4.4 KiB
Repair-destination save state: independent source review
Codex-9e8r6t /root/behavior_audit · 2026-09-11
READY for root-owned compilation and native recheck. No remaining material finding in the exact three-file freeze below. This is source review and hash readback only; none of the five tests was compiled or executed by this reviewer.
The native defect and current ownership were checked in Gitea #6, including comment 500. Review traced Document, App open/apply/save/recovery paths, DiskProject discovery and recovery semantics, the save conflict boundary, and the five new tests. Source HEAD at review: eeeaa1262748800c4c9aaa1eca79a7de96757358; the file hashes below identify the uncommitted correction precisely.
The implementation changes only the saved-source marker. An installed invalid Open binds the exact raw reachable bundle of its new destination without accepting that source, generating IDs, changing the model, recording history, advancing revision, or clearing the recovered-unsaved flag. An identical repair remains a no-op engineering transaction but is dirty relative to the newly loaded invalid disk bytes. Valid Open and successful snapshot-correlated Save retain their existing behavior. Failed/cancelled Open never reaches the rebinding call.
The initial proposal had a concrete recovery gap: a pending journal could leave disk equal to the accepted AFTER snapshot; unchanged Apply was clean, then recovery rolled disk back to different BEFORE bytes while retaining the old saved marker. The final code rebinds the recovered raw bundle only when the recovered destination is current or is being adopted. Recovery of a former Save As destination cannot change the current baseline. If successful recovery cannot reload the current destination, saved=None explicitly represents unknown bytes; source inspection confirms equal Apply and Undo/Redo cannot clear that unknown state, while successful Save can. Accepted snapshots, revision, history and the recovered-unsaved flag are untouched by both new methods.
The prepared tests discriminate the important cases:
- Two distinct directories, same entry name: missing include and duplicate alias repairs exactly reproduce the earlier accepted bytes. Tests check unchanged accepted model/source/revision, no extra Undo step, dirty save label, unchanged invalid disk before Save, Close prompt, and explicit successful Save.
- A changed repair checks Undo/Redo against the newly opened baseline, preserved actual invalid disk, an external edit refused by the real saver, and clean/dirty transitions around successful Save.
- Equal valid content opened at a second destination remains clean, avoiding a blanket always-dirty Open workaround.
- A real valid v1 journal changes AFTER to BEFORE during actual core recovery. The App retains its accepted snapshot but becomes dirty, and explicit Save restores the intended bytes.
- A real before:false journal deletes the entry and reloads as Ok(DiskProject) with empty files. A separate branch then injects Err to exercise the successful-recovery/failed-read adapter boundary. Both branches compare current versus former destinations and require current-destination closing protection. The injected failure is not represented as a naturally occurring filesystem fault.
The reviewer's earlier claim that deleting the entry alone produces reload Err was corrected before this freeze: discover_missing preserves it as a missing-file diagnostic in Ok(DiskProject). The final tests correctly retain that distinction. No finding or claim relies on the retracted assertion.
Limits: source review does not establish test execution, GUI repair usability, asynchronous scheduling under real I/O failures, or package/release acceptance. Root must run the affected gates and repeat the native invalid Open → repair → Apply-before-Save check. The earlier eeeaa126/input4 packaging adapter review does not authorize final packaging from this advanced source; its inputs must be rebound after new successful gates.
Frozen SHA256 values:
- crates/oa-desktop/src/document.rs:
7C87280B5B8D112C34865253F8BA0F80D43BC9897771943B15DC7B5608EB17A4 - crates/oa-desktop/src/app.rs:
4A41B062DA233A72F1B04866898EEDDB3F79882918A67F5F09469FE4EADD9929 - crates/oa-desktop/src/app/repair_save_state_tests.rs:
5543DCBA853BB1513ACF824B860249729A6004747E7E320B46EFE60EA19E2D83
Readback completed 2026-09-11T20:27:21.024999+00:00. No production/shared source, index or refs were modified by this review.