Promote unstable → stable: Evidence Core, standards validation & operator interactions

[mberrys]

Promotion summary

Promote the current unstable train into stable: independent, final-byte standards validation; Evidence Core record/fence repairs; typed Interaction operator state; preflight finding navigation and accessibility; cross-adapter receipt parity; and actual Select/Hand/page-box drag behavior. This is a promotion of accumulated work, not one isolated feature and not a claim that the 0.3.0 milestone or all independent qualification gates are complete. Core remains the authority for PDF inspection, verdicts, correction constraints and publication; an editor tool or an external validator does not become a second authority.

Measured PR scope: stable (c352e98341a5db5ec9a81b54e128a2788aa3672c) → unstable (072a300afc24472df4fb054c647a6beeafb8d14d): 35 non-merge commits (50 commits including 15 merges), 118 changed files, +8,004 / −692 lines. The base is the actual promotion base, not an assumed version tag.

Added

• L02-01 — Define typed DocumentFacade state #22 — Host-neutral operator snapshot. DocumentFacade exposes revision-bound document/inspection state, Core verdict and coverage, selected finding, intended correction, cancellation and errors. State transitions reject absent, stale and terminal requests before publishing operator-visible results.
• L02-05 — Prove adapter parity over one receipt #26 — One-receipt cross-adapter acceptance. Shared operator fixtures compare the same Core preflight receipt as presented through EditorHost, the isolated preflight worker and PdfTool, including finding IDs, verdict, coverage, limitations and corrective intents.
• Select and Hand toolbar buttons are checkable placeholders with no behavior #103 — Working Select/Hand tools. Define a closed interaction-tool vocabulary, make Hand drag pan and Select retain selection/drag semantics, wire the Quick toolbar to EditorHost::activeTool/setActiveTool and reject unknown tool values at the host boundary.
• Completed drags are discarded: EditorHost::onDragCompleted drops the DragSession #104 — Page-box drag command and correction. A completed, revision-fenced box drag now feeds actionMoveSelection (108 shell actions), proposes the translate-page-box Core repair in the Fix workspace, and enforces valid page-box nesting. Execution uses the normal plan/approval/new-artifact path; the translate-page-box recipe must be imported—no built-in recipe is shipped.

Changed

• L01-04 — Prove independent standards and rendering claims #18 — Standards conversion is prepare → serialize → validate final bytes → publish. Standard-conversion requirements propagate through repair transactions, Action Lists, PdfTool and PageMaster; independent validator results are bound to the exact candidate artifact and recorded with the output. standards-convert is version 2 and requires validation_contract: 2.
• L02-02 — Navigate stable findings to source region #23 — Stable finding navigation. Selecting a current finding navigates to the reported page region and exposes the effective profile, document revision and evidence coverage; findings from replaced documents cannot navigate into the new revision.
• L02-03 — Model cancel, retry, and reopen transitions #24 — Cancellation/retry/reopen identity. Cancelling a document operation becomes terminal for that request. Retry cause and request identity remain explicit; completion after cancellation, replacement, reopening or host teardown is fenced out.
• L02-04 — Expose accessible operator semantics #25 — Accessible preflight semantics. Quick presents focusable verdict, limitations, selected-finding and job information, announces status changes, and explains unavailable actions. The native/software accessibility smoke fixtures cover the resulting operator state.

Fixed

• L01-04 — Prove independent standards and rendering claims #18 — Serialization and publication correctness. The writer emits the PDF binary-header marker and separates indirect-object endobj correctly (real veraPDF findings). Final-artifact validation precedes atomic publication; published byte identity is checked against validated bytes, and cancellation can stop commit.
• L01-04 — Prove independent standards and rendering claims #18 — PageMaster resume cannot recycle compliance evidence. Standards conversion on resumed exports re-runs the pipeline and clears prior independent, governed and Action List evidence, including when the destination already exists or changes. Ordinary non-standards resume behavior remains.
• L02-03 — Model cancel, retry, and reopen transitions #24 — Cancelled-write retry race. A write retry is refused until the prior cancelled worker has actually stopped, rather than allowing a late worker completion to race the retry.
• Select and Hand toolbar buttons are checkable placeholders with no behavior #103/Completed drags are discarded: EditorHost::onDragCompleted drops the DragSession #104 — Editor tool/drag consistency. The Interaction controller is the active-tool source of truth; completed drags are no longer silently dropped, and unknown page impact for translate-page-box is conservatively classified as document-wide.

