Blacksite/docs/editor/evaluations/guarded-shutdown-savepoints/README.md

Guarded Shutdown And Clean Savepoints Evaluation

Date: 2026-07-13

Issue: Gitea #55

Branch: codex/guarded-shutdown-savepoints

Implementation commit: 4b33f3235761fd0dd3daf219e5bbbaee884eb626

Release-candidate commit: Not nominated

Implementation validation: Pass

Native acceptance: Pass

This record covers editor-owned shutdown authorization and per-document authored-content clean checkpoints. The permanent architecture contract lives in ADR 0042. The automated results below apply to the exact implementation commit. Native rows exercise the same shutdown implementation after the unrelated toolbar fix disclosed below. Neither replaces the clean-checkout, soak, or independent-signoff requirements for a future release candidate.

Automated Verification

Command or suite	Result	Evidence
cargo fmt --all -- --check	Pass	Formatting check completed without changes.
git diff --check	Pass	No whitespace errors.
cargo clippy --workspace --all-targets -- -D warnings	Pass	Workspace and all targets completed with warnings denied.
cargo test --workspace --all-targets --no-fail-fast	Pass	All workspace targets passed; the editor crate reported 282 passing tests.
Guarded shutdown regressions	Pass	Native close, menu/programmatic exit, cancel/discard, broker contention, late-authoring mutation, and secondary-window behavior are covered by 13 focused tests.
Save All regressions	Pass	Named and untitled tab sequencing, cancellation, conflict retention, duplicate destination rejection, and active-tab restoration are covered by six focused tests.
Project-switch regressions	Pass	Three focused tests cover guarded handoff, cancellation, and browser-spawn failure.
Packaged acceptance	Deferred	Explicitly deferred by project-owner direction; no packaged result is claimed.

Native Acceptance

The guarded-shutdown implementation under test is the source commit named above. The native debug editor was rebuilt at 9e23ae731f95dc351ecc744d6ca61f6bc4467317 after the independently scoped UI action-safety fix (Gitea #57) made the untitled-scene toolbar workflow reachable, then launched as target/debug/editor --project .. Each row records an observed workflow rather than inferring behavior from the automated suite.

Workflow	Result	Evidence
Undo back to the clean checkpoint	Pass	A scene mutation added the dirty marker; undo restored the canonical authored projection and cleared the marker.
Native window close, then Cancel	Pass	The dirty-document decision appeared; Cancel retained the dirty document and kept the editor running.
File > Quit, then Discard	Pass	The same guarded decision path ran and the editor process exited with code 0 without saving the dirty draft.
File > Switch Project... guard	Pass	A dirty document was intercepted by the shared shutdown decision before project-browser handoff.
Dirty named document, Save All	Pass	The named scene write completed before authorization and the editor then exited with code 0.
Clean untitled document close	Pass	No dirty-work decision was needed and the editor exited with code 0.
Dirty untitled document, Save All, then Save As continuation	Pass	File > New Scene created an untitled tab; the toolbar Cube action spawned authored content and marked it dirty. Native close followed by Save All opened KDE Save As in assets/levels; saving as issue55_shutdown_qa.scn.ron wrote a 1,986-byte scene and the editor exited with code 0. The QA scene was verified and removed.

Evidence Status

• Native modal capture: /tmp/blacksite-issue55-shutdown-modal-4b33f32.png (temporary staging; 3426x1384 RGB PNG, 1,656,602 bytes).
• SHA-256: 2ddb2571325e0d99f5559efd1ba3164845ffba64767833d4e5ad8d2925aedfb5.
• Gitea #55 native attachment: asset 36, uploaded through the issue attachment API.

The Gitea copy was uploaded as an ordinary issue attachment. No repository PNG or LFS raw URL is claimed by this evaluation.

Release Use

The #55 source and native feature-level acceptance record is complete. A future production candidate must still rerun these workflows from the exact nominated commit; this record does not nominate a candidate or establish production readiness.