Source was captured above eeeaa12627 plus three uncommitted files: crates/oa-desktop/src/document.rs, crates/oa-desktop/src/app.rs, and new crates/oa-desktop/src/app/repair_save_state_tests.rs. A parallel records-only commit 00a21d3322 did not alter the captured inputs.

Invalid Open retained the previous accepted Document and its saved baseline while changing the local destination. Repairing back to that previous saved content made Apply a legitimate no-op transaction, but falsely displayed All changes saved while the newly opened disk files remained invalid. Close/New/Open guards consequently could discard the repair without prompting. Apply never performs the source disk write; Save all does.

The correction binds the exact reachable raw source read at an installed repair destination as the saved baseline, preserving accepted graph, source, revision, Undo/Redo, and the recovered-unsaved guard. A successful current-destination journal recovery likewise binds the reloaded rollback bytes. If successful recovery cannot reload the current destination, the saved baseline becomes explicitly unknown (None), so no current/history content is asserted saved. Recovery of a former Save As destination retains the current destination's baseline. Successful Save receipts continue to establish the actual saved snapshot. Ordinary valid Open of equal bytes at a different destination stays clean.

Independent critic found the applied-workspace rollback seam during review; it was corrected before compilation. An early review hypothesis that a first-save rollback necessarily produces a reload error was retracted: missing entry normally returns an empty DiskProject with a diagnostic. Tests distinguish that actual result from an explicitly injected reload error. No failed compiler/test attempt occurred in this correction's gate run.

Verification

inputs1.zip: 500 files, 9,482,855 uncompressed bytes, SHA256 213fdb39ea7c3601b4baac674c3ab3ecc863ac44db1b092d922d3e24f26887b7. ZIP members were compared byte-for-byte with source before execution. Source file set and SHA256 values were checked before and after each gate and remained unchanged.
Windows PowerShell 7; project-local Windows gnullvm toolchain; CARGO_BUILD_JOBS=1; Cargo commands locked/offline. Exact commands, selected environment, tool versions, compiler hash, separate raw stdout/stderr and terminal exits are retained in environment.json and each *-result.json.
Full desktop suite: 755 passed, 0 failed, 1 ignored, 0 filtered, 341.76 seconds test execution; 536.296 seconds including compilation. The existing manual 100-module timing test remained ignored. All five new repair-save tests passed, including missing/duplicate declarations, equal previous source, exact disk preservation, no-op history, Close protection, failed save, Undo/Redo, journal rollback/missing-entry, injected failed reload, and former-target isolation.
Strict all-target desktop Clippy: exit 0, 53.881 seconds. Scoped rustfmt check and git diff check: exit 0.
Matching GUI build: exit 0, 65.833 seconds, finished 2026-09-11T20:39:08.199756Z. Cargo artifact record is in gui-build-stdout.log; gui-build-result.json identifies executable, profile, size and SHA256.
GUI .local/target-gnullvm/debug/arcadia-studio.exe: 113,206,272 bytes, SHA256 b183ef31f16b3986538b3f2aba8435eab45978635c47f99ca01be6e72b168848. This is a Windows development binary, not a native acceptance claim. No GUI was launched by this worker.

Final source SHA256:

Path	SHA256
document.rs	7c87280b5b8d112c34865253f8ba0f80d43bc9897771943b15dc7b5608eb17a4
app.rs	4a41b062da233a72f1b04866898eeddb3f79882918a67f5f09469fe4eadd9929
app/repair_save_state_tests.rs	5543dcba853bb1513acf824b860249729a6004747e7e320b46efe60ea19e2d83

The original private #9 Document timing experiment remains scoped to its old Document source and binary. These gates do not rerun or extend those measurements. Linux/WSL stayed paused. Parent owns source integration, native repair retest, evidence publication, and release decisions.