000-000000000028",
+      "alias": "operation_probe_40",
+      "name": "Reset then read status",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Sa": {
+          "Shared": {
+            "Scenario": {
+              "viewpoint": "BoundaryInterface",
+              "context": null,
+              "precondition": "",
+              "postcondition": "",
+              "steps": [
+                "52060906-0000-4000-8000-00000000002b",
+                "52060906-0000-4000-8000-00000000002c",
+                "aa8b674f-012f-583f-8dc7-a76407d1f8a7"
+              ]
+            }
+          }
+        }
+      }
+    },
+    "52060906-0000-4000-8000-000000000029": {
+      "id": "52060906-0000-4000-8000-000000000029",
+      "alias": "operation_probe_41",
+      "name": "Service participant",
+      "description": "",
+      "parent": "52060906-0000-4000-8000-000000000028",
+      "body": {
+        "Sa": {
+          "Shared": {
+            "Lifeline": {
+              "represented": "52060906-0000-4000-8000-00000000000a"
+            }
+          }
+        }
+      }
+    },
+    "52060906-0000-4000-8000-00000000002a": {
+      "id": "52060906-0000-4000-8000-00000000002a",
+      "alias": "operation_probe_42",
+      "name": "Service participant",
+      "description": "",
+      "parent": "52060906-0000-4000-8000-000000000028",
+      "body": {
+        "Sa": {
+          "Shared": {
+            "Lifeline": {
+              "represented": "52060906-0000-4000-8000-00000000000b"
+            }
+          }
+        }
+      }
+    },
+    "52060906-0000-4000-8000-00000000002b": {
+      "id": "52060906-0000-4000-8000-00000000002b",
+      "alias": "operation_probe_43",
+      "name": "Call Reset",
+      "description": "",
+      "parent": "52060906-0000-4000-8000-000000000028",
+      "body": {
+        "Sa": {
+          "Shared": {
+            "Occurrence": {
+              "body": {
+                "Exchange": {
+                  "exchange": "52060906-0000-4000-8000-000000000022",
+                  "sender": "52060906-0000-4000-8000-000000000029",
+                  "receiver": "52060906-0000-4000-8000-00000000002a",
+                  "message_kind": "Call",
+                  "reply_to": null,
+                  "values": []
+                }
+              },
+              "precondition": "",
+              "postcondition": ""
+            }
+          }
+        }
+      }
+    },
+    "52060906-0000-4000-8000-00000000002c": {
+      "id": "52060906-0000-4000-8000-00000000002c",
+      "alias": "operation_probe_44",
+      "name": "Call ReadStatus",
+      "description": "",
+      "parent": "52060906-0000-4000-8000-000000000028",
+      "body": {
+        "Sa": {
+          "Shared": {
+            "Occurrence": {
+              "body": {
+                "Exchange": {
+                  "exchange": "52060906-0000-4000-8000-000000000022",
+                  "sender": "52060906-0000-4000-8000-000000000029",
+                  "receiver": "52060906-0000-4000-8000-00000000002a",
+                  "message_kind": "Call",
+                  "reply_to": null,
+                  "values": []
+                }
+              },
+              "precondition": "",
+              "postcondition": ""
+            }
+          }
+        }
+      }
+    },
+    "53ad2109-ba9d-5859-b258-64cdaab5c4a8": {
+      "id": "53ad2109-ba9d-5859-b258-64cdaab5c4a8",
+      "alias": "sa_x",
+      "name": "X · Check authorization",
+      "description": "",
+      "parent": "d4911fd0-52ed-535c-9f87-170e8f5731d2",
+      "body": {
+        "Sa": {
+          "Shared": {
+            "Occurrence": {
+              "body": {
+                "Action": {
+                  "action": "8c3d9b89-aa12-5218-9de9-12b8b5d4e4b3",
+                  "lifeline": null
+                }
+              },
+              "precondition": "",
+              "postcondition": ""
+            }
+          }
+        }
+      }
+    },
+    "62cfdab1-a18b-5b06-8ee7-cd0b320e4024": {
+      "id": "62cfdab1-a18b-5b06-8ee7-cd0b320e4024",
+      "alias": "sa_r1",
+      "name": "First assessment",
+      "description": "",
+      "parent": "d4911fd0-52ed-535c-9f87-170e8f5731d2",
+      "body": {
+        "Sa": {
+          "Shared": {
+            "Occurrence": {
+              "body": {
+                "SequenceReference": {
+                  "sequence": "c1d4eda2-fac7-5621-a7ac-25f985911bf5"
+                }
+              },
+              "precondition": "",
+              "postcondition": ""
+            }
+          }
+        }
+      }
+    },
+    "6575bce8-4185-519b-a004-d96650da63dc": {
+      "id": "6575bce8-4185-519b-a004-d96650da63dc",
+      "alias": "sa_work_c",
+      "name": "C · Finish assessment",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Sa": "Function"
+      }
+    },
+    "7932ab3a-6b60-5059-a3a0-fca3a2f9a197": {
+      "id": "7932ab3a-6b60-5059-a3a0-fca3a2f9a197",
+      "alias": "sa_nested_definition",
+      "name": "Nested assessment wrapper",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Sa": {
+          "FunctionalChain": {
+            "steps": [
+              "e21febd2-30ec-5e9d-aa4c-3c54c95c2c9f"
+            ]
+          }
+        }
+      }
+    },
+    "8c3d9b89-aa12-5218-9de9-12b8b5d4e4b3": {
+      "id": "8c3d9b89-aa12-5218-9de9-12b8b5d4e4b3",
+      "alias": "sa_work_x",
+      "name": "X · Check authorization",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Sa": "Function"
+      }
+    },
+    "999b5e15-903f-5ca1-bc11-e51fadf80762": {
+      "id": "999b5e15-903f-5ca1-bc11-e51fadf80762",
+      "alias": "sa_r2",
+      "name": "Second assessment",
+      "description": "",
+      "parent": "d4911fd0-52ed-535c-9f87-170e8f5731d2",
+      "body": {
+        "Sa": {
+          "Shared": {
+            "Occurrence": {
+              "body": {
+                "SequenceReference": {
+                  "sequence": "c1d4eda2-fac7-5621-a7ac-25f985911bf5"
+                }
+              },
+              "precondition": "",
+              "postcondition": ""
+            }
+          }
+        }
+      }
+    },
+    "a39639dc-0ece-5b71-981d-c9523fed4914": {
+      "id": "a39639dc-0ece-5b71-981d-c9523fed4914",
+      "alias": "oa_work_b",
+      "name": "B · Review assessment",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Oa": "Activity"
+      }
+    },
+    "aa8b674f-012f-583f-8dc7-a76407d1f8a7": {
+      "id": "aa8b674f-012f-583f-8dc7-a76407d1f8a7",
+      "alias": "reset_reply",
+      "name": "Correlated reset reply",
+      "description": "",
+      "parent": "52060906-0000-4000-8000-000000000028",
+      "body": {
+        "Sa": {
+          "Shared": {
+            "Occurrence": {
+              "body": {
+                "Exchange": {
+                  "exchange": "52060906-0000-4000-8000-000000000022",
+                  "sender": "52060906-0000-4000-8000-00000000002a",
+                  "receiver": "52060906-0000-4000-8000-000000000029",
+                  "message_kind": "Reply",
+                  "reply_to": "52060906-0000-4000-8000-00000000002b",
+                  "values": []
+                }
+              },
+              "precondition": "",
+              "postcondition": ""
+            }
+          }
+        }
+      }
+    },
+    "af139b27-7e42-5729-9e49-53b2ac62c9e7": {
+      "id": "af139b27-7e42-5729-9e49-53b2ac62c9e7",
+      "alias": "oa_procedure",
+      "name": "Reusable assessment A to C",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Oa": {
+          "Process": {
+            "steps": [
+              "dc17769b-7e1e-5f15-99bb-0caf98bcb006",
+              "ef2a06af-6013-5f0b-a56d-db705f0685ce",
+              "c40c2011-4497-52f0-9e0e-10323b3150a8"
+            ]
+          }
+        }
+      }
+    },
+    "bf9ba00e-2aaa-5f04-9ba1-2c242d07b938": {
+      "id": "bf9ba00e-2aaa-5f04-9ba1-2c242d07b938",
+      "alias": "sa_b",
+      "name": "B · Review assessment",
+      "description": "",
+      "parent": "c1d4eda2-fac7-5621-a7ac-25f985911bf5",
+      "body": {
+        "Sa": {
+          "Shared": {
+            "Occurrence": {
+              "body": {
+                "Action": {
+                  "action": "3360ccb1-68ac-51cd-8d9a-8893000c80ef",
+                  "lifeline": null
+                }
+              },
+              "precondition": "",
+              "postcondition": ""
+            }
+          }
+        }
+      }
+    },
+    "c1d4eda2-fac7-5621-a7ac-25f985911bf5": {
+      "id": "c1d4eda2-fac7-5621-a7ac-25f985911bf5",
+      "alias": "sa_procedure",
+      "name": "Reusable assessment A to C",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Sa": {
+          "FunctionalChain": {
+            "steps": [
+              "14d1133a-697d-5b54-b624-eed0fb04a354",
+              "bf9ba00e-2aaa-5f04-9ba1-2c242d07b938",
+              "1a215aed-f0b1-521d-b52f-0c1cfbbf1c36"
+            ]
+          }
+        }
+      }
+    },
+    "c40c2011-4497-52f0-9e0e-10323b3150a8": {
+      "id": "c40c2011-4497-52f0-9e0e-10323b3150a8",
+      "alias": "oa_c",
+      "name": "C · Finish assessment",
+      "description": "",
+      "parent": "af139b27-7e42-5729-9e49-53b2ac62c9e7",
+      "body": {
+        "Oa": {
+          "Shared": {
+            "Occurrence": {
+              "body": {
+                "Action": {
+                  "action": "47335738-0876-5f90-b25e-1636c7448e93",
+                  "lifeline": null
+                }
+              },
+              "precondition": "",
+              "postcondition": ""
+            }
+          }
+        }
+      }
+    },
+    "d48951ad-c6db-5eae-923a-edccab97155e": {
+      "id": "d48951ad-c6db-5eae-923a-edccab97155e",
+      "alias": "oa_r1",
+      "name": "First assessment",
+      "description": "",
+      "parent": "2100ac23-79ee-54e1-b3cf-69f3d4f3b30a",
+      "body": {
+        "Oa": {
+          "Shared": {
+            "Occurrence": {
+              "body": {
+                "SequenceReference": {
+                  "sequence": "af139b27-7e42-5729-9e49-53b2ac62c9e7"
+                }
+              },
+              "precondition": "",
+              "postcondition": ""
+            }
+          }
+        }
+      }
+    },
+    "d4911fd0-52ed-535c-9f87-170e8f5731d2": {
+      "id": "d4911fd0-52ed-535c-9f87-170e8f5731d2",
+      "alias": "sa_caller",
+      "name": "Caller with three assessments",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Sa": {
+          "FunctionalChain": {
+            "steps": [
+              "53ad2109-ba9d-5859-b258-64cdaab5c4a8",
+              "62cfdab1-a18b-5b06-8ee7-cd0b320e4024",
+              "999b5e15-903f-5ca1-bc11-e51fadf80762",
+              "4a65dad8-e2a1-51dc-87a0-02ea4ab69384"
+            ]
+          }
+        }
+      }
+    },
+    "dc17769b-7e1e-5f15-99bb-0caf98bcb006": {
+      "id": "dc17769b-7e1e-5f15-99bb-0caf98bcb006",
+      "alias": "oa_a",
+      "name": "A · Begin assessment",
+      "description": "",
+      "parent": "af139b27-7e42-5729-9e49-53b2ac62c9e7",
+      "body": {
+        "Oa": {
+          "Shared": {
+            "Occurrence": {
+              "body": {
+                "Action": {
+                  "action": "25fdfe13-c45d-5822-830a-192ff13f660d",
+                  "lifeline": null
+                }
+              },
+              "precondition": "",
+              "postcondition": ""
+            }
+          }
+        }
+      }
+    },
+    "e16033cd-3184-56ef-b462-5559ad212c84": {
+      "id": "e16033cd-3184-56ef-b462-5559ad212c84",
+      "alias": "oa_inner",
+      "name": "Inner assessment",
+      "description": "",
+      "parent": "273d8df8-83c8-5d75-99d1-59a7c9fdb705",
+      "body": {
+        "Oa": {
+          "Shared": {
+            "Occurrence": {
+              "body": {
+                "SequenceReference": {
+                  "sequence": "af139b27-7e42-5729-9e49-53b2ac62c9e7"
+                }
+              },
+              "precondition": "",
+              "postcondition": ""
+            }
+          }
+        }
+      }
+    },
+    "e21febd2-30ec-5e9d-aa4c-3c54c95c2c9f": {
+      "id": "e21febd2-30ec-5e9d-aa4c-3c54c95c2c9f",
+      "alias": "sa_inner",
+      "name": "Inner assessment",
+      "description": "",
+      "parent": "7932ab3a-6b60-5059-a3a0-fca3a2f9a197",
+      "body": {
+        "Sa": {
+          "Shared": {
+            "Occurrence": {
+              "body": {
+                "SequenceReference": {
+                  "sequence": "c1d4eda2-fac7-5621-a7ac-25f985911bf5"
+                }
+              },
+              "precondition": "",
+              "postcondition": ""
+            }
+          }
+        }
+      }
+    },
+    "e78d841a-a37e-5106-8356-b1e3ce6d2501": {
+      "id": "e78d841a-a37e-5106-8356-b1e3ce6d2501",
+      "alias": "oa_work_x",
+      "name": "X · Check authorization",
+      "description": "",
+      "parent": null,
+      "body": {
+        "Oa": "Activity"
+      }
+    },
+    "ef2a06af-6013-5f0b-a56d-db705f0685ce": {
+      "id": "ef2a06af-6013-5f0b-a56d-db705f0685ce",
+      "alias": "oa_b",
+      "name": "B · Review assessment",
+      "description": "",
+      "parent": "af139b27-7e42-5729-9e49-53b2ac62c9e7",
+      "body": {
+        "Oa": {
+          "Shared": {
+            "Occurrence": {
+              "body": {
+                "Action": {
+                  "action": "a39639dc-0ece-5b71-981d-c9523fed4914",
+                  "lifeline": null
+                }
+              },
+              "precondition": "",
+              "postcondition": ""
+            }
+          }
+        }
+      }
+    },
+    "fc986c5c-eae7-5363-bcd5-b832d565a89a": {
+      "id": "fc986c5c-eae7-5363-bcd5-b832d565a89a",
+      "alias": "oa_r3",
+      "name": "Nested assessment",
+      "description": "",
+      "parent": "2100ac23-79ee-54e1-b3cf-69f3d4f3b30a",
+      "body": {
+        "Oa": {
+          "Shared": {
+            "Occurrence": {
+              "body": {
+                "SequenceReference": {
+                  "sequence": "273d8df8-83c8-5d75-99d1-59a7c9fdb705"
+                }
+              },
+              "precondition": "",
+              "postcondition": ""
+            }
+          }
+        }
+      }
+    }
+  },
+  "relations": {
+    "0fc11ada-23a6-5f39-9891-e7f363a1edfb": {
+      "id": "0fc11ada-23a6-5f39-9891-e7f363a1edfb",
+      "alias": "oa_a_then_b",
+      "name": "a then b",
+      "description": "",
+      "body": {
+        "SequenceLink": {
+          "source": "dc17769b-7e1e-5f15-99bb-0caf98bcb006",
+          "target": "ef2a06af-6013-5f0b-a56d-db705f0685ce",
+          "guard": ""
+        }
+      }
+    },
+    "169f558e-a466-5fcc-b0d7-53e481952714": {
+      "id": "169f558e-a466-5fcc-b0d7-53e481952714",
+      "alias": "oa_b_then_c",
+      "name": "b then c",
+      "description": "",
+      "body": {
+        "SequenceLink": {
+          "source": "ef2a06af-6013-5f0b-a56d-db705f0685ce",
+          "target": "c40c2011-4497-52f0-9e0e-10323b3150a8",
+          "guard": ""
+        }
+      }
+    },
+    "52060906-0000-4000-8000-00000000001e": {
+      "id": "52060906-0000-4000-8000-00000000001e",
+      "alias": "operation_probe_30",
+      "name": "InterfaceItemAllocation 30",
+      "description": "",
+      "body": {
+        "InterfaceItemAllocation": {
+          "source": "52060906-0000-4000-8000-000000000016",
+          "target": "52060906-0000-4000-8000-000000000014",
+          "order": 0,
+          "transmission": "Synchronous",
+          "acquisition": "Unspecified"
+        }
+      }
+    },
+    "52060906-0000-4000-8000-00000000001f": {
+      "id": "52060906-0000-4000-8000-00000000001f",
+      "alias": "operation_probe_31",
+      "name": "InterfaceItemAllocation 31",
+      "description": "",
+      "body": {
+        "InterfaceItemAllocation": {
+          "source": "52060906-0000-4000-8000-000000000016",
+          "target": "52060906-0000-4000-8000-000000000015",
+          "order": 0,
+          "transmission": "Synchronous",
+          "acquisition": "Unspecified"
+        }
+      }
+    },
+    "52060906-0000-4000-8000-000000000020": {
+      "id": "52060906-0000-4000-8000-000000000020",
+      "alias": "operation_probe_32",
+      "name": "InterfaceRequirement 32",
+      "description": "",
+      "body": {
+        "InterfaceRequirement": {
+          "source": "52060906-0000-4000-8000-00000000000c",
+          "target": "52060906-0000-4000-8000-000000000016"
+        }
+      }
+    },
+    "52060906-0000-4000-8000-000000000021": {
+      "id": "52060906-0000-4000-8000-000000000021",
+      "alias": "operation_probe_33",
+      "name": "InterfaceProvision 33",
+      "description": "",
+      "body": {
+        "InterfaceProvision": {
+          "source": "52060906-0000-4000-8000-00000000000d",
+          "target": "52060906-0000-4000-8000-000000000016"
+        }
+      }
+    },
+    "52060906-0000-4000-8000-000000000022": {
+      "id": "52060906-0000-4000-8000-000000000022",
+      "alias": "operation_probe_34",
+      "name": "BoundaryExchange 34",
+      "description": "",
+      "body": {
+        "BoundaryExchange": {
+          "source": "52060906-0000-4000-8000-00000000000c",
+          "target": "52060906-0000-4000-8000-00000000000d",
+          "oriented": false,
+          "items": [
+            "52060906-0000-4000-8000-000000000014",
+            "52060906-0000-4000-8000-000000000015"
+          ]
+        }
+      }
+    },
+    "661511e2-3604-5faf-9deb-f741925615bb": {
+      "id": "661511e2-3604-5faf-9deb-f741925615bb",
+      "alias": "sa_a_then_b",
+      "name": "a then b",
+      "description": "",
+      "body": {
+        "SequenceLink": {
+          "source": "14d1133a-697d-5b54-b624-eed0fb04a354",
+          "target": "bf9ba00e-2aaa-5f04-9ba1-2c242d07b938",
+          "guard": ""
+        }
+      }
+    },
+    "aedc3e72-fd4b-5dcd-b9c1-ced7aee3e0d1": {
+      "id": "aedc3e72-fd4b-5dcd-b9c1-ced7aee3e0d1",
+      "alias": "sa_b_then_c",
+      "name": "b then c",
+      "description": "",
+      "body": {
+        "SequenceLink": {
+          "source": "bf9ba00e-2aaa-5f04-9ba1-2c242d07b938",
+          "target": "1a215aed-f0b1-521d-b52f-0c1cfbbf1c36",
+          "guard": ""
+        }
+      }
+    }
+  },
+  "diagrams": {},
+  "artifact_links": {},
+  "traces": {}
+}
@@ -0,0 +1,477 @@
+arcadia 7;
+project source7_native_contract "Reusable procedures and operation identity" id "52060906-0000-4000-8000-000000000001" {
+    include "rationale.arcadia";
+    description "";
+
+    sa_function sa_work_a "A · Begin assessment" id "071edc32-5c27-5c1d-91ff-337c80b462d5" {
+        description "";
+        parent none;
+    }
+
+    oa_occurrence oa_x "X · Check authorization" id "08ff2083-dac1-5f4b-ad6a-7cc81d7be29d" {
+        body {
+            Action {
+                action @oa_work_x;
+                lifeline none;
+            };
+        };
+        description "";
+        parent @oa_caller;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_occurrence sa_a "A · Begin assessment" id "14d1133a-697d-5b54-b624-eed0fb04a354" {
+        body {
+            Action {
+                action @sa_work_a;
+                lifeline none;
+            };
+        };
+        description "";
+        parent @sa_procedure;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_occurrence sa_c "C · Finish assessment" id "1a215aed-f0b1-521d-b52f-0c1cfbbf1c36" {
+        body {
+            Action {
+                action @sa_work_c;
+                lifeline none;
+            };
+        };
+        description "";
+        parent @sa_procedure;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_occurrence oa_r2 "Second assessment" id "1e27be58-3e3e-5869-ad30-e94a28ea2a2e" {
+        body {
+            SequenceReference {
+                sequence @oa_procedure;
+            };
+        };
+        description "";
+        parent @oa_caller;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_process oa_caller "Caller with three assessments" id "2100ac23-79ee-54e1-b3cf-69f3d4f3b30a" {
+        description "";
+        parent none;
+        steps [@oa_x, @oa_r1, @oa_r2, @oa_r3];
+    }
+
+    oa_activity oa_work_a "A · Begin assessment" id "25fdfe13-c45d-5822-830a-192ff13f660d" {
+        description "";
+        parent none;
+    }
+
+    oa_process oa_nested_definition "Nested assessment wrapper" id "273d8df8-83c8-5d75-99d1-59a7c9fdb705" {
+        description "";
+        parent none;
+        steps [@oa_inner];
+    }
+
+    sa_function sa_work_b "B · Review assessment" id "3360ccb1-68ac-51cd-8d9a-8893000c80ef" {
+        description "";
+        parent none;
+    }
+
+    oa_activity oa_work_c "C · Finish assessment" id "47335738-0876-5f90-b25e-1636c7448e93" {
+        description "";
+        parent none;
+    }
+
+    sa_occurrence sa_r3 "Nested assessment" id "4a65dad8-e2a1-51dc-87a0-02ea4ab69384" {
+        body {
+            SequenceReference {
+                sequence @sa_nested_definition;
+            };
+        };
+        description "";
+        parent @sa_caller;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_actor operation_probe_10 "Operator console" id "52060906-0000-4000-8000-00000000000a" {
+        description "";
+        parent none;
+    }
+
+    sa_system operation_probe_11 "Valve service" id "52060906-0000-4000-8000-00000000000b" {
+        description "";
+        parent none;
+    }
+
+    sa_port operation_probe_12 "Service socket" id "52060906-0000-4000-8000-00000000000c" {
+        contract {
+            Component {
+                kind Standard;
+                orientation Unset;
+            };
+        };
+        description "";
+        legacy none;
+        parent @operation_probe_10;
+    }
+
+    sa_port operation_probe_13 "Service socket" id "52060906-0000-4000-8000-00000000000d" {
+        contract {
+            Component {
+                kind Standard;
+                orientation Unset;
+            };
+        };
+        description "";
+        legacy none;
+        parent @operation_probe_11;
+    }
+
+    sa_exchange_item operation_probe_20 "Reset" id "52060906-0000-4000-8000-000000000014" {
+        description "";
+        kind Information;
+        mechanism Operation;
+        parent none;
+        supertype none;
+    }
+
+    sa_exchange_item operation_probe_21 "ReadStatus" id "52060906-0000-4000-8000-000000000015" {
+        description "";
+        kind Information;
+        mechanism Operation;
+        parent none;
+        supertype none;
+    }
+
+    sa_interface operation_probe_22 "Valve commands" id "52060906-0000-4000-8000-000000000016" {
+        description "";
+        parent none;
+        supertype none;
+    }
+
+    sa_scenario operation_probe_40 "Reset then read status" id "52060906-0000-4000-8000-000000000028" {
+        context none;
+        description "";
+        parent none;
+        postcondition "";
+        precondition "";
+        steps [@operation_probe_43, @operation_probe_44, @reset_reply];
+        viewpoint BoundaryInterface;
+    }
+
+    sa_lifeline operation_probe_41 "Service participant" id "52060906-0000-4000-8000-000000000029" {
+        description "";
+        parent @operation_probe_40;
+        represented @operation_probe_10;
+    }
+
+    sa_lifeline operation_probe_42 "Service participant" id "52060906-0000-4000-8000-00000000002a" {
+        description "";
+        parent @operation_probe_40;
+        represented @operation_probe_11;
+    }
+
+    sa_occurrence operation_probe_43 "Call Reset" id "52060906-0000-4000-8000-00000000002b" {
+        body {
+            Exchange {
+                exchange @operation_probe_34;
+                message_kind Call;
+                receiver @operation_probe_42;
+                reply_to none;
+                sender @operation_probe_41;
+                values [];
+            };
+        };
+        description "";
+        parent @operation_probe_40;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_occurrence operation_probe_44 "Call ReadStatus" id "52060906-0000-4000-8000-00000000002c" {
+        body {
+            Exchange {
+                exchange @operation_probe_34;
+                message_kind Call;
+                receiver @operation_probe_42;
+                reply_to none;
+                sender @operation_probe_41;
+                values [];
+            };
+        };
+        description "";
+        parent @operation_probe_40;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_occurrence sa_x "X · Check authorization" id "53ad2109-ba9d-5859-b258-64cdaab5c4a8" {
+        body {
+            Action {
+                action @sa_work_x;
+                lifeline none;
+            };
+        };
+        description "";
+        parent @sa_caller;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_occurrence sa_r1 "First assessment" id "62cfdab1-a18b-5b06-8ee7-cd0b320e4024" {
+        body {
+            SequenceReference {
+                sequence @sa_procedure;
+            };
+        };
+        description "";
+        parent @sa_caller;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_function sa_work_c "C · Finish assessment" id "6575bce8-4185-519b-a004-d96650da63dc" {
+        description "";
+        parent none;
+    }
+
+    sa_functional_chain sa_nested_definition "Nested assessment wrapper" id "7932ab3a-6b60-5059-a3a0-fca3a2f9a197" {
+        description "";
+        parent none;
+        steps [@sa_inner];
+    }
+
+    sa_function sa_work_x "X · Check authorization" id "8c3d9b89-aa12-5218-9de9-12b8b5d4e4b3" {
+        description "";
+        parent none;
+    }
+
+    sa_occurrence sa_r2 "Second assessment" id "999b5e15-903f-5ca1-bc11-e51fadf80762" {
+        body {
+            SequenceReference {
+                sequence @sa_procedure;
+            };
+        };
+        description "";
+        parent @sa_caller;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_activity oa_work_b "B · Review assessment" id "a39639dc-0ece-5b71-981d-c9523fed4914" {
+        description "";
+        parent none;
+    }
+
+    sa_occurrence reset_reply "Correlated reset reply" id "aa8b674f-012f-583f-8dc7-a76407d1f8a7" {
+        body {
+            Exchange {
+                exchange @operation_probe_34;
+                message_kind Reply;
+                receiver @operation_probe_41;
+                reply_to @operation_probe_43;
+                sender @operation_probe_42;
+                values [];
+            };
+        };
+        description "";
+        parent @operation_probe_40;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_process oa_procedure "Reusable assessment A to C" id "af139b27-7e42-5729-9e49-53b2ac62c9e7" {
+        description "";
+        parent none;
+        steps [@oa_a, @oa_b, @oa_c];
+    }
+
+    sa_occurrence sa_b "B · Review assessment" id "bf9ba00e-2aaa-5f04-9ba1-2c242d07b938" {
+        body {
+            Action {
+                action @sa_work_b;
+                lifeline none;
+            };
+        };
+        description "";
+        parent @sa_procedure;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_functional_chain sa_procedure "Reusable assessment A to C" id "c1d4eda2-fac7-5621-a7ac-25f985911bf5" {
+        description "";
+        parent none;
+        steps [@sa_a, @sa_b, @sa_c];
+    }
+
+    oa_occurrence oa_c "C · Finish assessment" id "c40c2011-4497-52f0-9e0e-10323b3150a8" {
+        body {
+            Action {
+                action @oa_work_c;
+                lifeline none;
+            };
+        };
+        description "";
+        parent @oa_procedure;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_occurrence oa_r1 "First assessment" id "d48951ad-c6db-5eae-923a-edccab97155e" {
+        body {
+            SequenceReference {
+                sequence @oa_procedure;
+            };
+        };
+        description "";
+        parent @oa_caller;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_functional_chain sa_caller "Caller with three assessments" id "d4911fd0-52ed-535c-9f87-170e8f5731d2" {
+        description "";
+        parent none;
+        steps [@sa_x, @sa_r1, @sa_r2, @sa_r3];
+    }
+
+    oa_occurrence oa_a "A · Begin assessment" id "dc17769b-7e1e-5f15-99bb-0caf98bcb006" {
+        body {
+            Action {
+                action @oa_work_a;
+                lifeline none;
+            };
+        };
+        description "";
+        parent @oa_procedure;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_occurrence oa_inner "Inner assessment" id "e16033cd-3184-56ef-b462-5559ad212c84" {
+        body {
+            SequenceReference {
+                sequence @oa_procedure;
+            };
+        };
+        description "";
+        parent @oa_nested_definition;
+        postcondition "";
+        precondition "";
+    }
+
+    sa_occurrence sa_inner "Inner assessment" id "e21febd2-30ec-5e9d-aa4c-3c54c95c2c9f" {
+        body {
+            SequenceReference {
+                sequence @sa_procedure;
+            };
+        };
+        description "";
+        parent @sa_nested_definition;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_activity oa_work_x "X · Check authorization" id "e78d841a-a37e-5106-8356-b1e3ce6d2501" {
+        description "";
+        parent none;
+    }
+
+    oa_occurrence oa_b "B · Review assessment" id "ef2a06af-6013-5f0b-a56d-db705f0685ce" {
+        body {
+            Action {
+                action @oa_work_b;
+                lifeline none;
+            };
+        };
+        description "";
+        parent @oa_procedure;
+        postcondition "";
+        precondition "";
+    }
+
+    oa_occurrence oa_r3 "Nested assessment" id "fc986c5c-eae7-5363-bcd5-b832d565a89a" {
+        body {
+            SequenceReference {
+                sequence @oa_nested_definition;
+            };
+        };
+        description "";
+        parent @oa_caller;
+        postcondition "";
+        precondition "";
+    }
+
+    sequence_link oa_a_then_b "a then b" id "0fc11ada-23a6-5f39-9891-e7f363a1edfb" {
+        description "";
+        guard "";
+        source @oa_a;
+        target @oa_b;
+    }
+
+    sequence_link oa_b_then_c "b then c" id "169f558e-a466-5fcc-b0d7-53e481952714" {
+        description "";
+        guard "";
+        source @oa_b;
+        target @oa_c;
+    }
+
+    interface_item_allocation operation_probe_30 "InterfaceItemAllocation 30" id "52060906-0000-4000-8000-00000000001e" {
+        acquisition Unspecified;
+        description "";
+        order 0;
+        source @operation_probe_22;
+        target @operation_probe_20;
+        transmission Synchronous;
+    }
+
+    interface_item_allocation operation_probe_31 "InterfaceItemAllocation 31" id "52060906-0000-4000-8000-00000000001f" {
+        acquisition Unspecified;
+        description "";
+        order 0;
+        source @operation_probe_22;
+        target @operation_probe_21;
+        transmission Synchronous;
+    }
+
+    interface_requirement operation_probe_32 "InterfaceRequirement 32" id "52060906-0000-4000-8000-000000000020" {
+        description "";
+        source @operation_probe_12;
+        target @operation_probe_22;
+    }
+
+    interface_provision operation_probe_33 "InterfaceProvision 33" id "52060906-0000-4000-8000-000000000021" {
+        description "";
+        source @operation_probe_13;
+        target @operation_probe_22;
+    }
+
+    boundary_exchange operation_probe_34 "BoundaryExchange 34" id "52060906-0000-4000-8000-000000000022" {
+        description "";
+        items [@operation_probe_20, @operation_probe_21];
+        oriented false;
+        source @operation_probe_12;
+        target @operation_probe_13;
+    }
+
+    sequence_link sa_a_then_b "a then b" id "661511e2-3604-5faf-9deb-f741925615bb" {
+        description "";
+        guard "";
+        source @sa_a;
+        target @sa_b;
+    }
+
+    sequence_link sa_b_then_c "b then c" id "aedc3e72-fd4b-5dcd-b9c1-ced7aee3e0d1" {
+        description "";
+        guard "";
+        source @sa_b;
+        target @sa_c;
+    }
+
+}
@@ -0,0 +1 @@
+// Native oracle: retain this authored 雨 note and CRLF.
@@ -0,0 +1,14 @@
+{
+  "expected-baseline.json": {
+    "bytes": 26428,
+    "sha256": "e2882a58f841f460f45d9d67db1606440e0d7997b9b29a784569ae48e4b23bfb"
+  },
+  "project.arcadia": {
+    "bytes": 13616,
+    "sha256": "5474d8ca05fd1375220dc0ad40d913631fde51159e9632bb9f290d1ecdab8dd7"
+  },
+  "rationale.arcadia": {
+    "bytes": 59,
+    "sha256": "e6a600e13036d4ad594a65380ed1b3d82d1772d583041bb0a624c9588a73047a"
+  }
+}
@@ -1,5 +1,5 @@
 //! Independent exact native lesson oracle, compiled against existing core libraries.
