# Repair/save native verification — 2026-09-11

Native operator: Codex-9e8r6t `/root`. Independent archive and stored-evidence inspection: Codex-9e8r6t `/root/linux_readiness`.

The corrected Windows GUI passed three bounded native repair workflows: missing include, duplicate alias, and interrupted-save rollback. Repaired accepted source remained visibly unsaved until explicit Save; attempted Close prompted and Cancel retained the work. After each final visible Save, the complete saved-model/source oracle passed with all four files and authored identities equal to the intended baseline.

Root operated the native application. This report's author independently inspected stored screenshots and checked the exact saved files, receipts, and archive bytes without rerunning the application or oracle. [The correction report](release-text-repair-save-state-20260911.md) records implementation and the 755-test/Clippy gates; [raw native evidence](experiments/text-navigation-native-20260911/repair-save-native-v4/manifest.json) preserves this trial.

## Identity and method

Launch receipt: **2026-09-11 20:52:46 UTC**, PID **10016**, source commit **33c6d83e9ba9a5b1310b1b627d7c40affcbcf15c**. Admission bound the 500 input files and successful gate receipts to input ZIP SHA256 `213fdb39ea7c3601b4baac674c3ab3ecc863ac44db1b092d922d3e24f26887b7`.

GUI: **113,206,272 bytes**, SHA256 `b183ef31f16b3986538b3f2aba8435eab45978635c47f99ca01be6e72b168848`. The bundled `libunwind.dll` SHA256 was `f45604a12e8bcd839fd86f667c1be1cc7c4f9da2b3c69ff381ac708f0e1ae7d4`. A private profile/TEMP and Windows-only PATH isolated the trial from the development toolchain. All 20 original screenshot captures include their metadata and show a **1442 × 932 outer window**.

Edits, Apply, Close/Cancel, Recover and Save were performed through the GUI. The helper only launched, copied/read disk checkpoints, ran the pinned saved-equality oracle after the caller confirmed visible Save, and recorded binary readback. Snapshot receipts alone make no Apply or accepted-model claim. The oracle executable was SHA256 `967d9ba3c6fb3a7efb410833903ec94556ca2d48a67d5072c8bb160f40a00f9c`.

## Observed outcomes

| Trial | Visible state and before-save disk evidence | Final saved check |
| --- | --- | --- |
| Missing include | Captures 03–05: invalid Open, repaired draft, then Model in sync **and Unsaved changes** after Apply. Disk snapshot at 20:55:26 still contains the broken include. Captures 06–07 show Close warning and Cancel retaining the repair. | Capture 08 shows clean after explicit Save. Oracle at 20:55:51 exits 0; exact valid baseline, complete Project/IDs and all four source files. |
| Duplicate alias | Captures 09–11: invalid Open, duplicate declaration removed, then Model in sync **and Unsaved changes** after Apply. Disk snapshot at 20:57:26 still contains the duplicate declaration. Captures 12–13 show Close warning and Cancel retaining the repair. | Capture 14 shows clean after explicit Save. Oracle at 20:57:52 exits 0; complete valid Project/IDs and four exact files. |
| Journal recovery | Capture 15 and 20:58:52 snapshot retain AFTER plus the three v1 journal files. Capture 16 shows unchanged Apply clean while disk still equals AFTER and the recovery banner remains. Actual Recover removes the journal and restores BEFORE on disk at 20:59:11; capture 17 shows retained AFTER text now **unsaved**, with Model in sync. Captures 18–19 show Close warning and Cancel. | Capture 20 shows clean after explicit Save. Oracle at 20:59:36 exits 0; full intended AFTER Project/IDs and four exact files. |

The distinguishing pre-save hashes are retained in the checkpoint manifests and copied source:

- Broken-include entry: `573357995f0a68fef39aa3eef3125e2271242d1ce01607c129624399b77e682e`.
- Duplicate `救援/confirm.arcadia`: `ba3e222bdc7dfa94e4f1b16df091447835da6b5bea8a72701e12e077e77319a6`.
- Recovery BEFORE entry: `6e9abf4ecf24175b9f04a8db11fe182146581059628eb8769e869597401f262e`.
- Valid/AFTER entry after final Save: `79e26836c048a35aaf98b21ff006ae8ac931160abd9913b9e67b542303215414`.

Root then closed the window normally and independently observed window/PID absence. The 20:59:59 helper receipt records the caller's absence confirmation and unchanged GUI/DLL bytes. Application stdout and stderr are empty. **No numeric process exit code was observed**; neither the helper nor this report infers one.

## Scope

No native failure occurred in these three repair trials. They resolve the false-clean defect observed in [GUI5478's historical native trial](release-text-navigation-native-v3-20260911.md). They do not repeat the entire navigation/engineering trial, establish minimum-size layout behavior, exercise native first-save deletion or injected reload failure, or establish package/release acceptance. The earlier GUI5478 record retains its own navigation/engineering scope. Linux/WSL remained paused.

The archive retains preparation helpers and their original **pre-launch** README, all 64 frozen fixture files, all seven checkpoints, all 20 JPEG/metadata pairs, launch/admission/close receipts and empty/raw logs. The historical preparation README remains explicitly historical. Redundant final trial model trees are omitted only after exact byte equality with preserved fixtures/checkpoints was verified. Binaries/profile/cache are excluded; executable identity remains in receipts. No originals were removed.

Archive verification passed for **166 payload files / 2,421,715 bytes**, plus manifest/readback. Manifest SHA256: `3a32afc0d93dafdead2066a7d1fddaf5fedddf99cf4a9b481cd7691007b6f9d9`. Readback SHA256: `b726cb6e8338488636fdd08c5254367fa44981aad19af18509839f7cf424a2cc`. The read-only verifier checks every payload, all fixture and checkpoint hashes, screenshot counts/dimensions, final four-file equality and the three actual oracle result records without rerunning an oracle. All 53 omitted duplicate trial files were matched to retained bytes.