# Arcadia Studio Windows authoring preview — validation Version: 0.2.0-preview.authoring.20260911. This is a working milestone prerelease; full OA/SA release work continues. ZIP SHA256: `664F30B6217689ACA1492EB263B3D15777067D732FA890EEB028F435209DADFA`. Source base: `2ec72d4241fa8971fa6fe9f626937de9dfd7c7eb`. Exact input reconstruction: `234e01e27d6935d213097b345d91d369f808af82`, available on `codex/authoring-prerelease-source-20260911`. --- # Authoring milestone prerelease preparation — 2026-09-11 Owner: Codex-9e8r6t /root/palette_finish. The initial read-only inventory and plan are followed below by root-authorized isolated preparation and successful packaging results. A new archive now exists; clean-extraction acceptance and publication remain separate gates. ## Result and boundary A coherent Windows milestone package can pair the immutable D4D9 desktop with the preserved EFEE server using the existing strict packaging script. Both have recorded build/validation evidence. Independent byte comparisons establish the shared source relationship; executable dates and the common `0.2.0` version are not used as evidence of equivalence. The package must be generated from an isolated committed snapshot corresponding to those binaries. Running the script against the evolving working tree would describe different local source. No checkout, Cargo metadata, package invocation, application launch, or native input was performed for this inventory. The separately authorized oracle compiler slot and its results are recorded in `release-staged-source-authoring-oracle-20260911.md`. The current script cannot package `arcadia.exe` as a CLI root. It accepts desktop/server roots only. Adding the CLI to an older package without a corresponding notice/source inventory is not proposed. ## Exact frozen inputs Paths below are relative to the repository root. SHA256 values were reread from the actual files. | Artifact | Bytes | SHA256 | | --- | ---: | --- | | `.local/behavior-creation-20260911/gui-verified/arcadia-studio.exe` | 111163904 | `d4d9c2bd937e301ff1009d7cb93a34ee5aa6dfc837ff7e87d468c85371b20c31` | | `.local/native-qa/bin-source7-post-routing/arcadia-server.exe` | 39743488 | `efeeb89c0d2e0f93df4472cb3e9f48b2b722a37ae1043c90a5a56f2e845fe665` | | `.local/behavior-creation-20260911/gui-verified/libunwind.dll` | 190976 | `f45604a12e8bcd839fd86f667c1be1cc7c4f9da2b3c69ff381ac708f0e1ae7d4` | | `.local/source-cli-20260911/verified/arcadia.exe` — separate candidate | 20312064 | `bad169f8be78dcfa74b32714569c886dd2132727080684fc2ba618d5822e3559` | The preserved server and mutable `.local/target-gnullvm/debug/arcadia-server.exe` currently have identical hashes. The preserved path is the proposed package input. The GUI's sibling `manifest.json` records its successful build from 08:49:00.3082487Z to 08:49:20.3746807Z on September 11, and 253 input hashes. It explains the behavior-equivalent history-fields let-chain correction after the full 653-test snapshot, followed by strict Clippy, formatting and the focused 63 history tests. The later contextual-source implementation is absent from this frozen GUI. The server's hash is recorded in `.local/native-qa/source7-post-routing-binary-hashes.json` and the September 7 native acceptance report. `.local/source7-post-routing-gates-status.json` records the focused server gates, full server gate, formatting, workspace strict Clippy and successful workspace binary build (08:27:18.0824157Z start; 102.218 seconds). The contemporaneous report records server 56/56 and desktop 564/564. These historical gates are attributed to their original run, not rerun by this inventory. ## Source relationship, including exact line endings Git commit `2ec72d4241fa8971fa6fe9f626937de9dfd7c7eb` and earlier `4bb4aaf` each match 246 of the GUI manifest's 253 raw input hashes. The seven differences are exactly LF versus CRLF. Converting each committed LF file to CRLF reproduces the expected GUI hash; current working bytes also match that expected hash: ```text crates/oa-desktop/src/semantic_review/artifacts_view.rs crates/oa-desktop/src/semantic_review/attachments_view.rs