6.4 KiB
Saved-destination repair union — 2026-09-12
Source 33e30c1 on codex/canvas-union-ytr83r-20260911 combines the a57 canvas and cb91525 grapheme corrections with a narrow saved-destination repair from peer 33c6d83e9ba9a5b1310b1b627d7c40affcbcf15c. Independent review found no actionable correctness finding. Windows focused repair 5, full desktop all-targets 761, strict desktop all-targets Clippy and GUI build passed; the five are included in 761. Matching bounded native repair/history/recovery, Unicode selection/passive-save and packaged GUI/server acceptance now passed. Release publication is a separate subsequent step. Artifact hashes and completed validation links exact evidence. STATE scopes earlier evidence and platform limits; issue 6 and native/release issue 5 retain live coordination.
Opening an invalid second destination retained the previously accepted Document and its old saved baseline. Repairing that destination to the old accepted bytes could make Apply an identical-content no-op and falsely appear clean, bypassing the intended unsaved Close/New/Open protection even though the destination still contained invalid bytes. The correction binds saved authority to the actual destination's reachable disk bytes. An unknown baseline after successful recovery with failed reload remains dirty. Recovery of a former Save As target cannot replace the current destination's baseline. Current model, revision and Undo/Redo history remain intact; successful Save establishes the new exact baseline.
The integration changes only app.rs, document.rs and the new app/repair_save_state_tests.rs. It imports the saved-baseline behavior and five regression tests, without peer navigation changes. The passing tests distinguish identical-content repair, exact disk state and Close/Cancel; Undo/Redo and external-write conflict; equal content at separate destinations; real journal rollback; and current/former destination authority after missing-entry rollback or an explicitly injected reload failure. They do not establish native chooser/close-dialog behavior.
The frozen manifest .local/repair-union-windows-20260911/inputs.json has SHA256 0F21B9A852CF44699BF29FCE0A35EC460744C85F5E26F0EA4920E8568211E312, covering 530 files / 9,727,025 bytes. Root verified all frozen bytes against source 33e30c1 HEAD. The manifest's earlier 0d39d58 baseline identifies capture provenance, not the final source commit. The verbatim independent review likewise records the precommit dirty candidate; its three source hashes are the reviewed integration identity. Its byte-exact copy has SHA256 96F56D781FEF4B0A1A5053D2FF889668DB32A8A3B9F01AAB967CE3C93676ACA6.
The closed Windows archive contains complete logs, exit-zero status receipts, environment and exact-input verification before each gate and after the final build. All 530 frozen files remained unchanged; after the same-byte source commit, each boundary also verified HEAD. The unoptimized GUI is 113,049,088 bytes, SHA256 504862533CAAD919912E40C89BED4B1E43BA98138C42085480602A0A21FFF658, preserved read-only with its required libunwind.dll and source/copy hash agreement. Exact commands, timings and local artifact provenance are in the gate report and binary manifest. The archive contains no executable, DLL or source ZIP.
Matching native repair → Apply identical bytes → Close/Cancel → Save passed, including exact original/new destination comparisons and separately saved graphical Undo/Redo. A prepared real journal rollback retained the current model as unsaved and saved correctly on retry. Accent/ZWJ and wide Latin/CJK selection/passive-save checks, packaged example/help smoke and normal GUI exit0 passed; all559 package files remained unchanged. Long wide labels can remain clipped. Fresh extracted server25-request editing/persistence checks also passed. Native evidence, producer/extraction, server evidence. These completed bounded checks do not establish full-product acceptance or publication. Earlier cb91525 four focused tests, desktop 756 and Clippy are closed evidence; its planned GUI build was superseded. The four tests are included in 756, not additional coverage.
Earlier a57/69DB staged native checks passed 13 oracles across 45 screenshots at the default wide window: Cancel, three source/consumer creation workflows, saved Undo/Redo and actual reopen. Exact archive, independent review. A separate fresh a57 session then covered OA 100%/125%/Fit, resizing to a reported 1100×700 client (1102×732 captured frame), minimum Fit66, OA leftward and SA upward pan with moved Create/Delete selection identities, and bounded card/capsule/viewport clipping without toolbar bleed. Passive Save preserved all identities, fields, reachable source and physical bytes: exactly two files / 20,214 bytes. The bound process exited normally with code 0 and empty stdout/stderr. Camera evidence, verbatim independent review.
At 66% the labels are visibly small; the camera record does not establish general readability, accessibility, complete focus/keyboard behavior, every zoom or every clipping edge. Exact inputs and client geometry are root's account; the 18 images independently support final states. The earlier picker failure and close remain separate historical evidence. These pre-grapheme a57/69DB results do not establish 33e30c1/50486253 native or package acceptance. Linux remains paused by explicit user instruction, and the full user goal remains incomplete.