ARCADIA-Studio/harness/release-source5-checkpoint-compatibility-20260906.md

Source-5 private checkpoint compatibility

Implemented and verified by focused Windows automated tests on 2026-09-06. Native source-5 recovery, Rust 1.90 and Linux verification remain pending. This note does not claim release acceptance.

Defect and selected boundary

After the source-6 upgrade, private checkpoints written by the source-5 desktop were still listed on Home but Recover rejected them: compiling their accepted source changed its header, violating the former exact-bundle guard. Removing that guard alone would also leave workflow fingerprints bound to the old serialized model and could admit identity insertion or broader migrations.

Recovery now accepts either an unchanged current bundle or a proven lossless source 5 to 6 upgrade. It uses the real language token spans and requires the complete migrated bundle to equal the original bundle with only its significant entry version token changed from 5 to 6. All other bytes, IDs and file membership stay identical. Older schemas, malformed/future source and missing identities still fail explicitly; checkpoint and origin files are retained. This private compatibility path does not weaken frozen source-5 admission of model constructs.

The recovered model remains a detached, dirty local copy without fabricated undo history. app/checkpoints.rs installs the migration report and explains the upgrade and review requirement. No model file is written by Recover.

Raw drafts and workflow identity

• Clean editor buffers refresh only when both text and baseline exactly match the old accepted file, the workspace is applied, and its entry matches. Dirty text AND baseline, detached buffers, unrelated clean buffers, unapplied invalid-open workspaces, active file and new-path draft remain unchanged.
• Property and behavior forms retain raw authored DTOs. Old Diagram property values without view_options remain editable through the existing defaulted model field. Invalid numeric input remains invalid rather than being normalized or discarded.
• A private historical serializer reconstructs the source-5 Project/Diagram field order from commit 2b2d2bc: schema version 5 and no Diagram.view_options. It is used only after the exact token-upgrade proof. An independently pinned literal and FNV-1a value verify field order, including a diagram; arbitrary JSON key rewriting is not used.
• Typed relation, trace, transition, port and semantic adapters require the saved legacy fingerprint to match that proven accepted model. Semantic adapters additionally check model identity. They restore raw choices and recompute current previews. Semantic v1/v2 impact approvals clear and must be reviewed again. Stored commands are not part of the checkpoint contract and are never replayed.

Implementation: crates/oa-desktop/src/recovery.rs, new recovery/source5.rs and source5_tests.rs, source_workspace.rs, workflow/recovery.rs, port_workflow.rs, semantic_review/recovery.rs, and app/checkpoints.rs. No Document or model schema changes were needed for this compatibility fix.

Evidence

• .local/source5-recovery-tests2.log: 13 passed, 0 failed for the source5 filter, covering exact header/comment/CRLF/Unicode preservation; clean and dirty baselines; distinct unapplied workspace; unchanged checkpoint/origin bytes; explicit source-4 and missing-ID refusal; transition/port stale-base rejection and rebinding; invalid property text; old Diagram property shape; unrelated clean buffer preservation; pinned historical fingerprint; semantic v1/v2 identity/raw-state preservation and approval reset.
• .local/source6-attachments-semantic-tests.log: 92 passed, 0 failed, including the semantic recovery adapter and integrated review regressions.
• The first desktop test compilation passed. Its initial source-5 fixture incorrectly used unsupported block comments, causing nine parse failures. The fixture now uses supported // comments between header tokens; production already filtered the actual tokenizer's Comment tokens. The accepted-upgrade policy was not relaxed.
• Existing code was frozen after the fixture correction. No Cargo was run by this worker; root coordinated both recorded runs using the prepared Windows gnullvm toolchain.

Remaining native and platform checks

The task-local native fixture is .local/source5-native-recovery-fixture/15000000-0000-4000-8000-000000000010.json, generated by .local/make-source5-recovery-fixture.py. It has two accepted source-5 files with explicit identities, exact comments/CRLF/Unicode, an invalid dirty entry with its original baseline, and an unfinished new-file name. It has not been installed into user recovery storage by this worker. After the new desktop build, verify Recover's migration notice and exact raw editor text; repair and Apply explicitly, then Save As and compare the accepted source oracle. The previously frozen source-6 binary predates this fix and is not evidence for it.

Automated evidence is Windows gnullvm only. No MSRV or Linux build/runtime claim follows from it. WSL remains pending the user-authorized Windows restart; no import was retried. The separate journal publication implementation guarantees no-replace on Windows via MoveFileExW. Unix fs::rename still has the documented competing-empty-directory limitation. A future Linux-specific renameat2(RENAME_NOREPLACE) path should fail closed on unsupported kernel/filesystem responses and be tested with an injected empty destination on the actual Linux filesystem; this remains a proposal, not implemented portability evidence or a general model-file compare-and-swap guarantee.