crates/oa-desktop/src/semantic_review/keyed_rows.rs crates/oa-desktop/src/semantic_review/keyed_tests.rs crates/oa-desktop/src/semantic_review/keyed.rs crates/oa-desktop/src/semantic_review/ordered.rs docs/openapi.json ``` This is not a claim that all 253 Git blobs already match. An isolated exact-byte snapshot needs these seven byte restorations and scoped `-text` attributes so a subsequent Git checkout preserves them. The GUI manifest's original head `d114a271c5ecffcd7960fb8aa44d45989c10dc33` is historical context; its input manifest is the more precise comparison boundary. No live-tree line endings were changed. The preserved server source snapshot is `.local/linux-qa/runtime/source7-20260907T082753190288Z.tar.gz`, SHA256 `cbb371a93a562e1e641d7629fe351e016d63e66fc9112499b3fed6d5cd171f78`. All 120 recorded core/server files were reread from that tar and match their recorded hashes and commit `2ec72d4` exactly. Its root Cargo manifest, lock, three shared build files and raw OpenAPI file match the GUI manifest as well. In particular: | Shared input | SHA256 | | --- | --- | | `Cargo.toml` | `9bd014df6e8124c769d551a660f7a511341ff196f80c70008dbb9250efd22081` | | `Cargo.lock` | `a6e070ed59b0ba19f18d60e8104494b777b470bd0268ae348cbe2b229790449f` | | `docs/openapi.json` raw CRLF bytes | `c6ae512f791a939eaf6ec5e5e78e9468bdee0e028092d00098bd90ad9498d967` | The snapshot was also used for a Linux gate; that fact alone does not attest the Windows executable. The conclusion uses the preserved Windows hash/build records, explicit source comparison, shared dependency inputs and compiler evidence together. It is not a reproducible-build claim. ## Compiler, runtime and notice evidence Direct `rustc -vV` from the configured toolchain reports Rust 1.98.1, commit `48a229ceaefd4985c50990b14116b6d856af0985`, host `x86_64-pc-windows-gnullvm`, LLVM 22.1.8. All three executables contain this exact `/rustc//` path. All 58 current target-library hashes match the prior strict Windows notice inventory. Embedded compiler paths corroborate provenance; they do not establish every linker input. The packager's required runtime is `.local/toolchain/llvm-mingw-20260826-ucrt-x86_64/x86_64-w64-mingw32/bin/libunwind.dll`, which matches the frozen sibling DLL above. The LLVM-MinGW root `LICENSE.TXT` is 15141 bytes, SHA256 `8d85c1057d742e597985c7d4e6320b015a9139385cff4cbae06ffc0ebe89afee`. The existing notice-complete packaging verification archive is `.local/packaging-20260910/windows-b/ArcadiaStudio-packaging-check-20260910-b-x86_64-pc-windows-gnullvm.zip`, 32309306 bytes, 557 files, SHA256 `bc27e398d7268a4ee6e6c52ccc89f32bb0a4a970020ca198963501c49146e8c8`. It validates the packaging mechanism and its earlier inputs. It does not contain the proposed D4D9 combination and cannot be relabeled as that milestone. Prior Linux notice inventories and the inert ELF packaging fixture likewise do not establish a runnable Linux prerelease. ## Concrete preparation and packaging plan Root selects the final version and coordinates checkout creation and the metadata lease. An illustrative version is `0.2.0-authoring.20260911.1`; it is not reserved by this report. 1. Create an isolated checkout under `.local/authoring-prerelease-20260911/source` from `2ec72d4`. Restore only the seven identified CRLF inputs, add exact-path `-text` attributes there, and commit the isolated byte-preserving snapshot. Recheck all 253 GUI inputs, all 120 server files, shared manifests/build inputs and a Git checkout round trip before packaging. Record the resulting commit, original base and seven restorations honestly. Do not describe the derived snapshot as the historical build commit. 2. Copy the frozen desktop and preserved server into a fresh private `bin` directory; reread both exact hashes. Keep the original GUI build manifest, server hash/gate records and source comparison inventory as provenance attachments. Do not use mutable target output as the source of the copy. 3. Prepare the packager's build-evidence JSON with `source_identity`, `profile`, `compiler`, `target` and `binary_sha256` entries for both executables. These strings must distinguish the reconstructed exact input snapshot from original build records. `Read-PackageBuildEvidence` checks target and binary hashes; descriptive source/compiler/profile fields remain caller assertions, so this report's underlying evidence remains necessary. 