# Independent staged native workflow review — a57c334

Codex-ytr83r /root/wsl_startup_review. Read-only evidence review; no new native action, oracle, compiler, or model validation executed. No material discrepancy found in the bounded three-workflow record. The reported cancellation, explicit parent creation, saved Undo/Redo, and actual reopen are supported by the closed results, independent physical byte comparisons, and selected images.

Evidence is main `.local/native-a57c334`, completion record UTC 2026-09-11T21:12:46.983Z, source `a57c334b302eb13352b4bb65df1c75d94d002348`, GUI SHA256 `69DBB90FA299B3B3D90140C7934891F79166025893AF9B35B2B8D754A37A0D40`, recorded PID 7564/window 459848. These executable/source bindings are read from frozen provenance; this review did not rehash the live executable. Files after screenshot 45 and live working/profile/application logs were excluded.

## Closed contract and identity checks

The frozen fixture README and checker source are byte-identical to their current main `harness/fixtures/staged-source-authoring/README.md` and `harness/staged-source-authoring-contract.rs`. The README's former first-item action wording is historical; observed a57 entry points are the permanent L and W palettes. This changes the entry route, not the tested source/consumer contract.

The checker predicts explicit commands using only role UUIDs from each separately pinned original first carrier; it does not adopt observed source metadata as expected semantics. It checks each original carrier against the staged prediction, complete decoded Project equality, exact reachable SourceBundle, and exact physical `.arcadia` files. Loading rejects source errors, requires compilation without bundle normalization/migration, and validates the candidate through an empty core command batch. The contract's self-check exercises wrong metadata, source-only drift, and unknown retained files. Historical admission has compile/self-check/baseline exit 0; recorded checker SHA256 `B1DEA048E319FB7B9A41620A17A0DB8B0831E09816ACCFDAEC7CFBDA0133C211`, core SHA256 `D282FEE7FF3B4FDD159EA85B12430262C8DA00E064BD290CCED380B6BA2335B5`. This review read that admission receipt, not a fresh checker execution.

All 13 frozen stage statuses are terminal exit 0: baseline, cancel, three first saves, three Undo saves, three Redo saves, machine reopen, and reopened-same. All 13 corresponding output logs contain PASS; all 12 separately captured stderr logs are empty. Baseline admission targeted the then-working project; subsequent relevant checks target frozen checkpoints. First and Redo commands pin the original lifeline, chain, and machine carriers in order; machine reopen pins all three originals. Undo commands compare the preceding accepted stage and supply the corresponding original first carrier solely to constrain retained disk files. Final same compares Redo machine against reopened. Last closed status completed 21:12:46.979Z.

Independent recursive all-file inventory/readback (not merely reachable includes) confirmed these eight equalities: Cancel equals baseline; all three Redos equal their original first saves; all three Undos equal the corresponding first-stage disk map overlaid by the preceding reachable disk map; reopened equals original first machine. Only `.arcadia` files occur in these directories. There are 47 files / 19,594 bytes across the eleven checkpoints, plus the two-file / 656-byte baseline. Undo lifeline retains one known activity file, Undo chain one known function file, and Undo machine two known participant/view files. Those exact orphans are expected Save behavior, not extra reachable semantic content. The independent note remains byte-identical everywhere.

Read actual declarations and references in the six-file machine carrier: OA scenario retains explicit OperationalActivity viewpoint and empty steps; the new lifeline represents the root Activity. SA chain contains exactly its new Action contribution, which references the root Function with no lifeline and empty pre/postconditions. The new SA SystemActor is root-owned and owns the StateMachine; the opt-in diagram projects that machine with one placement at (60,60), size 336×104. No additional regions/states or allocations were accepted. Complete model/relation/trace/artifact-link equality is supplied by the closed oracle, beyond this independent declaration inspection.

| New role | Original UUID, preserved by later stages/Redo/reopen |
|---|---|
| OA Activity | ed6d1f81-0f36-4207-a185-bf391f16d356 |
| OA Lifeline | 1400a6a2-e965-4dda-8746-e3c0d658739a |
| SA Function | 7c1b439d-ac4a-40e3-942c-6a8c855fb42c |
| SA Action contribution | 67a997d3-ae25-4beb-8824-f68657b3d58b |
| SA SystemActor | afc4c93a-4c99-4c9b-987f-ec36302c7046 |
| SA StateMachine | ce5cb57c-10fb-4b5a-abc9-3dbbd9bed4c5 |
| First state diagram | 3064c52b-4533-404c-957e-38672f0d9d54 |
| Machine placement | e6bd0215-f41a-4c27-9e2b-bbf0395b150a |

## Image inspection and UX limits

Inspected original JPEGs 08, 10, 16, 24, 28, 34, 36, 37, 38, 41, 43, 44, 45, all 1442×932. Images 08/24 show distinct staged source and consumer names, the retained parent form, and explicit Create/Cancel. Image 10 shows the cancelled OA form removed, baseline two objects and All source files saved. Image 34 makes System actor selection explicit; 36 retains that new owner in the machine form with first view unchecked; 37 checks the opt-in before Create and open. Image 38 shows the resulting owned machine and state diagram. Saved Undo images 16/28/41 show expected model-count rollback to 2/4/6; saved Redo 43 restores eight objects and the machine view. Image 44 visibly says Source project opened; 45 says All source files saved with the final eight objects. Thus reopening has direct application-state evidence, beyond file-only comparison. Screenshots support these states, while the exact single Undo/Redo action count comes from root's completion account and the resulting complete-model transitions.

