# Executable recovery evidence

Codex, 2026-09-25; baseline `d7b2ea4`. Scope: one published SDK implementation under
a controlled transport. [Experiment](../experiments/matrix-recovery/README.md),
[source](../experiments/matrix-recovery/experiment.mjs),
[results](../experiments/matrix-recovery/result.json), and
[provenance](../experiments/matrix-recovery/provenance.json) are retained.

## Findings and disposition

X01: Loss of a response after simulated acceptance leaves content in an SDK pending
event labelled NOT_SENT. Resending that event preserves path, payload and transaction
identity. This is executable evidence for client retention/retry behavior; duplicate
prevention on a real server is not established because the receiver is synthetic.

X02: The SDK blocks a fresh send while a failed event is pending. After explicit
local cancellation, a new identity for the same content produces a second fixture
acceptance. Keep that queue guard in the description; omitting it would overstate
how readily the client creates a duplicate. Cancellation is not remote rollback.

X03: When a matching remote event arrives first, both later success and later
transport failure leave one reconciled timeline entry. In the failure case the
send promise still rejects. Therefore a caller cannot derive domain acceptance
solely from that promise's result. This directly exercises the evidence-precedence
requirement proposed in VC-01.

X04: Element's pinned lockfile resolves the exact SDK commit previously inspected.
This closes the source pairing question from FrontendRecoveryImplementations. It
still does not prove a deployed build, and the runtime experiment deliberately
uses a separately pinned published SDK version, not that source checkout.

## Effect on the language

Retain eight drafts. Strengthen Mutation Outcome Tracking with attempt/domain
separation and explicit cancellation semantics; no new pattern is needed. Use the
experiment as one partial implementation observation, not a second independent
use alongside Element (same family). Local Draft State's complete merge contract,
VC-02 durability, frontend accessibility and baseline usefulness remain unverified.

No llm-connect call was needed: these findings come from executable assertions and
source/lockfile inspection. This is a narrow increase in empirical evidence, not
canonical admission or M1 completion.

## Next bounded comparison

Under T03, prepare matched tasks for an independent reviewer: same context and
information budget, pattern labels available in one condition and plain narrative
in the other. Score missed constraints, unsupported guarantees and correct recovery
choices; do not score use of preferred names. Counterbalance order and freeze the
corpus before drafting unseen variants. Until a reviewer completes that comparison,
decision usefulness stays unknown.

Under T02, keep the real client/server lost-response experiment open. This harness
reduces uncertainty about SDK behavior but intentionally does not validate server
deduplication, browser storage or a full Element deployment. Select a local disposable
server only if those server guarantees become the next question; no production
deployment is part of this research cycle.

Validation: a fresh `npm ci --ignore-scripts` installation from the checked-in lock
reproduced all four results and loaded SDK hashes exactly. The 35 existing repository
tests passed; local links and staged whitespace were checked. The four experiment
cases are additional SDK assertions, not frontend end-to-end tests.