-//! Usage: CHECKER oa|review NATIVE_ENTRY BEFORE_REVIEW_ENTRY OUTPUT_DIRECTORY
+//! Usage: CHECKER oa|review|fold|state-rename NATIVE_ENTRY BEFORE_REVIEW_ENTRY OUTPUT_DIRECTORY
 #[path = "../examples/release1/model.rs"]
 mod teaching;
 use oa_core::{source_files, source_project::*, transitions::*, *};
@@ -14,7 +14,13 @@ fn disk(entry: &Path) -> CompiledSourceProject {
        "{:?}",
        read.diagnostics
    );
-    compile_bundle(&read.reachable_bundle(), ProjectLimits::default()).unwrap()
+    let raw = read.reachable_bundle();
+    let compiled = compile_bundle(&raw, ProjectLimits::default()).unwrap();
+    assert_eq!(
+        raw, compiled.bundle,
+        "Use a checker built for the source profile being measured; migration or identity stabilization must not normalize the native bytes."
+    );
+    compiled
 }
 fn compare(expected: &CompiledSourceProject, actual: &CompiledSourceProject, label: &str) {
    assert_eq!(
@@ -42,9 +48,12 @@ fn main() {
    assert_eq!(
        args.len(),
        5,
-        "usage: CHECKER oa|review NATIVE_ENTRY BEFORE_REVIEW_ENTRY OUTPUT_DIRECTORY"
+        "usage: CHECKER oa|review|fold|state-rename NATIVE_ENTRY BEFORE_REVIEW_ENTRY OUTPUT_DIRECTORY"
    );
-    assert!(matches!(args[1].as_str(), "oa" | "review"));
+    assert!(matches!(
+        args[1].as_str(),
+        "oa" | "review" | "fold" | "state-rename"
+    ));
    let lesson = teaching::build();
    assert_eq!(lesson.before_transition.id, lesson.project.id);
    assert!(!lesson.request.sources.is_empty());
@@ -85,7 +94,37 @@ fn main() {
    assert!(plan.conflicts.is_empty(), "{:?}", plan.conflicts);
    let reviewed = apply_semantic_transition(&before.decoded.project, &plan).unwrap();
    let after = update_bundle(&before, &reviewed, ProjectLimits::default()).unwrap();
-    let expected = if args[1] == "oa" { &before } else { &after };
+    let mut state_model = reviewed.clone();
+    if args[1] == "fold" {
+        let diagram = state_model
+            .diagrams
+            .get_mut(&teaching::id("sa_state_view"))
+            .unwrap();
+        let matching: Vec<_> = diagram
+            .nodes
+            .values_mut()
+            .filter(|node| node.element == teaching::id("sa_monitor_region"))
+            .collect();
+        assert_eq!(matching.len(), 1);
+        for node in matching {
+            assert!(!node.collapsed);
+            node.collapsed = true;
+        }
+    } else if args[1] == "state-rename" {
+        let work = state_model
+            .elements
+            .get_mut(&teaching::id("sa_assess"))
+            .unwrap();
+        assert_eq!(work.name, "Assess pressure alarm");
+        work.name = "Assess incoming pressure alarm".into();
+    }
+    let state_model = execute_batch(&reviewed, &[Command::Replace(state_model)]).unwrap();
+    let state_after = update_bundle(&after, &state_model, ProjectLimits::default()).unwrap();
+    let expected = match args[1].as_str() {
+        "oa" => &before,
+        "review" => &after,
+        _ => &state_after,
+    };
    let output = Path::new(&args[4]);
    fs::create_dir_all(output).unwrap();
    fs::write(
@@ -0,0 +1,176 @@
+//! Run once against the frozen schema-6 library, never regenerate with schema7.
+use oa_core::{source_project::*, *};
+use serde::Serialize;
+use serde::ser::{SerializeStruct, Serializer};
+use std::{collections::BTreeSet, fs, path::Path};
+struct Project5<'a>(&'a Project);
+struct Diagram5<'a>(&'a Diagram);
+impl Serialize for Project5<'_> {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        let p = self.0;
+        let diagrams: std::collections::BTreeMap<_, _> =
+            p.diagrams.iter().map(|(id, d)| (id, Diagram5(d))).collect();
+        let mut s = serializer.serialize_struct("Project", 10)?;
+        s.serialize_field("schema_version", &5u32)?;
+        s.serialize_field("id", &p.id)?;
+        s.serialize_field("alias", &p.alias)?;
+        s.serialize_field("name", &p.name)?;
+        s.serialize_field("description", &p.description)?;
+        s.serialize_field("elements", &p.elements)?;
+        s.serialize_field("relations", &p.relations)?;
+        s.serialize_field("diagrams", &diagrams)?;
+        s.serialize_field("artifact_links", &p.artifact_links)?;
+        s.serialize_field("traces", &p.traces)?;
+        s.end()
+    }
+}
+impl Serialize for Diagram5<'_> {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        let d = self.0;
+        let mut s = serializer.serialize_struct("Diagram", 8)?;
+        s.serialize_field("id", &d.id)?;
+        s.serialize_field("alias", &d.alias)?;
+        s.serialize_field("name", &d.name)?;
+        s.serialize_field("description", &d.description)?;
+        s.serialize_field("layer", &d.layer)?;
+        s.serialize_field("projection", &d.projection)?;
+        s.serialize_field("nodes", &d.nodes)?;
+        s.serialize_field("routes", &d.routes)?;
+        s.end()
+    }
+}
+fn alias(p: &Project, name: &str) -> Id {
+    p.elements
+        .values()
+        .find(|e| e.alias == name)
+        .map(|e| e.id)
+        .or_else(|| p.relations.values().find(|e| e.alias == name).map(|e| e.id))
+        .unwrap()
+}
+fn main() {
+    assert_eq!(
+        SCHEMA_VERSION, 6,
+        "fixture writer must use historical core6 library"
+    );
+    let out = Path::new("crates/oa-desktop/src/recovery/fixtures");
+    fs::create_dir_all(out).unwrap();
+    let original = persistence::decode(&fs::read("examples/release1/model.json").unwrap()).unwrap();
+    for schema in [5, 6] {
+        let mut p = original.clone();
+        if schema == 5 {
+            let mut removed: BTreeSet<_> = p
+                .elements
+                .values()
+                .filter(|e| e.kind() == Kind::ExchangeCategory)
+                .map(|e| e.id)
+                .collect();
+            removed.extend(
+                p.relations
+                    .values()
+                    .filter(|r| r.kind() == RelationKind::CommunicationMean)
+                    .map(|r| r.id),
+            );
+            removed.extend(
+                p.relations
+                    .values()
+                    .filter(|r| {
+                        r.kind() == RelationKind::ExchangeAllocation
+                            && removed.contains(&r.source())
+                    })
+                    .map(|r| r.id)
+                    .collect::<Vec<_>>(),
+            );
+            p.elements.retain(|id, _| !removed.contains(id));
+            p.relations.retain(|id, _| !removed.contains(id));
+            p.traces
+                .retain(|_, t| !removed.contains(&t.oa) && !removed.contains(&t.sa));
+            for d in p.diagrams.values_mut() {
+                d.view_options = Default::default();
+            }
+            let assess = alias(&p, "oa_assess");
+            let repair = alias(&p, "oa_repair");
+            let request = alias(&p, "oa_repair_request");
+            for name in ["oa_conversation", "oa_full_scenario"] {
+                let id = alias(&p, name);
+                let Some(SharedBody::Scenario { viewpoint, .. }) =
+                    p.elements.get_mut(&id).unwrap().shared_mut()
+                else {
+                    panic!()
+                };
+                *viewpoint = ScenarioViewpoint::OperationalActivity;
+            }
+            for (name, work) in [
+                ("oa_caller", assess),
+                ("oa_responder", repair),
+                ("oa_outer_controller", assess),
+                ("oa_outer_technician", repair),
+            ] {
+                let id = alias(&p, name);
+                let Some(SharedBody::Lifeline { represented }) =
+                    p.elements.get_mut(&id).unwrap().shared_mut()
+                else {
+                    panic!()
+                };
+                *represented = Some(work);
+            }
+            for name in ["oa_call", "oa_reply"] {
+                let id = alias(&p, name);
+                let Some(SharedBody::Occurrence {
+                    body: OccurrenceBody::Exchange { exchange, .. },
+                    ..
+                }) = p.elements.get_mut(&id).unwrap().shared_mut()
+                else {
+                    panic!()
+                };
+                *exchange = Some(request);
+            }
+        }
+        let issues = validation::validate(&p);
+        assert!(
+            !issues
+                .iter()
+                .any(|i| i.severity == validation::Severity::Error),
+            "{issues:?}"
+        );
+        let mut bundle = format_bundle(&p);
+        if schema == 5 {
+            let block = "    view_options {\n        coverage \"All\";\n        exchange_labels \"Name\";\n        hidden_edges [];\n        participant_categories \"All\";\n        relation_kinds \"All\";\n        work_categories \"All\";\n        work_contexts \"All\";\n    };\n";
+            let mut removed = 0;
+            for text in bundle.files.values_mut() {
+                removed += text.matches(block).count();
+                *text = text.replace(block, "");
+            }
+            assert_eq!(removed, p.diagrams.len());
+        }
+        let entry = bundle.files.get_mut(&bundle.entry).unwrap();
+        *entry = entry.replacen(
+            "arcadia 6;",
+            &format!("// Frozen legacy recovery input 雨.\r\narcadia // profile\r\n {schema};"),
+            1,
+        );
+        let compiled = compile_bundle(&bundle, ProjectLimits::default()).unwrap();
+        assert_eq!(compiled.decoded.project, p);
+        let bytes = if schema == 5 {
+            serde_json::to_vec(&Project5(&p)).unwrap()
+        } else {
+            serde_json::to_vec(&p).unwrap()
+        };
+        assert_eq!(persistence::decode(&bytes).unwrap(), p);
+        fs::write(out.join(format!("source{schema}-model.json")), &bytes).unwrap();
+        fs::write(
+            out.join(format!("source{schema}-bundle.json")),
+            serde_json::to_string_pretty(&bundle).unwrap() + "\n",
+        )
+        .unwrap();
+        let hash = bytes.iter().fold(0xcbf29ce484222325u64, |h, b| {
+            (h ^ u64::from(*b)).wrapping_mul(0x100000001b3)
+        });
+        println!(
+            "source{schema}: files={}, elements={}, relations={}, traces={}, fingerprint={hash:016x}",
+            bundle.files.len(),
+            p.elements.len(),
+            p.relations.len(),
+            p.traces.len()
+        );
+    }
+}
@@ -0,0 +1,46 @@
+# Basic diagram editing priority reset — 7 September 2026
+
+The user reported that advanced semantic review is noisy and unclear, while basic diagram creation and layer transitions remain difficult. This changes the immediate priority: establish usable everyday authoring before extending advanced workflows. Existing release requirements remain open.
+
+The user explicitly authorized resuming desktop checks after the earlier Escape stop. Root resumed only the isolated test application, with both APPDATA and LOCALAPPDATA pointing to `.local/native-qa/basic-editing-20260907-profile`. The observed fresh Home contained no recent models. Discovery binary SHA256: `327FBDF734716A7F1AF2874183D46A531A8F429BA1A478E83A3E7F2EB1D6248B`.
+
+## Reproduced problems
+
+- Empty OA Allocation offered a global creation catalog including scenario and state-machine types; canvas tools had no entity creation action.
+- Creating an Entity immediately committed `New entity` and changed zoom from 100% to 150%, rather than requesting a name and respecting the clicked point.
+- Ordinary OA-to-SA transition presented an unmade System/System actor choice as an unresolved conflict. Its result view was selected by target-layer UUID order, which can choose an incompatible state diagram.
+- Reviewing a newly created, unchanged counterpart opened seven tabs, duplicate row selectors and unreviewed fields without explaining the task.
+
+## Work underway and acceptance
+
+Creation work adds named, contextual canvas creation and a relevant existing-element picker, preserving camera, clicked world position, raw drafts and one-step history. Transition work adds a compatible result-view picker, safe automatic destination selection, explicit boundary choice and preservation of existing placements/routes. Review presentation work explains its purpose and reduces default navigation noise without changing semantic operations.
+
+Root owns native checks and review presentation. `state_contract` owns creation and narrow app integration; `behavior_review` owns transition implementation and tests; `state_representation` owns an independent deterministic fixture/oracle and recovery review. Shared Cargo work is serialized.
+
+Required acceptance: named Entity/Actor/Activity creation; cancellation; contextual existing placement; connections and explicit allocation; zoom/pan and move; visible layer-transition destination and boundary choice; complete Save/Undo/Redo/reopen source equality; raw-draft guards; and usable minimum-window layout. Implementation and historical passing test counts are not native acceptance of these changes.
+
+## Integration findings
+
+Initial creation-filter tests passed 14/14 and new transition tests passed 6/6. The existing transition-context group found one regression (4/5 passed): the new free-space rule also moved new scenario placements in an explicitly chosen behavior destination. The rule was narrowed to ordinary roots; the existing complete-model assertion was kept unchanged.
+
+Independent review checked recovery binding, stale gestures and destination compatibility. Start cannot replace a retained named draft; start/submit/edit/cancel invalidate earlier placement gestures. A new application-level regression checks that an explicitly selected Overview wins over another Allocation view already containing the counterpart.
+
+The Add-existing results list now adapts to window height. Its real minimum-window layout remains a native gate; an experimental spacer-based layout test was removed because it did not measure the actual dialog. The initial integration compile exposed a missing renderer bound in that removed helper; no test pass was claimed from the failed compilation. The repeated integration run uses the simplified production layout.
+
+The independent [fixture and complete source oracle](fixtures/basic-editing/README.md) compiled with warnings denied and passed its self-check and exact baseline. It includes six seed elements, four views and two source files. Capabilities is a valid but unchosen destination for a SystemActor; the StateMachine is the incompatible decoy. The checker does not copy observed names, aliases, geometry or source text into its prediction.
+
+Review presentation now explains counterpart updating, displays the copy direction and uses one review-area selector. All seven areas and existing decisions remain reachable. Required additional changes retain the combined-plan approval gate. The guide is being aligned with the named creation, existing placement and result-view controls.
+
+Linux work is deferred during this correction. No VM is running; the policy-rejected direct boot action must not be retried or bypassed. The full release goal remains active and incomplete.
+
+## Native v1 and second Escape stop
+
+The integration gates passed: full desktop **584/584**, no failures or ignored cases (209.82 seconds test execution); Windows workspace binaries; formatting; and strict workspace/all-target Clippy. Logs/status: `.local/basic-editing-gates-status.json`. The guide's creation and transition instructions were updated during test execution; the subsequent binary build and Clippy include those label-only edits.
+
+Isolated executable `.local/native-qa/bin-basic-editing-20260907-v1/arcadia-studio.exe` has SHA256 `D8CFAA0E714EEAD552BF0A0138B7255E6E9529D91657A603AA8D94C00320384D`. Process 9600 uses fresh APPDATA and LOCALAPPDATA under `basic-editing-acceptance-v1-profile`, clean system PATH and the copied fixture `basic-editing-acceptance-v1-work`. Fresh Home showed no recent models.
+
+At 1444×932, the fixture opened to its OA Allocation view at 100%. Entity, Actor, Activity and Add existing were directly available on the canvas toolbar; the old global creation catalog was absent from Architecture. Entity opened a focused name dialog. Typing `Rescue team` and pressing Enter left the accepted object count at six until the canvas click; committing created the seventh object with its final name and retained 100% zoom.
+
+**Native defect:** the ordinary creation toolbar is one row, while the pending toolbar is two. The canvas top moved from approximately y391 to y414 while placing, then back to y391 on commit. Clicking (401,550) produced a node whose top-left was approximately (401,528): the world conversion was correct but the widget layout shifted the visible point. The toolbar needs invariant geometry before placement can be accepted.
+
+The user physically pressed Escape at the next attempted Ctrl+Z. Computer Use rejected that action as stopped; **Undo was not observed or claimed**. Root stopped native control and interrupted the creation agent. Process 9600 remained live at the next read-only check, with an unsaved QA Entity (`9bcf91e3-22d8-489d-8459-561ab726ab6f`). No native creation/history/source equality, transition, minimum-height or current review pass is claimed. The goal continuation resumes code work only; native control remains paused until renewed user authorization.
@@ -0,0 +1,88 @@
+# Capella 7.1 basic editing benchmark and redesign
+
+The user's rejection of the large horizontal creation buttons supersedes the
+previous toolbar proposal. On 2026-09-07 the user explicitly requested consulting
+the installed Capella through Computer Use. That renewed authorization follows
+the earlier Escape stop; native consultation resumed on a disposable project.
+
+## Environment and method
+
+Actual executable: `C:\Users\User\capella-7.1.0.202606231255-win32-win32-x86_64\capella\capella.exe`.
+An isolated workspace `.local/capella-basic-ux-20260907` contains the native-created
+project `Basic Editing Benchmark`. The `[OAB] Operational Entities` diagram was
+opened from the Operational Analysis workflow. Observations below were made in
+the real application at approximately 1010 × 760, using Computer Use. Saved
+`.capella` XML independently establishes the semantic result of creation and
+allocation. This is separate from the older Capella 7.0 benchmark.
+
+## Observed behavior
+
+* A narrow right palette groups Entities, Roles, Activities, Accelerators and
+  Common tools. It collapses completely. Its context menu offers List, Columns,
+  Icons Only and Details, plus an independent large-icons option. Icons Only was
+  exercised: small glyphs and tooltips expose the contextual tools without a
+  horizontal creation row. Some labels in List mode clipped at this width.
+* Selecting Operational Entity and clicking the canvas creates `OE 1`. F2 edits
+  the label directly on the node; entering `Rescue team` and pressing Enter updates
+  the model and Properties. Selection also changes a formatting toolbar and shifts
+  Capella's canvas vertically; that jump is a weakness to avoid copying.
+* Selecting Operational Activity and clicking inside Rescue team creates a nested
+  activity and expands its graphical container. The saved activity remains under
+  the root Operational Activity, with a separate ComponentFunctionalAllocation
+  from the Entity. Graphical nesting therefore does not imply semantic ownership.
+* Saved identities: Entity `3cb395ad-2932-402c-bd51-6a667a45940e`, Activity
+  `29a873f8-eb2a-41bd-b48f-3ef6a973027b`, allocation
+  `5693d9ff-9a45-4809-b090-edf4b0f01c0e`. Only this disposable model was changed.
+* The Manage Activity Allocation tooltip explicitly describes connecting an
+  existing activity to a participant and displaying it there. The endpoint action
+  itself was not exercised in this pass.
+* Interactions and Operational Processes Insert/Remove tooltips explicitly
+  distinguish changing graphical presence from deleting semantic objects. These
+  tooltips were inspected; no insertion/removal operation is claimed as tested.
+* The Entity context menu exposes Transitions and Allocation Management. Create
+  System Actor opens a large candidate/result merge preview. Clicking OK closed
+  it, but the saved model did **not** contain the proposed SA actor. This establishes
+  contextual initiation and preview, not a successful transition. No automatic
+  merge behavior is inferred from the dialog closing.
+
+## Alternatives and decision
+
+The rejected horizontal buttons made common commands visible but consumed canvas
+height and changed its origin during placement. Context-menu-only creation would
+save space but hide the primary workflow. A permanently expanded catalogue would
+repeat the global-list problem. Select a compact side palette with explicit label
+expansion and contextual menus as a second entry point.
+
+The implementation target is a neutral 36 px palette, explicitly expandable to
+156 px. It contains projection-compatible creation and connection tools, compact
+vector icons, tooltips and clear selected-tool feedback. Only toggling its width
+may resize the canvas; arming a tool, typing, validation, committing and cancelling
+must not move the clicked location on screen.
+
+Creation is tool → canvas point → name in place → Enter. Escape cancels without
+accepting a placeholder. F2 uses the same in-place editor for Rename. Add existing
+offers compatible unplaced objects by default, with explicit broader filtering
+and Locate for already placed objects. Contextual Add activity / Add function on
+a participant names that performer and creates the work plus allocation in one
+undoable transaction. Ordinary root creation remains unallocated. Connections
+belong in the same palette, not a second permanent button row.
+
+This adopts Capella's useful interaction and domain distinctions while avoiding
+its clipped labels, immediate placeholder commits and large merge dialogue for
+ordinary creation. The proposed editor is still an implementation hypothesis;
+compactness alone does not establish usability.
+
+## Acceptance still required
+
+Inspect the actual new executable at wide and minimum sizes. Check discovery,
+tool state, pointer placement, name focus, Enter/Escape, long names and edge
+clamping; canvas origin must remain stable through every drafting phase. Exercise
+F2, compatible existing-object insertion, explicit allocated work and connection
+creation. Verify exact source/model Save, Undo, Redo and recovery, followed by
+ordinary forward/reverse transition destination selection. Preserve the existing
+independent oracle; update its interaction instructions, not its expected model
+to match whatever the new UI happens to produce.
+
+The prior v1 build passed 584 desktop tests and build/lint gates, but remains a
+rejected UI with an observed 22 px placement jump. Its pass does not transfer to
+this redesign. The release goal remains active and incomplete.
@@ -0,0 +1,78 @@
+# Contextual path native finding
+
+Confirmed from accepted source and production code, independently of the screenshot.
+The accepted `oa-link-accepted/project.arcadia` SHA256 is
+`40351AF825518FE44FCD67E33D5289C2FD3C1AFBF29A2A7D27BA11896918CD5F`.
+Its link `d5eb66cc-231e-477a-97ea-521c065e1415` has owner `oa_caller`, source
+`[]/oa_x`, target `[oa_r1]/oa_b`, and guard `Check accepted`. The source identity
+and `endpoint_rect` matching are correct.
+
+## Defect
+
+With the fixture's ordinary preview, all caller contributions occupy x=24..294.
+X occupies y=24..128. First assessment begins at y=164; its visible B mini-card is
+`(161,282,113,32)`. The old route correctly ended at `(161,298)`, but used
+`end.x-16=145` as its long vertical return gutter. That lies inside First, Second,
+and Nested assessment cards. The route unnecessarily went below every card first.
+
+Additionally, contextual arrows were painted before opaque outer reference
+backgrounds. That covered the terminal arrow even though its semantic anchor was
+correct. Selection prioritized the enclosing reference over the visible terminal
+stub. This is a routing/paint/hit-testing defect, not an endpoint or model defect.
+
+## Bounded correction (desktop only)
+
+- Route via outer-card column gutters. Visible left/right mini-columns connect
+  through their outward-facing host padding; hidden addresses use the host border.
+- The native X→First.B case now follows `(294,76) → (312,76) → (312,298) → (274,298)`:
+  a short clear right gutter terminating on B's right border. Other-side routes
+  retain a bounded below-card detour. Parallel exact links keep distinct paths and
+  labels. Caller layout, source identities, and bounded preview enumeration stay
+  unchanged.
+- Explicit paint passes keep legacy direct edges below node backgrounds while
+  painting contextual paths after outer backgrounds and before mini-card content.
+  Thus the arrowhead stays visible in the selected mini-card's clear outer padding.
+- Exact mini-card selection remains first, followed by selected direct-link
+  endpoint handles, then contextual stubs, then enclosing references. Independent
+  review caught an initial mixed-edge priority regression: when both edge kinds
+  shared X's source anchor, the contextual hit stole the direct reconnect press.
+  The corrected ordering preserves that selected handle's drag behavior.
+
+Owned files: `behavior/topology.rs`, `behavior/topology/direct.rs`, and new
+`behavior/topology/contextual_routing.rs`. Targeted rustfmt completed; no Cargo run
+was made while the Linux worker held the heavy execution lease. This desktop delta
+does not change the frozen Linux core/server snapshot's tested sources.
+
+Three prepared tests reconstruct the tracked native baseline in both layers, assert
+the exact corrected route, reject intersections with unrelated outer/mini cards,
+check the paint-pass ordering actually consumed by drawing, and exercise real
+mouse publication at 45% and 100% (stub→link, mini→qualified endpoint). Further
+cases cover nested visible/hidden targets, parallel links, and unchanged legacy
+procedure routes/extents. Selected direct reconnection sharing a contextual source
+anchor is also exercised through real mouse input at both scales. That regression checks the
+press publishes no replacement selection and the drag emits the exact direct-link
+source reconnect event.
+
+After Linux shutdown, Windows one-job execution passed without further changes:
+
+- `cargo test --locked -p oa-desktop --bin arcadia-studio contextual_route_ -- --test-threads=1`:
+  3/3 passed, exit 0; command 182.18 s including compilation, tests 0.12 s.
+  Log `.local/source7-routing-focused-tests.log`.
+- Full `oa-desktop --bin arcadia-studio` tests: 564/564 passed, exit 0;
+  command 280.16 s, tests 277.65 s. Log `.local/source7-desktop-post-routing-tests.log`.
+
+This compiled the desktop **test binary** and ran existing process interaction,
+source/history and all other desktop regressions. A fresh standalone GUI build,
+strict checks and native routing/terminal-paint verification remain separate gates.
+
+## Native recheck
+
+Open the unchanged accepted `oa-link-accepted` source in the rebuilt desktop.
+Select First assessment gate at 100%, then Fit. Confirm the path stays to the right
+of the reference cards and terminates visibly at First.B's right border; it must
+not pass through Second/Nested or dive below them for this one link. Click the
+terminal stub to select the link, then B's mini-card to select `[oa_r1]/oa_b`.
+Verify the full From/To labels, unchanged accepted model/source bytes, and existing
+Open definition/Back controls. Check one expanded nested target and its collapsed
+host fallback. Fit may change slightly because the unnecessary detour no longer
+extends canvas height; the underlying column layout is deliberately unchanged.
@@ -0,0 +1,18 @@
+# Deployability/source-handoff audit — 2026-09-07
+
+Read-only code/docs/package inspection; no build, Cargo, VM, GUI input or change to the rejected boot action. Frozen when root redirected work to basic diagram usability. Findings below concern concrete handoff paths, not the already-recorded Linux GUI/boot acceptance gap. No fixes applied.
+
+| Priority | Exact seam and evidence | Minimal correction |
+| --- | --- | --- |
+| P2 | `README.md:24–27` tells an engineer to build release and run `target/release/arcadia-studio`; `crates/oa-desktop/src/home.rs:50–51` allows the repository example fallback only with debug assertions. `home.rs:56–71` otherwise looks beside the executable. Cargo's documented build does not copy the lesson there. A normal fresh optimized source run therefore cannot open the Home water-pressure walkthrough, although debug source runs can. | Stage the whole `examples/release1` directory beside the optimized binary and document that step, or provide an explicit safe source-run lookup policy. Include all37files/evidence; source-only Save As is insufficient. Pin release-mode resolution expectations. |
+| P2 | `deployment/Dockerfile.dockerignore:1–10` excludes `.git`, target/dist and some caches but not `.local`, `.env*` or model-store. `docs/server.md:74` builds from repository root. Those paths are Git-ignored, which does not make them Docker-ignored; current `.local` contains large toolchain/QA artifacts and disposable guest keys. No Docker transmission was performed. | Add the intended private/cache/data exclusions, preferably use a minimal allowlist matching Dockerfile COPY inputs; test the resulting context file inventory without running a container. [Docker context rules](https://docs.docker.com/build/concepts/context/) describe exclusion before transfer. |
+| P2 | No `scripts/package-linux*` exists. `.github/workflows/ci.yml:22–29` uploads only desktop/server executables, while `deployment/Dockerfile:14–18` also installs only the server executable. Neither path stages this project's license, Rust/dependency notices, examples or release runtime inventory. The current Windows collector/package path does those jobs; Linux final-package handoff is unfinished, independently of whether the binary runs. | Add a reproducible Linux staging/archive path that takes already-built inputs and exact source/toolchain provenance, includes matching notices and the complete example, records ELF dependencies/ABI baseline and validates archive contents. Reuse the reviewed notice policy rather than treating bare CI binaries as final distributions. |
+| P2 | `scripts/package-windows.ps1:87–127` intentionally refuses unknown imports, including VC redistributable DLLs; MSVC has no runtime-source input. But `docs/windows-packaging.md:10–12` presents ordinary README MSVC release outputs as the standard packaging path, without selecting a static CRT. Rust MSVC normally uses the dynamic CRT; [Rust's target source](https://raw.githubusercontent.com/rust-lang/rust/1.90.0/compiler/rustc_target/src/spec/base/windows_msvc.rs) documents implicit vcruntime/ucrt linking. This is a source-backed expected refusal, **not** an observed current MSVC build/import failure. | Make the supported MSVC release recipe explicit: either verify a targeted static-CRT build and keep strict import checks, or implement provenance/notice-bound VC redistributable staging. Do not merely allowlist those DLLs as Windows system files. Verify actual optimized MSVC imports before claiming closure. |
+| P2 | `scripts/package-windows.ps1:135–137` includes only two harness reports, but copies the repository README unchanged. Inspecting the actual preview README found nine broken relative links (including repeated `harness/STATE.md`, native tutorial fixtures, journal review and source7 decision). The packaged Windows guide/server links themselves resolve. | Supply a package-specific README/entry page with valid included evidence links, or include a bounded reachable documentation closure. Add an archive-relative link check. The existing package's binaries/runtime integrity is unaffected. |
+| P3 | `docs/server.md:3` still says schema5, despite current source/schema7. `README.md` claims Windows/Linux CI is configured, but only GitHub Actions exists and the actual origin is GitLab; no `.gitlab-ci.yml` exists. The workflow follows stable and does not test declared1.90 explicitly. These are documentation/automation coverage gaps, not proof of a source build failure. | Correct current schema wording, state the actual CI provider/activation requirement, and add an explicit MSRV job when CI ownership is settled. Preserve historical verification scope. |
+
+## Paths inspected without another defect established
+
+Docker source COPY now includes `build/`, resolving the earlier Windows-manifest include omission. The server build avoids desktop renderer compilation; `docs/openapi.json` is copied for the production include. The systemd unit's binary/data/token paths agree with its installation text. The current Windows package stages the full lesson and hashes/readbacks its contents, and its START-HERE correctly says source checkout is required for Cargo/Docker instructions. The notice collector refuses missing source/supplement/runtime evidence before creating the output claim; that refusal should be retained.
+
+Optimized MSVC imports, a fresh minimal Docker build/context and an actual Linux package were not executed in this audit. The current development previews and earlier runtime results do not establish those unrun paths. Root deferred these fixes when prioritizing the user's basic diagram creation/placement feedback.
@@ -0,0 +1,24 @@
+# Deterministic HTTP prepared-candidate regression
+
+The immutable source7 Linux gate passed the catalog GET and competing PATCH two-second assertions, but its deliberately expensive nested-source request reached the real production30-second deadline and returned504 instead of412. An isolated rerun reproduced it (49.38s test duration, cached build14.01s), so it is not classified as a random failure. The original100ms/unfinished-client observation did not prove that the server had passed its initial revision check.
+
+The replacement uses the production router, loopback TCP, Reqwest and the real source parsing/migration/validation/updater path. A private `cfg(test)` per-Store gate is consumed once for its exact resource and ETag, after `PreparedProject::replacement` succeeds and before the catalog commit lock is acquired. The observer receives the actual prepared model and source bundle and recompiles the latter for equality. Only then does it issue the catalog GET and competing PATCH, each still bounded to two seconds. The candidate remains pending until explicit release. Its final response must be exactly412, `revision_conflict`, current revision2; the accepted complete model, ETag and persisted model/source envelope must retain the winner.
+
+The gate mutex is released before waiting. Explicit release permits the normal commit recheck; RAII guard drop cancels without installing anything, with a focused cancellation regression. The blocking wait has a15-second ceiling, preparation/release observations have10-second watchdogs, and server shutdown is bounded. There is no production configuration, timeout, dependency or public API change: the gate field, call, support module and real-TCP test are compiled only for library unit tests. The obsolete timing-dependent integration test alone is removed; existing store commit-conflict tests remain.
+
+This strengthens proof of an actual fully prepared stale candidate overlapping a newer HTTP commit and an available catalog while that worker is paused. It is not a sustained CPU throughput benchmark and does not promise that every admitted model finishes in30seconds. Accepting either504or412, retry-until-pass, platform-specific fixture shrinking, raising the production deadline, or raising only the client watchdog were rejected.
+
+Implementation files: `crates/oa-server/src/store.rs`, `src/store_preparation_gate.rs`, `src/preparation_http_tests.rs`, the test-module declaration in `src/lib.rs`, and the single removed fixture in `tests/http.rs`.
+
+Verification at preparation checkpoint: rustfmt and scoped `git diff --check` pass. Cargo has not been run; the Linux source snapshot and its failed test evidence remain unchanged. Required filters after the shared resource lease is released:
+
+```text
+cargo test --locked -p oa-server --lib prepared_source_http_rechecks_revision_without_holding_catalog
+cargo test --locked -p oa-server --lib preparation_gate_drop_cancels_without_installing_candidate
+```
+
+Moving the regression into the library changes target distribution, not its real-HTTP nature; the extra guard-drop test increases the overall test inventory by one.
+
+Windows execution on 2026-09-07 passed both focused regressions (HTTP 0.07s test runtime; cancellation 0.06s), then all server targets: 4 library + 50 HTTP + 2 state tests, 56 passed, zero failures/ignored. Full-server command took 68.78s, including compilation. Workspace formatting passed and strict workspace/all-target Clippy passed in 99.60s. All recorded exit codes are zero in `.local/source7-post-routing-gates-status.json`; logs are `.local/source7-server-prepared-http-focused.log`, `.local/source7-server-preparation-cancel-focused.log`, `.local/source7-server-post-preparation-all-targets.log`, and `.local/source7-post-routing-clippy.log`.
