# Independent native creation oracle — 2026-09-11

Current checker: **v2**, source `51AB2FFA1826DD949B79F3A9690042A2F9E38DAF9ED91517CADE3861482117BA`,
executable `056EEFD444924916BF6AC3C4897AB2FF4A8A4BB892E1DBC16ADAD32E59BF6A36`.
It supersedes the initial version's incorrect strict-disk rule for Undo;
the initial build evidence below is retained as history.

Codex-9e8r6t /root/behavior_audit. Owns only the new standalone
`harness/behavior-creation-contract.rs`, fixture README and this report.
No production Rust, Cargo, native input, commit or push. Read PROJECT_GOAL,
Gitea issue1 through #120, open PRs (none), Integration3978bbe Wiki, preserved
baseline and published first-view planner contract. Creation author confirmed
the exact generated view name/projection/root-only contract before any created
artifact was read.

The fixture README defines the root's three literal native actions and separate
creation/Undo/Redo/reopen checkpoints. Expected Project and SourceBundle are
constructed with explicit core records/commands, using only fresh role-proven
UUIDs from output. Desktop creation code is not imported. One optional first
view is a single machine-root placement; the typed core Layout prediction is
60,60, size 336×104, with nine exact source files after all three operations.
Earlier diagrams, relations, traces and source comments remain unchanged.

Direct-rustc compilation with `--edition 2024 -D warnings` passed at
2026-09-11 08:51:12 UTC in 3.43 s; writer lease returned immediately. Self-checks
and a complete unchanged-baseline check then passed. False metadata/geometry,
changed scenario viewpoint/context, extra regions/files, unrelated metadata
and same-model source-comment drift are rejected. These are harness validation,
not native Studio acceptance. No created checkpoint has been inspected here.

Artifacts under `.local/behavior-creation-oracle-20260911/`:
`build.log`, `build-result.json`, `self-check.log`, `baseline-check.log`,
`check-results.json`, `manifest.json`, `behavior-creation-contract.exe`.

| Artifact | SHA-256 |
| --- | --- |
| Harness source | `65547C7E1259EB49EC2313184AA13BC1FEB3DBDD4B992A482CA682C9E0F2CF1D` |
| Checker executable | `73FA81B205457D04700FD25BAE3769969EB9F8413B05D7C2F9C69F7D187A9BFF` |
| Linked `liboa_core-3e81c616fea1d901.rlib` | `5018A1FD7286ED9DFEDCBBF5B68B399AD5D143F2A9AAAED3078CFC934C9589C4` |

Preserved baseline is the whole directory
`.local/native-qa/palette-20260910-v3/checkpoint-transition-reopen/`.
SHA-256 values read before construction and again after harness execution match:

| Source | Bytes | SHA-256 |
| --- | ---: | --- |
| `project.arcadia` | 4844 | `B35A3F63F223CC4FE2760D6308E87B016ED1EADFBEF0A3A4BD051B52C9080958` |
| `rationale.arcadia` | 57 | `C01867C9DC0D40726853119FAC3C6AD24A40D8D362A93A8B9D20DF04EC2E273F` |
| `traceability.arcadia` | 395 | `F778ACAAA85DE0940CEDCD9514CD803032A11E782D859454203235FEBB73E5F0` |
| `oa/participants.arcadia` | 403 | `094CAB67F34B64902942C10A35BBCD0F760886D862588A0816D6CEB57BACF51B` |
| `oa/activities/activity_assess_incident.arcadia` | 376 | `AE41D7C20B062B39C2EDAB7FB890A3D88A9CE18FD8D03018EF2D6F95EEFF62E8` |
| `sa/participants.arcadia` | 124 | `FB975B83D3EC164C38936BF27FE7D2021CC46805574902A534744B040F7D3AE8` |

Root owns native checks and release claims. Keep the first committed operation
checkpoint as the role carrier for Redo/reopen so fresh replacement UUIDs cannot
be mistaken for history preservation. `same` compares all identities and source
bytes with a previously accepted checkpoint. The reused core transaction/layout
and source updater define the published model/source contract; independent
native observations must still establish UI behavior and transaction boundaries.

## V2: explicitly proven retained files after Undo

Root independently found the initial harness defect before new native creation:
`checkpoint-transition-undo` restores the basic four-source reachable bundle but
physically retains six source files. This follows `source_files.rs:817` (detached
files are never deleted) and `docs/language.rst:1854`; the initial `load` check
would incorrectly fail an otherwise exact Undo. Published `4bb4aaf` contains that
initial oracle, not this correction. No model or desktop fix was needed.

The corrected `same EXPECTED ACTUAL [UNDO_FROM]` keeps full Project and reachable
SourceBundle equality. With an explicit origin, expected disk bytes are the
exact first-committed checkpoint's source file map overlaid with EXPECTED's
reachable files. The origin is itself checked for an exact reachable file set.
Without that argument, ordinary comparisons continue to reject detached files.
Unknown, changed or missing retained files and reachable-source drift all fail.

V2 direct-rustc `-D warnings` compilation passed; lease returned before runtime
checks. Built-in self-checks now independently simulate one retained machine
module and falsify unknown/changed/missing detached files and reachable drift.
The pre-existing immutable native transition Undo passes with **four exact
reachable sources and six exact disk files, two proven retained**. Separate
isolated copies with an unknown detached file or an appended byte in retained
`traceability.arcadia` both return exit 101. The same valid Undo without an
origin also returns 101, proving there is no general orphan exemption. Baseline
comparison and all previous model/source self-checks still pass. No new behavior
creation output was read; the stated three-action expectations are unchanged.

New evidence under `.local/behavior-creation-oracle-20260911/`:
`build-v2.log`, `build-v2-result.json`, `self-check-v2.log`, `baseline-v2.log`,
`old-transition-undo-v2.log`, `checks-v2-result.json`,
`strict-undo-rejection-v2.log`, `unknown-detached-rejection-v2.log`,
`changed-detached-rejection-v2.log`, `disk-falsifiers-v2-result.json`,
`manifest-v2.json`, and `behavior-creation-contract-v2.exe`. Initial artifacts
remain intact; isolated changed copies are named `probe-v2-*`.