4. After release of the writer lease, invoke the script from the isolated checkout with the configured toolchain environment and absolute paths. This performs locked offline Cargo metadata, not compilation. Keep the strict font/supplement and license checks intact. It must produce a fresh notice inventory from that snapshot, not reuse a prior inventory against different local files. 5. Record the final ZIP checksum, exact file inventory and script logs. The script verifies archive membership and hashes, uses deterministic archive timestamps, checks ordinary PE imports and runtime closure, and refuses existing output/claim paths. Its successful result is still `NativeAcceptancePending`. 6. Root performs clean extraction with a clean runtime PATH, desktop/server launch and the chosen bounded example/first-run checks, then publishes the versioned runnable artifact with truthful milestone limitations. Dynamically loaded and delayed imports remain runtime checks. The prior native authoring report does not replace clean-package launch acceptance. Illustrative invocation after those prerequisites, with variables deliberately supplied by the coordinating executor: ```powershell & (Join-Path $milestoneSource 'scripts/package-windows.ps1') ` -Target x86_64-pc-windows-gnullvm ` -Version $milestoneVersion ` -BinaryDirectory $milestoneBin ` -LlvmMinGWRoot $verifiedLlvmMinGWRoot ` -BuildEvidence $milestoneBuildEvidence ` -Python 'C:\Users\User\.cache\codex-runtimes\codex-primary-runtime\dependencies\python\python.exe' ` -OutputRoot $milestoneOutputRoot ``` With the illustrative version and private output root, the expected new artifact path is `.local/authoring-prerelease-20260911/packages/ArcadiaStudio-0.2.0-authoring.20260911.1-x86_64-pc-windows-gnullvm.zip`. This path is a plan, not an existing notice-complete deliverable. The current `Get-ArcadiaNotices` root allowlist accepts `oa-desktop` and/or `oa-server`, and `package-windows.ps1` requires both named executables. A separate CLI package needs explicitly coordinated support for its root, exact CLI source/workspace snapshot, documentation and runtime/notice closure. Its new local workspace/lock entry is absent from the older GUI snapshot. CLI author tests and independent 183-assertion review establish its scoped functionality, not an archive's redistribution completeness. ## Coordination and durable evidence Gitea issue 1 comment 172 coordinates publication ownership. Later user comment 178 explicitly authorizes programmatic reuse of existing MCP credentials for authenticated Git and direct Gitea REST asset upload, without printing or committing secrets. Thus the previously reported missing MCP upload method is not itself a publication blocker. Publication remains with root/the coordinated host; this worker neither read credentials nor attempted publication. Private reproducible inventory: `.local/authoring-prerelease-20260911/inventory.py`, `inventory-output.log` and `inventory.json`. The JSON SHA256 is `3c78dea4e93dae186fd24ab826c6680178a2c7849c270a22deae2ff732f1857b`; it retains individual comparisons and all measured artifact hashes. An initial inventory script key typo (`target_libraries` instead of the existing `target_libraries_sha256`) was corrected before the successful inventory. It was not an application, compiler or packaging failure. Next action belongs to root: choose this frozen milestone or wait for the newer contextual-source GUI, authorize the corresponding isolated source preparation and metadata window, and reserve the version. A newer GUI requires its own exact source/build comparison and native acceptance; none of this report silently transfers D4D9's evidence to it. ## Authorized preparation follow-up Root selected `0.2.0-preview.authoring.20260911`, the frozen GUI/server milestone based on `2ec72d4`, and