+
+The corrected server delta still requires native Linux execution. The fresh immutable 458-file snapshot `source7-20260907T082753190288Z.tar.gz` has SHA256 `cbb371a93a562e1e641d7629fe351e016d63e66fc9112499b3fed6d5cd171f78`; it includes the corrected server regression and desktop routing. Earlier frozen Linux failures remain unchanged and are not reclassified by these Windows passes.
@@ -0,0 +1,96 @@
+# Windows-hosted Linux cross-build feasibility and bounded probe — 2026-09-06
+
+## Result and scope
+
+**Compilation and ELF inspection PASS; Linux execution NOT RUN.** An explicitly selected Windows-hosted Rust 1.90.0 compiler produced an x86-64 Linux PIE executable containing the exact locked `ring 0.17.14` native implementation. This is a successful toolchain feasibility probe, not an ARCADIA GUI build, Linux runtime acceptance, or complete workspace MSRV claim.
+
+The authorized setup/probe began 2026-09-07 06:44:39 UTC. The successful third build ended 06:52:06 UTC: 35.05 seconds reported by Cargo, 40.02 seconds including command overhead. Earlier attempts and their compiler work remain in the cache; this is **not a cold-build timing**. Heavy Cargo ownership was returned to root immediately after completion. No VM was launched, no default toolchain or global PATH was changed, and production sources/lockfile were not changed.
+
+## Exact prepared tools and artifact
+
+All downloaded tools, cache, build output, sources and logs are ignored under `.local/cross-linux-qa`. Rustup uses the already established `.local/toolchain` homes.
+
+| Input | Pinned value / verification |
+|---|---|
+| Rust host | `1.90.0-x86_64-pc-windows-gnu`, rustc `1159e78c4` (2025-09-14), Cargo 1.90.0 |
+| Target standard library | `x86_64-unknown-linux-gnu`, added to this explicit toolchain using Rustup |
+| Zig | 0.16.0 Windows x86-64 archive, 97,217,739 bytes; SHA256 `68659eb5f1e4eb1437a722f1dd889c5a322c9954607f5edcf337bc3684a75a7e` |
+| cargo-zigbuild | 0.23.3 Windows MSVC portable executable archive, 1,730,059 bytes; SHA256 `7c1edab4815fa6542f1899c0fd8921c3995b2b109f65dd96e81247036f3a5970` |
+| Host linker | Existing LLVM-MinGW Clang/LLD 23.1.0, with a task-local GNU-runtime wrapper |
+| Target baseline | `x86_64-unknown-linux-gnu.2.28` |
+| Native dependency | `ring = "=0.17.14"`; local probe lock seeded from the workspace lock, subsequent builds `--offline --locked` |
+
+The Zig archive was checked against the [official download index](https://ziglang.org/download/index.json). cargo-zigbuild was checked against both the official release asset digest and its separately downloaded checksum file from [release 0.23.3](https://github.com/rust-cross/cargo-zigbuild/releases/tag/v0.23.3). Captured provenance: `downloads/zig-index.json`, `downloads/cargo-zigbuild-release-v0.23.3.json`, checksum file, and `verified-tools.json`.
+
+Output: `.local/cross-linux-qa/target/x86_64-unknown-linux-gnu/debug/arcadia-linux-cross-probe`, **530,064 bytes**, SHA256 **`53DD54F85EEFD31006B76999D756753A8EDE94AA10D5CD1259237C776A583CC3`**.
+
+`llvm-readelf -h -l -d -V` confirms ELF64 little-endian AMD x86-64, PIE, interpreter `/lib64/ld-linux-x86-64.so.2`, and dynamic requirements `libc.so.6`, `ld-linux-x86-64.so.2`, `libpthread.so.0`, `libdl.so.2`. Highest recorded required GLIBC version is 2.28. Complete metadata is retained in `probe-elf.txt`; machine-readable result is `probe-result.json`.
+
+## What the probe actually establishes
+
+`probe/build.rs` asserts the Windows GNU host and Linux GNU target separately, and emitted its success warning while executing on Windows. The target program asserts Linux/x86-64, computes the known SHA256 of `abc` through ring on a Rust thread, writes and reads a UTF-8 temporary file, removes only its own file/directory, and prints a fixed JSON success record. These runtime assertions are compiled but **have not executed**.
+
+The link includes ring's compiled native archive. Thus the result crosses the material native C/assembly dependency, rather than testing only Rust std. Rust build scripts run on the host and must configure their target work correctly; that distinction is described in the [Cargo build-script documentation](https://doc.rust-lang.org/cargo/reference/build-scripts.html).
+
+Reproduction from the repository root, after the pinned preparation:
+
+```powershell
+. .local/cross-linux-qa/env.ps1
+cargo +1.90.0-x86_64-pc-windows-gnu zigbuild `
+  --manifest-path .local/cross-linux-qa/probe/Cargo.toml `
+  --target x86_64-unknown-linux-gnu.2.28 --offline --locked -v
+```
+
+The environment confines Cargo target output, Zig caches and wrapper files to the new directory; jobs=1 and incremental=0. A separate root-approved Linux runtime gate should copy the hash-checked executable, execute it under a short timeout, and require exit 0 plus the JSON digest `ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad`. An ELF header inspection alone cannot supply that result.
+
+## Failures retained and why the final host link works
+
+1. Portable Python lacked zlib, so ZIP extraction failed. The verified preparation then validated archive paths/types and used existing `tar.exe` into a fresh destination. The partial directory was preserved and is unused.
+2. First Cargo attempt failed host build-script linkage: LLVM-MinGW did not supply `-lgcc_eh`/`-lgcc` required by Rust's GNU host std.
+3. Adding Rust's matching self-contained library directory exposed a second mismatch: Clang still supplied UCRT startup objects while the host Rust libraries expected the GNU/MSVCRT startup contract.
+4. The successful task-local `host-link.cmd` disables Clang's default config/startfiles, explicitly supplies the Rust toolchain's matching `crt2.o` and self-contained libraries, and selects LLD. Host build scripts then linked **and ran**.
+
+Logs/status JSON for all three attempts are preserved as `probe-build{1,2,3}.log` and `probe-build{1,2,3}-status.json`. Rust 1.90 has no downloadable Windows gnullvm **host compiler**; switching to that spelling would not solve the problem. The explicit GNU host was retained without changing the user's default.
+
+**Important next prerequisite:** this wrapper is proven for executable build scripts only. It unconditionally selects `crt2.o`; a full GUI graph includes host proc-macro DLLs, which require correct DLL startup/link behavior. Before committing to an Iced build, add a tiny proc-macro dependency probe and make any wrapper DLL handling explicit. Do not infer that the present wrapper supports arbitrary host artifact kinds.
+
+## Exact GUI feasibility and remaining boundaries
+
+The inspected locked GUI graph uses Iced 0.14 with `wgpu`, X11 and Wayland; rfd 0.15.4 uses the portal backend rather than GTK3. Inspected X11/Wayland/XKB and graphics paths use runtime dynamic loading; the inspected font path uses Rust parsing. Ring is the principal identified native C/assembly compilation dependency. This source inspection reduces the expected sysroot burden, but **does not prove the entire resolved Linux feature graph links without further native packages**.
+
+Zig is the lower-setup-risk choice here: [cargo-zigbuild](https://github.com/rust-cross/cargo-zigbuild) supplies the target linker integration and glibc-version targeting, and this exact Windows/Rust combination now reaches a real Linux ELF. Clang plus a guest sysroot remains viable but would additionally require a complete, correctly preserved glibc CRT/library/header tree, target runtime libraries, symlink handling and explicit suppression of the Windows driver's defaults. These are precisely the target/sysroot/toolchain distinctions in [Clang's cross-compilation guidance](https://clang.llvm.org/docs/CrossCompilation.html).
+
+A Windows cross-build could avoid much of QEMU TCG's measured compiler cost. Prior native Linux core/server compilation was measured in tens of minutes; no cold full Linux GUI build timing exists, so a numerical GUI speedup would be speculative. The remaining minimally useful sequence is: proc-macro host probe; bounded exact locked GUI cross-build; ELF dependency inventory; then actual guest launch and engineer workflow execution with the packaged teaching folder.
+
+Actual GUI execution additionally needs a usable display server, graphics software stack, XKB/fonts and portal/session services. The retained QEMU launch's `-vga none` cannot be fixed merely by changing its host display flag. Packaged examples must be placed relative to the executable as expected by Home. None of these runtime prerequisites was changed in this probe.
+
+Preserve native Linux core/server test gates: some integration tests embed `CARGO_MANIFEST_DIR` into runtime paths, so cross-built test binaries may refer to Windows paths. This work does not justify rewriting those tests or treating a cross-built GUI as evidence that they executed under Linux. Likewise, Rust 1.90 compiling this probe is prerequisite evidence only; the entire locked ARCADIA graph must still compile at that version before claiming full MSRV compliance.
+
+## Authorized proc-macro follow-up — 2026-09-07 00:01 PDT
+
+**Host executable + host proc-macro DLL + target Linux link PASS.** The follow-up stayed within its separate ten-minute lease; the successful run completed at 07:01:06 UTC and the lease was released immediately. No full GUI build or VM execution followed.
+
+A new local `arcadia-host-macro-probe` dependency has `proc-macro = true`. Its invoked macro asserts Windows/x86-64 at expansion time, emits an execution marker, and returns a string literal that the Linux program checks. This directly proves that the host compiler loaded and executed the newly linked DLL; a successful DLL file link alone would not prove this. The same successful run deliberately rebuilt and executed the ordinary `build.rs` executable, preserving both artifact-kind paths.
+
+The first run failed as predicted with `DllMainCRTStartup` and `WinMain` unresolved: the old wrapper forced executable `crt2.o`. The bounded task-local correction selects matching Rust GNU `dllcrt2.o` when rustc passes `-shared`, and otherwise keeps `crt2.o`. The original executable-only wrapper is preserved as `host-link-exe-only.cmd`. Final wrapper SHA256: `9B2C18E6B5B963B93868610C17C74061CAE620D146229BF3732B7307ABF65030`. This covers the observed explicit rustc linker arguments; an eventual unusually long response-file-only invocation remains untested and must not silently choose the wrong startup kind.
+
+`proc-macro-build2.log` records both execution markers and a successful Linux link: **1.42 seconds Cargo, 1.99 seconds wall**, with ring and target dependencies warm. `proc-macro-build1.log` retains the negative result. The command remains the earlier `zigbuild --offline --locked` command after the local path dependency was added to the probe lockfile.
+
+| Artifact | Bytes | SHA256 |
+|---|---:|---|
+| New Linux probe at the normal target path | 530,168 | `1D7029F9B6EBEA28B35765760C56631EBD4829E3C33DBDCC225D992F558EA023` |
+| Host `arcadia_host_macro_probe-6ddfc14bcc6b9433.dll` | 1,503,232 | `86B6321CE14606BD9E51CE3430331F787C1C3471858D8861DFC3EAA150362710` |
+
+The previous 530,064-byte Linux result was preserved as `.local/cross-linux-qa/hello-ring-before-macro.elf` before rebuilding. The new output remains ELF64 x86-64 PIE with the same Linux interpreter and glibc baseline. Host inspection confirms COFF x86-64 and imports the matching `msvcrt.dll`, along with Windows system libraries; the macro actually executed successfully. Metadata and hashes are retained in `proc-macro-elf.txt`, `proc-macro-dll.txt`, and `proc-macro-result.json`. Free host RAM after the probe was about 3.88 GiB.
+
+This closes the identified proc-macro startup prerequisite. The remaining next engineering gate is an explicitly authorized bounded build of the actual locked GUI graph, followed separately by real Linux execution; neither is claimed here.
+
+## Separately authorized real Linux execution — 2026-09-07 00:07 PDT
+
+**The proc-macro/ring probe now also passes actual Linux execution.** Root booted the retained Ubuntu 24.04.4 guest separately at 07:02:43 UTC. After SSH became healthy, the new ELF was transferred to a fresh task directory. Guest `sha256sum -c` confirmed `1D7029F9B6EBEA28B35765760C56631EBD4829E3C33DBDCC225D992F558EA023`, then `timeout 30s ./arcadia-linux-cross-probe` exited 0 and emitted:
+
+```json
+{"probe":"hello-ring-thread-file","os":"linux","arch":"x86_64","sha256":"ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad","passed":true}
+```
+
+The host independently parsed and checked every expected JSON field. Guest kernel is `6.8.0-139-generic`, x86-64. Evidence: `.local/linux-qa/runtime/source7-probe-and-unpack.log`. This supersedes the earlier **probe** runtime-pending statement, while full GUI compilation/execution remains unperformed. The subsequent native Linux source7 server/core gate is separate and cannot be inferred from this small executable's success.
@@ -0,0 +1,154 @@
+# Linux GUI runtime pilot plan — 2026-09-07
+
+**Proposal only. No guest/package/display changes, GUI build or native input were performed for this review.** Continue the active immutable core gate first. At07:51:38UTC the host had1,239MiB available memory and13.77GiB free disk; this is not enough headroom to add a competing GUI build/session during the current lease.
+
+## Recommended sequence and established prerequisites
+
+Use the retained Ubuntu24.04.4 guest, a QEMU GTK framebuffer window, a minimal Xorg/Openbox session, Mesa's software Vulkan driver and a session D-Bus/GTK file-chooser portal. Root then operates the actual Linux desktop through the host QEMU window. A full Ubuntu desktop image, host X server, additional remote-control service, Windows feature change or WSL retry is unnecessary for this pilot.
+
+The retained launcher `.local/linux-qa/launch-pilot.cjs` is the current authority, not the older `ready-command.json` (which still says two vCPUs). It uses one vCPU,2GiB, BelowNormal priority, retained `runtime/pilot.qcow2` and UEFI variables, loopback-only SSH2222/serial4444, seed18080, and the live budget file. Its `--gui` switch currently changes only the display backend while retaining `-vga none`: **that switch alone cannot display a guest framebuffer**. Read-only `qemu-system-x86_64.exe -display help` confirms GTK and SDL are compiled into this pinned QEMU11.1 distribution; corresponding DLLs are present.
+
+The Windows Rust1.90 GNU host, Linux target std, Zig0.16 and cargo-zigbuild0.23.3 are already prepared under `.local/cross-linux-qa`. The corrected host wrapper has separately executed both a build-script EXE and proc-macro DLL; the resulting ring/thread/filesystem ELF subsequently ran successfully on Linux. This closes those prerequisites, not the actual GUI graph. [Exact probe evidence](release-linux-cross-build-probe-20260906.md).
+
+## Display configuration after clean shutdown
+
+Create a separate reviewed GUI launcher derived from the current live-budget launcher. Preserve its PID/resource sampling, exact disk identity and shutdown machinery. Change only the relevant QEMU arguments:
+
+```text
+-vga std
+-display gtk,gl=off,zoom-to-fit=off,grab-on-hover=off,window-close=off
+```
+
+Keep USB tablet, serial and SSH unchanged. The GTK window is the intentionally visible test surface; helpers remain hidden. Use only one QEMU process for the writable overlay. Do not run qemu-img mutations, copy a live QCow2 as a backup, create an untracked fork of its backing chain, or replace its existing disk/cache. Preserve the old launcher and record the new arguments/hash. Standard VGA is a simple framebuffer; guest Vulkan runs in software, so host OpenGL/VirGL is not required. QEMU documents the independent VGA and display choices, GTK options and USB tablet behavior. [QEMU invocation](https://www.qemu.org/docs/master/system/qemu-manpage.html), [standard VGA](https://www.qemu.org/docs/master/specs/standard-vga.html).
+
+First display-only boot: budget15minutes, preserving the3-minute shutdown reserve. Require both retained SSH host identity and a visible firmware/kernel console, and root-confirmed visible firmware/kernel framebuffer. Do not operate a terminal or console application through Computer Use; guest commands use ordinary exec/SSH tools. Actual mouse/keyboard verification follows with nonterminal desktop/app surfaces after provisioning. If the framebuffer is absent, retain QEMU/serial logs and stop; do not proceed to package provisioning. The old serial-only boot/device trouble is retained evidence, so adding the display is itself an experiment.
+
+## Minimal guest package and session proposal
+
+Only in a separately granted provisioning slice, record `dpkg --audit`, `df`, `free`, package versions and `apt-get -s` output first. Exact download/installed sizes are not yet measured. Candidate command (guest only):
+
+```sh
+sudo apt-get -s install --no-install-recommends \
+  xserver-xorg-core xserver-xorg-input-libinput xauth x11-xserver-utils \
+  openbox kbd dbus dbus-x11 \
+  libx11-6 libx11-xcb1 libxcb1 libxkbcommon0 libxkbcommon-x11-0 \
+  libvulkan1 mesa-vulkan-drivers vulkan-tools \
+  fontconfig fonts-dejavu-core fonts-noto-cjk \
+  xdg-desktop-portal xdg-desktop-portal-gtk
+```
+
+After reviewing that transaction, the same explicit list with `-s` removed is the proposed install. Do not install a display manager or change the default systemd target. Reserve approximately1–2GiB for this runtime experiment until apt provides real sizes; this is a planning allowance, not a measured installation footprint. Noto CJK is purposeful coverage for the existing Unicode fixtures. The locked rfd0.15.4 default is xdg-portal, not a GTK3 compile backend; GTK is needed here as the runtime portal provider. [Ubuntu portal packages](https://packages.ubuntu.com/search?keywords=xdg-desktop-portal), [Mesa packages](https://packages.ubuntu.com/search?keywords=mesa&suite=noble).
+
+Use the task-created `arcadia` account and a fresh `/home/arcadia/qa-gui/<run>` directory. Set a fresh600-permission Xauthority cookie locally without logging it; create700-permission runtime/config/data directories. Prefer an authenticated, local-only Xorg server on an unused VT, without globally relaxing Xwrapper or running Studio as root. Proposed launch after verifying the packaged binary path and unused VT7:
+
+```sh
+sudo openvt -c 7 -s -- /usr/lib/xorg/Xorg :0 vt7 \
+  -nolisten tcp -auth /home/arcadia/qa-gui/RUN/Xauthority -noreset
+```
+
+`RUN` is a concrete fresh run directory chosen at execution, not a literal destination. Do not force an occupied VT. Xorg's default modesetting driver should be tested with the exposed standard-VGA/bochs device; if it fails, first inspect its log and `/dev/dri`, then assess explicit guest-only fbdev/vesa fallback packages. Do not assert driver availability from the headless baseline. [Ubuntu openvt manual](https://manpages.ubuntu.com/manpages/bionic/man1/open.1.html), [Xorg wrapper restrictions](https://manpages.ubuntu.com/manpages/noble/man1/Xorg.wrap.1.html).
+
+Run the window manager, probes, portals and app inside **one** `dbus-run-session` as arcadia. Supply DISPLAY=:0, the cookie path, fresh XDG_RUNTIME_DIR/CONFIG_HOME/DATA_HOME, and XDG_CURRENT_DESKTOP=Openbox; unset WAYLAND_DISPLAY and WAYLAND_SOCKET. The locked winit0.30.13 then chooses the available X11 display. Under the fresh config directory, `xdg-desktop-portal/portals.conf` contains:
+
+```ini
+[preferred]
+default=gtk
+```
+
+Inside that bus session, propagate DISPLAY/XAUTHORITY/XDG_CURRENT_DESKTOP/XDG_CONFIG_HOME/XDG_DATA_HOME/XDG_RUNTIME_DIR using `dbus-update-activation-environment`; start `openbox`. Verify root can open its desktop menu and manipulate a nonterminal application window. Terminal apps, including guest xterm/console applications, are not Computer Use targets. Verify an actual file chooser, not just the presence of its packages. If distro activation delegates to the existing user manager and loses the private environment, use the installed portal executables explicitly within this same private bus, after discovering their paths with `dpkg -L`. Keep logs and scoped PIDs; avoid global user-manager resets. [Portal configuration](https://flatpak.github.io/xdg-desktop-portal/docs/configuration-file.html), [activation environment](https://github.com/flatpak/xdg-desktop-portal/blob/main/doc/system-integration.rst).
+
+Discover the actual Lavapipe ICD path with `dpkg -L mesa-vulkan-drivers`; set `VK_DRIVER_FILES` to that path. Mesa documents `lvp_icd.x86_64.json` as the usual64-bit name. Run `vulkaninfo --summary` and then a bounded visible `vkcube` on DISPLAY=:0; require a software adapter and visible presentation, not just Vulkan enumeration. [Mesa driver selection](https://docs.mesa3d.org/install.html). For Studio set `WGPU_BACKEND=vulkan`; this exact setting is read by locked iced_wgpu0.14/wgpu-types27 source. Limit software-rendering worker count with `LP_NUM_THREADS=1` if supported by the installed Mesa; measure actual threads and responsiveness. Do not treat standard VGA as a hardware GPU or software-rendering latency as accelerated-host performance.
+
+## Exact locked GUI build proposal
+
+After the current Linux lease ends, prefer the host-native cross-build to avoid TCG compilation cost. Freeze a new complete source snapshot including `build/` and Cargo.lock; no mid-build edits. Keep the established separate target/cache and one-job environment:
+
+```powershell
+. .local/cross-linux-qa/env.ps1
+cargo +1.90.0-x86_64-pc-windows-gnu zigbuild `
+  --manifest-path <FROZEN-SNAPSHOT>/Cargo.toml `
+  -p oa-desktop --bin arcadia-studio `
+  --target x86_64-unknown-linux-gnu.2.28 --offline --locked
+```
+
+`<FROZEN-SNAPSHOT>` must be replaced with its reviewed path. A missing offline dependency is a fetch prerequisite, not permission to change the lock. Inspect any failure before adding a sysroot or system packages. The inspected graph has dynamically loaded X11/XKB/Wayland/Vulkan; wayland-sys0.31.11 skips pkg-config under DLOPEN. rfd's default avoids GTK compile libraries. This suggests low sysroot burden, but full feature unification/linkage remains unproven. The project Windows manifest build script returns early for the Linux target. The host wrapper's response-file-only DLL detection remains a documented untested corner.
+
+Give the first actual locked GUI compile its own bounded45minute lease with a20minute progress review; preserve cache on timeout. Allow several GiB target growth, retain the5GiB disk floor, and do not overlap the2GiB guest with heavy host compilation when RAM is tight. Exact GUI duration/size are unmeasured. On success inspect ELF interpreter/DT_NEEDED/GLIBC requirements, hash the binary and copy the complete teaching/evidence folder beside the packaged executable. Native guest `ldd` and loader logs resolve final runtime dependencies. Cross-built integration tests containing Windows CARGO_MANIFEST_DIR paths are not substitutes for native Linux test gates.
+
+## Acceptance and budget
+
+Root alone controls the QEMU GUI through Computer Use; scripts may provision/inspect but may not substitute automated clicks for the native task evidence. Record guest pixel size with xrandr, host-window scaling and supported app content dimensions. Start with the visible firmware framebuffer, then Openbox desktop input and a software Vulkan cube; then Home, offline guide, real portal Open/Save/Cancel, a complete source/model edit/Save/Undo/Redo/reopen oracle, qualified-link routing and exact operation/Reply identity. Save screenshots through the established native tool and retain stderr, adapter, process, binary and source hashes. An Xvfb image, process uptime or ELF header alone cannot close these workflows. X11/software Vulkan acceptance does not establish Wayland or hardware-GPU acceptance.
+
+Recommended next experiment is the15minute display-only boot after current clean shutdown, followed by a separately budgeted45minute package/X11/portal/Vulkan pilot if display/input works. Keep the live deadline,20-second host sampling,512MiB available-memory/5GiB free-disk thresholds and3-minute shutdown reserve. Do not begin apt when less than15minutes remain; reserve time to finish its transaction and never intentionally terminate dpkg midway. Cleanly stop the task session and guest, preserving the existing disk and compile cache. Full Studio acceptance follows only after both the runtime pilot and the exact GUI build succeed.
+
+## Prepared display launcher (not executed)
+
+`.local/linux-qa/launch-display-pilot.cjs` is a new derivative of the unchanged current launcher. Only its explanatory comment, window name, VGA type and GTK display argument differ. Disk/UEFI/cache identity, one vCPU/2GiB, BelowNormal priority, loopback bindings, seed lifecycle, hidden helper processes, PID recording, live resource/deadline checks and SSH shutdown/forced-stop fallback are byte-identical. There is intentionally no QEMU monitor or terminal-input test added.
+
+Node syntax checking and `--describe` are read-only verification; neither launches the VM. After root reviews this diff, the current VM is cleanly stopped, its logs/PIDs are preserved, and a fresh15minute `resume-budget.json` is installed, the proposed PowerShell launch from the repository root is:
+
+```powershell
+$qaDisplayNode = 'C:\Users\User\.cache\codex-runtimes\codex-primary-runtime\dependencies\node\bin\node.exe'
+$qaDisplayScript = Join-Path $PWD '.local/linux-qa/launch-display-pilot.cjs'
+Start-Process -FilePath $qaDisplayNode -ArgumentList ('"' + $qaDisplayScript + '"') `
+  -WorkingDirectory $PWD -WindowStyle Hidden -PassThru
+```
+
+The Node console is hidden; QEMU's GTK graphics window is the intentionally visible test surface. This launcher still depends on root's existing single-VM lease and fresh live budget: do not launch it beside the active core VM or against an expired budget. For inspection only, use `node --check .local/linux-qa/launch-display-pilot.cjs` and `node .local/linux-qa/launch-display-pilot.cjs --describe`.
+
+
+## Prepared provisioning helpers and monotonic lease (not executed)
+
+Subsequent root evidence showed VMware Tools changing wall time by +1,958,781ms and +796,378ms. An absolute-UTC watchdog consequently ended a cross-build experiment early without a compiler error. For the next display pilot, **use the new `.local/linux-qa/launch-display-monotonic.cjs`, not either earlier launcher**. Both predecessors remain unchanged. The new launcher accepts exactly15(default) or45minutes through `ARCADIA_GUI_BUDGET_MINUTES`, measures elapsed duration with Node `performance.now()` from QEMU spawn, and initiates shutdown with3minutes remaining. Wall-clock timestamps are provenance only and may jump. It intentionally does not read or extend the old live UTC deadline file. Resource floors,20-second sampling, seed/PID identity and the bounded SSH/forced-stop lifecycle are retained. Root must review this changed clock policy before boot.
+
+Three new task-local Bash helpers are prepared:
+
+| Helper | Exact scope and guard |
+|---|---|
+| `gui-packages.sh measure DIR` | Fresh private evidence directory; existing dpkg audit, package inventory/policy and `apt-get -s`; no apt update, fetch or installation. Prints the proposed plan hash. Includes Xorg/Openbox, XKB/Vulkan, GTK portal and CJK fonts; no terminal GUI/display manager. |
+| `gui-packages.sh install DIR SHA256` | Requires the explicitly reviewed plan hash and an identical fresh simulation; refuses removals, dirty dpkg state, guest RAM below512MiB, guest disk below5GiB, or less than20minutes until the supplied monotonic guest deadline. No package-operation timeout that deliberately interrupts dpkg. |
+| `gui-session.sh start RUN [ELF]` | Fresh700-permission runtime/config/data and600-permission cookie, authenticated Xorg on unused VT7, private session D-Bus, unprivileged Openbox/software Vulkan, explicit same-bus GTK portal providers. Starts either nonterminal vkcube or the reviewed ELF. No autologin/default-target/Xwrapper changes. Captures Xorg/portal/adapter/app logs. |
+| `gui-open-app.sh RUN ELF` | Joins only the running task's private session using its600-permission environment file, checks display and prints the exact binary hash, then execs Studio as arcadia. No scripted GUI input. |
+
+Syntax checks (`bash -n` on all three Bash files and `node --check` on the monotonic launcher) pass; `--describe` confirms the display arguments and fixed15minute default. **No helper has run against Linux.** Runtime package locations, VT/device/session behavior and the complete app remain unverified. `gui-session.sh` deliberately fails if the actual installed ICD/provider path inventory is ambiguous, rather than guessing. Files contain no existing credentials; the display cookie is generated only when an authorized session starts and is never printed.
+
+After root confirms the old QEMU/launcher/seed processes are absent, preserve current top-level runtime evidence into a fresh directory. Example PowerShell preparation, not executed:
+
+```powershell
+$qaRuntime = Join-Path $PWD '.local/linux-qa/runtime'
+$qaArchive = Join-Path $PWD ('.local/linux-qa/runtime-archive-' + [guid]::NewGuid())
+New-Item -ItemType Directory -Path $qaArchive -ErrorAction Stop
+Get-ChildItem -LiteralPath $qaRuntime -File |
+  Where-Object { $_.Extension -in '.log', '.json', '.jsonl' } |
+  Copy-Item -Destination $qaArchive -ErrorAction Stop
+Get-ChildItem -LiteralPath $qaArchive -File | Get-FileHash -Algorithm SHA256 |
+  ConvertTo-Json | Set-Content -LiteralPath (Join-Path $qaArchive 'copied-hashes.json')
+```
+
+This copies logs/metadata only; it does not copy/move/delete the QCow2, UEFI variables, guest target cache or nested prior gate archives. The archive GUID remains unique even if wall time changes. The reviewed launch command becomes:
+
+```powershell
+$env:ARCADIA_GUI_BUDGET_MINUTES = '15'
+$qaDisplayNode = 'C:\Users\User\.cache\codex-runtimes\codex-primary-runtime\dependencies\node\bin\node.exe'
+$qaDisplayScript = Join-Path $PWD '.local/linux-qa/launch-display-monotonic.cjs'
+Start-Process -FilePath $qaDisplayNode -ArgumentList ('"' + $qaDisplayScript + '"') `
+  -WorkingDirectory $PWD -WindowStyle Hidden -PassThru
+```
+
+Use45 only for a separately reviewed provisioning lease; never change Windows/global environment or quietly extend a running fixed lease. Root remains responsible for the single-VM/CPU lease. After the visible framebuffer/retained SSH gate succeeds, transfer the hash-checked scripts to a fresh guest helper directory via existing authenticated SCP. Proposed SSH-executed commands (replace RUN/PACKAGES/ELF with concrete reviewed paths):
+
+```sh
+bash /home/arcadia/qa-gui-helpers/gui-packages.sh measure /home/arcadia/qa-gui-packages/PACKAGES
+# Review plan.txt, its SHA256, actual download/disk sizes, host resource samples,
+# and remaining monotonic host lease BEFORE the separate installation action.
+GUI_DEADLINE_UPTIME_SECONDS=REVIEWED_GUEST_UPTIME_DEADLINE \
+  bash /home/arcadia/qa-gui-helpers/gui-packages.sh install \
+  /home/arcadia/qa-gui-packages/PACKAGES REVIEWED_PLAN_SHA256
+bash /home/arcadia/qa-gui-helpers/gui-session.sh start /home/arcadia/qa-gui/RUN
+# Later, join that private bus/display without opening a terminal GUI:
+bash /home/arcadia/qa-gui-helpers/gui-open-app.sh /home/arcadia/qa-gui/RUN /home/arcadia/qa-app/ELF
+```
+
+Set `GUI_DEADLINE_UPTIME_SECONDS` from current guest `/proc/uptime` plus the host launcher's **monotonically measured** remaining time before shutdown reserve; never derive it from UTC. It is an admission bound, not a new watchdog and not a reason to kill apt midway. Start installation early in a45minute lease and monitor progress; defer the action if transaction size/time does not fit. Keep the session command on a managed SSH job; no Computer Use terminal is opened. Root observes firmware, then Openbox/vkcube/file chooser/Studio surfaces. Session exit scopes cleanup to its own processes and verifies Xorg's exact run-specific cookie path before signalling it.
+
+The current458-file corrected-routing/private-server source snapshot and any later UI-layout delta require their own exact artifact hashes; neither is silently substituted into the older frozen455-file Linux gate. Preserve binary/example pairing and root's source oracle at launch. A successful package install or cube remains prerequisite evidence only.
@@ -1,5 +1,7 @@
 # Linux release verification options — 2026-09-06

+Latest outcome at 21:53 PDT: the source-6 Linux server built with Rust 1.90 and passed a real-process modular source import/rejection/restart oracle. The full server test build reached its bounded compile timeout before tests executed. QEMU is cleanly stopped; the exact snapshot, binary, logs and cache are preserved. Full Linux tests, desktop/GUI and final packaging remain open. See the final sections for provenance and the next measured gate.
+
 This note records an initial read-only feasibility inspection, subsequent portable QEMU preparation and pilot, and the later user-authorized switch to WSL. The chronological sections distinguish preparation, actual Linux execution, and outstanding release acceptance. No Windows feature/security setting was changed by these investigations.

 ## Observed environment
@@ -131,3 +133,108 @@ It failed after **524 ms**, before registration, with `Wsl/Service/RegisterDistr
 There is **no WSL guest session, initialized Linux workspace or installed Linux toolchain yet**. Host resources after QEMU shutdown and image download were approximately 3.97 GiB free RAM and 21.82 GiB free disk. After the host prerequisite is resolved, recheck `wsl --status` and `wsl --list --verbose`; if the task name remains absent, the verified image and `.local/linux-wsl/import.cjs` can retry the same isolated import without another download. The helper refuses an existing install directory, so inspect any partial state rather than overwriting it.