Security

• L01-04 — Prove independent standards and rendering claims #18 — Fail closed on unproven standards claims. PDF/X conversion refuses to claim compliance without an available independent PDF/X oracle; PDF/A validation uses tool-specific independent reports. Older evidence and generated golden files are not accepted as qualification. Recheck and final-byte identity gates prevent stale validation from being carried onto new artifacts.
• L01-01 — Pin reset truth and evidence obligations #15/L01-03 — Fence scheduled and worker results #17/L01-06 — Audit untrusted PDF process isolation #20 — Fencing and isolation boundaries are explicit. EditorHost fault-injection tests reject corrupted completion identities; the untrusted-PDF worker audit inventories twelve remaining in-process routes as reviewed deferrals, not as proof that those routes are isolated. Do not infer unconditional worker isolation from this promotion.

Internal

• L01-01 — Pin reset truth and evidence obligations #15/L01-03 — Fence scheduled and worker results #17/L01-06 — Audit untrusted PDF process isolation #20/G00-01 — Re-home legacy issue provenance after the repository rename #111 — L01 evidence/provenance reconciliation. Refresh the Evidence Core reset inventory, correct a backlog digest, bind open rows to live trackers, distinguish legacy issue provenance, and record source-backed worker-route dispositions and completion fences.
• L01-04 — Prove independent standards and rendering claims #18 — Reproducible independent qualification tooling. Add pinned-oracle installation, report parsing, fixed Ghostscript separation/image comparisons, immutable-source/corpus-linked Windows and Linux reproduction packets, packet-integrity verification, attribution, claim/schema inventories, and a dispatchable cross-platform qualification workflow.
• Completed drags are discarded: EditorHost::onDragCompleted drops the DragSession #104 — Architecture decisions and catalogs. Add ADR-012 for drag-to-command ownership; update the page-master, interaction, shell and generated action/repair catalogs. Extend native regression, acceptance and accessibility smoke coverage for the affected paths.

Release-admission limitations and references

• Refs L01-04 — Prove independent standards and rendering claims #18: The documented local/hosted independent runs prove expected validator outcomes and reproducible packets, not general renderer correctness. The review records seven separation coverage gaps and three fixed-tolerance failures. No successful independent rendering qualification for this promotion SHA is asserted.
• Refs L01-06 — Audit untrusted PDF process isolation #20: Source audit and reviewed deferrals are not equivalent to isolating every untrusted in-process PDF route.
• Refs Completed drags are discarded: EditorHost::onDragCompleted drops the DragSession #104: Only an imported translate-page-box recipe permits execution; no built-in recipe is provided.
• No new issue closure is asserted solely by this promotion. Preserve each issue's own acceptance/evidence decision rather than treating merged commits as release admission.

Verification

• Exact promotion head: 072a300afc24472df4fb054c647a6beeafb8d14d. New or currently running CI checks are not marked passed here. A merge decision must inspect the completed per-lane results and any skips against this exact SHA.
• Native and contract coverage added: UnitTestsStandardOracle, UnitTestsConversionOracle, repair/Action List/PageMaster, UnitTestsDocumentFacade, finding navigation, editor/interaction, Quick, product-operator loop, preflight and accessibility smoke suites; qualification-script tests and source/trust-contract gates. The presence of tests is not a claim they all ran green at the promotion head.
• Issue L01-04 — Prove independent standards and rendering claims #18 historical evidence: docs/INDEPENDENT_QUALIFICATION_REVIEW.md records a passing mapped 68-target local gate on earlier implementation snapshots and source-bound Linux/Windows reproduction. The independently measured rendering mismatches intentionally fail qualification; prior packets do not automatically qualify this later head.
• Required before admitting release claims: finished Linux/Windows build/tests and security checks; independently sourced, source-bound artifacts for both platforms; no concealed skipped/failed required lane; and an explicit reviewer disposition of every rendering and worker-isolation limitation.

Breaking changes

Yes — standards-convert recipe contract. standards-convert v2 requires validation_contract: 2. Migrate existing v1 recipes before they are submitted; historical v1 evidence does not qualify newly produced artifacts. No further persistent-format or public-API break is claimed here without separate evidence.

Rollback and quality

Rollback is to stop/revert this unstable → stable promotion before publishing dependent releases; retain the previous stable SHA and avoid running v2-only recipes on older binaries. Do not downgrade the evidence contract to make validation appear green.

The change keeps revision/cancellation, artifact identity, parser boundary, provenance and fail-closed validation checks rather than suppressing them. Docs, ADRs, evidence fragments and generated catalogs are included. A separate delayed diff self-review and final head-specific acceptance remain reviewer obligations.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}