# Analysis847: actual public checked-save failure

The existing checked-save regression **failed at public decode after successful `.arcadia` saves**, confirming the [previous source-derived prediction](release-analysis-next-acceptance-20260913.md). Source `847b1caa7e75bb82f6ce5193c45bcfc45973ad1a` remains isolated, clean and unmodified. This does not establish a defect in the private JSON depth codec or acceptance of the candidate.

Actual command:

```text
cargo test --locked -p oa-core --test review_regressions checked_save_returns_exact_bytes_and_accepts_unchanged_external_content -- --exact --test-threads=1 --nocapture
```

Windows GNU/LLVM Rust/Cargo1.98.1, LLVM-MinGW23.1.1, one build job, fresh isolated target `.local/analysis-checked-save-target-20260913`. Compilation completed in15m33s using the unoptimized test profile. Cargo exit101; **0 passed,1 failed,14 filtered out**, test duration0.08s. The direct compiled executable listing returned exactly one selected test. All512 raw committed input comparisons, HEAD and worktree status were unchanged. Compiler/test lease closed and was released; no further gate was run.

At `review_regressions.rs:464`, public decode returned `Unsupported schema version: expected arcadia 3, 4, 5, 6 or 7.` The preceding two save calls and disk/returned-byte equality assertions succeeded. The first `.arcadia` iteration then failed; its repeat save and subsequent `.oa.json` iteration did not execute. The test's temporary file was not retained after panic; the failed executable, complete logs and source evidence are preserved and hash-bound.

Cause in this candidate: `model.rs:9` sets schema8; `language.rs:577` writes it; `language.rs:1408` admits only3–7. `persistence.rs:952–979` takes `.arcadia` through the formatter and replaces the destination without validating public decode equality first. Source declaration formatting also omits the analysis definition catalog, and `language.rs:1653` rejects analysis records pending source8 authoring. Merely accepting the header would not establish complete source preservation.

The [portable archive](experiments/analysis-checked-save-windows-20260913/README.md) retains exact inputs, runner, command, logs, result and executable/runtime bindings. The result's auxiliary `log_test_failed: false` is intentionally unchanged: nocapture panic text interrupted its narrow contiguous-string match. Actual exit/counts/named failure/panic/listing establish the failure. No false success classification is adopted.

## Next smallest repair boundary — recommendation only

Keep private JSON depth admission and source persistence separate; do not enable DEPTH_128_VALIDATED or rewrite this test to pass. The smallest safety correction is to make `.arcadia` checked-save validate its generated source through the public decoder and require complete Project equality **before replacing any existing destination**. That prevents successful writes that cannot reopen, but is containment, not completion: this regression would then fail at save until source8 round-trip support is implemented.

The next bounded complete source repair must reconcile schema8 admission, definition-catalog declaration formatting and parsing, and existing analysis-record rejection together, preserving IDs/aliases, all authored fields and compatible older-source handling. Establish empty/ordinary OA/SA plus a meaningful populated definition/analysis example as round-trip evaluators; a whitelist-only patch or silently omitted records is insufficient. Continue with the existing public checked-save tests and frozen migrations/API persistence checks identified in the prior plan after the corrected source boundary is independently reviewed. No production/test edit, new test or broader acceptance execution is part of this archival task.

Full analysis/source8/REST parity, optimized memory calibration and Linux remain outside this result; Linux remains user-deferred. Root owns issue7 and subsequent decisions. This report records evidence and a source-level recommendation, not a live task ledger or candidate promotion.