 Once that distro actually starts, create its task-local non-root build account/workspace, provision only the required Rust/native prerequisites, and coordinate source snapshot identity with the Windows owner. Build inside the distro filesystem, not `/mnt/c` and not the Windows Cargo target. Start with one Cargo job and an isolated Linux target directory; the first proposed check, after prerequisites and source transfer, is `CARGO_BUILD_JOBS=1 CARGO_INCREMENTAL=0 cargo test --locked -p oa-core --lib`. Measure its wall time, peak memory and disk growth before broad workspace/GUI provisioning. Reserve at least 5 GiB free host disk. WSL installation by itself does not close any Linux build, runtime, GUI or package acceptance gate.
+
+## Later QEMU resume and build preparation (in progress)
+
+At 18:46 PDT the read-only WSL status still reported virtualization unavailable and no distributions; Windows last boot remained 10:31:42. No import was retried and no host feature/restart was changed. Root authorized continued work in the retained QEMU guest, with Windows compilation taking priority.
+
+The retained guest restarted at **18:47:16**, one vCPU, 2 GiB RAM, BelowNormal Windows process priority, no display, and the same loopback-only networking. Cloud-init completed normally at **18:51:10**, guest uptime 222.69 seconds, without the earlier device/emergency failures. SSH verified the retained host identity using the actual first-pilot host-key file **`runtime/known_hosts`** (the earlier preparation example's `keys/known_hosts` was a proposed path). The guest reported zero failed services, 529 MiB used on its 19 GiB root filesystem, and 1701 MiB available RAM. Logs: `runtime/resume-ssh-baseline.log`, `resume-ssh-debug.log`, and `resume-attempt1-serial.log`.
+
+Official Rust bootstrap **1.28.2**, from `https://static.rust-lang.org/rustup/archive/1.28.2/x86_64-unknown-linux-gnu/rustup-init`, was downloaded inside the guest and matched its published `.sha256`. The [official rustup manual-installation method](https://rust-lang.github.io/rustup/installation/other.html) supplies this archive/checksum convention. Its minimal Rust **1.90.0** installation completed and executed `rustc 1.90.0 (1159e78c4 2025-09-14)` / `cargo 1.90.0 (840b83a10 2025-07-30)`, host `x86_64-unknown-linux-gnu`, LLVM 20.1.8. The toolchain occupies 587 MiB under `/home/arcadia/qa-toolchain/{cargo,rustup}`; shell profiles were not modified. The host-fed script ended with an extra CRLF being interpreted as an empty command after those successful checks, so its final shell exit alone is not reported as a clean provisioning result. Future scripts are transferred as files. Log: `runtime/resume-rust-provision.log`.
+
+An authenticated Ubuntu apt index update fetched 34.2 MB in 2m44s. The `build-essential`, `pkg-config`, `ca-certificates` operation planned 58 new packages, no upgrades/removals, 79.3 MB download and 302 MB added guest disk; package download completed in 34 seconds. Its installation was interrupted as described below and must be repaired/verified before building.
+
+The immutable working-source snapshot at `/home/arcadia/qa-source/20260907T015812Z` contains 226 files (6.0 MiB), with `QA-SNAPSHOT.json` recording each file SHA-256 and parent commit `2b2d2bc18bc11ca71ef8c4c5d26610939c1b1f42`. It includes current uncommitted source, not only that commit, and is explicitly a core pilot snapshot rather than a final release tree. The 1,450,254-byte archive SHA-256 is **`db37874f1196315a6de9ea5728ca5012762ca3d5668f903d8da3d6edc60c9b4d`**, matched after SSH transfer. Task-local generator and manifest: `snapshot-source.py`, `runtime/source-snapshot-summary.json`, `runtime/source-20260907T015812Z.tar.manifest.json`; transfer/extraction log: `runtime/source-unpack.log`.
+
+Root authorized extending the initial 30-minute experiment after measured progress. During replacement of its initially hardcoded launcher timer, stopping the old launcher also unexpectedly terminated QEMU and the seed helper. This was an **unclean task-VM stop**, not a successful reboot or resource-threshold stop; neither monitor wrote a threshold-stop record. Rust installation had completed, but apt was unpacking `linux-libc-dev`. Its logs and the overlay are preserved. The old launcher/VM/seed IDs were 9348/6396/8304. The replacement launcher now reads a live deadline file each sample, avoiding another parent-process handoff. It restarted the same guest at **19:04:59**, launcher 8332, QEMU 3100, seed 11088, with an explicitly extended deadline of **20:17:16 PDT** and the same 512 MiB free-host-memory / 5 GiB free-host-disk stop thresholds. `runtime/resume-budget.json` is the active budget; the obsolete external watcher is not the owner of this new VM.
+
+The replacement guest completed cloud-init at 19:07:32 (141.75 seconds guest uptime), again with zero failed units. `dpkg --audit` precisely identified the interrupted `linux-libc-dev` unpack and pending configurations. A normal `dpkg --configure -a`, reinstall of the same cached `linux-libc-dev` package, and completion of the original apt package set restored a clean audit with **exit 0**. No packages were removed, no additional package archive download was needed for repair, and no host setting was changed. GCC **13.3.0** and pkg-config **1.8.1** executed successfully. Log: `runtime/resume2-dpkg-repair.log`.
+
+At 19:13 the actual Linux Rust 1.90 smoke program **compiled in 11.042 seconds** (7.059 user, 3.016 system) and **ran in 0.057 seconds**, writing then rereading exact UTF-8 file contents successfully. Log: `runtime/linux-rust190-hello2.log`; script `hello-and-core.sh --hello-only`. Bootstrap SHA-256 was recorded as `20a06e644b0d9bd2fbdbfd52d42540bdde820ea7df86e92e533c073da0cdd43c`. SSH connection latency is excluded from these internal shell timings; a preceding connection attempt timed out at 45 seconds during package processing and did not execute the test. The successful connection allowed a 120-second handshake for this emulated environment.
+
+With the Windows build lease released, the first actual application-core Linux/MSRV run started at **19:14:03**: `CARGO_BUILD_JOBS=1 CARGO_INCREMENTAL=0 CARGO_TARGET_DIR=/home/arcadia/qa-target cargo test --locked -p oa-core --lib`, inside the immutable source snapshot above. Output streams to `runtime/linux-rust190-core-lib.log`. This run is in progress; no application test result or graphical acceptance is claimed yet.
+
+A lightweight real-filesystem probe on this guest confirmed the remaining non-Windows publication limitation: ordinary directory `rename` replaced a competing **empty** destination created after the preflight, while `renameat2(..., RENAME_NOREPLACE)` returned `EEXIST` (17), retaining both the staged source and competing destination. The same no-replace operation successfully published to an absent destination. Log: `runtime/linux-rename-probe.log`; isolated test script: `rename-probe.py`. This exercises Ubuntu's current kernel/filesystem, not the application writer. It supports a bounded future `cfg(target_os = "linux")` publication implementation using no-replace rename, with unsupported syscall/filesystem errors failing closed instead of falling back to overwriting rename. The existing application source was not changed by this QA task. Linux documents the flag and filesystem support in [rename(2)](https://man7.org/linux/man-pages/man2/rename.2.html).
+
+During the core build at 19:21:35 PDT, the guest reported 1537 MiB available RAM, no swap, 2.0 GiB used / 17 GiB available on the 19 GiB root filesystem, and 65 MiB in the isolated Cargo target. Host monitoring at 19:21:20 still showed 1.65 GiB free RAM and 17.28 GiB free disk. Log: `runtime/core-build-resources.log`. These point samples complement the continuous host samples; they are not a claimed peak-memory measurement.
+
+A transient host-memory dip at 19:22:20 reached 580681728 bytes free (~554 MiB), above the 512 MiB stop threshold. It recovered to 1703440384 bytes on the next 20-second sample; the watchdog did not stop the VM. Root paused concurrent Windows build work. At 19:31:21, main `rustc` had run 9m34s (8m59 CPU), RSS ~767 MiB, with 887 MiB available guest RAM and an 83 MiB target directory. Host free memory was ~1.00 GiB. The compile was active, with no error yet; continuous resource sampling remains authoritative for the guard.
+
+For the subsequent Linux journal regression, a separately hashed three-file patch (`source_files.rs`, core manifest, lockfile) was staged in `/home/arcadia/qa-source/journal-20260907T022917Z`. The patch archive SHA-256 is **`3e57dad3be4c3c23b7952500924c41c5b671bcadb0e02a1d49d86f5bfa8f9300`**. `prepare-journal-delta.py` verified all 226 original file hashes before copying, checked the exact before/after patch hashes, then verified all 226 final files; the original source snapshot was unchanged. Log: `runtime/journal-delta-prepare.log`. `findmnt` confirmed the guest root filesystem is **ext4**. `strace` was absent (the final presence check returned 1); root authorized its small guest-only installation after the normal focused tests pass. The ignored injection oracle has not yet been executed and is not counted as passing.
+
+**First actual Linux/MSRV core result: PASS.** On the original immutable snapshot, `cargo test --locked -p oa-core --lib` finished its cold dependency/core compilation in **19m15s**, then ran **38 tests: 38 passed, 0 failed, 0 ignored**, in **14.15 seconds**. Total timed Cargo invocation was **1171.450 seconds** (980.274 user, 127.817 system), completed at 19:33:37 PDT. The isolated target occupied 86 MiB; the guest filesystem was 2.0 GiB used / 17 GiB available. Exact output: `runtime/linux-rust190-core-lib.log`. This establishes real Ubuntu/Linux execution of this source snapshot with the declared Rust **1.90.0** minimum; it does **not** establish all integration tests, desktop/server build, GUI, packaging, other architectures/libcs/filesystems, or a final-release source revision. Some platform-independent retry tests simulate Windows error codes; they do not exercise the Windows API on Linux.
+
+The authorized focused run against the separate Linux journal delta started after this result: `cargo test --locked -p oa-core --lib linux_journal_publication`. Log: `runtime/linux-journal-focused.log`. Normal cases and the explicitly ignored injected-error oracle are reported separately; no new result is claimed until this run completes.
+
+**Patched Linux journal result: PASS.** The exact delta compiled with Rust 1.90 in **8m20s**; its four normal focused tests passed in **1.19 seconds** (one explicitly ignored fault oracle). Total timed focused Cargo run was 504.145 seconds. Cargo's JSON artifact output identified `/home/arcadia/qa-target/debug/deps/oa_core-44b2b37bea4366c0`; this same binary then ran **42 normal library tests, all passed**, with the injection oracle still ignored, in **19.28 seconds**. This includes the existing interrupted-save, version-1/version-2 recovery and external-write preservation cases using the new Linux publication path.
+
+After those normal passes, Ubuntu installed **strace 6.8** and its `libunwind8` dependency: 639 kB fetched, 2345 kB added, no upgrades/removals, 17.694 seconds, clean `dpkg --audit`. The ignored full-save oracle was then **explicitly executed and passed three separate times**, injecting `ENOSYS` (38), `EINVAL` (22) and `EOPNOTSUPP` (95) at the actual `renameat2(..., RENAME_NOREPLACE)` syscall. Each run asserted the exact error and journal path, unchanged source bytes/expectations, no ownership transfer, no source replacements, and no pending journal. Raw traces contain the corresponding `(INJECTED)` kernel-call result. This is executed fault-injection evidence, not a skipped test counted as passing. Timed test-body results were 0.62, 0.48 and 0.45 seconds.
+
+Logs: `runtime/linux-journal-focused.log`, `runtime/linux-journal-all-and-injection.log`, `runtime/journal-injection-{ENOSYS,EINVAL,EOPNOTSUPP}.strace`, plus the Cargo artifact JSON and binary-path record. The reviewed `source_files.rs` SHA-256 is `669491dbddb8e8e6556161426dffa1a49ac1c826d31020bff0956d81a4d84683`; the exact delta manifest records the core manifest and lockfile hashes too. These results cover Ubuntu 24.04.4, x86_64, glibc 2.39 and ext4; they do not establish every Linux architecture/libc/filesystem, crash/power-loss durability, model-file compare-and-swap, or a complete release build.
+
+At completion (19:45:13 PDT), guest available RAM was **1645 MiB**, root filesystem **2.0 GiB used / 17 GiB available**, and isolated Cargo target **117 MiB**. Root approved a clean guest poweroff after preserving these traces to release its retained host memory for Windows checks. Source snapshots, disposable identity, Rust toolchain, package state and compiled target remain on the retained overlay for the next measured Linux gate.
+
+**Clean stop and resource release:** `sync; sudo systemctl poweroff` was issued at 19:47:03 PDT. The serial log reached `poweroff.target` and `reboot: Power down`; QEMU 3100, launcher 8332 and seed 11088 were all absent at the subsequent check. At **19:48:15**, host free RAM was **4542193664 bytes (4.23 GiB)** and free disk **18560270336 bytes (17.29 GiB)**. Logs: `runtime/resume-clean-poweroff.log`, `runtime/serial.log`, `runtime/post-poweroff-resources.json`. Windows heavy-build ownership was released only after this confirmation.
+
+### Exact resumption and next measured gate
+
+The VM is stopped. Before a later authorized run, confirm no existing task VM/seed is running and coordinate the Windows build lease. The old deadline is historical; assign a new explicit budget. This launches only the retained task-local guest and keeps the process hidden:
+
+```powershell
+$linuxQaDir = (Resolve-Path '.local/linux-qa').Path
+$linuxQaNode = 'C:\Users\User\.cache\codex-runtimes\codex-primary-runtime\dependencies\node\bin\node.exe'
+$linuxQaStamp = Get-Date -Format 'yyyyMMddTHHmmss'
+$linuxQaBudget = @{ deadline_utc = [DateTime]::UtcNow.AddMinutes(90).ToString('o'); reason = 'Authorized next measured Linux gate' } | ConvertTo-Json
+[IO.File]::WriteAllText((Join-Path $linuxQaDir 'runtime/resume-budget.json'), $linuxQaBudget, [Text.UTF8Encoding]::new($false))
+Start-Process -FilePath $linuxQaNode -ArgumentList ('"{0}"' -f (Join-Path $linuxQaDir 'launch-pilot.cjs')) -WorkingDirectory $linuxQaDir -WindowStyle Hidden -RedirectStandardOutput (Join-Path $linuxQaDir "runtime/$linuxQaStamp-launch.log") -RedirectStandardError (Join-Path $linuxQaDir "runtime/$linuxQaStamp-launch-error.log")
+```
+
+Read the newly written `runtime/pids.json`; use only those verified task identities. SSH remains loopback `127.0.0.1:2222`, user `arcadia`, identity `keys/guest_ed25519`, known-host file `runtime/known_hosts`, with `IdentitiesOnly=yes`, `StrictHostKeyChecking=yes`, `BatchMode=yes`, and a 120-second connect allowance. Preserve the one-vCPU/two-GiB settings and the existing 512 MiB free-host-memory / 5 GiB free-host-disk guards. Do not kill the launcher to extend time: adjust the live budget JSON before its deadline. Stop cleanly through the guest after active work finishes.
+
+The next useful build gate is the **headless Linux server**, followed separately by HTTP/runtime tests. The guest already has its compiler prerequisites; unlike the desktop, this target does not first require graphical libraries. On a freshly verified source snapshot, retain the existing custom Rust/Cargo homes and target, one build job and no incremental compilation. A bounded proposed first command is:
+
+```sh
+export RUSTUP_HOME=/home/arcadia/qa-toolchain/rustup
+export CARGO_HOME=/home/arcadia/qa-toolchain/cargo
+export PATH="$CARGO_HOME/bin:$PATH"
+export CARGO_BUILD_JOBS=1 CARGO_INCREMENTAL=0
+export CARGO_TARGET_DIR=/home/arcadia/qa-target
+# cd to the explicitly verified next source snapshot first.
+time timeout --signal=INT --kill-after=120s 50m cargo build --locked -p oa-server --bin arcadia-server
+```
+
+The 50-minute bound is an **experiment budget**, not a predicted successful server-build duration. Current measurements are a 19m15s cold core build and 8m20s core rebuild; additional server dependency cost is unmeasured. Allow up to 10 minutes for the observed 2.5–4-minute cold boot plus SSH, inspect compile/resource progress after 20 minutes, and reserve time for clean shutdown before the 90-minute watchdog. If the bounded command times out, retain its completed dependency cache and replan from the measured stage. No server command above has yet been run. Desktop compilation/GUI need a separate package and graphics-session plan and a fresh budget; a headless build alone cannot accept native Linux UI behavior. WSL remains awaiting the user-controlled restart, and its import must not be repeated before that prerequisite changes.
+
+The final serial shutdown log was copied to `runtime/resume-final-20260907T024703Z-serial.log` so a later boot cannot replace this evidence. `runtime/linux-validation-log-hashes.json` records SHA-256 for the focused/all-unit logs and each injected syscall trace.
+
+## Linux server/MSRV gate — next immutable snapshot
+
+Root authorized the next headless application gate after the Windows Home-hook checks released their resource lease. Prelaunch at 20:33 PDT: **3.93 GiB free host RAM, 16.57 GiB free disk**, no active QEMU/Cargo/rustc processes. The retained guest started at **20:33:36 PDT** with QEMU PID10880, launcher8652 and seed10696, one vCPU, 2 GiB RAM, BelowNormal priority and the same loopback-only networking. The live budget ends **22:03:35 PDT**. The task-local launcher now requests `sync; sudo systemctl poweroff` over the disposable SSH connection with a 180-second deadline reserve or upon the existing memory/disk threshold; if the guest does not exit in that reserve, a recorded forced task-VM stop remains the fallback. Launcher JavaScript syntax was checked before launch. No Windows setting or WSL import was changed.
+
+The first SSH attempt expired during boot and a second encountered startup connection reset. The next connection succeeded at 20:37:13; cloud-init subsequently reported **done, no errors or recoverable errors**, `dpkg --audit` was clean, and `systemctl --failed` listed no failed units. Guest root is ext4, 2.0 GiB used / 17 GiB available; guest available memory before the build was 1720 MiB. Boot logs are `runtime/server-boot-baseline{,2,3}.log` and the current serial log.
+
+The snapshot **`server-20260907T033312Z`** includes 281 files: current core/server/desktop source, build helpers, all documentation (including the server's embedded OpenAPI file), source-6 teaching project and Home-hook code/tests. Its archive is 1,739,164 bytes, SHA-256 **`394197749a01afe5a6e911f0ad4594bfef034c0da4cdc7ffd96454354a51c5c6`**. Parent commit is `2b2d2bc18bc11ca71ef8c4c5d26610939c1b1f42`; the per-file manifest records the actual uncommitted bytes, so this is not falsely described as that clean commit. The guest verified the archive and all 281 file hashes before compiling. Working-tree teaching corrections made after this snapshot are deliberately excluded and need separate acceptance; no snapshot was mutated mid-build.
+
+Actual command started **20:39:56 PDT** in `/home/arcadia/qa-source/server-20260907T033312Z` using the preserved `/home/arcadia/qa-toolchain/{cargo,rustup}`, Rust **1.90.0**, and `/home/arcadia/qa-target`: `CARGO_BUILD_JOBS=1 CARGO_INCREMENTAL=0 timeout --signal=INT --kill-after=120s 50m cargo build --locked -p oa-server --bin arcadia-server`. Source-verifying driver SHA-256: `3a81194092dd4b65585ebf3aae02bf7928815664a213bbb5039f7901d9a75936`. Logs: `runtime/server-source-unpack.log`, `runtime/linux-rust190-server-build.log`, continuous `resume-resource-samples.jsonl`. This command is in progress at this entry; no server build, HTTP, full integration, GUI or release-package result is claimed yet.
+
+At 20:57 the Linux server dependencies had compiled and `oa-core` was compiling. Guest available RAM was 1565 MiB; the target occupied 213 MiB. Root requested a brief Windows verification slice. After checking Cargo PID 754's working directory and dedicated PGID 753, only that guest timeout/Cargo/rustc group received SIGSTOP at **20:58:02**, then SIGCONT at **21:01:26** after Windows completion: **3m24s paused**. T/Tl and subsequent S/Rl/Sl process states were captured in `server-build-scoped-{pause,resume}.log`. The timeout retains its original wallclock budget (including the pause); the source snapshot is unchanged. During this overlap, free host RAM briefly reached 949800960 bytes (~906 MiB), above the 512 MiB floor, then recovered; no watchdog stop occurred. At 21:01:37 it was 2.11 GiB free with 15.79 GiB free disk. These elapsed compile timings include real emulation and this explicit scheduling pause, not physical Linux performance.
+
+**Linux server build PASS:** Cargo completed at **21:14:44 PDT**, exit 0, reporting **34m42s**; the timed command was **2083.938 seconds** (1585.444 user, 215.920 system), including the scheduling pause. The Linux target occupied 355 MiB, guest available RAM 1619 MiB, root filesystem 2.3 GiB used / 17 GiB available. The real executable `/home/arcadia/qa-target/debug/arcadia-server --version` returned **0.2.0** under the Ubuntu guest.
+
+**Real server process / HTTP / restart oracle PASS:** the task-local Python standard-library driver started the built executable on guest loopback `127.0.0.1:18787` with a fresh `/home/arcadia/arcadia-server-gate-h1z0bkqd/store`. It imported the snapshot's 28-file source-6 teaching bundle, compared the returned full model with the snapshot's `model.json`, checked exact modular source, submitted syntactically invalid source and verified unchanged accepted source/ETag, requested graceful SIGTERM shutdown, restarted the same binary/store, and verified exact model/source/ETag again. Both process shutdowns exited 0. Resource identity: `4973c893-79f0-4fbb-9351-ebd60a2095cc`, ETag `"p-4973c893-79f0-4fbb-9351-ebd60a2095cc-r1"`. Driver and log: `.local/linux-qa/server-http-smoke.py`, `runtime/linux-server-real-http-smoke.log`. The guest store/logs remain available. This is actual Linux application execution, not cross-compilation; it does not establish desktop/GUI acceptance or the later corrected 30-module teaching content.
+
+At **21:15:46 PDT**, after re-verifying all 281 snapshot file hashes, `cargo test --locked -p oa-server -- --test-threads=1` started with one build job and a 35-minute timeout. Log: `runtime/linux-rust190-server-tests.log`. This later test stage is in progress; the preceding build and real-process smoke must not be presented as a passing full server test suite.
+
+**Full server tests remain incomplete.** A second explicitly approved scheduling pause stopped only the verified test process group 1654 from **21:31:24 to 21:36:34** (5m10s; SSH completion exceeded the nominal five minutes by ten seconds). Its original 35-minute wallclock limit was retained. The subsequent brief one-job Windows Clippy/build overlapped the lightweight dependency stage without another pause; measured memory stayed above the guard. The Linux command reached its limit during the additional `oa-core` build required by the dev-test dependency feature set. It ended nonzero after **2104.777 seconds** (921.705 user, 134.911 system); **no server tests executed and no Rust diagnostic was emitted**. This is a bounded compilation timeout, not an assertion failure or full-suite pass. There was no blind retry or 90-minute VM-budget extension. Completed dependency artifacts remain available; the interrupted core compilation itself must be completed on the next run.
+
+The successful server executable was preserved separately before test artifacts could replace it: `/home/arcadia/qa-artifacts/server-20260907T033312Z/arcadia-server`, **34,950,168 bytes**, SHA-256 **`dcd216a34049a107c3b1234fb87c7d6d11f2e6c565c7cea8ac35232b42527d42`**. `readelf` identifies an x86-64 ELF64 position-independent executable. `ldd` resolves `libgcc_s.so.1`, `libm.so.6`, `libc.so.6` and the glibc loader on this Ubuntu guest. This is a debug-profile tested artifact, not a final Linux release package or a claim about older glibc systems. `linux-server-binary-metadata.log` records the exact output.
+
+Final verification at **21:52:13** rechecked all 281 source hashes unchanged and found no remaining Cargo/rustc/server process. Guest available RAM was 1670 MiB; root filesystem 2.6 GiB used / 16 GiB available; retained target 570 MiB. The real server process log was copied to `runtime/linux-server-real-process.log`. A clean `sync; sudo systemctl poweroff` was requested at **21:53:05**, serial reached `poweroff.target` and `Power down`, and QEMU 10880 / launcher 8652 / seed 10696 were absent at **21:53:56**. Host available RAM recovered to **4435210240 bytes (4.13 GiB)**; free disk was **16901267456 bytes (15.74 GiB)**. Logs: `linux-server-final-evidence.log`, `server-gate-clean-poweroff.log`, `server-gate-post-poweroff-resources.json`, and preserved `server-gate-20260907T045305Z-final-serial.log`.
+
+Across 239 samples in this run, minimum free host RAM was **874897408 bytes (~834 MiB)** and minimum free disk **15001563136 bytes (13.97 GiB)**. No resource watchdog stop occurred. `runtime/server-gate-summary.json` records these bounded-run statistics and SHA-256 for 14 result/process/pause/shutdown logs. The clean stop happened before the original 22:03:35 deadline, and no WSL retry, Windows setting change or existing user credential access occurred.
+
+### Next Linux gate after this clean stop
+
+The VM is off and Windows heavy-build ownership has been released. On a future authorized 90-minute lease, use the same explicit live-budget launcher procedure, verify the retained guest and snapshot, then run the pending server tests with a **50-minute command allowance and no concurrent Windows compilation**. This allowance is informed by the 35-minute incomplete test build (including 5m10s pause and additional contention), rather than treating emulated compile time as a correctness failure. Preserve `/home/arcadia/qa-target` and the custom Rust homes. The existing `server-gate.sh SNAPSHOT test 50m` driver rechecks source hashes; add explicit exit-status recording in a new version of the driver before the next run rather than modifying the already-hashed evidence script. If the intended test tree has changed, create a new separately hashed snapshot instead of overwriting this one.
+
+Required later gates remain the full server suite, full core integration suite, Linux desktop compilation and actual GUI workflows, and final release packaging. The current source-6 server build and real HTTP/restart proof establish meaningful Linux/MSRV progress; they do not accept later source-7 changes, the corrected 30-module teaching project, desktop UX changes made after this snapshot, other architectures/libcs/filesystems, or complete Linux release readiness.
@@ -0,0 +1,39 @@
+# Independent process Fit/layout review — 2026-09-07
+
+Scope: read-only review of the frozen desktop change in `behavior.rs`, `behavior/topology.rs`, `behavior/topology/view.rs`, `behavior/topology/layout_tests.rs`, the test accessor in `behavior/topology/direct.rs`, and the narrow process sidebar/main seam in `views.rs`. App dispatch and process-canvas handlers were inspected as dependencies. No Cargo, native input, production edits or VM activity by this reviewer.
+
+**Updated result: the constructor correction passed all six focused Fit tests and the full 570-test desktop suite.** The first executed filter exposed a real defect missed by the initial static review (four passed, two failed): Iced dropped zero-size sibling slots, remounting the canvas/main tree. The independently reviewed correction closed both failures without weakening their expectations. Current packaged native evidence is bounded below; broader native acceptance remains open. BCC1 routing and the earlier full 564-test/native results precede this layout change.
+
+| Boundary | Inspection and remaining evidence limit |
+| --- | --- |
+| Available canvas versus graph size | Explicit topology now has fixed header/details/canvas sibling positions. The inner canvas scroller and enclosing card use Fill; its sensor measures the scroller allocation after card padding. The removed scrolling page ancestor cannot allocate an apparently large viewport below its visible clip. Fit uses the measured width and height with scrollbar gutters. Layout tests exercise production pane builders with tall content, pending forms and several center-pane sizes. These are representative pane allocations, not a rendered measurement of the whole app at 1100×700. |
+| Fit and manual zoom | Fit clamps at 5–100%, reports when the 5% minimum still exceeds available area, and leaves both-axis scrolling available. Manual zoom remains 50–200% and independent of viewport changes. Header wrapping and the limit hint change the measured remaining height; they do not become part of the graph's content size. A first-layout fallback is explicitly provisional. |
+| Pointer coordinates | Explicit graphs now apply only the Canvas offset. A stale ordered-view Page offset no longer shifts clicks. The new real canvas-input regression retains Page=370 and checks selection at scales .45 and 1.0 with nonzero Canvas offsets. Existing qualified/direct hit ordering is unchanged by this delta. |
+| Focus and disclosure state | The process main widget remains row child 1. Focus replaces sidebar contents with a clipped zero-width Space while leaving the main slot stable; inspector removal occurs after main. Permanent inner shelf/canvas and diagram/form slots avoid sibling-index changes. Focus intentionally preserves the current disclosure choice; initial shelves are closed. Full qualified addresses and definition actions remain in the scrollable Selection details shelf. |
+| Raw pending actions | Shelf changes do not start or submit forms, so App dispatch admits them with a pending behavior draft. Focus remains view-only. Apply/Cancel stay above the independently scrolling form. Owner/definition changes remain behind existing pending guards; this change does not clear raw fields to permit navigation. |
+
+## Review corrections and test scope
+
+The initial new tests preserved draft bytes but did not assert that dispatched shelf events actually changed state; a swallowed event could therefore satisfy them. The worker added explicit Tools → Selection → None assertions and Focus boolean assertions. The local real-Iced scroll test now also moves the pending form to y=600, checks pinned actions, and retains canvas translation (90,180).
+
+The passing whole-app test uses the actual `views::view` tree and App dispatch, checking a marker at the canvas ancestor through Focus/disclosure/form changes, together with exact raw recovery DTO and accepted snapshot identity. This establishes stable tree identity, **not** actual whole-app canvas/form scroll offsets after renderer layout. The passing local production-builder layout/scroll tests provide the complementary geometry evidence.
+
+## Executed falsifier and constructor correction
+
+The first six-test run passed four and failed the actual canvas-scroll retention and whole-app tree-path tests. These were genuine implementation failures, not expectations to relax. The initial review's assumption that syntactically permanent slots imply permanent widget-tree children was false: locked `iced_widget` 0.14.2 `Row::push` and `Column::push` inspect `size_hint().is_void()` and omit zero-size children. Thus the collapsed details shelf disappeared before canvas, and the zero-width Focus sidebar disappeared before main.
+
+The worker changed only these two constructors to `Column::from_vec` and `Row::from_vec`. Independent source inspection confirms that `from_vec` retains the supplied children without filtering. Both callsites explicitly set Fill width/height because this constructor also skips automatic child sizing inference. The optional form is after the diagram, and the inspector remains after main, so neither can shift the preceding canvas path. No padding, tool, pointer or semantic behavior was changed by this correction.
+
+The two failing expectations remain unchanged. An added assertion establishes a unique actual `process-canvas` ID and translation (90,180) before any tree diff, ruling out a meaningless unscrolled baseline. The generic text-renderer bound was also corrected to compile the helper with the real scroll widget. No further blocking defect was found in the narrow constructor fix; the successful rerun closes both observed failures.
+
+## Final automated gates and packaged native observation
+
+Authoritative `.local/source7-latest-preview-status.json` records all six gates exit0: Fit6/6 (54.02s command including compile), existing pending-scroll1/1 (1.09s), existing branch-fit1/1 (1.73s), locked workspace bins build51.63s, format4.02s, strict workspace/all-target Clippy42.95s. `.local/source7-latest-full-desktop-status.json` records exit0/200.63s; its log reports570passed/0failed/0ignored,198.82s test execution. Initial failures remain in `source7-latest-fit-tests-attempt2-scroll.log`; the passing run is `source7-latest-fit-tests.log`.
+
+The verified development-profile preview is `dist/ArcadiaStudio-preview-source7-20260907-x86_64-pc-windows-gnullvm/arcadia-studio.exe`, SHA256 `DC50C887BFE9C73565E3C5DC2AE451BEBC48EC25DF7A1F7C5D97E9C853F2C93A`. Root launched it with a clean PATH. At1444×932 the accepted OA caller graph showed all four cards at Fit68%; width1102 at height932 was also observed. This is not1100×700 evidence. The user's Escape ended Computer Use before final verification; no clean shutdown or final model/source oracle is claimed, and the app may remain open.
+
+To run, open that executable with its adjacent runtime files intact, or extract the entire corresponding ZIP first. Independent package verification records565files/all37teachingfiles and ZIP SHA256 `1fac10b30daf2f8e1dac29e9469485e4bea142e77ff5a13e4c9d1e41ff03abb2`; the `.zip.provenance.json` preserves the build/source capture. Package integrity and this limited native observation do not close the remaining checks below.
+
+## Required native recheck on the new binary
+
+At 1100×700, with both panels and with Focus: exercise Fit on a tall expanded OA and SA process; open Tools and Selection details and reach the last control/full nested identity; open an invalid raw contribution form, scroll its final fields and use its pinned actions; toggle disclosures/Focus and verify raw text plus manual canvas/form scroll remain usable. Check both minimum-fit scrolling and ordinary fit without clipping, then click a qualified mini endpoint and a selected direct reconnect anchor after scrolling. Repeat resize and guarded owner navigation. These checks should use the new build's hash; the earlier BCC1 routing oracle is not a substitute.
@@ -0,0 +1,188 @@
+# Process Fit and focused-layout audit
+
+Initial read-only audit followed by the authorized implementation below. Root's BCC1 native routing
+check passed the short visible path, terminal-stub selection and qualified B
+selection. This is a separate viewport/layout defect, not a routing regression.
+
+## Verified cause
+
+- `behavior/topology.rs:235`: Fit uses measured viewport **width**, but its height
+  term is always `450 / graph.height`. The measured `Size.height` is ignored.
+- `behavior/topology/view.rs:316`: the inner canvas scroller is assigned
+  `(window_height - 360).clamp(190,600)`; pending forms use
+  `(window_height - 510).clamp(160,240)`. Neither subtracts actual header, palette,
+  qualified-summary or form allocation height.