authorized private source/binary/evidence preparation and the unchanged package invocation. CLI source was separately committed and published at `01b76a1e89e93b7992f39e63560aa8b2ca2f69e0`. The newer AGENTS milestone-publication instruction exists on that current branch. Its changed Cargo workspace and lock are intentionally absent from the exact older GUI/server input snapshot. The initially authorized checkout at `01b76a1` was cleanly retargeted to detached `2ec72d4` after root confirmed this source boundary. Private auxiliary commit `234e01e27d6935d213097b345d91d369f808af82` preserves the seven exact CRLF restorations and their scoped `-text` attributes. Ignoring end-of-line differences, its only diff is nine `.gitattributes` lines. It is a derived input-preservation commit, not the original GUI/server build commit or the chosen public base tag. The main working tree and shared packaging scripts were not changed. `.local/authoring-prerelease-20260911/prepare.py` verified all 253 GUI inputs, all 120 server files and the three copied executable/runtime hashes. `preparation.json` records the comparisons. `verify-committed.py` additionally reads the Git blobs and a fresh `git checkout-index` output. `package.ps1` supplies exact frozen binary hashes and the explicit provenance assertion in `build-evidence.json`, invoking the isolated unchanged script with the selected version. The metadata slot was explicitly granted by release_audit and returned after the single Cargo metadata call; remaining notice scanning and archive work are read-only with respect to Cargo. Terminal packaging and round-trip results follow below when measured. ## Bounded separate CLI packaging design proposal This proposal changes no scripts. Extend the notice collector's root allowlist to include `oa-cli`, keeping its existing exact local-source, lock, normal/build graph, Rust/runtime and supplement checks unchanged. Add a CLI-specific prebuilt entry point requiring exactly `arcadia.exe` and its checked runtime closure, invoking the collector with only `oa-cli` as its declared root. Share the existing ordinary PE import inspection rather than copying a divergent checker, and retain the common build-evidence, reserved-output, checksum and archive-readback helpers. Its documentation closure should start with a CLI-specific package README and `docs/source-cli.md`, with examples linked by those documents. It should not promise a desktop executable. Use the exact `01b76a1` CLI workspace/lock/source inputs and preserved BAD169F8 build evidence, independently verify their hashes, and version it distinctly (for example an `ArcadiaCLI-…` archive). CLI native smoke is `--version`, `--help`, valid explicit-root check, preview byte equality and explicit write in a disposable example. Reject missing runtime, wrong binary hash, missing notice, unknown root, existing output and changed-source evidence just as the existing workflow does. Tests must also confirm that adding the allowlisted CLI root does not change the desktop/server default roots. This is a small packaging extension, not a saved-plan CLI feature or a waiver of distribution notices. ## Terminal package result and frozen handoff The first package invocation passed, starting `2026-09-11T12:17:30.7730570Z`, finishing `12:21:23.0302800Z`, duration **232.2812442 seconds**. No packaging failure or retry occurred. The checked-in packaging scripts were used without modification. The separate committed-blob/fresh-checkout test passed all 253 input comparisons and confirmed the isolated source worktree remained clean. Frozen ZIP: `.local/authoring-prerelease-20260911/packages/ArcadiaStudio-0.2.0-preview.authoring.20260911-x86_64-pc-windows-gnullvm.zip`. - Bytes: **32618262**; package files: **559**. - SHA256: **`664f30b6217689aca1492eb263b3d15777067d732fa890eeb028f435209dadfa`**. - Notice inventory: **266 packages**, declared roots `oa-desktop` and `oa-server`; original lock hash `a6e070ed59b0ba19f18d60e8104494b777b470bd0268ae348cbe2b229790449f` retained. - Executables/runtime: exact D4D9 desktop, EFEE server and F456 libunwind identities from