No material obstruction or incorrect name/source relationship is visible in this selected wide-window route. Existing-choice controls remain visible beside the explicit new-source summary, which communicates the active staged choice. The Save status alone is not proof that a staged child committed: child Use retains a draft, and Save can adopt valid pending drafts. The tested cancellation route correctly cancels before Save, then proves baseline equality.

This is bounded contextual-authoring acceptance, not full native/application/package acceptance. No minimum-size, directed pan/zoom, keyboard/focus matrix, repeated-create, or new grapheme-binary result is claimed. The machine view visibly shows 125%; this is an observed default view state, not a zoom sweep. Visible 3/5/6 model-check counts must not be described as zero diagnostics: the contract validates the intended sparse model, not completeness of empty behavior/state content. The recorded picker-capture timeout/recovery is a tool-history limitation; images 44/45 and exact reopen checks establish the later recovered application state. No newer screenshots or ongoing root actions were reviewed.

## Exact reviewed evidence fingerprints

All hashes SHA256. Each directory/group digest below hashes UTF-8 compact JSON of its sorted array of objects `{path,size,sha256}`, with sorted keys, `ensure_ascii=true`, separators `(',', ':')`; directory paths are relative to that directory, group paths relative to `.local/native-a57c334`. This binds exact inventory and bytes, not timestamps.

| Frozen item | Bytes | SHA256 |
|---|---:|---|
| `staged-native-complete.json` | 1416 | `91DFFF807497F6FA2B82D3A3A81F93D7AE5A6CFA67BDB55273C40F9B7DD25095` |
| `provenance/staged-fixture-README.md` | 8380 | `711910A12D5F3960F32DA9AA7BC2E647F31D770C84B7FC26E232DCB3A76F8821` |
| `provenance/staged-source-authoring-contract.rs` | 22693 | `9EB9DD3868B6CB772F907D16AE02995AD10A16F85C087012C24948E6E6FE775D` |
| `provenance/staged-oracle-status.json` | 896 | `ECDC63F1AD012FD2120C2C4F87E93F7FA4D672817C86FDA33724F9053BBB1612` |

| Checkpoint directory | Files | Bytes | Inventory digest |
|---|---:|---:|---|
| `baseline-staged` | 2 | 656 | `0FED5FF2A4745C9CDDE7ED3A0B56F2D0DA5761D9D756CE59731E89143B8C27E1` |
| `staged-cancel` | 2 | 656 | `0FED5FF2A4745C9CDDE7ED3A0B56F2D0DA5761D9D756CE59731E89143B8C27E1` |
| `staged-first-chain` | 4 | 1661 | `729AA4632801340D46448A7AAFF437579908EC64F12F2B65F3F6D97716D26A9E` |
| `staged-first-lifeline` | 3 | 1065 | `F2A72FB2C89C38FD3C34A88DDFA524C74EED88383523866E131233D9D66D4374` |
| `staged-first-machine` | 6 | 2900 | `679DB4CAE6ABDEF27BD5C81256ACCED92737D02C1551B493BDDFDE5FA46A7978` |
| `staged-redo-chain` | 4 | 1661 | `729AA4632801340D46448A7AAFF437579908EC64F12F2B65F3F6D97716D26A9E` |
| `staged-redo-lifeline` | 3 | 1065 | `F2A72FB2C89C38FD3C34A88DDFA524C74EED88383523866E131233D9D66D4374` |
| `staged-redo-machine` | 6 | 2900 | `679DB4CAE6ABDEF27BD5C81256ACCED92737D02C1551B493BDDFDE5FA46A7978` |
| `staged-reopened` | 6 | 2900 | `679DB4CAE6ABDEF27BD5C81256ACCED92737D02C1551B493BDDFDE5FA46A7978` |
| `staged-undo-chain` | 4 | 1199 | `14EE15D0C4B89B55E1DA5F4C72F81A5C2E928BB5D419EB7B228C9BD355E5482E` |
| `staged-undo-lifeline` | 3 | 798 | `9A05645EF8236D50F3ACA60B74192A902F8EA544EF1E378256AF0DF50D4241D9` |
| `staged-undo-machine` | 6 | 2789 | `A99E8BA5D5F78C3A600F5DC5E4CABEF05205366E163C1342E35FEE6FE26CBE08` |

| Reviewed group | Files | Bytes | Inventory digest |
|---|---:|---:|---|
| 13 closed statuses | 13 | 7387 | `27F1632E6F95C74449838635749BF8E68CDBFEE8E762AA6FCC95A2CC61230383` |
| 25 closed output/stderr logs | 25 | 1065 | `F1617EC3312A06090C442DEB32237DD8EC48792EE6C6E0AFD60B59779CDB7EF5` |
| 13 visually inspected JPEGs | 13 | 1347445 | `ECBBF4D7E8C7E03D312010FFDC98BDB18808E7CF2E361139D7649360E52833BA` |