+- `view.rs:324`: the sensor surrounds that allocated box plus 8px padding. Iced
+  `iced_widget-0.14.2/src/sensor.rs:217,239,250` publishes `layout.bounds().size()`,
+  not its intersection with the outer viewport. Substituting sensor height for
+  450 alone therefore leaves the off-screen-box problem.
+- `view.rs:559`: a second outer scroller contains the entire heading, owner picker,
+  focus button, two palette rows, help, variable navigation and inner canvas.
+  `panes` divides that page and the independent editor vertically when pending.
+- `views.rs:228`: Focus removes explorer/inspector only. It does not compact any
+  vertical controls. `behavior.rs:717` and `view.rs:78–261` explain the tall stack.
+
+For the observed 1444×932 window, canvas top y566 leaves at most 366px even before
+the footer; Fit can still create 450px of graph. The allocated inner scroller is
+572px high, so much of it lives below the outer fold. Seeing Nested below the fold
+is consistent with the code. The current action fits a synthetic 450px drawing
+height, not the visible viewport. Outer scrolling can reach it but does not make
+the Fit claim accurate. Existing test `fitting_a_branch_keeps_all_nodes_visible...`
+uses viewport height460 and only asserts450, so never falsifies smaller viewports.
+
+## Smallest coherent correction
+
+Keep the existing main/form split and graphical model; replace only the explicit
+process graph's nested page layout with a height-constrained column:
+
+1. A stable compact header/control shelf: owner/focus controls, then accessible
+   Tools, Selection details/definition navigation, and Fit/zoom controls. Keep its
+   always-visible rows small (about80–100px at1100×700); place the existing palette,
+   help and full qualified identity text in a bounded scrollable details area
+   opened explicitly. Focus starts with that details area collapsed. Every action
+   and complete From/To identity remains reachable; no silent text truncation or
+   removal of raw-draft guards. Do not collapse/alter the actual pending editor.
+2. The graph scroller takes `Fill` in the remaining **allocated pane** height.
+   It must not sit inside an outer scrollable that permits its allocation to
+   extend off-screen. Measure its inner usable viewport, excluding card padding
+   and any scrollbar allowance, independently of scaled graph content.
+3. Fit uses `min(available_width/graph_width, available_height/graph_height,1)`.
+   Preserve the existing bounded minimum zoom policy, but report that limit if a
+   huge graph cannot fit at the minimum; do not promise a full fit in that case.
+   Resizing, opening details, changing qualified selection or opening the form
+   updates this measured area and recomputes Fit. Manual100% stays100% and scrolls.
+4. Preserve `panes`' independent pending editor with fixed Apply/Cancel above its
+   own `process-form` scroller. At the existing minimum570px center height, a
+   roughly285px graph pane minus at most100px shelf leaves about185px usable canvas;
+   the editor retains its current approximately200px-or-more field viewport.
+   Without a form, Focus gives most of the center height to the graph.
+
+This should be a bounded `topology/view.rs`, `topology.rs::scale`, and layout-test
+change, with only small state/events for Tools/Selection details if needed.
+`behavior.rs` may need its title/owner header factored into the compact shelf.
+No core/analysis/source/recovery schema change, no expansion of the512-node preview.
+Persist only existing authored drafts; disclosure/viewport state remains transient.
+
+## Scroll-tree and verification boundaries
+
+Keep permanent shelf, canvas and form sibling slots. Put conditionals inside each
+slot; do not prepend/remove siblings containing the real `process-canvas` or
+`process-form` trees. Retain IDs and owner/document observer identity. A shelf
+disclosure may resize the graph but must not remount it, change selection or erase
+manual scroll. The existing unchanged pending-form scroll-state regression is a
+required falsifier; merely naming a new scrollable with the same ID is insufficient.
+
+Focused checks should exercise the actual shared layout helpers and Iced tree:
+
+- Minimum1100×700 and native1444×932 available center sizes; graph viewport entirely
+  inside its pane before/after full qualified summary, Tools and pending editor.
+- Fit at measured heights180,320,600 with a tall fixture; every graph bound within
+  measured usable dimensions (unless explicit minimum-zoom limit), and100% unchanged.
+- Real scroll state through select→qualified select→pending form→cancel and focus
+  toggle; full raw invalid draft unchanged and Apply/Cancel always visible.
+- Existing nested picker/definition/Back and reconnect tests unchanged, plus native
+  Fit after100% scrolling and after a resize, with exact accepted source unchanged.
+
+Avoid a patch that merely swaps450 for another window-height estimate or sensor
+height while retaining the outer clipped allocation. That would leave the measured
+native failure intact.
+
+## Follow-up implementation checkpoint
+
+Owned delta: `behavior.rs` compact owner header; `topology.rs` transient Tools/
+Selection shelf state and measured Fit; `topology/view.rs` stable remaining-height
+explicit graph; `topology/layout_tests.rs`; one `cfg(test)` annotation on the
+unchanged legacy summed-scroll accessor in `topology/direct.rs`.
+
+The explicit graph now uses a permanent header/shelf/canvas structure. **Tools**
+opens its existing authoring palette including **Qualified link / assembly…**.
+**Selection details** opens complete addresses and definition/Back actions. The
+details scroller is112px (64px with pending editor), or closed by default; the
+canvas gets remaining Fill height. Its inner sensor measures actual usable space.
+Fit reserves24px horizontally and10px vertically, keeps5% minimum/100% maximum,
+and visibly reports when the minimum leaves graph content outside the viewport.
+Manual zoom behavior is unchanged. The independent editor/actions remain mounted.
+
+Explicit pointer transforms use Canvas offset only; an old ordered-page offset
+cannot move a hit target. New prepared tests exercise actual mouse selection with
+Page y370 and Canvas(11,19) at45%/100%, small-height Fit/minimum notice policy,
+exact rejected raw draft retention during disclosures/focus, and real Iced layout/
+scroll operations across compact shelves, form open/close and pane resizing.
+The existing pending-form canvas-tree regression remains unmodified.
+
+Authorized outer-tree correction: `views.rs` keeps process main at row child1
+through Focus. The sidebar's container remains as a clipped zero-width slot with
+an empty Space child while focused, so hidden controls cannot intercept input.
+Inspector is removed only after main. Other page layouts retain their existing
+branches. A new whole-`views::view` tree test checks the actual canvas scroll-state
+marker and exact pending raw draft through Focus/disclosure changes in both layers.
+This supplements actual layout/scroll tests; it does not claim pixel/native proof.
+The full-app test proves tree identity, exact disclosure/Focus events and raw
+state; actual offsets are exercised in the production pane helpers with Iced's
+debug renderer. That helper additionally scrolls the pending form to600 while
+requiring canvas(90,180) and pinned actions to remain unchanged. Native full-app
+offset retention after Focus still needs direct verification.
+
+Six focused `process_fit_` tests now pass. Full source list also includes this
+narrow `views.rs` seam. Existing pending-form scroll regression is unchanged.
+Current exact native control path is **Tools → Qualified link / assembly…** and
+**Selection details → full addresses / Open contribution definition / Back**.
+Focused exit label is **Restore panels**; old ordered-view layout remains as before.
+
+The current automated gates are recorded below. The earlier564 desktop pass and
+BCC1 native routing evidence retain their previous-binary scope.
+
+### First focused execution and correction
+
+Root's initial compile identified the generic helper's missing text-renderer
+bound; root applied the required `iced::advanced::text::Renderer` bound.
+The next compile succeeded and `process_fit_` ran:4 passed,2 failed, preserved in
+`.local/source7-latest-fit-tests-attempt2-scroll.log`. Failures were genuine remounting defects:
+actual canvas offsets became(0,0), and Focus shifted the main tree path.
+
+Locked Iced0.14.2 `Row::push` and `Column::push` discard children whose size hints
+have a Fixed(0) dimension (`iced_core::Size::is_void`). Thus the supposedly stable
+zero-height shelf and zero-width sidebar slots disappeared. This was not a wrong
+ID or first-scrollable test bug. The bounded correction uses `Column::from_vec`
+for explicit header/shelf/canvas and `Row::from_vec` for process sidebar/main;
+these retain the supplied children verbatim, with Fill dimensions set explicitly.
+All retention expectations remain unchanged. The local test additionally proves
+there is exactly one `process-canvas` ID and that its actual offset is(90,180)
+before any diff. Corrected source passed the rerun without changing the failed
+expectations; the original failure remains part of the evidence.
+
+## Final gates and runnable preview
+
+`.local/source7-latest-preview-status.json` records exit0 for every gate:
+
+| Gate | Result / command duration |
+| --- | --- |
+| Six `process_fit_` tests |6/6;54.02s including compilation |
+| Existing pending-form scroll regression |1/1;1.09s |
+| Existing branch Fit/selection regression |1/1;1.73s |
+| Locked workspace binaries build |Passed;51.63s |
+| Format check |Passed;4.02s |
+| Strict workspace/all-target Clippy |Passed;42.95s |
+| Subsequent full desktop |570/570,0failed/0ignored;200.63s command,198.82s tests |
+
+The full desktop result is independently recorded in
+`.local/source7-latest-full-desktop-status.json` and
+`.local/source7-latest-full-desktop-tests.log`. Focus intentionally preserves the
+chosen disclosure; only its initial default is collapsed. No new accepted-source
+or recovery fields were introduced by the Fit fix.
+
+Open `dist/ArcadiaStudio-preview-source7-20260907-x86_64-pc-windows-gnullvm/arcadia-studio.exe`
+with its runtime files beside it. Alternatively extract the whole corresponding
+ZIP, then open the executable. This is a development-profile preview. Independent
+package integrity verification records565files, all37teachingfiles, ZIP SHA256
+`1fac10b30daf2f8e1dac29e9469485e4bea142e77ff5a13e4c9d1e41ff03abb2`, and the
+adjacent `.zip.provenance.json`. The executable SHA256 is
+`DC50C887BFE9C73565E3C5DC2AE451BEBC48EC25DF7A1F7C5D97E9C853F2C93A`.
+
+Root's native observation on this packaged binary: clean-PATH launch succeeded;
+the accepted OA caller graph at1444×932 fitted at68% with all four cards visible.
+A1102×932 width was also observed, **not** the700-pixel minimum-height case.
+The user's Escape stopped Computer Use before final checks. The app may remain
+open; no clean-close or final unchanged model/source oracle is claimed. The
+remaining minimum-height, pending-form, disclosure/Focus scroll and broader
+OA/SA native cases above remain acceptance work.
@@ -0,0 +1,45 @@
+# Source7 language, API and integration checks
+
+Current integration on `codex/release1-continuation` after checkpoint4b6b5fc. Fresh source7 Windows core/server/desktop and strict checks pass as recorded below; native7 and current Linux acceptance remain separately scoped and incomplete.
+
+The normative reST adds caller-owned ContextualLink endpoints and three distinct purposes, instance-specific analysis, typed dependency cleanup, explicit operation allocation selection and Call-derived Reply behavior, omission rationale on SA→OA, and frozen old5/6 recovery requirements. OpenAPI adds closed records and five typed semantic leaves, with the same200omission capacity on ordinary and semantic preview/Apply.
+
+`crates/oa-server/tests/semantic_schema.py --check --validate` passes **72structural fixtures,204component schemas,14families and90scalar leaves**. It uses the task-local `.local/source6-schema-tools` Python dependencies. Missing jsonschema in the bundled runtime was resolved by using that existing dependency directory; no fixture was skipped. This is structural-schema evidence, not runtime proof of path or port semantics.
+
+Both `docs/language.rst` and `docs/api.rst` rendered with Docutils0.22.2 and `halt_level=2, report_level=2`, using the html5 writer. Initial short heading underlines were corrected; both strict renders pass and checked-in HTML was refreshed. The new contextual source example is a declaration fragment requiring its enclosing fixture, not a standalone compilable project. Complete normative examples remain subject to the core language tests.
+
+Independent state-contract review found and root addressed:
+
+- Category/view fields are rejected by versions1–5; version6 accepts them. The API wording now names that boundary explicitly.
+- New authored path entries consume the existing caller's ordered-reference budget: REST50000, desktop500000, core explicit ParseLimits. Cache state never alters counting. Path depth64 and analysis50000nodes/100000edges are separate limits. No desktop capacity reduction was introduced.
+- A selected operation without actual channel/lifeline/direction proof must be refused; core was corrected rather than weakening the ratified proof requirement. Explicit allocationNone remains editable.
+- Sole allocation deletion remains subject to independent carried-item contracts, including a separate Reply channel. Surviving same-item allocations may admit a channel but never replace the deleted selected identity automatically. This clarification is ratified in the source7 decision.
+- HTTP old-version rejection must isolate the new fields so one rejection cannot mask another. The new transport test sends ContextualLink-only and operation-null-only schema6 candidates in addition to the combined case.
+
+Actual HTTP tests cover a modular source import, changing only a caller reference path and a parameterless operation allocation in one transaction, querying ContextualLink, exact full-model comparison, unchanged authored CRLF/Unicode note, source recompilation parity, invalid definition-as-path/item-as-allocation rejection, old-version rejection and exact model/source/revision/ETag/disk preservation after restart. Separate ordinary/semantic tests enforce200/201omission limits on Preview and modified prepared Apply envelopes.
+
+`cargo test --locked -p oa-server --test http source7_ -- --test-threads=1` compiled in2m56s and the new source7 test passed in0.35s (`.local/source7-http-contract-tests1.log`). The complete HTTP target then passed **51/51 in17.15s** (`.local/source7-http-full-tests1.log`), including both omission-limit tests and all prior transport cases. One-job Windows GNU/LLVM environment was used. This accepts that earlier compiled core/server checkpoint. The fresh complete core/server runs below supersede it and include the later bounded contextual-work correction; the historical log remains unchanged.
+
+The current teaching entry, model JSON and transition-before JSON have only their version tokens changed6→7, plus constructor `operation:None` defaults and README labeling. All four teaching tests, including exact generator equality, passed in the core checkpoint. All pinned source6 native executables, copied source baselines and historical fixtures are preserved. Recovery fixture JSON receives scoped `-text` attributes so pinned SHA/FNV bytes are not changed by Git line-ending conversion.
+
+The offline guide now explains the implemented contextual endpoint tree, instance navigation, Focus canvas, operation selection/derived Reply and omission rationale controls. That text is included in the fresh source7 desktop build; remaining native walkthroughs must verify the actual compiled UI.
+
+## Fresh Windows integration gates — 2026-09-07
+
+The current one-job GNU/LLVM runs supersede the earlier scoped compile/test checkpoints. Counts below are independently read from each log's `test result:` summaries; affected reruns are not added to full-suite totals.
+
+| Gate | Observed result | Evidence |
+|---|---|---|
+| Core, all targets | 433 passed, 1 ignored, zero failed across 44 summaries; exit0,138.72s | `.local/source7-core-all-targets.log`; `.local/source7-current-gates-status.json` |
+| Server, all targets | 55 passed, zero failed/ignored across 4 summaries; exit0,64.74s | `.local/source7-server-all-targets.log`; current-gates status |
+| Full desktop | 561 passed, zero failed/ignored; tests263.39s | `.local/source7-desktop-full-tests2.log` |
+| Strict workspace/all-target Clippy | Passed; finished in2m50s | `.local/source7-workspace-clippy2.log` |
+| Final format check | Root observed `cargo fmt --all -- --check` exit0; empty log is expected | `.local/source7-format-final.log`; root's execution observation |
+| Affected semantic rerun after equivalent lint edits | 3 passed, zero failed/ignored; tests3.46s; whole invocation exit0 in57.12s | `.local/source7-semantic-after-clippy.log`; current-gates status |
+| Native binary build | Exit0,124.47s | Current-gates status entry `native-build` |
+
+The first full desktop run exposed a real scroll-state regression: a conditional navigation control changed the widget structure above the canvas. A stable navigation Column fixed it; the unchanged regression passed in the complete561-test rerun. The later three-test semantic rerun covers contextual Incident composition, reverse operation omission after recovery, and the operation virtual-None Candidate. It does not claim a second complete desktop run. The ignored core test remains ignored in this run and is not counted as executed evidence.
+
+Root reports native7 PID11060 passed the Reset case's complete model/source Save, Undo and Redo oracles. Reopening explicitly displayed allocation30 on the derived Reply. This accepts that bounded case only; other native7 authoring, recovery and engineering walkthroughs remain open.
+
+Root launched a separate bounded90minute Linux gate with launcher5000 and a455-file source snapshot created2026-09-07T07:02:43Z, SHA256 `7104946c89b2be7a1a030fdff47cb4405bacf05357d68cf35d181e860f55c279`. Its build/test gates have not started at this documentation checkpoint. Earlier Linux core/MSRV and server/HTTP results retain their older snapshot scope; no current Linux application or release-package acceptance is claimed.
@@ -0,0 +1,79 @@
+# Source7 checkpoint inventory audit — 2026-09-07
+
+Read-only Git/fixture/link audit around08:16UTC. No staging, commit, production edit, Cargo invocation or VM mutation. This report is the only new file written by this audit. **Checkpoint readiness is conditional on the remaining affected checks; no release acceptance is claimed.**
+
+## Branch and integrated baseline
+
+HEAD remains `4b6b5fc1977523e8cf52fdd5503a0a71c87a3f63` on `codex/release1-continuation`, after `2b2d2bc` and integrated `c091f80e6ecf90e9aa6f13ec6fd34924c5ef55de`. The index is empty. No remote fetch or mutation was performed.
+
+`origin/codex/data-contract-integration` is an ancestor of HEAD. Original state branches are not literal ancestors, which must not be mistaken for missing implementation:
+
+| Original contribution | Already integrated evidence |
+|---|---|
+| State integration `a8f451ebae85cd4a56ff8a152ea737c260129e44` | `git cherry HEAD origin/codex/state-integration` marks both camera316dc55 and acceptancea8f451e patch-equivalent; integrated equivalents9118218/c5276b1 are ancestors ofc091f80. |
+| State core `a63654f78217f9250a149ea4f505ab9d5ed5db43` | Adapted state-core commit `e7a8163` is an ancestor ofc091f80. It introduces the persisted state model/projection/reference/routing/session/validation paths and744-line state-diagram tests. The original is not exact patch-equivalent, consistent with the earlier adapted/tree audit. |
+
+Retain the existing integrated checkout; do not merge or replay those old branches merely because `merge-base --is-ancestor` returns1 for their original tips. The prior [branch audit](release-branch-integration-20260906.md) remains the broader semantic/hosted/data lineage evidence. This review independently rechecked the specific state seams above, not every old branch anew.
+
+## Pending commit scope
+
+Before adding this report, inventory contained **92 modified tracked files and41 untracked files,133 total**. No tracked deletions or staged changes were present. Counts are a point-in-time working-tree inventory, not a frozen commit manifest.
+
+| Review group | Files in inventory | Intended scope |
+|---|---:|---|
+| oa-core |39| Operation identity, caller-context topology/analysis, source7 admission/migration, references/lifecycle, transitions/semantic facets and meaningful contract tests. |
+| oa-desktop |43| Contextual/scenario authoring, exact operation controls, qualified navigation/routing, forms/semantic composition, traceability view, old5/6 recovery and raw-draft tests. |
+| oa-server |12| Runtime/schema/HTTP source7 parity plus the private cfg(test) prepared-candidate evaluator replacement. |
+| docs |5| API/language reST and their checked-in HTML, regenerated OpenAPI JSON. These are intended generated deliverables, not temporary output. |
+| examples |5| Current release1 example/generator/readme schema7 alignment. Existing legacy examples and frozen source6 fixtures remain separate. |
+| harness |27| Decisions, tracking, scoped runtime/review reports, native/recovery generators and frozen native payloads. |
+| Root metadata |2| README and exact-fixture `.gitattributes` additions. |
+
+No Cargo manifest or Cargo.lock change is pending. Scanning all133 pending files by extension and PE/ELF magic found **no executable, DLL, PDB, log, archive, QCow2, object or rlib candidate**. `git ls-files` likewise found no tracked exe/dll/pdb/rlib/qcow2/log. `.local` and the target/dist build trees remain ignored. The largest pending file is the expected `docs/openapi.json` (359,757bytes); no unexplained large payload appeared.
+
+### Untracked modules must accompany declarations
+
+**Do not use a tracked-files-only commit:**15 new Rust files are currently untracked. Their declarations/explicit paths exist, or Cargo discovers the integration-test file automatically. Omitting them would produce a non-buildable or silently reduced test checkpoint.
+
+```text
+crates/oa-core/src/operations.rs
+crates/oa-core/src/topology_context.rs
+crates/oa-core/src/topology_context/analysis.rs
+crates/oa-core/src/topology_context/analysis_tests.rs
+crates/oa-core/tests/source7_contract.rs
+crates/oa-desktop/src/behavior/scenario_operation_tests.rs
+crates/oa-desktop/src/behavior/topology/contextual.rs
+crates/oa-desktop/src/behavior/topology/contextual_routing.rs
+crates/oa-desktop/src/forms/context_fields.rs
+crates/oa-desktop/src/recovery/source7_tests.rs
+crates/oa-desktop/src/semantic_review/source7_tests.rs
+crates/oa-desktop/src/views/traceability.rs
+crates/oa-server/src/preparation_http_tests.rs
+crates/oa-server/src/store_preparation_gate.rs
+crates/oa-server/tests/http/source7_contracts.rs
+```
+
+The untracked recovery fixture directory, native fixture directory and harness generators are also compile/test inputs: include them with their consuming code. Confirm the complete explicit inventory before any eventual commit, rather than treating untracked reports and production modules as one disposable category.
+
+## Exact source and historical fixture protection
+
+All seven pinned payloads were independently hashed against their manifests:
+
+- Native `expected-baseline.json`, `project.arcadia`, `rationale.arcadia`: exact size andSHA256 equal `harness/fixtures/source7-native/manifest.json`.
+- Historical source5/source6 model and bundle JSON: all fourSHA256 values equal `recovery/fixtures/profiles.json`. Independent byte-wise FNV-1a equals source5`31b56f1d17c2d9cf` and source6`88c1149e445e8676`.
+
+`git check-attr` reports `text: unset` for every payload. The inherited `eol: lf` value does not reenable text conversion when text is explicitly unset. Pending `.gitattributes` adds exactly `crates/oa-desktop/src/recovery/fixtures/*.json -text` and `harness/fixtures/source7-native/** -text`; include those rules in the same checkpoint. Existing `crates/oa-core/tests/fixtures`, `harness/fixtures/release1-native` and `harness/fixtures/interface-operation-probe` have no pending changes. Inspected migration-test edits change current output expectations toSCHEMA_VERSION, not frozen old input bytes.
+
+Ordinary Markdown/reST/JSON/HTML CRLF normalization notices are expected under repository text rules; they are not evidence of protected-fixture damage. The full current `git diff --check` completed successfully. After staging is eventually authorized, independently read the staged fixture blobs and repeat manifest/FNV checks before commit; no staged-byte result exists yet.
+
+## Links and evidence wording
+
+All ordinary local Markdown file links in pending Markdown resolve. Both generated HTML files have no missing local href/src files or same-document fragment targets. This is a local-link check, not a network-link or general prose-path audit; ignored task-local evidence paths remain local evidence rather than distributable release assets.
+
+One minor stale sentence remains in `harness/fixtures/source7-native/README.md`: “Prepared, not yet natively accepted” predates the now-recorded Reset/ReadStatus and OA persistence passes. The baseline itself must stay frozen. Before checkpointing, clarify that sentence as fixture provenance and link the scoped [native acceptance report](release-source7-native-acceptance-20260907.md), which correctly leaves contextual rendering and other cases open. Do not replace it with an unqualified accepted label.
+
+## Next verification and commit boundary
+
+The Windows433core/55server/561desktop plus strict/build results scope the prior6BAB executable. Root reports three focused routing tests have since passed; that is an affected slice, not a new full desktop/native result. The private server phase/cancellation delta still requires compilation and execution at this audit checkpoint. The immutable Linux snapshot retains its reproduced504-vs-412 failure; later fixed-source tests require separate provenance. The active Linux core gate and GUI/display preparation do not confer a release pass.
+
+Before a reviewable source7 checkpoint: finish the current bounded Linux gate; run the affected private server tests/full server targets and routing/interaction/strict checks after the resource lease; reconcile results and current native rendering/recovery outcomes in the ledgers; inspect an explicit staged diff including every new module/fixture and rerun staged-byte/link checks. Keep source7's interdependent core/source/API/desktop/recovery/fixture contract together or split only at demonstrably buildable boundaries. Evidence-only reports can form a separate follow-up commit if their scope remains clear. No branch transplant, remote publication or final package replacement follows from this audit.
@@ -0,0 +1,38 @@
+# Source 7 core checkpoint — 6 September 2026
+
+Scope: core implementation of the ratified contextual-chain and interface-operation contracts. This is a component checkpoint, not release acceptance or evidence of native, REST, recovery, or desktop completion.
+
+Latest integrated verification: `cargo test --locked -p oa-core --all-targets` passed **433 tests, zero failed, one explicitly ignored inheritance-scaling probe**, across44 target summaries. The fresh green invocation took138.72s including compilation; log `.local/source7-core-all-targets.log`. It supersedes the cumulative-only count below and includes the traversal-budget and four operation-composition corrections. Workspace/all-target strict Clippy also passed in `.local/source7-workspace-clippy2.log`; desktop review needed two equivalent style corrections, with no core change.
+
+## Implemented contract
+
+- New caller-owned `ContextualLink` with qualified reference-occurrence paths and closed Precedence, Exchange, and CommonWork purposes. The shared `TopologyIndex` resolves complete endpoints and incomplete picker scopes, preserves repeated/nested instance identity, and produces separate precedence/assembly projections and qualified advisory diagnostics. Existing direct `SequenceLink` semantics remain unchanged.
+- Optional exact operation-allocation identity on SA BoundaryInterface Call/Asynchronous occurrences. Ordinary `None` is omitted in serialized records. Explicit unresolved intent preserves values; selected intent requires actual concrete port, interface, direction, item and transmission proof. Reply derives the correlated Call's signature and independently validates its channel.
+- Typed reference lifecycle, caller-owned source placement, exact history, qualified transition mapping, explicit reverse operation-omission rationale, and typed semantic-review facets. Reverse dependency discovery does not introduce technical allocation dependencies solely from an operation being explicitly abstracted.
+- One schema/source 7 increment. Versions 1–6 reject new constructors and fields, including explicit null operation fields. Old nonempty Call/Reply record serialization remains unchanged; source migration changes the version token while preserving module bytes and comments.
+
+Public seams are in `crates/oa-core/src/model.rs`, `topology_context.rs`, `topology_context/analysis.rs`, and `operations.rs`. Desktop uses those resolvers; it must not infer qualified ownership from generic leaf endpoints. `resolve_scope` supports raw endpoint drafts without fabricating a selected leaf.
+
+## Verification and corrections
+
+`cargo test -p oa-core --tests --no-fail-fast --locked` produced 425 passing, one failing and one ignored test in `.local/source7-all-core-tests2.log`. The sole failure was an old test expecting migration's current token to be 6. Changing that expectation to `SCHEMA_VERSION` preserved its schema-5 input and exact trivia comparison. A fresh complete `communication_means` target passed 9/9 in `.local/source7-communication-means-final.log`. Combined component coverage is **426 passing and one ignored**, with no remaining observed test failure. This is not a claim of one wholly green full-suite invocation.
+
+The fresh full run includes all **12 source7 contract tests**, all **39 core unit tests**, and all **four teaching-project tests**. Teaching equality passed after root changed only the three current generated version tokens; no additional model regeneration was needed. Earlier failures and corrections are preserved in the ignored source7 logs. Current-version expectations changed; frozen historical fixture bytes were not rewritten as current models.
+
+The new tests exercise OA and SA repeated/nested references, R1/R2 distinction, cache eviction, qualified branch advice, assembly incidence without invented precedence/global coverage, path depth/accounting, deletion/retarget/reidentify, source-module ownership and token-only upgrade, exact Undo/Redo, typed semantic observations, parameterless operation identity, missing channel/lifeline/direction proof, separate void Reply channel, unresolved retained values, and reviewed reverse abstraction.
+
+One consequential integration correction preserved the established independent channel contract: deleting a sole operation allocation cannot leave a boundary carrying an unadmitted item. Tests pin refusal without mutation, successful explicit channel repair with retained unresolved values, and successful deletion when another interface allocation admits the item without substituting that surviving allocation as the selected operation. This is the root-ratified lifecycle clarification, not a scenario-specific relaxation of port validation.
+
+The normative language sections 4.2.1 and 4.3.1 were compared with the implemented contract after these corrections. Selected operations now reject missing concrete proof; explicit unresolved intent remains editable. Authored paths use existing caller-specific ParseLimits (REST 50,000, desktop 500,000, core caller policy), separate from depth 64 and analysis budgets.
+
+## Open acceptance work
+
+Independent review immediately after the initial checkpoint found that the analysis edge limit bounded stored output but did not stop traversal of later authored edges/repeated instances. A concrete 1,000-reference × 1,000-parallel-link model could examine roughly one million edges after reaching the 100,000 limit. The subsequent correction reserves actual work before each authored endpoint resolution and each synthetic/legacy edge, including attempts that produce no stored edge. Exhaustion stops traversal through ancestor frames and returns no inferred partial entry/exit boundaries. Node-budget exhaustion uses the same stop propagation. A single located budget notice marks the analysis incomplete.
+
+Three new internal tests passed in `.local/source7-analysis-work-limit-tests.log` (33.22-second compilation, 3.49-second execution): the actual million-edge fixture stops at 100,000 examined attempts and before later reference nodes; cache capacity 1 cold/warm and capacity 0 produce identical output; unresolved authored endpoints consume work despite zero stored edges; and exact edge budgets include synthetic entry/exit connectors. One fewer permitted connector and a node-limit abort both report incomplete with no fabricated bypass. The counter is actual reservations before examination, not stored-vector length. This closes the identified edge-work defect within that measured scope.
+
+Fresh `language` 16/16 and `source7_contract` 12/12 passed afterward in `.local/source7-core-after-work-limit2.log`. Their first rerun found the normative-example test collector recognized only historical literal headers 2/3/4/6 after root upgraded the current prose examples to 7; it now recognizes 1 through `SCHEMA_VERSION` and actually parses the examples. Combined baseline plus the three new tests is **429 passing and one ignored**, with fresh affected-target evidence. The full core suite has not been rerun after this bounded traversal correction. Core ownership and the sole Windows Cargo lease were released to the desktop worker after the green focused run.
+
+Final default-node-limit scale evidence is still needed. Graphical authoring, exact contextual semantic composition, old/new checkpoint restore, REST admission/limits, native readability and Save/Undo/Redo/reopen remain independent integration gates outside this core report. No source7 release completion is claimed.
+
+Follow-up operation evidence: four additional test-only cases in `source7_contract.rs` exercise actual reverse unoriented channel traversal with exact Reply correlation; inherited exposure versus a separate same-item allocation requiring its own explicit caller requirement; all Call/Asynchronous × Synchronous/Asynchronous/Unspecified combinations; and allocation deletion that repairs both the Call and separate Reply channel while retaining raw InOut values through Undo/Redo. The entire target passed **16/16** in `.local/source7-operation-composition-tests2.log` (4.88-second compilation, 0.35-second execution). The initial compile required cloning the non-Copy MessageKind in the test matrix; no production defect or semantic expectation adjustment was needed. This closes those four previously listed composition-evidence gaps. Scoped cumulative core coverage is now **433 passing and one ignored** across the original full run and affected-target reruns, not one fresh full-suite invocation. The Windows Cargo lease was released immediately after the green target.
@@ -0,0 +1,70 @@
+# Source 7 desktop authoring checkpoint
+
+Desktop integration compiles. Current focused checks passed: qualified links 5,
+operation authoring 3, semantic composition/omission 3, source7 recovery 8, legacy
+recovery 13, Traceability browsing 2, and focused-canvas draft guard 1. Evidence:
+`.local/source7-desktop-final-focused.log` and
+`.local/source7-desktop-traceability-rerun.log` (the latter replaces the first
+Traceability fixture's duplicate-mapping admission failure).
+
+The first full run passed 560/561 and exposed a canvas scroll-state regression.
+A fixed navigation container corrected it; the existing unchanged regression
+passes in `.local/source7-desktop-scroll-state-rerun.log`. The full rerun passed
+561/561, zero failed/ignored, in 263.39s:
+`.local/source7-desktop-full-tests2.log`. Source is frozen and the Cargo lease has
+returned to root. No source7 native acceptance is claimed here.
+
+## Observable workflow
+
+- Process/chain canvas offers Focus canvas and Restore explorer and properties.
+  Hidden panels do not bypass invalid draft or source guards. Saved diagram names
+  sort by name then identity. Open source/Back remain above the canvas.
+- Qualified links retain separate caller-qualified source and target addresses.
+  Enter reference browses the complete direct inventory of that exact reference
+  scope; Up and Root return without changing either selected endpoint. Search
+  examines that whole inventory before 24-row pagination. Canvas preview folding
+  remains separate and bounded. The >512 regression covers both direct and nested
+  tail identities, last-page/search access, and raw draft recovery.
+- Precedence and exchange/common-work incidence remain separate typed purposes.
+  The existing core resolver validates every address and link. Repeated uses of a
+  definition are distinct. The canvas renders incidence without a precedence
+  arrow and exposes full qualified identity and explicit definition navigation.
+- SA BoundaryInterface Call/Asynchronous drafts select an exact interface-item
+  allocation, including parameterless operations. Explicit unresolved selection
+  is retained; Reply derives its identity from the correlated Call. Value fields
+  use the core's selected signature. Invalid raw values survive toggle/recovery.