the table above. - Package script full archive membership/hash readback: **PASS**. Returned native status: **Pending**. Private logs are `package-initial.log` and `package-initial-result.json`; `committed-roundtrip.json` retains the 253 committed and rechecked input hashes. The sibling package directory, ZIP and checksum are frozen. Root and the independent reviewer received the exact path, size and hash. The reviewer owns clean extraction and private packaged-server checks; root owns clean-package GUI acceptance and publication. This result does not claim those checks, a runnable Linux artifact, release-profile optimization, or native acceptance of the newer contextual-source GUI. --- # Packaged authoring GUI acceptance — 2026-09-11 Codex-9e8r6t `/root`, Windows. Bounded clean-package verification for `0.2.0-preview.authoring.20260911`; the full OA/SA release remains unfinished. ## Artifact and environment ZIP SHA256 `664F30B6217689ACA1492EB263B3D15777067D732FA890EEB028F435209DADFA`, 32,618,262 bytes, 559 files. A fresh extraction independently verified every 558 manifest entry and the exact physical inventory including SHA256SUMS.txt. Desktop D4D9C2BD…B20C31 and libunwind F45604A1…0E1AE7D4 match the package and earlier native authoring artifacts. The source/provenance/notice boundary is in `release-authoring-prerelease-preparation-20260911.md`. The first launch harness stopped before spawning any process: Python's copied Windows environment had uppercase SYSTEMROOT, while the harness read SystemRoot. That extracted directory is preserved. The corrected second attempt uses a new directory and reads the existing uppercase key. No application or package file was changed to correct this harness error. Trial `.local/authoring-prerelease-gui-20260911-v2/` records the exact launch. PATH contains only the extracted package, C:\Windows\System32 and C:\Windows. LOCALAPPDATA and APPDATA point to fresh private profile directories. The desktop was launched from the extracted package directory as PID10800, native window984068. Loaded module inspection found only the packaged executable/libunwind outside C:\Windows; no compiler, Cargo target or development runtime path was loaded. This is a clean application runtime/profile on the current Windows machine, not a claim of a fresh operating-system installation. ## Native observations - Fresh Home showed Untitled mission, no recent models, and usable example/help actions. The initial occluded screenshot was not used for acceptance; explicit activation exposed the packaged window before input. - Open water-pressure walkthrough loaded the packaged multi-file example: 94 objects, 62 links and one model check. OA architecture showed allocated activities nested inside Control room and Field technician, with exchanges. - Ordinary Ctrl+S completed. All 558 checksum entries still match and the exact 559-file package inventory remains unchanged, including every example source. - Switching to System Analysis rendered the service boundary, allocated functions, SystemActor and ports. Behavior & scenarios rendered the pressure-supervision state machine and its editing toolbar. - Engineering guide opened its bundled content and scenario-authoring topic. - Alt+F4 closed the clean-package instance; a fresh window/process inventory confirmed it had exited, while the separate native scenario trial remained open. Screenshots, launch metadata, module inventory, post-Save exact comparison and stdout/stderr are retained in the trial directory. No runtime error was present in stderr during these checks. The current host's wider/minimum named creation, source parity, Undo/Redo and recovery checks are separately tied to the same D4D9 executable; they were not all repeated as package smoke tests. ## Limits This milestone uses development-profile Windows x64 binaries. It includes the desktop, server, examples, offline documentation and dependency notices. It does not include the newer contextual-source or reference-chooser work, B4 lifetime changes, the separately committed CLI executable, completed executable analysis/ quantity/library semantics, or a verified Linux binary. Some long labels and state-transition text remain crowded, and scenario forms can retain a prior scroll offset. Those limitations remain visible in the release notes. Independent package/server/restart verification is recorded separately. This bounded acceptance supports publishing a working prerelease, not full release completion or optimized-build acceptance. --- # Independent authoring prerelease review — 2026-09-11 Codex-9e8r6t /root/behavior_audit. **PASS within the agreed archive/provenance/notices and packaged-server scope; no material finding.