ARCADIA-Studio/harness/release-saved-destination-independent-review-20260912.md

Independent saved-destination repair review

Reviewer: fresh /root/repair_review agent, 2026-09-12. Result: no actionable correctness finding in the reviewed three-file integration. This is a source review, not an execution or release acceptance claim.

Reviewed version and boundaries

Worktree: C:/Users/User/Documents/Git/ARCADIA-Studio/.local/canvas-union-ytr83r-20260911, branch codex/canvas-union-ytr83r-20260911, HEAD 0d39d58ebdacc9c5f6c147dfcc93259a8c5f742f plus the three dirty source files below. SHA256 values are exact filesystem bytes, independently read during review:

File under worktree	SHA256
crates/oa-desktop/src/app.rs	0415B8CF4BE7C6AD13B8F2E130FB37652002EEBDFC285AC5706C61BC00568579
crates/oa-desktop/src/document.rs	7C87280B5B8D112C34865253F8BA0F80D43BC9897771943B15DC7B5608EB17A4
crates/oa-desktop/src/app/repair_save_state_tests.rs	5543DCBA853BB1513ACF824B860249729A6004747E7E320B46EFE60EA19E2D83

Read root and worktree AGENTS instructions, PROJECT_GOAL requirements, the integration plan, relevant STATE checkpoint, actual diff, all five new tests, and surrounding Apply/history/save/recovery/dirty-state implementation. Read the locally available Gitea default-branch instruction object (refs/remotes/gitea/HEAD resolves to gitea/main); no network freshness claim. User-provided instructions take precedence over the worktree's older reasoning guidance. Parent owns Gitea coordination and execution.

Compared the app hunks with peer 33c6d83e9ba9a5b1310b1b627d7c40affcbcf15c. Document has no diff against that peer; the new test file's Git blob hash a60eb4353ab0f533a3db578b97a6d7909920793b matches the peer exactly. The test file is untracked in this worktree; an ordinary Git diff against the peer represents it as absent from the index, so that comparison alone is not a filesystem-content comparison. No peer navigation changes were imported. git diff --check returned success.

Correctness assessment

• app.rs:3867 binds the new repair destination's reachable source before Apply, independent of the retained accepted model. Document::commit still treats identical accepted bundles as a no-op; its lack of a new history entry no longer implies that the new destination contains those bytes.
• document.rs:157 compares accepted content to the optional saved bundle. bind_repair_baseline and invalidate_saved_baseline change only that saved authority, preserving revision, current snapshot, Undo/Redo, cached model index, and recovered-unsaved status. mark_saved restores a known exact saved snapshot. Undo/Redo therefore compare to the destination's actual baseline and can become clean again at the successfully saved revision.
• app.rs:3040 rebinds after successful recovery only for the current target or an adopted first-save destination. app.rs:3048 invalidates the saved authority under the same destination guard after successful recovery with failed reload. Recovery of a former Save As target cannot overwrite the new destination's saved baseline. A mismatching pending-recovery target is rejected before these changes.
• Successful reload of an unapplied repair workspace follows the existing open_source_project path, which either installs a new valid Document or runs the new repair-baseline binding. Applied recovery retains the model and editor drafts while updating disk state. Reachable-bundle loading retains original source bytes, with missing/unreadable source represented by absent bundle members and diagnostics; it does not silently replace saved bytes with compiler-normalized content.
• The existing dirty aggregation and Message::Request guard consume the repaired Document state, so Close/New/Open protections remain active after an identical-content repair or an unknown recovered baseline. Save receipt document identity, entry adoption, disk expectations, and conflict handling are unchanged.

Regression-test assessment and limitations

The five tests have meaningful distinct oracles: invalid destination repair to previous saved bytes with exact disk comparison and Close/Cancel; Undo/Redo with external-write conflict and successful Save; equal valid content at distinct destinations; real journal rollback that changes disk while preserving the accepted snapshot; and current/former destination authority across missing-entry rollback and failed reload. Tests explicitly distinguish actual missing-entry reload (an empty repair workspace) from an injected post-recovery read error.

No Cargo, build, runtime, native UI, WSL/Linux, network, Gitea, Git index/history, or source mutation was performed. Tests were reviewed but not run. The test helpers deliver adapter receipts directly and do not establish chooser behavior, asynchronous scheduling, native close-dialog usability, or packaged-build correctness. The parent still owns focused and combined desktop execution, strict Clippy/build, and matching native repair -> Apply identical bytes -> Close/Cancel -> Save verification. Existing unrelated native evidence directories were preserved and not treated as acceptance evidence for this candidate.