+- Reverse transitions and semantic review expose explicit operation omission and
+  its required rationale. No allocation is inferred and the source is retained.
+- Traceability has a fixed All / Layer traces / Development artifacts filter and
+  search above the cards. It searches the complete inventory, including artifact
+  URI/revision and owner identity, with stable name/UUID sorting. Filtering does
+  not change selection or raw property drafts. The test uses 68 distinct mappings
+  and exercises the existing invalid-property selection guard.
+
+The operation test creates Reset and ReadStatus Call/Reply pairs through the GUI
+adapter without adding per-operation channels. Each result matches the core
+command, source reparse, and exact Undo/Redo bundles. Qualified-link tests cover
+both layers, repeated-reference identity, rejected raw endpoints, nested folding,
+and one-command exact source/history behavior.
+
+## Review findings and scope
+
+`semantic_review/source7_tests.rs` passed the direct ContextSource path-only versus
+Incident leaf conflict checks in both directions, virtual absent operation field
+to exact selected allocation, and rejected omission rationale recovery/repair
+against the core batch. The resolver-backed stale transient selection check is
+used at display, seed, Back, and camera sites; its deletion regression retains
+authored qualified drafts for explicit repair.
+
+Independent review identified selected asynchronous operation value pickers
+exposing response-only parameters. A shared effective value-phase adapter now
+applies request direction to explicit asynchronous operation intent after exact
+signature admission, preserving ordinary asynchronous channel behavior. The new
+root/nested parameter test passed and retains a rejected output expression over
+recovery and toggling operation intent. Core admission remains authoritative.
+
+Canvas preview expansion is bounded separately from authoring. Folded/omitted
+contributions retain full endpoint labels and explicit definition navigation;
+the complete-scope picker has no 512-prefix authoring limit. No unbounded rendering
+or simulator was added. Strict checks/build and source7 native authoring are the
+next gates; root owns those stages and their reports.
@@ -0,0 +1,25 @@
+# Source 7 desktop independent review — 6 September 2026
+
+Read-only source review by the core contract implementer, independent of desktop implementation. No Cargo, native input, or production edits in this review. The desktop owner was still wiring tests and artifact navigation; observations refer to the named source seams, not a tested release executable.
+
+## Concrete finding
+
+**P2 — Selected asynchronous operation values offer output-only parameters that core rejects.** `crates/oa-desktop/src/data_values.rs::phase_allows` (around line 136) narrows Call to In/InOut and Reply to Out/InOut/Return, but its wildcard admits every direction for Asynchronous. `behavior/scenario.rs::Draft::signature` / `browsed_values` and `forms/data_fields.rs::message_value` correctly obtain the exact selected-operation signature, then pass the unchanged Asynchronous phase through the common field browser. Core `validation.rs` (around line 1926) intentionally narrows Asynchronous **when a selected signature exists** to In/InOut/Unspecified.
+
+Reproduction: give one SA operation an In parameter and an Out or Return parameter, declare asynchronous transmission, and select that exact operation on an asynchronous BoundaryInterface message. The scenario and property value browsers offer the output-only parameter; entering its value causes Apply to reject `message_parameter_phase`. The selected allocation itself is valid. This is an authoring-option mismatch, not a core admission defect. Ordinary operation=None asynchronous messages retain their historical broader phase behavior, so globally treating every Async as Call would regress compatibility. Pass an effective input-only phase for selected operation signatures, or an explicit phase policy, consistently through roots/children/resolve/current-value presentation. Pin both editors plus ordinary Async and Reply as controls. Reported directly to root and desktop owner; runtime reproduction and fix verification remain pending.
+
+## Bounded preview limitation, not semantic identity loss
+
+`behavior/topology.rs` around line 930 requests at most 512 flattened preview contributions for an expanded reference, or four when collapsed. `topology/contextual.rs::preview` stops at that limit. `GraphNode::endpoint_rect` around line 781 returns the enclosing reference rectangle when an exact endpoint is absent from preview; qualified link anchoring and `selection_offset` use this fallback.
+
+A valid link to contribution 513 can be authored via the complete scoped picker and retained exactly, but its line attaches to the outer reference even after Expand. This is **not** an authoring blocker or a semantic retarget: selected links show full From/To names and aliases in `topology/view.rs` around lines 186–188; qualified selection shows its full address and an **Open contribution definition** action around lines 191–194; the preview itself reports “N shown · M direct contributions” around `topology.rs` line 1303. The earlier 512-entry picker omission is corrected and is not repeated as a finding here.
+
+Small presentation recommendation: identify an endpoint omitted by the expanded preview limit explicitly, or reserve a bounded row for selected exact endpoints. Preserve the deliberate folded-reference summary. Do not require unbounded expansion of repeated/nested trees. The displayed count also mixes flattened nested rows with a direct-contribution total, so it can say more shown than direct contributions; label those two populations clearly if changing this area. Whether existing text is sufficiently clear at minimum window size requires native observation; this review does not claim an observed user error.
+
+## No additional material finding in inspected seams
+
+- Qualified endpoint hits retain complete reference paths; root reference UUIDs are used only for local selection/visual containment. Caller-owned link edits validate through the shared core index. Repeated leaf UUIDs do not replace the selected path.
+- The new `State::qualified_selection(p, owner)` filters stale transient selection through core resolution before breadcrumbs, source seeding and camera use. Authored drafts remain intact. `OpenQualified` checks the current event context, pending edit guards and successful Apply before resolving the address again in the resulting accepted model. Definition navigation is explicitly labeled as affecting all uses.
+- Operation choices consume core `eligible_allocations`; exact current invalid selections remain visible for repair rather than being replaced with another allocation. Message signatures and labels consume core operation resolution. Explicit unresolved intent does not fall back to channel union. Reply displays the exact correlated Call operation and has no independent writable selection in scenario creation.
+
+Limits: this was targeted inspection of contextual authoring/rendering/navigation and operation controls, not an audit of all semantic-review composition, checkpoint migration, accessibility, or large-model frame time. Existing focused test results were supplied by the desktop owner; no new runtime evidence was generated here.
@@ -12,12 +12,14 @@ Both additions use one schema/source7 change. They must not be shipped as separa

 ## Resolved critique boundaries

- Admission counts authored path components deterministically. Resolver cache capacity only evicts/skips storage; it never changes validity. Per-request analysis budgets are separate. Initial depth64, total ordered-reference budget50000, analysis50000nodes/100000edges remain explicit service/desktop resource policies and must pass scale/cold/warm/eviction tests before acceptance.
+- Admission counts authored path components deterministically. Resolver cache capacity only evicts/skips storage; it never changes validity. Per-request analysis budgets are separate. Depth64 and analysis50000nodes/100000edges must pass scale/cold/warm/eviction tests before acceptance. Integration clarification from independent code review: the ordered-reference budget is existing caller policy, not a new global limit. REST retains50000, desktop source retains500000, and core callers choose ParseLimits explicitly. New path components count in those existing budgets; do not reduce desktop capacity or let caching change admission.
 - Normal Delete removes the whole dependent ContextualLink atomically when its owner, path member, leaf or purpose work/exchange is deleted. It never shortens/reinterprets the address or changes purpose. Reidentify visits every typed component. Retargeting that invalidates a surviving link refuses unless an explicit valid repair batch is supplied. Caller ownership controls source placement even when both leaves are external.
 - Accept the [contextual analysis contract](release-chain-context-analysis-contract-20260906.md): separate precedence, assembly incidence and coverage projections; qualify nested definitions by occurrence paths; mark synthetic reference boundaries and exclude their arcs from authored cardinality/guards. A qualified advisory may flag R1.B's two incoming authored precedence links, without invalidating the model, forcing a Join, changing standalone P/R2 or claiming execution analysis. Missing/empty/over-budget expansion is explicitly incomplete, never a guessed bypass or complete-looking reachability result. Direct-only historical diagnostics remain unchanged.
 - A selected operation requires proof through the **actual concrete Standard component ports** of the Call: receiver Provides, sender Requires a compatible interface exposing that same allocation. Participant containment does not inherit interface roles onto ports. Refuse a selected allocation without this proof; explicit unresolved operation intent remains editable. Resolve inherited allocations through the existing data rules; never substitute a separately allocated same item. Call/Asynchronous transmission and actual reversed-channel direction follow the operation contract.
 - Reply derives roles and signature from the Call, then separately validates existing reply correlation/order/reversed participants/channel rules. A separate explicit return channel remains permitted when it carries the selected operation item (or an admitted subtype) and its actual endpoints satisfy the existing channel contract; this check applies even to parameterless/void returns. Do not demand that the Reply receiver provide the operation. Ordinary operation=None replies retain their prior behavior.
 - Deleting an operation allocation clears its selection to present/unresolved and preserves still-live value expressions. While signature is unresolved, perform independent live-reference/path checks and report incomplete signature; do not fall back to the whole channel's union as a substituted operation. Item/field deletion uses normal proven-reference cleanup. Reselection validates retained values against the exact new signature and rejects without implicit pruning/defaults.
+
+  Integration clarification: this is reference cleanup within an otherwise valid candidate, not an exemption from the established port/channel contract. Existing `workflows.rs` allocation-deletion tests and `ports.rs` `port_interface_items` explicitly reject removing the sole interface allocation while a boundary still carries that now-unadmitted item. Keep that refusal atomic and unchanged. A surviving second allocation may admit the channel item, allowing deletion, but the operation MUST stay unresolved rather than select that other identity. Otherwise an explicit repair batch must address every affected carried-item contract, including a separate Reply channel, while preserving still-live unresolved message values. Root rejected downgrading channel errors based on the presence of a scenario; that would make channel validity depend on unrelated occurrence records. State-contract independently reviewed this clarification and found it consistent with whole-candidate validation. Pin both simple-delete and explicit-repair cases in core tests.
 - SA→OA operation abstraction requires explicit per-source omission with rationale in the transition preview. Missing/irrelevant/duplicate/wrong-direction decisions reject; Reply derives the Call's abstraction and has no duplicate writable choice. Preserve the source, map remaining facts explicitly and validate the whole target. Technical operation Take into an OA NotApplicable slot is not ordinary cross-layer reference mapping.

 ## Implementation and acceptance boundary
@@ -0,0 +1,85 @@
+# Frozen source7 native Linux gate — 2026-09-07
+
+Status: **Native core PASS (436 passed, 0 failed, 2 ignored); native server gate FAILED one reproducible deadline assertion (52 passed, 1 failed). VM cleanly powered off.** These are scoped results for the frozen snapshot, not overall release acceptance. Root owns VM lifecycle; no simultaneous Windows Cargo compilation is allowed during this gate.
+
+## Exact inputs and environment
+
+Root booted the retained headless Ubuntu 24.04.4 guest at 2026-09-07 07:02:43 UTC, with a hard live deadline of 08:32:43 UTC and 180 seconds reserved for shutdown. SSH became healthy around 07:06:41 UTC. Guest kernel: `6.8.0-139-generic`, x86-64. Native Rust/Cargo are explicit 1.90.0; Rust commit `1159e78c4747b02ef996e55082b704c09b970588`.
+
+Fresh guest snapshot: `/home/arcadia/qa-source/source7-20260907T070243259972Z`. It contains 455 frozen working-source files plus `QA-SNAPSHOT.json`; the recorded Git parent is `4b6b5fc1977523e8cf52fdd5503a0a71c87a3f63`. Source7 changes are captured working bytes, not represented as already committed in that parent.
+
+| Input | SHA256 |
+|---|---|
+| `source7-20260907T070243259972Z.tar.gz` | `7104946c89b2be7a1a030fdff47cb4405bacf05357d68cf35d181e860f55c279` |
+| Corresponding external `.tar.manifest.json` | `b6fd1cc065a3370c3736f3d6f34545dd3f2b0f600168fada2b931ecb64a0c870` |
+| `source7-gate.sh` | `2489e1053b5523515b77c5a5d191175c21eb6d85e2ae8b080b977bec3bbd8b96` |
+
+All three hashes matched on both host and guest. Before extraction, the setup script checked archive member count and exact inventory, prohibited nonregular/absolute/parent-traversal entries, checked every file hash and internal/external manifest equality, and required a previously absent destination. Driver syntax checking passed. Driver additionally verifies exact inventory/content before and after each test command and compares its captured manifest.
+
+Cache: preserved `/home/arcadia/qa-target`; Cargo jobs=1, incremental=0. Guest has 1,961MiB RAM and no swap; the host monitor remains active. No cross-built test executable is substituted for these native Cargo tests.
+
+## Ordered gates
+
+1. Native server: `cargo +1.90.0 test --locked -p oa-server -- --test-threads=1`, command timeout 50 minutes plus bounded termination grace. Started around 07:08 UTC. Final result: compilation passed; unit tests 2/2 and HTTP 50/51, detailed below.
+2. Native core: `cargo +1.90.0 test --locked -p oa-core --tests -- --test-threads=1`, only if at least 15 minutes remain after shutdown reserve. Executed after the isolated server rerun; final result below.
+
+Driver artifacts are retained below `/home/arcadia/qa-artifacts/source7-gates/`; each run records its exact driver, manifest, command, status JSON, full output and source pre/post verification. Host streaming log: `.local/linux-qa/runtime/source7-server-gate.log`. Final passing counts below come from the collected status and complete per-target test summaries.
+
+## Separate cross-built executable runtime check
+
+Before native tests, the hash-checked Windows/Rust1.90 cross-built probe actually executed in this guest and passed the ring SHA256, thread and UTF-8 filesystem checks. Exact ELF SHA256 `1d7029f9b6ebea28b35765760c56631ebd4829e3c33dbdcc225d992f558ea023`; runtime JSON was independently parsed and matched. See `release-linux-cross-build-probe-20260906.md` and `.local/linux-qa/runtime/source7-probe-and-unpack.log`. This closes only that bounded executable runtime check; no Iced Linux GUI binary has been built or launched.
+
+
+## Native server result and bounded classification
+
+The full server gate ended at 07:30:19 UTC, command exit 101, driver wall time 1,290 seconds. Compilation succeeded in **17m10s**; server unit tests **2/2 PASS** and HTTP tests **50/51 PASS** (238.94 seconds). The failed Cargo target prevents treating later targets/doc tests as executed.
+
+Sole failure: `accepted_slow_source_does_not_lock_catalog_and_loses_to_a_newer_http_revision`, `crates/oa-server/tests/http.rs:638`: actual **504**, expected **412**. The test had passed its unfinished-after-100ms assertion, two-second catalog-read bound, two-second concurrent PATCH bound and winner status. The final loser JSON/revision/disk assertions occur after the failed status assertion and therefore were **not reached**.
+
+The source is a 1,000-deep admitted activity hierarchy. `crates/oa-server/src/lib.rs:111` independently enforces a hard 30-second request deadline and emits 504 `outcome_unknown`. The test permits a 45-second completion watchdog but requires preparation to finish within the actual service deadline to observe 412. The unfinished client assertion does not establish that the server has already completed its initial revision check. This is a resource-dependent fixture/deadline mismatch, not evidence that the catalog or commit mutex was held throughout preparation, nor evidence that the final persisted-state assertions passed.
+
+One explicitly authorized isolated rerun used the identical frozen sources and assertions, the already compiled HTTP target, exact test filter, one test thread and a ten-minute outer limit. It reproduced **504 versus 412**, in **49.38 seconds test time** (cached Cargo preparation 14.01 seconds), without other test/compile contention. Therefore this is **not classified as a random full-suite flake**. No fixture, production timeout or assertion was modified and no further retry was made. A future precise synchronization test seam could test the intended post-initial-check race without depending on costly graph validation outrunning one bound but finishing before another; that requires a separately reviewed change.
+
+Both full and isolated runs passed all 455 source-content/inventory prechecks and postchecks. Their guest artifact directories were copied intact to the host under `.local/linux-qa/runtime/source7-gate-artifacts/`:
+
+- `server-test-20260907T070848Z-G0glzP`: full run, status FAILED/101, 1,290 seconds.
+- `server-test-20260907T073317Z-3MLzDC`: isolated run, status FAILED/101, 96 seconds driver wall time.
+
+The focused driver differs only in the exact printed Cargo command and retains the same source validation/status machinery. Its SHA256 is `701e7e242109290f2952cc6929a903fc8c25d4086e44434c4c1193ad71e4b55f`. Streaming evidence: `source7-server-gate.log`, `source7-server-focused-gate.log`; final guest status JSON and driver copies are preserved in the artifact directories.
+
+
+## Native core final result
+
+**PASS: 436 passed, 0 failed, 2 ignored across 40 test targets.** Explicit native `cargo +1.90.0 test --locked -p oa-core --tests -- --test-threads=1` exited 0. Compilation took **23m03s**. Driver status records 1,992 seconds wall time, start `07:36:23Z`, completion output `08:09:37 UTC`. Exact 455-file source precheck and postcheck both passed. The copied guest status is `PASSED`, command status `0`, exit status `0`.
+
+The source7 contract target passed all **16/16** tests (6.63 seconds), including contextual repetition/nesting and analysis budgets, source/identity/history/migration, exact inherited allocation identity, reverse unoriented Call/Reply binding, transmission mismatch/Unspecified diagnostics, and independent repair of Call and separate Reply channels after allocation deletion. The shipped teaching generator/source equality tests also passed in the actual Linux filesystem context.
+
+The unit target passed 42 tests and ignored one. Linux-specific syscall-publication coverage executed successfully:
+
+| Linux publication case | This snapshot's result |
+|---|---|
+| Concurrent stages have exactly one winner | PASS |
+| Competing destination and caller-owned stage are preserved | PASS |
+| Raw path bytes are preserved and NUL rejected | PASS |
+| Publication refusal never starts model writes | PASS |
+| Injected unsupported `renameat2` error fails closed | **IGNORED**; requires separate strace injection and `OA_TEST_RENAMEAT2_ERRNO` |
+
+The other explicit ignore is `inheritance_chain_validation_scaling_probe`, an opt-in scaling experiment requiring `--ignored --nocapture`. Neither ignored case was rerun in this gate. Prior Linux injection evidence, if cited elsewhere, belongs to its earlier snapshot and must not be relabeled as this source7 run.
+
+## Copied evidence hashes and shutdown
+
+All three guest artifact directories were copied intact before shutdown. Each includes exact `driver.sh`, `snapshot-manifest.json`, `output.log`, and `status.json`. The 12-file host size/hash inventory is `.local/linux-qa/runtime/source7-artifact-hashes.json`; core count extraction is `source7-core-counts.json`.
+
+| Copied artifact | SHA256 |
+|---|---|
+| Core output | `c744bcba79ae5af163577cb6367ae39b192754b5864724fbefca05d09fd31480` |
+| Core final status | `af1143378ba1aebae943d9de728935d1ab655e25d36f187a90beb2aee493a810` |
+| Full server output | `8ce24e5e9a84cc119e7499f41fce3c9a9a914c138237fd82d901977408aad8d0` |
+| Isolated server output | `5f858c816963ae3ca013f66fa3e1945377f95c2a6844d881e56d6eba13721161` |
+| Internal snapshot manifest, identical in all three runs | `57061c50d48444ef7b82fc063e874209ef7d86424638c2b37104ab7e483c4950` |
+
+The internal manifest's bytes differ from the separately exported manifest's line endings; JSON equality and the complete file digest mapping were explicitly checked before extraction. Each driver's own internal manifest was also compared byte-for-byte before/after its run.
+
+Root delegated clean shutdown after evidence collection, with no additional gate. `sync; sudo -n poweroff` was accepted at **08:12:55 UTC**. Serial output reached `reboot: Power down`; by **08:13:56 UTC**, QEMU PID 6280, launcher PID 5000 and seed PID 816 were all absent. Host free RAM was 4,157 MiB at that confirmation. The heavy build lease was released immediately. The VM disk, toolchain and approximately 1.5 GiB guest Cargo target cache remain preserved. Durable records: `source7-clean-poweroff.log`, `source7-final-serial.log`, and `source7-post-poweroff.json`.
+
+An optional executed-binary hashing command was interrupted by the clean shutdown after partial output; `source7-test-binary-hashes.log` is explicitly **not a complete binary inventory**. This does not affect the copied, complete test logs/statuses/manifests or their host hashes. No source or assertion edits, VM reboot, or extra Linux test gate were made in this run. A new server test design and fresh Linux snapshot require separate validation; Linux Iced GUI compilation/execution remains outside this gate.
@@ -0,0 +1,115 @@
+# Source7 Linux GUI cross-build — 2026-09-07
+
+Status: **Current frozen-source Linux GUI cross-build PASSED with Rust1.90; ELF and staged lesson independently verified. Linux GUI runtime acceptance remains pending. Both earlier incomplete runs are preserved below.** Root granted the exclusive Windows heavy-build lease after its Windows tests, strict Clippy and binary build passed. The Linux VM is off. No production code was changed for this build.
+
+## Exact source and command
+
+Root's new frozen archive contains 458 files, 2,089,801 compressed bytes. Archive `.local/linux-qa/runtime/source7-20260907T082753190288Z.tar.gz`, SHA256 `cbb371a93a562e1e641d7629fe351e016d63e66fc9112499b3fed6d5cd171f78`. The preparation helper verified this hash, each regular archive member and its digest, exact inventory, internal/external manifest identity/file mapping, and a previously absent destination. It rejected unsafe paths, duplicates and nonregular members. The copied source is:
+
+`.local/cross-linux-qa/sources/source7-20260907T082753190288Z`
+
+Its exact internal `QA-SNAPSHOT.json` SHA256 is `125557e1c3e9c7dcf843ed57a700311b944aa0f807c66bd004eac17b6adbbd7d`. Driver precheck independently verified all 458 copied files and the manifest before starting. The retained prior native Linux gate used a different 455-file snapshot; its results are not silently attributed to this source copy.
+
+```powershell
+. .local/cross-linux-qa/env.ps1
+cargo +1.90.0-x86_64-pc-windows-gnu zigbuild `
+  --manifest-path <exact-frozen-copy>/Cargo.toml `
+  -p oa-desktop --bin arcadia-studio `
+  --target x86_64-unknown-linux-gnu.2.28 --offline --locked
+```
+
+The child overrides only the task-local Windows-host linker with the response-aware shim described below. Cargo uses the preserved separate `.local/cross-linux-qa/target`, jobs=1, incremental=0, pinned Zig 0.16.0 and cargo-zigbuild 0.23.3. The default development profile is the repository's existing debug=0; no features or dependencies are removed to make the GUI compile.
+
+Run directory `.local/cross-linux-qa/gui-runs/20260907T0831324427733Z`; hidden worker PID 2612. Start **08:31:32 UTC**, twenty-minute review **08:51:32 UTC**, hard command budget deadline **09:16:32 UTC**. The driver checks every approximately twenty seconds for available host RAM below 512 MiB or disk below 5 GiB and stops only its own still-live worker/compiler descendant tree if a floor or time limit is crossed. Cache is retained. It records status, resources, exact driver/child/proof/manifest and the Cargo log. The twenty-minute event requests an explicit progress assessment within the already authorized 45-minute budget; it does not start another job or extend the deadline.
+
+## Read-only dependency and host-wrapper prerequisites
+
+`cargo +1.90.0-x86_64-pc-windows-gnu metadata --locked --offline --filter-platform x86_64-unknown-linux-gnu` passed without downloads. Inspection of the metadata's desktop normal/build dependency closure found 333 package records and no declared `rust_version` above 1.90. Some packages do not declare an MSRV; this inventory cannot prove they compile. This metadata closure is an inventory, not an exact platform-feature compilation oracle: Cargo's metadata feature union included Emscripten-only EGL static flags. A separate target-specific offline `cargo tree -p oa-desktop --target x86_64-unknown-linux-gnu -e features -i khronos-egl` confirmed the actual Linux tree uses dynamic EGL, without those static flags.
+
+Inspected locked build scripts/features confirm tiny-xlib and wayland-sys `dlopen`, smithay-client-toolkit without its build-time xkbcommon feature, and rfd's async-std/xdg-portal backend. Missing pkg-config data is tolerated on the inspected dynamic X11 path. Full link success remains the real check; no guest sysroot or host package installation was assumed. Inventory evidence: `gui-metadata.json`, `gui-dependency-inventory.json`, `gui-feature-evidence.json`, `gui-egl-tree.log`. The inspected workspace lock hash was `a6e070ed59b0ba19f18d60e8104494b777b470bd0268ae348cbe2b229790449f`; the build additionally requires the frozen lock's own manifest digest.
+
+The previous `.cmd` host wrapper selected `dllcrt2.o` only when `-shared` appeared directly. Rust 1.90 can replace an oversized linker command with a UTF-8 response file containing its arguments. That makes direct-only detection insufficient. A task-local **native executable** shim now examines the original arguments and flat Rust GNU response file for the actual `-shared` flag, selects the matching Rust-provided `crt2.o` or `dllcrt2.o`, and forwards the original argument/response data to Clang without shell interpretation. Nested response files, non-UTF8 content and response files above the explicit 4 MiB inspection bound fail clearly instead of guessing. The format assessment follows the exact [Rust 1.90 linker implementation](https://github.com/rust-lang/rust/blob/1.90.0/compiler/rustc_codegen_ssa/src/back/link.rs#L1462-L1527).
+
+Root approved a real bootstrap before the GUI build. The shim itself was compiled with the explicit Rust 1.90 GNU host and the previously proven EXE linker path. Then the existing task-local ring probe rebuilt and executed both its Windows EXE build script and Windows proc-macro DLL in **direct** and **forced-response-file** modes, and linked the Linux target in both modes. Two fresh audit records prove forced response inspection selected both artifact kinds. Results: direct **2.23s**, forced **2.11s**, both exit 0, warm cache. An initial helper-only `Select-String` argument-binding typo was fixed; its successful direct compilation was not a compiler defect or production change.
+
+Final shim SHA256 `98f0da6d32ba3f99a334659e5803110c6d5c3eaa17b5cd288a23025216f814a9`; source SHA256 `c48c0a33621d4ad36ceb31415fc2497f0cb320986b54bdc1da3ba8b1d87f8b46`. Proof: `.local/cross-linux-qa/host-link-response-proof.json`, with direct/forced log hashes. The GUI driver requires this successful proof to match the actual shim executable. Earlier runtime-verified ELF `1D7029F9…8EA023` and host DLL `86B6321C…362710` were preserved as `hello-ring-before-response.elf` and `host-macro-before-response.dll` before this modified probe rebuilt; their earlier execution evidence remains scoped to those original bytes.
+
+## Remaining checks and limits
+
+On successful Cargo completion the driver verifies the frozen source again, records ELF headers/interpreter/dynamic dependencies/version requirements, hashes the executable and stages it in the fresh run's package directory with the **whole** `examples/release1` folder beside it. Manual inspection must confirm the Linux ELF and required runtime libraries before any guest trial. On failure/time/resource stop, preserve the exact error and partial cache; discuss production defects before changing shared code.
+
+No GUI guest has been launched for this build. The separate `release-linux-gui-runtime-plan-20260907.md` still governs VGA/framebuffer, Xorg/Openbox, software Vulkan, portal and actual engineer workflow prerequisites. A cross-compiled GUI, even at Rust 1.90, does not establish display rendering, usable dialogs, Save/Undo/reopen behavior, Wayland support, or hardware acceleration. Native core/server test evidence remains in `release-source7-linux-gate-20260907.md` with its explicit server failure, separate snapshot and ignored cases.
+
+Prepared helper ownership is limited to `.local/cross-linux-qa/{prepare-gui-source.ps1,bootstrap-host-link-response.ps1,host-link-response.rs,gui-cross-build.ps1,gui-cross-child.ps1}` and their task-local output. PowerShell parser checks, exact archive preparation/precheck, and real bootstrap passed. The original wall-clock time-stop and later explicitly requested process-tree interruption were observed as recorded below; the resource-floor branch was not deliberately triggered.
+
+
+## First run stopped after host clock adjustments
+
+The driver ended **TIME_LIMIT**, with the post-build frozen-source check **passed**, at `2026-09-07T09:30:04.4385366Z`. Cargo was terminated before completion, so `exit_status` is null and no GUI executable was staged. The last compiler lines were `rustls-webpki`, `tiny-skia`, `guillotiere` and `rand_core`; no compiler or linker error had appeared. This is an incomplete build, not a passing feature/MSRV test or a compiler failure.
+
+Resource samples have a gap from `08:43:32Z` to `09:30:01Z`. Read-only Windows System event inspection found two Kernel-General event 1 records identifying `vmtoolsd.exe` as the time-change source:
+
+| Old UTC | New UTC | Recorded delta |
+|---|---|---:|
+| 08:43:35.257 | 09:16:14.039 | +1,958,781 ms |
+| 09:16:26.925 | 09:29:43.304 | +796,378 ms |
+
+These total **45m55.159s** of clock adjustments. The driver's UTC start/end span was about 58m32s; it cannot establish 45 minutes of active compilation. No sleep/power transition is inferred. Exact event evidence is retained in the run's `host-time-events.json`. The twenty-minute review notification and time-limit decision occurred together when the monitor next resumed sampling after the clock jumps; there was no normal twenty-minute progress checkpoint before termination.
+
+`stop.log` records termination of the task-created process tree. One child initially returned an unsupported-termination error; a subsequent explicit check confirmed **all seven referenced PIDs absent**, as well as no cargo/rustc/clang/zig processes. `stopped-process-check.json` records the check at `09:31:18Z`, host free RAM 4,125 MiB and disk 11.84 GiB. The heavy lease was released immediately. The preserved cache remains available; no source, features, dependencies or production code were changed in response.
+
+A renewed run requires root authorization. Recommended helper-only correction before that run: use a monotonic `Stopwatch` for elapsed budget/review decisions, retaining UTC times and recording wall/monotonic divergence for provenance. This avoids using wall-clock synchronization as evidence of elapsed build work. Preserve this original TIME_LIMIT run and its logs; do not relabel it as a successful or continuously active 45-minute compile. No retry was started under the expired lease.
+
+
+## Explicitly authorized renewed run
+
+Root authorized a renewed cached run of the identical frozen 458 files after reviewing the documented VMware time events. Only the task-local driver timing was changed: a monotonic `Stopwatch` now controls the twenty-minute review and 45-minute cap. UTC timestamps, monotonic elapsed seconds, UTC elapsed seconds and their difference are recorded in status/resource evidence. Elapsed time is not described as active compiler CPU time. Original run/evidence are unchanged.
+
+PowerShell parser review passed. Updated driver SHA256: `f58950cabb1f7567caba13462db766c40022da261a21ee5a047e8bea582de74c`. New run `.local/cross-linux-qa/gui-runs/20260907T0933400874515Z`; hidden worker PID **8156**; UTC start **09:33:40.5906463Z**. The 45-minute limit is monotonic (nominal UTC 10:18:40 only if wall time remains stable). The exact source precheck passed again, and the unchanged linker proof/cache were reused without rerunning the bootstrap. No VM or second Cargo worker was started.
+
+At the renewed run's normal twenty-minute review (UTC `09:53:55Z`, monotonic elapsed **1,207 seconds**), Cargo had reached `oa-core`, `iced_renderer`, `rfd` and `ashpd` without a compiler/linker error. Sampled free RAM was **3,572 MiB**, disk **11.698 GiB**, and UTC/monotonic divergence approximately −0.062 seconds. The recorded decision was to continue within the existing 45-minute limit; no source/features/toolchain change or restart. Evidence: renewed run `twenty-minute-review.json`.
+
+
+## Renewed run interrupted for the user's latest Windows build
+
+Root directed immediate resource handoff for the user's requested latest Windows build. Inspection showed actual `rustc` PID3700 compiling `oa_core`, despite Cargo having printed the `oa-desktop` package/build-script line; this was **not final GUI linking**, and no completion-within60seconds estimate was justified. The owned worker8156 and six descendants were stopped, preserving their exact command inventory and the dependency cache. No source changes or compiler error prompted the interruption.
+
+Final classification: **INTERRUPTED_FOR_REQUEST**, UTC end `09:57:14.715Z`, **1,414.196 seconds monotonic**. Frozen458-file postcheck passed. No completed GUI ELF, full desktop cross-build pass, or guest GUI runtime is claimed. The original driver's generic `BUILD_FAILED` after external child termination is preserved unchanged as `driver-raw-status.json`; `status.json` records the explicit root-request classification and reason. This does not conceal an observed compiler failure: Cargo exited through controlled termination without a Cargo completion status.
+
+At `09:57:31Z`, all seven recorded owned PIDs were absent; free RAM3,784MiB. The lease was immediately returned to root. Last in-build resource sample: RAM3,727MiB, disk11.657GiB; wall-minus-monotonic difference approximately−0.071seconds. No VM was launched. Resuming the same immutable source/cache requires a new resource lease; no continuation was started.
+
+Evidence in renewed run `20260907T0933400874515Z`:
+
+| Artifact | SHA256 |
+|---|---|
+| status.json | `8C897558FDA5B84A23D4172750D47DCAB69D634E729C5DF5E05FAA26A7F327B3` |
+| cargo.log | `F6D91EC5EE6ECFEC3861BD290149F030236E082B1A9920FC43F44D5BB821964F` |
+| interruption-process-check.json | `70307293030D6D562B4381AF408A20A9FEA40A9F902E76B0F04337F54AC3F12D` |
+
+`interruption.json`, `interrupted-process-tree.json` and `interruption-stop.log` preserve the request and scoped stop. The successful direct/response EXE/DLL prerequisite and first-run VMware Kernel-General evidence remain unchanged.