** Root owns packaged GUI acceptance and publication. This review does not establish completion of the full OA/SA release goal. ## Frozen artifact Reviewed the completed ZIP independently from a new extraction under `.local/authoring-prerelease-review-20260911/extracted/`. The producer's staging directory and ZIP were not modified. - Version: `0.2.0-preview.authoring.20260911`, target `x86_64-pc-windows-gnullvm`. - ZIP: `.local/authoring-prerelease-20260911/packages/ArcadiaStudio-0.2.0-preview.authoring.20260911-x86_64-pc-windows-gnullvm.zip`. - Size: **32,618,262 bytes**; **559 files**. - ZIP SHA256: `664f30b6217689aca1492eb263b3d15777067d732fa890eeb028f435209dadfa`. - GUI SHA256: `d4d9c2bd937e301ff1009d7cb93a34ee5aa6dfc837ff7e87d468c85371b20c31`. - Server SHA256: `efeeb89c0d2e0f93df4472cb3e9f48b2b722a37ae1043c90a5a56f2e845fe665`. - `libunwind.dll` SHA256: `f45604a12e8bcd839fd86f667c1be1cc7c4f9da2b3c69ff381ac708f0e1ae7d4`. The first independent artifact gate passed at **12:33:36–12:34:20 UTC**, with 3,643 assertions, including per-file checks. ZIP CRCs, safe ordinary members, case uniqueness, fixed timestamps, complete extracted membership and bytes all passed. `SHA256SUMS.txt` covers exactly the other 558 files. The 553 `package.json` input hashes match; the remaining six files are the explicit generated checksum, start instructions, third-party notice index, dependency inventory, documentation check and package metadata. The only directory payloads are `deployment`, `docs`, `examples` and `licenses`; the root files are the declared executables/runtime, public license/readme and generated package records. Every shipped source document/example/deployment file and public license matched the isolated source. No harness, profile, store, credentials directory or source checkout was bundled. Local build paths appear in Cargo package identifiers and development-binary provenance; that is distinct from copying private files. This review does not claim a universal secret scan of binary strings. ## Source and notice correspondence Independently read the original GUI manifest, Git blobs, retained server tar and packaged notice inventory, rather than adopting the producer's comparison booleans. - All **253 original GUI input hashes** match auxiliary commit `234e01e27d6935d213097b345d91d369f808af82` and its isolated checkout. Base `2ec72d4241fa8971fa6fe9f626937de9dfd7c7eb` differs at exactly the seven documented LF/CRLF inputs. Each LF-to-CRLF conversion reproduces its original input hash; beyond those bytes the auxiliary diff is only `.gitattributes`. - All **120 originally recorded core/server files** match the preserved source tar, base Git blobs and isolated source bytes. Shared Cargo manifest/lock, three build files and raw OpenAPI bytes match the original GUI inputs and tar manifest. The tar SHA256 is `cbb371a93a562e1e641d7629fe351e016d63e66fc9112499b3fed6d5cd171f78`. - The inventory names **266 dependency packages**, with roots exactly `oa-desktop` and `oa-server`. Every reported package identity/registry checksum occurs in the historical lock. Every local crate's complete file set/hashes and every recorded common build input match the isolated source. Lock SHA256 remains `a6e070ed59b0ba19f18d60e8104494b777b470bd0268ae348cbe2b229790449f`. - All **484 distinct notice-reference files** match their inventory hashes, including Fira Sans, Iced Icons, Rust and libunwind notices. The one additional license is the LLVM-MinGW distribution license, SHA256 `8d85c1057d742e597985c7d4e6320b015a9139385cff4cbae06ffc0ebe89afee`, matching the recorded original. All **58 recorded compiler target-library hashes** match the retained toolchain files. The package correctly describes its source snapshot as reconstructed input preservation, its executables as debug/development builds, and the original build records separately. Its metadata binds the exact executable hashes without claiming that packaging proves the caller's compiler/source/profile assertions. This reviewer did not rebuild the dependency graph or binaries; the producer's strict locked/offline metadata execution remains separately attributed. No reproducible-build, release-profile, universal-license-audit or Linux runtime claim is made. CLI is absent from this desktop/server package and is not advertised as included. ## Packaged server execution The first runtime gate passed at **12:34:35–12:34:48 UTC**, with 1,800 assertions including complete pre/post package inventories. The executable ran only from the independent extraction. Its child environment contained `SystemRoot`, `WINDIR`, `PATH=C:\Windows\System32;C:\Windows`, and private `TEMP`/`TMP`; no toolchain path, token or proxy environment was inherited. All HTTP requests used a proxy-free loopback client. Data lived outside the package in `.local/authoring-prerelease-review-20260911/server-run/data`. 1. `--version` and `--help` exited successfully with empty stderr; the underlying application version is correctly `arcadia-server 0.2.0`. 2. `/health` and `/health/ready` returned the exact expected success object. `/api/v1/openapi.json` matched the complete packaged OpenAPI bytes, including their recorded line endings. 3. Exactly one POST created `Independent package persistence — 救助 20260911`. Complete response summary, distinct fresh resource/model UUIDs, Location and ETag matched the contract. Before execution, the checker predicted all empty-project fields and the full one-file `SourceBundle` from the published constructors/formatter. The subsequent GET and persisted disk envelope matched that complete expectation, allowing only the two freshly generated UUIDs. 4. After the acknowledged durable create, the checker explicitly terminated its owned server process, started a second process on another private port using the same data directory, and repeated readiness/GET. Complete model/source, revision, ETag and every persisted envelope byte were unchanged. This is process-stop/restart persistence, not graceful-drain acceptance. Both owned processes were terminated and awaited. 5. All **559 extracted package files** and the original ZIP were unchanged afterward. The private listeners were `127.0.0.1:56455` (PID 8248) and `127.0.0.1:56463` (PID 1692). Resource `0517cc0a-c519-4e46-a1d5-2f385361552e` retained revision 1 and ETag `"p-0517cc0a-c519-4e46-a1d5-2f385361552e-r1"`. Durable envelope SHA256: `cf68e095e70717c7b86ec9e54c39f3a4b0effd331d748e1f4311592c7b8feb11`. ## Preserved evidence and limits Private evidence remains under `.local/authoring-prerelease-review-20260911/`: | Evidence | SHA256 | | --- | --- | | `review.py` | `af9eb20946dfcec78bf8959f1d5dc175e82ebb9fabba9f94cefe590fea516b92` | | `artifact-result.json` | `8b20e9d294338754ddc9b3320b59f55fc19ab979b8da18819fb47a8036db0bba` | | `server-result.json` | `086bf21e79f3bc7deddfd3278c8ade9b470b11031f7fb278ca0ead3a75b6cfb1` | `server-run/` retains every HTTP response/body/header record, process stdout/stderr, original expected envelope and the private store. No artifact or runtime gate failed or required a retry. Earlier read-only schema inspection included a harmless list/dictionary inspection error; no executable had been launched and no artifact/evidence was overwritten. No production/script changes, Cargo/rustc, GUI/native input, publication or credential access occurred in this review. Root's separate packaged GUI report and original named-creation native evidence must accompany any combined milestone acceptance. Current contextual-source, lifecycle, chooser and numerical work, full product parity and Linux verification retain their separate outstanding acceptance boundaries.