# Guarded Shutdown And Clean Savepoints Evaluation

> **Evidence record — not current product guidance.** Use the [documentation index](../../../README.md) for current behavior and architecture.

**Date:** 2026-07-13

**Issue:** [Gitea #55](https://git.spacetrainclubhouse.com/Falling-Metal-Interactive/Blacksite/issues/55)

**Branch:** `codex/guarded-shutdown-savepoints`

**Implementation commit:** `4b33f3235761fd0dd3daf219e5bbbaee884eb626`

**Release-candidate commit:** Not nominated

**Implementation validation:** **Pass**

**Native acceptance:** **Pass**

This record covers editor-owned shutdown authorization and per-document authored-content clean
checkpoints. The permanent architecture contract lives in
[ADR 0042](../../../adr/0042-guarded-editor-shutdown-and-document-savepoints.md). The automated
results below apply to the exact implementation commit. Native rows exercise the same shutdown
implementation after the unrelated toolbar fix disclosed below. Neither replaces the clean-checkout,
soak, or independent-signoff requirements for a future release candidate.

## Automated Verification

| Command or suite | Result | Evidence |
|------------------|--------|----------|
| `cargo fmt --all -- --check` | Pass | Formatting check completed without changes. |
| `git diff --check` | Pass | No whitespace errors. |
| `cargo clippy --workspace --all-targets -- -D warnings` | Pass | Workspace and all targets completed with warnings denied. |
| `cargo test --workspace --all-targets --no-fail-fast` | Pass | All workspace targets passed; the editor crate reported 282 passing tests. |
| Guarded shutdown regressions | Pass | Native close, menu/programmatic exit, cancel/discard, broker contention, late-authoring mutation, and secondary-window behavior are covered by 13 focused tests. |
| Save All regressions | Pass | Named and untitled tab sequencing, cancellation, conflict retention, duplicate destination rejection, and active-tab restoration are covered by six focused tests. |
| Project-switch regressions | Pass | Three focused tests cover guarded handoff, cancellation, and browser-spawn failure. |
| Packaged acceptance | Deferred | Explicitly deferred by project-owner direction; no packaged result is claimed. |

## Native Acceptance

The guarded-shutdown implementation under test is the source commit named above. The native debug
editor was rebuilt at `9e23ae731f95dc351ecc744d6ca61f6bc4467317` after the independently scoped
[UI action-safety fix](../scoped-ui-actions/) ([Gitea #57](https://git.spacetrainclubhouse.com/Falling-Metal-Interactive/Blacksite/issues/57))
made the untitled-scene toolbar workflow reachable, then launched as
`target/debug/editor --project .`. Each row records an observed workflow rather than inferring
behavior from the automated suite.

| Workflow | Result | Evidence |
|----------|--------|----------|
| Undo back to the clean checkpoint | Pass | A scene mutation added the dirty marker; undo restored the canonical authored projection and cleared the marker. |
| Native window close, then **Cancel** | Pass | The dirty-document decision appeared; Cancel retained the dirty document and kept the editor running. |
| **File > Quit**, then **Discard** | Pass | The same guarded decision path ran and the editor process exited with code 0 without saving the dirty draft. |
| **File > Switch Project...** guard | Pass | A dirty document was intercepted by the shared shutdown decision before project-browser handoff. |
| Dirty named document, **Save All** | Pass | The named scene write completed before authorization and the editor then exited with code 0. |
| Clean untitled document close | Pass | No dirty-work decision was needed and the editor exited with code 0. |
| Dirty untitled document, **Save All**, then Save As continuation | Pass | **File > New Scene** created an untitled tab; the toolbar Cube action spawned authored content and marked it dirty. Native close followed by **Save All** opened KDE Save As in `assets/levels`; saving as `issue55_shutdown_qa.scn.ron` wrote a 1,986-byte scene and the editor exited with code 0. The QA scene was verified and removed. |

## Evidence Status

![Native guarded-shutdown decision over the Blacksite editor](https://git.spacetrainclubhouse.com/attachments/b9538ef6-25e0-46b0-9997-9a4311584893)

- Native modal capture: `/tmp/blacksite-issue55-shutdown-modal-4b33f32.png` (temporary staging;
  3426x1384 RGB PNG, 1,656,602 bytes).
- SHA-256: `2ddb2571325e0d99f5559efd1ba3164845ffba64767833d4e5ad8d2925aedfb5`.
- Gitea #55 native attachment: asset 36, uploaded through the issue attachment API.

The Gitea copy was uploaded as an ordinary issue attachment. No repository PNG or LFS raw URL is
claimed by this evaluation.

## Release Use

The #55 source and native feature-level acceptance record is complete. A future production candidate
must still rerun these workflows from the exact nominated commit; this record does not nominate a
candidate or establish production readiness.