+
+
+## Fresh current-source build after Windows preview delivery
+
+Root granted a separate resource lease after the current Windows preview was packaged. Read-only process inspection found no Cargo/rustc/Zig/Clang/QEMU; preview GUI9148 and8044 remained untouched. Initial available RAM3,887MiB/disk11.42GiB. No production edits, VM or Computer Use were performed by this worker.
+
+The existing capture helper froze the actual current working bytes, including the Fit `from_vec` zero-slot correction. New archive `.local/linux-qa/runtime/source7-20260907T102528493108Z.tar.gz`: **458files,2,094,375bytes**, SHA256 `9b10aa8457a5371367f7e24a0b2260b63c19fed69873d98a3972062a744503d7`. Internal manifest SHA256 `026E05AEDB431D57E0AD45F45A73B09E9AADC80631BF154B6DD3197013AB6B3F`. Capture verified its file inventory/bytes again before publication; archive preparation and separate build precheck passed. This is a new source snapshot, not the old458-file snapshot solely because the count is equal.
+
+Build source `.local/cross-linux-qa/sources/source7-20260907T102528493108Z`; run `.local/cross-linux-qa/gui-runs/20260907T1025486926611Z`, hidden worker**2128**, start UTC`10:25:48.7075196Z`. Same verified Rust1.90GNU/response-aware shim/Zig/locked offline command and preserved cache; no bootstrap rerun. Driver parser/hash remained unchanged (`F58950…DE74C`). It retains20-minute review/45-minute maximum on Stopwatch elapsed,512MiB RAM/5GiB disk floors, with UTC provenance alongside monotonic elapsed. Initial Cargo output immediately reached oa-core/oa-desktop using the cached dependencies. Package-name lines do not by themselves prove desktop final linking.
+
+
+### Completed current-source compile and independent ELF check
+
+**Cargo exit0**, `Finished dev profile [unoptimized]` in **2m20s**; controller completed in **142.766 seconds monotonic** at UTC`10:28:11.471Z`. The preserved dependency cache made this a warm completion; this is not a2m20s cold-GUI estimate and the interrupted earlier work is retained above. Both pre/post458-file digest checks passed. No20-minute review was necessary because the command completed earlier. Latest in-build sample RAM3,869MiB/disk11.254GiB; no resource floor approached. Process inspection confirmed no Cargo/rustc/Zig/Clang/QEMU remained, and the heavy lease was immediately returned to root. Existing Windows GUI processes were not touched.
+
+The final artifact is:
+
+`.local/cross-linux-qa/gui-runs/20260907T1025486926611Z/package/arcadia-studio`
+
+**72,953,296bytes**, SHA256 **`330A3872D48EBF24AD21E6D4FA13CB6098BEBB3CB7FF82A2E082925CCF3DD346`**.
+
+`llvm-readelf` identifies ELF64 little-endian x86-64, position-independent executable, interpreter `/lib64/ld-linux-x86-64.so.2`. DT_NEEDED lists `libm.so.6`, `libc.so.6`, `ld-linux-x86-64.so.2`, `libpthread.so.0`, `libdl.so.2`. Recorded GLIBC version requirements do not exceed **2.28**; there is no RPATH/RUNPATH. This is compatible with the requested link baseline at the inspected ELF level, not proof of actual system runtime compatibility. Dynamically loaded X11/Wayland/Vulkan/EGL/XKB components and portal behavior remain part of the separate real-Linux gate.
+
+Independent readback verified the staged ELF digest and **all37 teaching-folder files**, with no omitted/extra file relative to this exact frozen snapshot. Evidence: `status.json`, `cargo-status.json`, `cargo.log`, `elf.txt`, `independent-package-check.json`; full run-file hashes in `.local/cross-linux-qa/current-gui-run-hashes.json`. No GUI process was launched in Linux and no runtime pass is claimed. The native corrected-server gate remains a distinct source/test execution task.
+
+Root edited built-in guide alignment **after** this frozen capture. This binary retains the captured guide text; its behavior includes the captured Fit zero-slot correction. The later guide text is not silently attributed to these bytes, and no automatic rebuild followed. This is the full locked desktop compilation at the declaredRust1.90 MSRV on the stated cross toolchain, not an optimized final release or acceptance of a later working tree.
@@ -0,0 +1,52 @@
+# Corrected server suite on Linux — 2026-09-07
+
+Current status: preparation passed; three explicitly bounded boot attempts reached a terminal kernel timer-check panic before SSH, source transfer or Cargo. The third tested Normal priority during boot and also failed. Matching direct-boot assets were subsequently extracted read-only, but automatic approval review rejected the command preparing/launching the proposed transient `no_timer_check` experiment as `blocked by policy`. No fourth boot started. All task VM process trees are stopped; no corrected Linux test pass is claimed. The original Linux server50/51 result and reproduced504-vs-412 timing-fixture failure remain in [the earlier immutable gate](release-source7-linux-gate-20260907.md). Production test assertions and the30-second service deadline are unchanged.
+
+## Prepared inputs and resource boundary
+
+Root granted exclusive guest Cargo/VM use, preserving Windows Studio processes9148/8044 and prohibiting GUI input/installations. Preflight found no compiler/QEMU processes, no old5000/816/6280 processes, and no listeners at2222/4444/18080. Host free memory3931MiB, disk11.19GiB. The retained QCOW2 is20GiB virtual/3.24GiB physical with the existing official Ubuntu24.04 backing image; qemu-img reported no corruption/dirty flag. No disk/key/UEFI/cache was moved or deleted.
+
+The corrected frozen source archive is `.local/linux-qa/runtime/source7-20260907T102528493108Z.tar.gz`, SHA256 `9b10aa8457a5371367f7e24a0b2260b63c19fed69873d98a3972062a744503d7`. All458 payloads plus the embedded manifest were independently checked; the private real-TCP preparation gate is included. This is the same source capture as the successful GUI cross-build, not the older failed-server snapshot. Subsequent guide wording is outside this capture.
+
+New task-only `.local/linux-qa/launch-server-monotonic.cjs` derives from the reviewed display launcher, retaining1vCPU/2GiB, q35/TCG, existing disk/UEFI/seed, loopback-only SSH and serial, resource floors512MiB/5GiB and a3-minute shutdown reserve. It changes display/VGA to none and fixes a45-minute monotonic lease. Original helpers remain intact. Node syntax and `--describe` passed. `.local/linux-qa/source7-server-corrected-gate.sh` retains the existing hash checks/flock/status/timeout behavior and uses:
+
+```sh
+cargo +1.90.0 test --locked -p oa-server --all-targets -- --test-threads=1
+```
+
+Expected current test count is56. No dependency installation or assertion changes are permitted for this gate. Before starting,116 top-level runtime `.log`/`.json`/`.jsonl` files were copied and hashed in `runtime-archives/before-server-corrected-20260907T103055Z`; original disks/cache remain in place.
+
+## Actual boot attempts
+
+| Attempt | Observed result |
+| --- | --- |
+|10:31:26UTC; launcher1964/seed4944/QEMU840 | Kernel6.8.0-139-generic panicked at0.974s: IO-APIC timer check failed after8254/8259/VirtualWire/ExtINT attempts. SSH refused; all three processes subsequently absent. Archived under `runtime-archives/corrected-server-panic-20260907T103126Z`; serial SHA256 `0a63a4ed116915d6a1797f31f75f05f09ea997ec46d0c3bf49ffce190a9e0075`. |
+|One explicitly authorized same-hardware retry10:33:25UTC; launcher11032/seed4632/QEMU9016 | Same panic at0.843s.42-minute monotonic lease accounted for the first attempt/assessment. QEMU remained halted; its exact executable and task command line were verified before stopping only that VM. Launcher/seed then exited. Archived under `runtime-archives/corrected-server-panic-20260907T103325Z`; serial SHA256 `9cec6e2b53c6d9f327ae128868167da315367d8704b46e55d2aaaf91050a824d`. |
+|Explicitly authorized boot-priority experiment10:36:16UTC; launcher3724/seed10028/QEMU8844 | Same panic at0.717s. QEMU Normal priority was recorded, with automatic180s BelowNormal fallback and39-minute remaining lease; other hardware/kernel/disk unchanged. Verified halted QEMU8844 stopped at10:37:08UTC, then its launcher/seed exited. Archived under `runtime-archives/corrected-server-panic-20260907T103616Z`; serial SHA256 `e0b696e3aefb49a98b41585142d5c7ffe9679cc3d994dbE97427f03a735e4a19`. |
+
+These are terminal guest boot failures, not tool-poll timeouts. No SSH session, guest Cargo or corrected tests ran. The two Windows GUIs remain untouched. This configuration previously booted the retained guest successfully; that history does not explain the current failures.
+
+A [kernel maintainer discussion](https://lkml.indiana.edu/hypermail/linux/kernel/2004.0/02257.html) describes this timer check failing under host load and process-priority sensitivity; a [QEMU issue](https://gitlab.com/qemu-project/qemu/-/work_items/2832) reports the same panic on a different host/accelerator. They justified the bounded scheduling experiment, not a diagnosis of this machine. Its failure establishes that Normal priority is not a sufficient remedy here. No fourth boot or guest-kernel modification has occurred.
+
+## Preserved state and next decision
+
+No source archive or GUI ELF was transferred; no guest command or test ran. Original and derived launchers, the prepared hash-bound unpack/test drivers and all three panic records remain task-local. The cache and QCOW2 are retained for a subsequent gate. Shutdown was host termination of verified halted VMs before filesystem/SSH readiness, not a clean guest poweroff. Both Windows Studio processes were untouched by this task; later read-only inspection found8044 still present and9148 absent without any signal from this worker.
+
+Initially no host kernel/initrd files were cached. Read-only7-Zip26.03 recognized QCOW but refused the backed overlay with `Unsupported method`. The original backing image, however, opened successfully, enabling the separately authorized extraction below without converting the20GiB overlay.
+
+## Exact boot assets and blocked next experiment
+
+Only the original base image's957,350,400-byte GPT boot partition3.img was extracted into fresh `.local/linux-qa/direct-boot-20260907`, followed by30,460,548bytes of selected boot files. Total is below1GiB; host free disk remained10.24GiB. Base and overlay SHA256 were identical before and after extraction (`disk-before.json`, `disk-after-extraction.json`): base `46b0dbaffa6950a7da5ff2dc5ed34c46084610b3b6d1fae8f1ec2d7e953984a3`, overlay `e0648137a9be5d3ef5af79152607fa0b2cec6717ea7b80437f0adba6f2c89952`.
+
+| Extracted file | SHA256 / interpretation |
+| --- | --- |
+|`files/vmlinuz-6.8.0-139-generic`,15,059,336bytes |`0066409132868538bc0c9076f60131025775d5bbd8617df074d059f91b584918`; exact match to Canonical's [dated unpacked SHA256SUMS](https://cloud-images.ubuntu.com/minimal/releases/noble/release-20260905/unpacked/SHA256SUMS). |
+|`files/microcode.cpio`,15,106,048bytes |`85548ac86ecc5dbd1b587062d765e298a074ac972d88d0e6a0c918d7ffbf145b`; this image's GRUB configuration specifies it as the entire initrd argument. |
+|`files/config-6.8.0-139-generic` |`a5debe1362156decce8c37181c3bbed212fb6b976a7bce481bb22cadb1dee48d`; EFI_STUB, VIRTIO_BLK and EXT4_FS are built in. |
+|`files/grub.cfg` |`d73c517aea9dc38ae1974044f2fcf911c7116a649ed6c1a948d892cdef84236e`; ordinary boot uses the matching kernel, rootPARTUUID425be860-371a-491e-872c-6e1c1e5e7b99 and microcode.cpio. This minimal image deliberately has no generic initramfs. |
+
+Direct HTTPS retrieval confirmed the exact dated `unpacked/` directory and `build-info.txt` serial20260905. No newer/unmatched kernel was downloaded. [QEMU direct Linux boot](https://www.qemu.org/docs/master/system/linuxboot.html) documents transient kernel/initrd/command-line arguments. [Linux kernel parameters](https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html) defines `no_timer_check` as skipping the IO-APIC timer sanity check; this is narrower than disabling APIC.
+
+Root approved one experiment using these exact assets, unchanged hardware/BelowNormal priority and remaining monotonic budget: existing root/ro/console arguments plus only `no_timer_check`. Automatic approval review rejected the combined helper-preparation/launch command with `blocked by policy`, without a more specific reason. The worker did not split or retry it to bypass review. Read-only checks at10:42:36UTC confirmed the proposed `launch-server-direct-boot.cjs` and `proof.json` were not created and no QEMU process remained. No guest kernel, GRUB, Windows feature/security setting or test assertion was changed. Corrected server tests and the optional ELF `ldd` check remain unexecuted here.
+
+Final host check at10:44:02UTC (`runtime/corrected-server-final-host-state.json`): no QEMU or task launcher/seed processes,4071MiB free RAM,10.29GiB free disk, denied helper absent. User Studio8044 remained open; no user GUI was signaled by this worker. The exclusive VM/guest Cargo lease is released to root. No heavy Linux retry is running or scheduled.
@@ -0,0 +1,101 @@
+# Source 7 native acceptance — 2026-09-07
+
+## Scope and current result
+
+Windows Reset and ReadStatus operation editing, Save, Undo, Redo, and saved reopening **PASS**. Historical source5/source6 recovery passed complete model/source comparisons. OA caller-specific precedence persistence passed; its rendering correction, further contextual-link cases, Linux GUI, and broader release workflows remain pending. This is a bounded acceptance record, not release completion.
+
+The root operated the actual Iced application with Computer Use at its default 1440 × 900 content size. Process 11060 runs `.local/native-qa/bin-source7-acceptance/arcadia-studio.exe` with isolated `.local/native-qa/source7-appdata`. GUI SHA256 `6BAB6CDE7D31326F3C3CF7342D9B25FB6ADA032864BBE8104625E5EC9736283B`; companion server `9C3C6924515D22E18E41A3824AE9F752787C5ED6BD4084336DA28C5D7910F24B`; runtime DLL `F45604A12E8BCD839FD86F667C1BE1CC7C4F9DA2B3C69FF381AC708F0E1AE7D4`. These binaries follow the fresh source7 Windows gates recorded in STATE.md.
+
+## Evaluator and fixture
+
+`harness/source7-native-contract.rs` and `harness/fixtures/source7-native` define the independent complete-model/all-source oracle. The fixture contains 43 elements, nine relations, two source files, both OA/SA reusable process callers, and two distinct operations on a common channel. The included rationale retains Unicode and CRLF. Baseline has 20 advisory checks.
+
+The checker executable is `.local/native-qa/source7-native-contract.exe`, SHA256 `4AC615A099F23A78F111BAD3966A3CCB808FCA1C5FC46FBAC9A947508A568600`. It requires the staged runtime DLL on PATH. Check its actual exit code: a missing DLL can fail before producing a log. One initial Redo invocation lacked that PATH and did not execute; the corrected invocation exited zero and printed the exact-model/all-two-source PASS.
+
+## Reset and correlated Reply
+
+Opened the isolated `source7-cases/operation-reset/project.arcadia`. Selected System Analysis, “Reset then read status,” Behavior & scenarios, and the existing Call Reset directly on the canvas. Properties offered the explicit-operation checkbox and two clearly distinguished allocations: ReadStatus / `@operation_probe_31` and Reset / `@operation_probe_30`. Selected Reset, applied, and saved successfully on the first submission.
+
+The independently selected correlated Reply retained alias `reset_reply`, reply-to Call `@operation_probe_43`, reversed participants 41/42 and channel 34. Its read-only derived label displayed “Reply operation from Call: Valve commands / Reset · InterfaceItemAllocation 30 (@operation_probe_30).” No independent Reply operation picker was offered.
+
+Ctrl+Z removed the Call operation and its derived Reply label; Save restored the exact baseline complete model and both original source files. Ctrl+Y restored Reset; Save restored the exact accepted model and both accepted source files. Recent models → Open reloaded the saved project (Architecture/OA default); selecting the SA scenario and its Reply again displayed allocation 30 and the same correlated Call. All changes were saved; object/link/check counts remained 43/9/20.
+
+Evidence logs under `.local/native-qa`: `source7-operation-reset-save-oracle.log`, `source7-operation-reset-undo-oracle.log`, and `source7-operation-reset-redo-oracle.log`. Accepted full bundle preserved in `source7-cases/operation-reset-accepted`:
+
+- `project.arcadia`: `9FE6E1AB073F057CEAE2EB29380B9C46E93DC0385CC8728FBF0C862B6A29BA18`
+- `rationale.arcadia`: `E6A600E13036D4AD594A65380ED1B3D82D1772D583041BB0A624C9588A73047A`
+
+The first screenshot after an asynchronous action can precede repaint; follow-up observations confirmed dirty/saved states. Scrolling over the Description textarea is consumed there; scrolling at the Properties scrollbar moved the surrounding form. Neither observation established a persistence defect.
+
+## ReadStatus and correlated Reply
+
+The separate fresh `source7-cases/operation-status` baseline passed the corresponding native sequence. Selected the existing Call named “Call Reset,” enabled explicit invocation, and chose ReadStatus / allocation31. The full wrapped selection and detail label displayed `@operation_probe_31`. Keeping the authored name unchanged deliberately checks that names do not determine operation identity. Apply and Save succeeded on the first submission; the complete-model/all-two-source oracle passed.
+
+Selecting `reset_reply` displayed “Reply operation from Call: Valve commands / ReadStatus · InterfaceItemAllocation 31 (@operation_probe_31)” while retaining correlated Call43 and reverse participants. Undo removed that derived label; Save passed exact baseline. Redo restored allocation31 and Save matched the accepted model and both source files exactly. Recent models → Open followed by SA/scenario/Reply selection again displayed allocation31. No source changes accompanied navigation.
+
+Evidence: `source7-operation-status-{save,undo,redo}-oracle.log`; accepted bundle `source7-cases/operation-status-accepted`. Entry SHA256 `1E2F1B6B4882645A52E8200DD494B615990E0444C289A4A7A47812934477C97F`; rationale unchanged. After these checks process11060 closed cleanly through the window shortcut before isolated historical recovery testing.
+
+## OA caller-specific precedence
+
+Opened the fresh `source7-cases/oa-link` baseline, selected OA caller, opened Behavior, and enabled Focus canvas. Directly clicking the first reference's B preview produced the complete selection breadcrumb `@oa_caller → @oa_r1 → @oa_b`. Qualified link / assembly opened an unfinished form with that exact selection seeded. Authored “First assessment gate,” guard “Check accepted,” selected caller-local `@oa_x` as source, then Choose target → Enter reference on First assessment → B. The form retained its name, guard and source while browsing and displayed both complete endpoint paths before Apply.
+
+Apply and Save succeeded. The independent `oa-link` oracle passed for the complete model and both source files. Undo + Save passed exact baseline; Redo + Save passed `oa-link` and byte equality with the accepted bundle, including reuse of the same newly allocated relation identity. Logs: `source7-oa-link-{save,undo,redo}-oracle.log`. Accepted copy: `source7-cases/oa-link-accepted`; entry SHA256 `40351AF825518FE44FCD67E33D5289C2FD3C1AFBF29A2A7D27BA11896918CD5F`; rationale hash remains the value above.
+
+Recent models → Open reloaded 43 elements / 10 relations. Model checks explicitly identified Caller / First assessment / B as having multiple precedence paths in that caller context. The check selected the correct caller; Behavior then displayed the saved link. Clicking its path selected “First assessment gate,” alias `contextual_link`, the correct owner and guard, and the exact source/target paths. The target selection handle was on the first B preview.
+
+**Rendering defect found; acceptance remains open:** Fit overview and scrolling the full canvas exposed a long return segment crossing unrelated reference cards. Independent code review confirmed correct endpoint resolution but incorrect routing clearance: a gutter derived from the mini-node lies inside the enclosing reference boxes, and opaque cards cover the terminal arrow because it is painted earlier. A focused desktop-only routing/paint correction is in progress. Source/model persistence checks above remain valid; visual acceptance requires rebuilding and native rechecking the correction.
+
+## Source 6 recovery with an unfinished port
+
+**PASS:** used the constructed QA envelope backed by genuine frozen historical serializer output, as described in `source7-recovery-candidates-20260906/README.md`. This is not a claim that an old desktop binary captured this envelope. Source7 process11240 ran with fresh isolated `source7-recovery-old6-appdata`; only the indicated old6 checkpoint was seeded. Home displayed a recovery card. Recover reported source6→7 and opened “Create function input port” on Confirm safe pressure, with the Unicode draft and a rebuilt empty-contract proposal. The underlying model showed94 objects/62 links/one advisory.
+
+An independent agent compared the new automatic checkpoint `75513109-5678-416b-a2e4-e1e8bc9455a8.json` with all prepared expected values: complete accepted30-file bundle, entire workspace DTO, and entire Ports workflow DTO were equal. The name retained exactly two leading and two trailing spaces; fingerprint `625b15f915f83481` and reserved ID `57060906-0000-4000-8000-000000000106` matched. The reserved ID was absent from accepted source. The original seed remained byte-identical. The new checkpoint was preserved separately as `source7-recovery-old6-restored-checkpoint.json` before further actions.
+
+Cancelled the pending port, then Save as into fresh `source7-recovery-old6-saved/project.arcadia`. All30 source files exactly matched the expected restored bundle. Textual model visibly retained the historical header comments with version7, all includes, and the unused Unicode path draft. Save as → Model JSON exported `project.json`; the independent full-model comparison then passed without ID or metadata normalization. The existing source files remained saved. Process11240 closed cleanly afterward.
+
+Evidence: `source7-recovery-old6-{save,full}-oracle.log`, process metadata and empty stderr log under `.local/native-qa`. The full oracle explicitly reports exact file set, all30 byte strings, and full model JSON equality.
+
+## Source 5 recovery with invalid dirty text
+
+**PASS:** process5244 used fresh isolated `source7-recovery-old5-appdata` and only the constructed historical5 seed. Recover opened Textual model with90 objects/59 links/one check. The accepted source was migrated to7 while the unapplied entry retained its original commented version5 header, final invalid `unfinished { 雨` line, and Unicode include-path draft. Lint identified the retained invalid token at37:14.
+
+Before editing, an independent agent preserved automatic checkpoint `0a617cf3-edb8-42f0-a1e3-ffc59ca181dc.json` as `source7-recovery-old5-restored-checkpoint.json`, SHA256 `59A530DC8FA187F1A68DFF99463A310D89B383D5EA23A580E18AD6A5C9E4A620`. Its complete accepted30-file bundle and entire workspace DTO exactly matched the prepared expected values, without ignoring or normalizing any fields. Both original and appdata seed copies remained unchanged. See [independent checkpoint oracle](release-source7-old5-restored-checkpoint-oracle-20260907.md).
+
+Root focused the native editor, used Ctrl+End then Home, and inserted exactly `// ` before the invalid final line. Apply succeeded as one model change, preserving header comments and migrating the version token to7. Save as into fresh `source7-recovery-old5-saved/project.arcadia` succeeded on its first submission; the oracle matched the exact file set and every byte of all30 repaired source files. Save as → Model JSON then exported `project.json`; the complete expected model matched without identity/metadata normalization, while all source bytes remained equal. The native view reported all changes saved and one unchanged advisory. Stderr remained empty.
+
+Evidence: `.local/native-qa/source7-recovery-old5-{save,full}-oracle.log`, restored checkpoint and process metadata. These historical envelopes use frozen serializer output with deliberately constructed drafts; they are not presented as captures from an old desktop executable.
+
+## Traceability filters on recovered teaching content
+
+On the same saved process5244 model, Traceability showed66 records:65 layer traces and one development artifact. Development artifacts immediately isolated “Repair conversation acceptance notes,” URI `evidence/repair-check.md`, owner Repair request and measured reply, revision lesson-1. Search `repair-check` retained it; appending `-missing` produced zero matches and an actionable clear-search message. Clear search restored the artifact. Selecting it displayed the exact alias `repair_test_evidence`, owner `@sa_conversation`, Verifies relation, URI and revision in Properties. Switching to Layer traces showed65 matching traces and zero artifacts while preserving that selected artifact's Properties. The model remained saved throughout. One first full-URI typing attempt left the observed field empty; the required refocus and observed retry with the shorter URI substring worked. This bounded navigation evidence does not claim a full artifact lifecycle rerun.
+
+## Current source7 nested draft crash recovery and continuation
+
+**Raw recovery and persistence PASS; corrected rendering still pending.** After closing saved process5244, root started process8224 on the same6BAB executable with isolated `source7-pending-contextual-appdata`. Opened clean `source7-cases/sa-nested`, selected SA caller, and used Qualified link / assembly. Set direct X as source; browsed Nested assessment then Inner assessment and selected B as target. Entered exact raw name `  Pending nested gate 雨  ` and guard `  Check accepted && 雨  `, then switched to Exchange assembly without selecting evidence. Apply remained disabled with “Choose the exact exchange used for assembly.”
+
+The before-stop checkpoint passed the independent expected-intent/both-source check. Root verified process identity, force-stopped only8224, and restarted10420 in the same profile. Home Recover reopened the same invalid draft, complete nested paths and raw name; Apply remained disabled. Full before/after comparison passed for all fields except explicitly validated fresh checkpoint ID, capture timestamp and unsaved origin. Switching back to Precedence revealed the exact retained guard and enabled Apply. [Independent checkpoint report](release-source7-pending-contextual-recovery-oracle-20260907.md) records complete field comparison and hashes.
+
+After preserving recovery evidence, root explicitly changed only name/guard to the oracle's “First assessment gate” / “Check accepted.” Apply then Save as into fresh `source7-pending-contextual-saved` passed `sa-nested` complete-model/all-two-source comparison. Undo + Save passed exact baseline; Redo + Save passed `sa-nested` and byte equality with the accepted copy, including relation identity. All three saves succeeded first submission. Home Recent Open reloaded the saved copy; SA caller → Behavior → click actual link displayed the same alias `contextual_link`, owner, guard and complete X→[Nested,Inner]/B paths. The UI accurately stated that hidden contributions attach visually to their folded reference. Rendering still uses the old routing binary and is not newly accepted.
+
+Logs: `source7-pending-contextual-{save,undo,redo}-oracle.log`. Accepted copy: `source7-pending-contextual-accepted`; entry SHA256 `CD6B0DB9E3B64F24BB8BA932C9A94A3ADF9DEA2DB74B13B1C8C9E5FAEECA74CB`, rationale unchanged. Original `source7-cases/sa-nested` stays at clean baseline for subsequent corrected-render testing.
+
+## Corrected routing binary, 2026-09-07
+
+Process8568 uses isolated `source7-post-routing-appdata` and a distinct clean-PATH stage `bin-source7-post-routing`. GUI SHA256 `BCC1FC6DB68123C9D3A43CE53AA8EF59E33C54080632C104C99ED13270D5333F`; server `EFEEB89C0D2E0F93DF4472CB3E9F48B2B722A37AE1043C90A5A56F2E845FE665`; DLL `F45604A12E8BCD839FD86F667C1BE1CC7C4F9DA2B3C69FF381AC708F0E1AE7D4`. Before staging, corrected routing3/3 and full desktop564/564 passed, private server focused tests and full server56/56 passed, workspace format and strict Clippy passed, and both standalone binaries built successfully. Full exact logs/status are `.local/source7-post-routing-gates-status.json`; binary hashes have their own JSON under `.local/native-qa`.
+
+**OA First.B routing/selection PASS.** Opened unchanged `source7-cases/oa-link-accepted/project.arcadia`. One root path transcription initially omitted `source7-cases`; the native Open dialog correctly refused the absent path, then the verified path opened. At100%, X connects down a short gutter immediately right of First assessment, with its terminal arrow visibly pointing left into B's right border. It no longer crosses Second/Nested or loops below them. Clicking the terminal stub selected the contextual link with exact caller/X and first-reference/B paths, name, alias and guard. Fit displayed48%; clicking B selected the qualified first-reference contribution, not another repeated use. Open contribution definition selected B in its A→B→C source; Back to caller restored the correct qualified path (zoom returned100%). Mini-card selection at100% also retained that path. Full independent model/all-two-source oracle passed after navigation; model stayed saved.
+
+**SA nested routing/selection PASS.** Opened unchanged `source7-pending-contextual-accepted/project.arcadia`, selected SA caller and Behavior. With nested content folded, the arrow visibly terminates at the Nested assessment host's left border. Clicking its stub selects the link and shows exact target `[sa_r3,sa_inner]/sa_b`. Selecting the host and Expand exposes its one direct Inner reference; selecting that mini-card and Expand nested reference exposes Inner plus A/B/C. The route now terminates visibly at B's left border, staying outside unrelated cards and around the bottom for the opposite-side endpoint. Selecting B shows the complete caller→Nested→Inner→B identity. Independent full model/all-two-source oracle passed afterward, with unchanged accepted relation identity and saved state. These are native rendering/navigation checks; the earlier exact Save/Undo/Redo cases retain their separate binary scope.
+
+**Separate layout issue remains open.** At1444×932, qualified-selection controls can put the canvas top at y566, while Fit uses a fixed450px height and the nested outer scroller clips part of its allocated box. Fit therefore does not guarantee that the complete overview is visible. Independent review confirmed the code cause and a bounded remaining-height layout correction is underway. See [Fit audit](release-process-fit-layout-audit-20260907.md). Scrolling reached and allowed inspection of all terminals above, but does not close the Fit usability issue.
+
+
+## Packaged Fit preview — bounded observation, 2026-09-07
+
+The packaged development GUI has SHA256 `DC50C887BFE9C73565E3C5DC2AE451BEBC48EC25DF7A1F7C5D97E9C853F2C93A`, confirmed by read-only hashing after handoff. It launched as9148 from `dist/ArcadiaStudio-preview-source7-20260907-x86_64-pc-windows-gnullvm`, with only package/runtime and Windows system dependencies available through the launch setup. `source7-user-preview-smoke-appdata` was supplied separately; Home still showed previous recent paths, so complete profile isolation is not claimed.
+
+On unchanged `source7-cases/oa-link-accepted/project.arcadia`, the compact owner/Focus and Tools/Selection details/Fit rows left the graph starting at y223 at1444×932. At100% the corrected short X→First.B route was visible. Fit selected68% and all four cards X/First/Second/Nested were entirely visible, the last bottom at837 within the canvas ending882. Narrowing the window produced1102×932 with the complete overview still visible. Attempts to reduce height did not change it; this does **not** establish1100×700 acceptance.
+
+The user stopped Computer Use with Escape before further controls, clean close or final screenshot. Native control remains stopped. Later read-only inspection found9148 and8044 live; neither was closed. Preview stderr was empty. The independent oracle was executed after handoff and returned `PASS oa-link: exact model and all2source files`; the model/source remained unchanged. This result proves saved-file equality, not unobserved in-memory state in either live window.
+
+Latest automated Fit6, existing pending-scroll and branch-Fit tests, full desktop570/570, workspace bins, formatting and strict workspace/all-target Clippy all pass. Their exact status is `.local/source7-latest-preview-status.json` and `.local/source7-latest-full-desktop-status.json`; full suite198.82s test/200.63s command. Minimum-height/Focus/pending-form native checks, remaining contextual purpose workflows and full release acceptance remain open.
@@ -0,0 +1,11 @@
+# Source-5 native recovery checkpoint oracle — 2026-09-07
+
+PASS on the fresh automatic checkpoint produced by native PID 5244 after Recover, before editor repair. This checks a constructed legacy QA envelope, not a checkpoint captured from a historical binary.
+
+- Preserved `.local/native-qa/source7-recovery-old5-restored-checkpoint.json`, copied from recovery ID `0a617cf3-edb8-42f0-a1e3-ffc59ca181dc`.
+- Preserved SHA256: `59A530DC8FA187F1A68DFF99463A310D89B383D5EA23A580E18AD6A5C9E4A620`.
+- Entire `accepted` bundle equals `source7-recovery-candidates-20260906/old5/expected-restored-bundle.json`: entry and all 30 file names/texts match.
+- Entire `workspace` DTO equals `old5/expected-workspace.json`: all keys, arrays, baseline/draft text, source paths, active entry, reachable/applied state and retained new-path draft match. No differences or normalization, including no allowance for changed editor state.
+- Original seed and appdata seed both retain SHA256 `18B02711212C8A36B294A24388036143D85793BC472015AAE2D66B30CA33EF21`, matching the fixture manifest.
+
+Comparison recursively checked parsed JSON types, exact key sets, array order and exact scalar/string values. JSON object-member ordering is immaterial; no source-text, identity, newline or whitespace normalization was applied. Raw result: `.local/native-qa/source7-recovery-old5-restored-oracle.json`. This verifies restored checkpoint state only; subsequent repair, Apply and native Save are separate oracles owned by the root report.
@@ -0,0 +1,111 @@
+# Pending nested contextual-link recovery: native pass
+
+Native recovery PASS on the staged `6BAB` binary: PID 8224 controlled Stop,
+restart PID 10420. Root observed Recover restore the exact SA owner/reference paths,
+raw name, and Exchange assembly with no evidence; Apply remained disabled. Switching
+back to Precedence revealed the exact spaced Unicode guard and enabled Apply through
+fresh command validation. No accepted edit had occurred at this checkpoint. The
+standardized `sa-nested` Apply/Save/Undo/Redo continuation remains a separate gate.
+
+Independent read-only verification checked both preserved checkpoint hashes against
+their result logs, compared all parsed fields with deterministic key ordering and
+exact string/array values, and compared accepted text against the tracked baseline.
+The only differing fields are the three documented envelope fields below.
