ARCADIA-Studio/harness/release-source7-pending-contextual-recovery-oracle-20260907.md

Pending nested contextual-link recovery: native pass

Native recovery PASS on the staged 6BAB binary: PID 8224 controlled Stop, restart PID 10420. Root observed Recover restore the exact SA owner/reference paths, raw name, and Exchange assembly with no evidence; Apply remained disabled. Switching back to Precedence revealed the exact spaced Unicode guard and enabled Apply through fresh command validation. No accepted edit had occurred at this checkpoint. The standardized sa-nested Apply/Save/Undo/Redo continuation remains a separate gate.

Independent read-only verification checked both preserved checkpoint hashes against their result logs, compared all parsed fields with deterministic key ordering and exact string/array values, and compared accepted text against the tracked baseline. The only differing fields are the three documented envelope fields below.

Preserved evidence	SHA256
.local/native-qa/source7-pending-contextual-before.json	3E50C49A2BC3033CE01565F6012CC243D5E50A0F3D1C9AC9FCE6C29BDD94DB86
.local/native-qa/source7-pending-contextual-after.json	2751794637222AC293AF44B91D6548F7312D59E23AE31686096BA5551EAA331D
Original and tracked baseline project.arcadia	5474D8CA05FD1375220DC0AD40D913631FDE51159E9632BB9F290D1ECDAB8DD7
Original and tracked baseline rationale.arcadia	E6A600E13036D4AD594A65380ED1B3D82D1772D583041BB0A624C9588A73047A

The original source files remain unchanged. Exact fields: accepted, behavior, name, property, selected, version, workflow, workspace. Checkpoint ID changes from b8d5c6e3-6104-4d0c-bc32-b8176a30416d to bef57f71-0fc7-4c37-8c49-1a2adb6ea53a; modified seconds advance from 1788768039 to 1788768113; the original absolute sa-nested entry path becomes null. Both source7-pending-contextual-{before,after}-result.json logs report PASS.

No production changes or Cargo runs were needed for this oracle. Use the unchanged .local/native-qa/source7-cases/sa-nested/project.arcadia and its complete tracked fixture/oracle in harness/fixtures/source7-native.

Minimal native sequence

1. Open that clean baseline. Choose SA → Behavior → Caller with three assessments (@sa_caller). Click Qualified link / assembly….
2. Under Choose source, select direct X · Check authorization (@sa_x). Under Choose target, click Enter reference for Nested assessment (@sa_r3), then Enter reference for Inner assessment (@sa_inner), then select B · Review assessment (@sa_b). Keep that browsing scope.
3. Enter Link name exactly Pending nested gate 雨 (two surrounding spaces). With Precedence, enter guard exactly Check accepted && 雨 . Switch purpose to Exchange assembly and leave its evidence picker empty. This deliberately makes the draft non-applicable while retaining both exact endpoints and the now-hidden raw guard. Apply link must be disabled and the form must show Choose the exact exchange used for assembly.
4. Wait for the automatic checkpoint, preserve/check it with Capture below, then have the root kill/restart the app and choose this checkpoint's Recover. Do not modify the recovered form before Compare. It should reopen Behavior, retain both full path labels and Exchange assembly, and still refuse Apply.
5. After the recovered checkpoint is preserved and compared, switch to Precedence. The exact spaced Unicode guard must reappear. The form computes a fresh valid command; it has no persisted approval flag or cached command. Accepted sources must remain unchanged until explicit Apply.
6. Optional continuation reuses the existing complete native oracle: replace name with First assessment gate, guard with Check accepted, keep Precedence and the same endpoints, then Apply once. Save a fresh folder and run .local/native-qa/source7-native-contract.exe check sa-nested SAVED/project.arcadia. The existing oracle predicts every record and both source files, admitting only the one new relation UUID. Undo/save must match baseline; Redo/save must match the same accepted identity. This continuation is a separate gate.

Read-only checkpoint verifier

PowerShell 7 script: .local/native-qa/verify-source7-pending-contextual.ps1. Pass the actual automatic checkpoint file paths selected from the isolated appdata recovery directory; never point Compare at the original old checkpoint.

& .local/native-qa/verify-source7-pending-contextual.ps1 -Mode Capture -Checkpoint BEFORE_KILL.json
& .local/native-qa/verify-source7-pending-contextual.ps1 -Mode Compare -Checkpoint NEW_RECOVERED_CHECKPOINT.json

It creates immutable source7-pending-contextual-before.json / -after.json copies and corresponding -result.json logs under .local/native-qa; existing copies are never overwritten. Both checkpoints must contain the exact clean two-file baseline, clean source text/baselines, the expected SA owner and qualified paths, the exact raw name/guard, and the rejected new Exchange-without-evidence draft. Compare checks every saved field, including the entire behavior and workspace DTOs, exact selection, browsing search/page/scope, and null property/workflow. It does not normalize IDs, whitespace, Unicode or source text.

Only three top-level envelope differences are permitted and checked explicitly:

• id: new nonnil checkpoint ID. checkpoint_loaded calls App reset, which allocates a new canvas_document; checkpoint_tick uses that as snapshot ID.
• modified: equal or later Unix seconds, assigned by Snapshot::capture.
• origin: initial absolute file path becomes null; checkpoint_loaded calls reset(..., None) to recover an unsaved copy without overwriting the origin.

All other differences fail, including selection changes. Source checkpoint hashes are checked before/after reading and preserved copies are hashed. The expected baseline file comparison plus unchanged accepted bundle rules out automatic creation; the native disabled-button/error check establishes preview refusal. The script does not claim to execute the Rust validator or inspect a cached plan.

Existing implementation evidence and limits

topology::Draft and contextual::Draft serialize closed raw authoring fields; State::from_recovery restores only that draft with transient state defaulted. contextual::Draft::purpose rejects missing Exchange evidence before command creation; topology/view.rs recalculates d.command(p) to enable Apply, and Submit prepares the command against the accepted Project again. Arbitrary guard text is not treated as invalid syntax: it is retained text, hence the explicit missing evidence refusal rather than a fictional guard-parser failure.

Existing focused tests include exact combined operation/contextual draft recovery, rejected qualified endpoints remaining rejected after recovery, and valid nested GUI proposals matching core. They do not substitute for this native crash case. The verifier passed PowerShell syntax parsing and both actual native checkpoint checks. The independent full-field/source comparison above corroborates its results.