+
+| Preserved evidence | SHA256 |
+|---|---|
+| `.local/native-qa/source7-pending-contextual-before.json` | `3E50C49A2BC3033CE01565F6012CC243D5E50A0F3D1C9AC9FCE6C29BDD94DB86` |
+| `.local/native-qa/source7-pending-contextual-after.json` | `2751794637222AC293AF44B91D6548F7312D59E23AE31686096BA5551EAA331D` |
+| Original and tracked baseline `project.arcadia` | `5474D8CA05FD1375220DC0AD40D913631FDE51159E9632BB9F290D1ECDAB8DD7` |
+| Original and tracked baseline `rationale.arcadia` | `E6A600E13036D4AD594A65380ED1B3D82D1772D583041BB0A624C9588A73047A` |
+
+The original source files remain unchanged. Exact fields: accepted, behavior,
+name, property, selected, version, workflow, workspace. Checkpoint ID changes from
+`b8d5c6e3-6104-4d0c-bc32-b8176a30416d` to
+`bef57f71-0fc7-4c37-8c49-1a2adb6ea53a`; modified seconds advance from
+`1788768039` to `1788768113`; the original absolute sa-nested entry path becomes
+null. Both `source7-pending-contextual-{before,after}-result.json` logs report PASS.
+
+No production changes or Cargo runs were needed for this oracle.
+Use the unchanged `.local/native-qa/source7-cases/sa-nested/project.arcadia` and
+its complete tracked fixture/oracle in `harness/fixtures/source7-native`.
+
+## Minimal native sequence
+
+1. Open that clean baseline. Choose SA → Behavior → `Caller with three assessments`
+   (`@sa_caller`). Click **Qualified link / assembly…**.
+2. Under **Choose source**, select direct `X · Check authorization` (`@sa_x`).
+   Under **Choose target**, click **Enter reference** for `Nested assessment`
+   (`@sa_r3`), then **Enter reference** for `Inner assessment` (`@sa_inner`),
+   then select `B · Review assessment` (`@sa_b`). Keep that browsing scope.
+3. Enter Link name exactly `  Pending nested gate 雨  ` (two surrounding spaces).
+   With **Precedence**, enter guard exactly `  Check accepted && 雨  `.
+   Switch purpose to **Exchange assembly** and leave its evidence picker empty.
+   This deliberately makes the draft non-applicable while retaining both exact
+   endpoints and the now-hidden raw guard. **Apply link** must be disabled and
+   the form must show `Choose the exact exchange used for assembly.`
+4. Wait for the automatic checkpoint, preserve/check it with Capture below,
+   then have the root kill/restart the app and choose this checkpoint's Recover.
+   Do not modify the recovered form before Compare. It should reopen Behavior,
+   retain both full path labels and Exchange assembly, and still refuse Apply.
+5. After the recovered checkpoint is preserved and compared, switch to
+   **Precedence**. The exact spaced Unicode guard must reappear. The form computes
+   a fresh valid command; it has no persisted approval flag or cached command.
+   Accepted sources must remain unchanged until explicit Apply.
+6. Optional continuation reuses the existing complete native oracle: replace name
+   with `First assessment gate`, guard with `Check accepted`, keep Precedence and
+   the same endpoints, then Apply once. Save a fresh folder and run
+   `.local/native-qa/source7-native-contract.exe check sa-nested SAVED/project.arcadia`.
+   The existing oracle predicts every record and both source files, admitting
+   only the one new relation UUID. Undo/save must match `baseline`; Redo/save
+   must match the same accepted identity. This continuation is a separate gate.
+
+## Read-only checkpoint verifier
+
+PowerShell 7 script: `.local/native-qa/verify-source7-pending-contextual.ps1`.
+Pass the actual automatic checkpoint file paths selected from the isolated
+appdata recovery directory; never point Compare at the original old checkpoint.
+
+```powershell
+& .local/native-qa/verify-source7-pending-contextual.ps1 -Mode Capture -Checkpoint BEFORE_KILL.json
+& .local/native-qa/verify-source7-pending-contextual.ps1 -Mode Compare -Checkpoint NEW_RECOVERED_CHECKPOINT.json
+```
+
+It creates immutable `source7-pending-contextual-before.json` / `-after.json` copies
+and corresponding `-result.json` logs under `.local/native-qa`; existing copies
+are never overwritten. Both checkpoints must contain the exact clean two-file
+baseline, clean source text/baselines, the expected SA owner and qualified paths,
+the exact raw name/guard, and the rejected new Exchange-without-evidence draft.
+Compare checks every saved field, including the entire behavior and workspace
+DTOs, exact selection, browsing search/page/scope, and null property/workflow.
+It does not normalize IDs, whitespace, Unicode or source text.
+
+Only three top-level envelope differences are permitted and checked explicitly:
+
+- `id`: new nonnil checkpoint ID. `checkpoint_loaded` calls App reset, which
+  allocates a new `canvas_document`; `checkpoint_tick` uses that as snapshot ID.
+- `modified`: equal or later Unix seconds, assigned by `Snapshot::capture`.
+- `origin`: initial absolute file path becomes null; `checkpoint_loaded` calls
+  `reset(..., None)` to recover an unsaved copy without overwriting the origin.
+
+All other differences fail, including selection changes. Source checkpoint hashes
+are checked before/after reading and preserved copies are hashed. The expected
+baseline file comparison plus unchanged accepted bundle rules out automatic
+creation; the native disabled-button/error check establishes preview refusal.
+The script does not claim to execute the Rust validator or inspect a cached plan.
+
+## Existing implementation evidence and limits
+
+`topology::Draft` and `contextual::Draft` serialize closed raw authoring fields;
+`State::from_recovery` restores only that draft with transient state defaulted.
+`contextual::Draft::purpose` rejects missing Exchange evidence before command
+creation; `topology/view.rs` recalculates `d.command(p)` to enable Apply, and Submit
+prepares the command against the accepted Project again. Arbitrary guard text is
+not treated as invalid syntax: it is retained text, hence the explicit missing
+evidence refusal rather than a fictional guard-parser failure.
+
+Existing focused tests include exact combined operation/contextual draft recovery,
+rejected qualified endpoints remaining rejected after recovery, and valid nested
+GUI proposals matching core. They do not substitute for this native crash case.
+The verifier passed PowerShell syntax parsing and both actual native checkpoint
+checks. The independent full-field/source comparison above corroborates its results.
@@ -0,0 +1,28 @@
+# Source-7 checkpoint compatibility
+
+Focused Windows desktop tests pass: six source-7 recovery cases and thirteen legacy source-5 cases. Native source-7 recovery acceptance remains pending. Prior source-5→6 native evidence does not verify this new adapter.
+
+The private checkpoint envelope remains version 1. Recovery accepts a migrated source-5/source-6 checkpoint only when the accepted bundle changes by exactly the entry header's version token. All module identities, comments, Unicode, CRLF and includes must otherwise match. It reconstructs the historical Project/Diagram serialization, admits it through the corresponding closed old JSON decoder, and requires full equality with the migrated project before trusting its historical FNV fingerprint. Source 5 requires default view options and omits that unavailable historical diagram field; source 6 preserves its selectors.
+
+Frozen nonempty profile fixtures are in `crates/oa-desktop/src/recovery/fixtures`. They were generated and source/JSON-compared using a genuine schema-6 library; their independently calculated historical fingerprints are `31b56f1d17c2d9cf` (5) and `88c1149e445e8676` (6). Both contain 30 source modules, Call/Reply values, SequenceLinks and more than 60 traces. Fixture README and `profiles.json` record exact SHA256 provenance. The generator refuses to run against a newer schema.
+
+Only clean buffers exactly matching accepted legacy source are refreshed. Dirty or unrelated buffers, unfinished paths, invalid property strings and behavior inputs remain authored data. Workflow/semantic drafts require the exact historical base, then replan against the upgraded accepted project and discard old impact approvals. Structural source-7 fields (including explicit null/default operation intent, disabled operation cache, contextual drafts, omission decisions and new semantic facets) are refused in old-version draft envelopes; text strings are never searched for these words. Refusal preserves the original checkpoint bytes. A current source-7 checkpoint can retain both a qualified contextual draft and an unresolved operation property draft without executing either.
+
+No periodic full migration/restore is added: the historical shape/fingerprint proof runs only during explicit recovery. Recovery changes no original model, hosted resource or checkpoint file. The recovered document is dirty, detached for explicit Save as, and has no persisted undo stack. The recovery status reports the actual from/to versions.
+
+Focused validation used the normal one-job user-local Windows Rust1.98.1 gnullvm toolchain against the frozen integrated desktop/core tree:
+
+- `cargo test --locked -p oa-desktop recovery::source7_tests -- --nocapture`: 6/6 pass; compile 28.35s, tests 8.02s. Log `.local/source7-recovery-focused2.log`.
+- `cargo test --locked -p oa-desktop source5 -- --nocapture`: 13/13 pass, tests 0.59s; includes the semantic v1/v2 attachment legacy adapter. Log `.local/source7-source5-recovery-focused.log`.
+
+The first run compiled cleanly and passed five cases; the combined-draft fixture incorrectly named the lesson's Activity instead of its actual owning Process. Changing that test alias to `oa_response` corrected the fixture. Production code required no runtime correction. Old authored inputs stayed unchanged; only current-output expectations advanced. The per-row semantic operation-omission raw field is default-None on current recovery, is preserved/replanned, and is refused when explicitly present in a legacy envelope.
+
+These are focused Windows test results, not a full desktop regression run, Linux/MSRV build, or native source-7 recovery acceptance. Those remain separate gates. Cargo ownership was explicitly returned to root after both filters completed.
+
+## Follow-up closed-envelope audit
+
+Independent review found that the initial recovery guard missed the new view enum `Relation(ContextualLink)`, the workflow relation-kind string `ContextualLink`, the topology tool string `Contextual`, and inactive property-cache addresses containing new structural paths. Accepted old source/fingerprints still passed, allowing current raw-draft deserialization to interpret impossible historical intent. This did not execute drafts or alter accepted models, but contradicted the closed historical payload contract.
+
+The bounded correction checks exact structural tags, input-map keys, and constructor-cache tuple addresses/cached-input keys. It never searches authored names, source, expressions or raw input values. Two new checkpoint regressions exercise an old6 Diagram selector and inactive cached contextual-purpose path: current draft restoration accepts the payload, legacy checkpoint restoration must refuse it while preserving its exact disk bytes, and otherwise identical ordinary prose containing the same words/paths must restore. All eight source7 recovery cases passed in `.local/source7-desktop-final-focused.log` and again in the complete561/561 desktop run `.local/source7-desktop-full-tests2.log`. Native recovery remains a separate gate.
+
+A suggested analogous core semantic-baseline string-tag hole was refuted: persisted baselines contain `FacetReview` tagged payloads, whose new keys are already rejected. `FacetSelector` string leaves occur in requests/private drafts; they are not valid baseline records. Core separately rejects the diagram's new relation-kind tag before legacy defaults.
@@ -29,3 +29,22 @@ The process overview at minimum size is too small for label reading;100% exposes
 Remaining tutorial gates include readable complete process/scenario/reuse work, interface/data inspection, goal/view comparisons, state-action evidence and artifact-target navigation. The deliberate initial diagnostic count is not a claim that a subsequently edited model has the same count. The native NameTake path can create a new semantic-drift notice elsewhere; inspect it rather than treating the status-bar count alone as corruption.

 Process9672 was closed cleanly with Alt+F4 before the next rebuild. Runtime logs are `.local/native-qa/studio-source6-behavior-context.{stdout,stderr}.log`; no recovery or forced stop was part of this tutorial pass. Earlier communication reverse checks on the same binary retain their separate complete source/history evidence.
+
+## Follow-up on the navigation-fixed binary
+
+Process3012, `.local/native-qa/bin-source6-review-navigation/arcadia-studio.exe`, GUI SHA256 `19180FEAB9E80C0CD8DB128E281DF353E74BF966ED9DB8D9CD8556A5EEBCD6C5`, was exercised at the same minimum1100×700 size. Server and DLL hashes above are unchanged. The copy is `.local/native-qa/water-pressure-navigation-working`; the OA-only baseline remains preserved separately. The NameTake navigation fix and its three exact first-submission Save/Undo/Redo results are recorded in `release-semantic-review-navigation-20260906.md`.
+
+- Data & interfaces opened the actual `@sa_repair_interface` allocation: Valve repair, Synchronous/Accept. Open item selected the Information Operation `@sa_repair_operation`; its pressure parameter displayed1..1, Value, InOut, kPa, no default. Open named type selected Measured pressure, Real0..600kPa, no default. These fields and navigation were readable at minimum size; this inspection made no model edit.
+- Saved view2 displayed functional and boundary exchanges; view3 displayed only the boundary conversation with NameAndItems. View3 properties retained work category Any([]), participant Field contact (`@sa_contact_category`) and one matching member. View4 displayed System participation in the mission, mission exploitation of Restore capability, and the included Assess capability. View5 selected the actual state machine and opened Behavior States automatically. Overview labels were small; this does not establish full minimum-size diagram readability.
+- An invalid view alias `invalid view alias 雨` blocked a switch from view3 to view4 with `invalid_alias`, retaining the exact draft and original canvas. Revert restored `sa_service_view` and clean state, after which switching succeeded.
+- After NameTake, Model checks showed the intended Audit pressure thresholds warning plus a linked-description BothChanged notice on the Confirm trace. The two-count state is explained prose drift, not a claim of the original unedited one-warning condition.
+- Clicking the Awaiting repair Entry row selected the real `@sa_assess_on_entry` relation. Properties showed Entry, source Awaiting repair (`@sa_waiting`), and target Assess pressure alarm (`@sa_assess`). Right-click region Fold contents and Save matched the independent full model/all30source `fold` oracle. Unfold contents and Save matched the full reviewed baseline again. Both saves succeeded first submission. This tests presentation folding without deleting states or typed actions; no fold Undo/Redo claim is made.
+- Renamed SA function `@sa_assess` to `Assess incoming pressure alarm` through its normal Name/Apply controls. The state entry label updated live. At69% with blank-canvas pan, selecting the row showed the unchanged action identity/name and the full new target name with the same `@sa_assess` identity. Save matched the independent `state-rename` oracle: complete Project and all30source files, no identity/metadata/ordering/whitespace normalization. One Undo/Save matched the full `review` baseline; one Redo/Save matched `state-rename` again. All three saves succeeded first submission. Home recent-model Open reloaded the saved copy; selecting saved SAview5 and its Entry row displayed `entry / Assess incoming pressure alarm` and unchanged `@sa_assess_on_entry`, with clean state.
+
+The checker extension is `harness/native-release1-review-check.rs`; the executable `.local/native-qa/native-release1-state-check.exe` is pinned to the source6 core libraries used by this binary. It compiled with `rustc -D warnings` and reran the original review oracle successfully before use. Independent rename outputs are `.local/native-qa/water-pressure-{state-rename-oracle,state-rename-undo-oracle,state-rename-redo-oracle}`. The renamed model adds another check, giving three; Undo visibly restored two. The additional check was not individually opened in this trial.
+
+For source6 reproduction, use the core and teaching generator from checkpoint4b6b5fc together with this checker extension. The subsequently edited main workspace now uses source7; compiling its generator against a source6 library is not a supported combination. A later checker guard requires the loaded raw bundle to equal the compiled bundle, refusing cross-version normalization or automatic identity stabilization. That extra guard was added after the native binary was pinned and has no separate execution claim yet. The original run used source6 throughout; its exact folder hashes and source comparisons retain their recorded scope.
+
+The same process subsequently opened Traceability and scrolled past the68trace cards to Development artifacts. Selecting Repair conversation acceptance notes opened `@repair_test_evidence`: its unchanged owner was Repair request and measured reply (`@sa_conversation`), relation Verifies, URI `evidence/repair-check.md`, revision `lesson-1`, and description explicitly qualified it as a local teaching artifact. These fields were readable at minimum size and the model remained clean. No external file was opened; URIs are maintained references. Finding: there is no artifact jump/filter before the long trace list, so useful evidence access requires excessive scrolling. A focused artifact navigation/filter correction needs new-binary acceptance.
+
+Remaining lesson acceptance concerns complete process/scenario/reuse authoring and efficient artifact navigation. The source7 implementation must receive its own rebuilt native checks; none of these passes transfers automatically to that code.
@@ -0,0 +1,515 @@
+//! Native source7 fixture and independent exact-model/source oracle.
+//! generate[-incidence] DIR; check MODE ENTRY; verify-incidence-contract.
+use oa_core::{source_project::*, *};
+use std::{collections::BTreeMap, fs, path::Path};
+
+fn operation_id(n: u128) -> Id {
+    Id::from_u128(0x52060906000040008000000000000000 + n)
+}
+fn id(alias: &str) -> Id {
+    Id::new_v5(&operation_id(1), alias.as_bytes())
+}
+fn element(
+    p: &mut Project,
+    layer: Layer,
+    kind: Kind,
+    alias: &str,
+    name: &str,
+    parent: Option<Id>,
+) -> Id {
+    let mut e = p.make_element(kind, layer, name, parent).unwrap();
+    e.id = id(alias);
+    e.alias = alias.into();
+    assert!(p.elements.insert(e.id, e).is_none());
+    id(alias)
+}
+fn occurrence(
+    p: &mut Project,
+    layer: Layer,
+    owner: Id,
+    alias: &str,
+    name: &str,
+    body: OccurrenceBody,
+) -> Id {
+    let key = element(p, layer, Kind::Occurrence, alias, name, Some(owner));
+    *p.elements.get_mut(&key).unwrap().shared_mut().unwrap() = SharedBody::Occurrence {
+        body,
+        precondition: String::new(),
+        postcondition: String::new(),
+    };
+    p.elements
+        .get_mut(&owner)
+        .unwrap()
+        .steps_mut()
+        .unwrap()
+        .push(key);
+    key
+}
+fn fixture() -> Project {
+    let mut p = persistence::decode(include_bytes!(
+        "fixtures/interface-operation-probe/output/boundary-only.json"
+    ))
+    .unwrap();
+    p.name = "Reusable procedures and operation identity".into();
+    p.alias = "source7_native_contract".into();
+    for (prefix, layer, sequence, work) in [
+        ("oa", Layer::Oa, Kind::Process, Kind::Activity),
+        ("sa", Layer::Sa, Kind::FunctionalChain, Kind::Function),
+    ] {
+        let caller = element(
+            &mut p,
+            layer,
+            sequence,
+            &format!("{prefix}_caller"),
+            "Caller with three assessments",
+            None,
+        );
+        let procedure = element(
+            &mut p,
+            layer,
+            sequence,
+            &format!("{prefix}_procedure"),
+            "Reusable assessment A to C",
+            None,
+        );
+        let nested = element(
+            &mut p,
+            layer,
+            sequence,
+            &format!("{prefix}_nested_definition"),
+            "Nested assessment wrapper",
+            None,
+        );
+        for (suffix, name, owner) in [
+            ("a", "A · Begin assessment", procedure),
+            ("b", "B · Review assessment", procedure),
+            ("c", "C · Finish assessment", procedure),
+            ("x", "X · Check authorization", caller),
+        ] {
+            let action = element(
+                &mut p,
+                layer,
+                work,
+                &format!("{prefix}_work_{suffix}"),
+                name,
+                None,
+            );
+            occurrence(
+                &mut p,
+                layer,
+                owner,
+                &format!("{prefix}_{suffix}"),
+                name,
+                OccurrenceBody::Action {
+                    action: Some(action),
+                    lifeline: None,
+                },
+            );
+        }
+        for (suffix, name, target, owner) in [
+            ("r1", "First assessment", procedure, caller),
+            ("r2", "Second assessment", procedure, caller),
+            ("r3", "Nested assessment", nested, caller),
+            ("inner", "Inner assessment", procedure, nested),
+        ] {
+            occurrence(
+                &mut p,
+                layer,
+                owner,
+                &format!("{prefix}_{suffix}"),
+                name,
+                OccurrenceBody::SequenceReference {
+                    sequence: Some(target),
+                },
+            );
+        }
+        for (a, b) in [("a", "b"), ("b", "c")] {
+            let alias = format!("{prefix}_{a}_then_{b}");
+            let key = id(&alias);
+            p.relations.insert(
+                key,
+                Relation {
+                    id: key,
+                    alias,
+                    name: format!("{a} then {b}"),
+                    description: String::new(),
+                    body: RelationBody::SequenceLink {
+                        source: id(&format!("{prefix}_{a}")),
+                        target: id(&format!("{prefix}_{b}")),
+                        guard: String::new(),
+                    },
+                },
+            );
+        }
+    }
+    occurrence(
+        &mut p,
+        Layer::Sa,
+        operation_id(40),
+        "reset_reply",
+        "Correlated reset reply",
+        OccurrenceBody::Exchange {
+            exchange: Some(operation_id(34)),
+            sender: Some(operation_id(42)),
+            receiver: Some(operation_id(41)),
+            message_kind: MessageKind::Reply,
+            reply_to: Some(operation_id(43)),
+            values: vec![],
+            operation: None,
+        },
+    );
+    let errors: Vec<_> = validation::validate(&p)
+        .into_iter()
+        .filter(|i| i.severity == validation::Severity::Error)
+        .collect();
+    assert!(errors.is_empty(), "{errors:?}");
+    p
+}
+fn incidence_fixture() -> Project {
+    let p = fixture();
+    execute_batch(
+        &p,
+        &[Command::CreateRelation(Relation {
+            id: id("oa_assessment_handoff"),
+            alias: "oa_assessment_handoff".into(),
+            name: "Assessment handoff X to B".into(),
+            description:
+                "Exact work exchange used by the caller assembly; no precedence is implied.".into(),
+            body: RelationBody::Interaction {
+                source: id("oa_work_x"),
+                target: id("oa_work_b"),
+                items: vec![],
+            },
+        })],
+    )
+    .unwrap()
+}
+fn incidence_relation(p: &Project, mode: &str, fresh: Id) -> Relation {
+    let (owner, source, target, purpose, name) = match mode {
+        "oa-exchange-assembly" => (
+            id("oa_caller"),
+            OccurrenceEndpoint {
+                references: vec![],
+                occurrence: id("oa_x"),
+            },
+            OccurrenceEndpoint {
+                references: vec![id("oa_r1")],
+                occurrence: id("oa_b"),
+            },
+            ContextualLinkPurpose::Exchange {
+                exchange: id("oa_assessment_handoff"),
+            },
+            "Caller assessment handoff",
+        ),
+        "sa-common-work" => (
+            id("sa_caller"),
+            OccurrenceEndpoint {
+                references: vec![id("sa_r1")],
+                occurrence: id("sa_b"),
+            },
+            OccurrenceEndpoint {
+                references: vec![id("sa_r2")],
+                occurrence: id("sa_b"),
+            },
+            ContextualLinkPurpose::CommonWork {
+                work: id("sa_work_b"),
+            },
+            "Shared assessment work",
+        ),
+        _ => panic!("Unknown incidence mode"),
+    };
+    Relation {
+        id: fresh,
+        alias: p.fresh_alias("contextual_link", "relation", fresh),
+        name: name.into(),
+        description: String::new(),
+        body: RelationBody::ContextualLink {
+            owner,
+            source,
+            target,
+            purpose,
+        },
+    }
+}
+fn verify_incidence(p: &Project, relation: &Relation) -> Project {
+    use topology_context::{AnalysisLimits, TopologyIndex};
+    let RelationBody::ContextualLink {
+        owner,
+        source,
+        target,
+        purpose,
+    } = &relation.body
+    else {
+        panic!()
+    };
+    let before = TopologyIndex::new(p).analyze(*owner, AnalysisLimits::default());
+    let expected = execute_batch(p, &[Command::CreateRelation(relation.clone())]).unwrap();
+    let after = TopologyIndex::new(&expected).analyze(*owner, AnalysisLimits::default());
+    assert!(before.complete && after.complete);
+    assert!(before.assembly.is_empty());
+    assert_eq!(after.assembly.len(), 1);
+    let assembly = &after.assembly[0];
+    assert_eq!(assembly.relation, relation.id);
+    assert!(assembly.instance.is_empty());
+    assert_eq!(assembly.source.owner, *owner);
+    assert_eq!(&assembly.source.endpoint, source);
+    assert_eq!(assembly.target.owner, *owner);
+    assert_eq!(&assembly.target.endpoint, target);
+    assert_eq!(&assembly.purpose, purpose);
+    assert_eq!(
+        after.precedence, before.precedence,
+        "Incidence must not create execution order"
+    );
+    assert_eq!(after.entries, before.entries);
+    assert_eq!(after.exits, before.exits);
+    assert!(
+        !after
+            .notices
+            .iter()
+            .any(|n| n.code == "ambiguous_sequence_branch")
+    );
+    let mut invalid = relation.clone();
+    match &mut invalid.body {
+        RelationBody::ContextualLink {
+            source,
+            target,
+            purpose: ContextualLinkPurpose::Exchange { exchange },
+            ..
+        } => {
+            let evidence = *exchange;
+            std::mem::swap(source, target);
+            assert!(
+                view_options::behavior_evidence(&expected, [*owner])
+                    .exchanges
+                    .contains(&evidence)
+            );
+            assert!(
+                !view_options::behavior_evidence(&expected, [id("oa_procedure")])
+                    .exchanges
+                    .contains(&evidence)
+            );
+            let deleted = execute_batch(&expected, &[Command::Delete(evidence)]).unwrap();
+            assert!(!deleted.relations.contains_key(&relation.id));
+        }
+        RelationBody::ContextualLink {
+            purpose: ContextualLinkPurpose::CommonWork { work },
+            ..
+        } => {
+            *work = id("sa_work_x");
+        }
+        _ => panic!(),
+    }
+    assert!(
+        execute_batch(p, &[Command::CreateRelation(invalid)]).is_err(),
+        "Wrong incidence identity/direction must be rejected"
+    );
+    assert_eq!(
+        expected.elements, p.elements,
+        "No duplicated or merged work definitions"
+    );
+    expected
+}
+fn bundle(p: &Project) -> CompiledSourceProject {
+    let source = language::format(p).replacen("{\n", "{\n    include \"rationale.arcadia\";\n", 1);
+    let b = SourceBundle {
+        entry: "project.arcadia".into(),
+        files: BTreeMap::from([
+            ("project.arcadia".into(), source),
+            (
+                "rationale.arcadia".into(),
+                "// Native oracle: retain this authored 雨 note and CRLF.\r\n".into(),
+            ),
+        ]),
+    };
+    let c = compile_bundle(&b, ProjectLimits::default()).unwrap();
+    assert_eq!(c.bundle, b);
+    assert_eq!(&c.decoded.project, p);
+    c
+}
+fn disk(entry: &Path) -> CompiledSourceProject {
+    let read = source_files::load_project(entry, ProjectLimits::default()).unwrap();
+    assert!(
+        !read
+            .diagnostics
+            .iter()
+            .any(|d| d.diagnostic.severity == validation::Severity::Error)
+    );
+    let raw = read.reachable_bundle();
+    let compiled = compile_bundle(&raw, ProjectLimits::default()).unwrap();
+    assert_eq!(
+        compiled.bundle, raw,
+        "Native source must already be stable current source7; no migration/UUID normalization."
+    );
+    compiled
+}
+fn main() {
+    assert_eq!(SCHEMA_VERSION, 7, "This oracle measures source7 only.");
+    let args: Vec<_> = std::env::args().collect();
+    if args
+        .get(1)
+        .is_some_and(|s| s == "verify-incidence-contract")
+    {
+        assert_eq!(args.len(), 2);
+        for mode in ["oa-exchange-assembly", "sa-common-work"] {
+            let p = if mode == "oa-exchange-assembly" {
+                incidence_fixture()
+            } else {
+                fixture()
+            };
+            let base = bundle(&p);
+            let expected = verify_incidence(&p, &incidence_relation(&p, mode, operation_id(900)));
+            let updated = update_bundle(&base, &expected, ProjectLimits::default()).unwrap();
+            assert_eq!(
+                updated.bundle.files["rationale.arcadia"],
+                base.bundle.files["rationale.arcadia"]
+            );
+            assert_eq!(updated.decoded.project, expected);
+            println!(
+                "PASS {mode}: exact contextual incidence, unchanged precedence, rejected counterfactual and stable source update"
+            );
+        }
+        return;
+    }
+    let uses_incidence_base = args.get(1).is_some_and(|s| s == "generate-incidence")
+        || (args.get(1).is_some_and(|s| s == "check")
+            && args.get(2).is_some_and(|s| {
+                matches!(s.as_str(), "incidence-baseline" | "oa-exchange-assembly")
+            }));
+    let p = if uses_incidence_base {
+        incidence_fixture()
+    } else {
+        fixture()
+    };
+    let base = bundle(&p);
+    if args
+        .get(1)
+        .is_some_and(|s| matches!(s.as_str(), "generate" | "generate-incidence"))
+    {
+        assert_eq!(args.len(), 3);
+        let dir = Path::new(&args[2]);
+        assert!(
+            !dir.exists(),
+            "Generate into a new directory; preserve prior measured fixtures."
+        );
+        fs::create_dir_all(dir).unwrap();
+        for (name, bytes) in &base.bundle.files {
+            fs::write(dir.join(name), bytes).unwrap();
+        }
+        fs::write(
+            dir.join("expected-baseline.json"),
+            serde_json::to_vec_pretty(&p).unwrap(),
+        )
+        .unwrap();
+        println!(
+            "Generated source7 native fixture: {} elements, {} relations, {} source files",
+            p.elements.len(),
+            p.relations.len(),
+            base.bundle.files.len()
+        );
+        return;
+    }
+    assert_eq!(args.len(), 4, "check MODE ENTRY");
+    assert_eq!(args[1], "check");
+    let mode = args[2].as_str();
+    let actual = disk(Path::new(&args[3]));
+    let expected = if matches!(mode, "baseline" | "incidence-baseline") {
+        base
+    } else if matches!(mode, "oa-exchange-assembly" | "sa-common-work") {
+        let added: Vec<_> = actual
+            .decoded
+            .project
+            .relations
+            .keys()
+            .filter(|key| !p.relations.contains_key(key))
+            .copied()
+            .collect();
+        assert_eq!(added.len(), 1, "Exactly one new incidence link is expected");
+        let fresh = added[0];
+        assert!(!p.contains(fresh));
+        assert_eq!(fresh.get_version_num(), 4);
+        let expected = verify_incidence(&p, &incidence_relation(&p, mode, fresh));
+        update_bundle(&base, &expected, ProjectLimits::default()).unwrap()
+    } else if matches!(mode, "operation-reset" | "operation-status") {
+        let mut e = p.elements[&operation_id(43)].clone();
+        let Some(SharedBody::Occurrence {
+            body: OccurrenceBody::Exchange { operation, .. },
+            ..
+        }) = e.shared_mut()
+        else {
+            panic!()
+        };
+        *operation = Some(OperationUse {
+            allocation: Some(operation_id(if mode == "operation-reset" {
+                30
+            } else {
+                31
+            })),
+        });
+        let expected = execute_batch(&p, &[Command::EditElement(e.id, e)]).unwrap();
+        update_bundle(&base, &expected, ProjectLimits::default()).unwrap()
+    } else {
+        let (prefix, nested) = match mode {
+            "oa-link" => ("oa", false),
+            "sa-link" => ("sa", false),
+            "oa-nested" => ("oa", true),
+            "sa-nested" => ("sa", true),
+            _ => panic!("Unknown mode"),
+        };
+        // Creation allocates one fresh UUID. Only that nonce comes from the native
+        // result; all authored fields, dependencies, aliases and source are predicted.
+        let added: Vec<_> = actual
+            .decoded
+            .project
+            .relations
+            .keys()
+            .filter(|key| !p.relations.contains_key(key))
+            .copied()
+            .collect();
+        assert_eq!(
+            added.len(),
+            1,
+            "Exactly one new caller-owned relation is expected."
+        );
+        let fresh = added[0];
+        assert!(!p.contains(fresh));
+        assert_eq!(fresh.get_version_num(), 4);
+        let relation = Relation {
+            id: fresh,
+            alias: p.fresh_alias("contextual_link", "relation", fresh),
+            name: "First assessment gate".into(),
+            description: String::new(),
+            body: RelationBody::ContextualLink {
+                owner: id(&format!("{prefix}_caller")),
+                source: OccurrenceEndpoint {
+                    references: vec![],
+                    occurrence: id(&format!("{prefix}_x")),
+                },
+                target: OccurrenceEndpoint {
+                    references: if nested {
+                        vec![id(&format!("{prefix}_r3")), id(&format!("{prefix}_inner"))]
+                    } else {
+                        vec![id(&format!("{prefix}_r1"))]
+                    },
+                    occurrence: id(&format!("{prefix}_b")),
+                },
+                purpose: ContextualLinkPurpose::Precedence {
+                    guard: "Check accepted".into(),
+                },
+            },
+        };
+        let expected = execute_batch(&p, &[Command::CreateRelation(relation)]).unwrap();
+        update_bundle(&base, &expected, ProjectLimits::default()).unwrap()
+    };
+    assert_eq!(
+        actual.decoded.project, expected.decoded.project,
+        "Complete model mismatch; no identity/metadata exclusions."
+    );
+    assert_eq!(
+        actual.bundle, expected.bundle,
+        "Complete authored source mismatch; no whitespace or version normalization."
+    );
+    println!(
+        "PASS {mode}: exact model and all{}source files",
+        expected.bundle.files.len()
+    );
+}
				`@@ -0,0 +1 @@`
				`// Preserve this included engineering note: rescue 雨.`
				`@@ -0,0 +1 @@`
				`// Native oracle: retain this authored 雨 note and CRLF.`