> ## Documentation Index > Fetch the complete documentation index at: https://docs.comet.rpamis.com/llms.txt > Use this file to discover all available pages before exploring further. # Native safety and recovery > Understand shared Guard routing, stale evidence, concurrent conflicts, transaction recovery, repair stops, and Ambient Resume. Native uses two complementary safety layers. The Skill guides the model through requirement and phase protocols; the Runtime enforces deterministic state, evidence, and transaction invariants. A prose Rule alone is not an unbypassable state machine. ## One write belongs to one change Project initialization installs one Comet workflow Rule per platform and only one `comet-hook-router.mjs` on platforms with Hook support. The Router reads `.comet/config.yaml` and `.comet/current-change.json`, then sends one atomic multi-file write to at most one workflow Guard. Native and Classic Guards remain independent: * Native checks only Shape, Build, Verify, Archive, and Native paths; * Classic checks its five phases and OpenSpec/Superpowers paths; * invalid, stale, or ambiguous selection causes potential writes to fail closed; * explicitly recognized read-only tools do not trigger a write Guard. This boundary reduces accidental writes and double blocking. For shell commands, external processes, or writes a platform does not expose to Hooks, the Native Runtime's state and evidence checks remain the final authority. ## Why verification evidence becomes stale The Runtime binds verification conclusions to: * the brief and complete target specifications; * project artifacts in the implementation scope; * Acceptance IDs and an immutable report snapshot; * the current change revision; and * an optional built-in check receipt. Changing any input marks old evidence stale. If the change occurs during Verify, status returns a controlled summary-only `next`. Run it to retreat to Build, generate a new scope, and verify again. Reconfirm with the user only when the brief/spec contract hash also changed; preserve the existing approval when only the project snapshot or implementation changed. Drift in a report, receipt, or another bound Archive fact uses the same retreat protocol. Never delete findings, edit evidence refs, or reuse the old pass. The Native Runtime invokes Git only in Git projects to create a bounded Git-aware snapshot. `comet native check` is a separate built-in bounded read-only text-hygiene scan. It invokes no Git, shell, test command, external Skill, or other external process and does not replace project tests. ## Baselines and schema migration A new change must obtain a complete baseline before committing state. A Git snapshot includes only tracked and non-ignored untracked files, treats each submodule/gitlink as one atomic entry, and excludes ignored caches and contents of unregistered nested repositories from the project-owned set. An incomplete current snapshot never turns a missing path into a deletion. For a change already using the v3 schema, a missing or incomplete baseline is not an automatic doctor repair. Rebuilding from current files would erase historical differences since creation. Restore the original baseline from a trusted backup, or preserve the brief/specifications and implementation facts while creating a new change. Explicit v1/v2 schema migration is the sole cutover exception. Before any state write, `doctor --repair` captures a complete baseline at the migration timepoint. An incomplete capture leaves the old state unchanged. Post-migration evidence proves only changes after the cutover and cannot inherit an old scope or pass. An old Verify/Archive change retreats to Build to establish fresh v3 evidence. ## Autonomous repair does not loop forever A Verify failure returns to Build. The Runtime builds a failure signature from categories, check IDs, the contract, and implementation scope: * the third identical signature on the same scope becomes a manual stop; * a real implementation-scope change opens a new repair episode; * one no-progress override is available and is bound to the current signature; * one episode records at most 12 failures. The stop condition measures evidence of progress rather than simply counting phase transitions. ## Concurrent specification conflicts Several Native changes may exist in parallel, but safety for the same canonical specification has a precise boundary. Archive compares the `base_hash` frozen by the Runtime in Shape with the current canonical hash. A mismatch stops instead of applying last-write-wins. Recovery is: 1. read the latest canonical specification; 2. rewrite the change's complete target specification; 3. run `comet native spec rebase --summary `; 4. repeat Build and Verify; and 5. run the two-step Archive again. The conflict radar reports capability overlap and scope signals provable inside the current Native root. It does not claim knowledge of arbitrary external branches or untracked parallel work. ## Transaction and lock recovery Phase transitions, checkpoints, Archive, and root moves have explicit journals or recovery protocols. Ordinary writes never take over a stale lock on their own. Only `doctor --repair` can do so after proving the local owner no longer exists, lock identity is unchanged, and no conflicting transaction exists. ```bash theme={null} comet native doctor [] comet native doctor [] --repair comet native doctor [] --repair --strategy continue comet native doctor [] --repair --strategy rollback ``` * ordinary phase transitions can only continue; * Archive and root moves can roll back only while the journal is still reversible; * after Archive's final marker, only exactly-once continuation is allowed; * Doctor never rewrites a user's brief, specifications, verification report, or project source. ## Ambient Resume `comet resume-probe` is read-only. It resolves the default workflow from `.comet/config.yaml`, then inspects only that side: | Result | Meaning | | -------------- | ---------------------------------------------------------------------- | | `auto_resume` | One target matches a request to continue; resume through `nextCommand` | | `ask_user` | Several candidates or unclear ownership require one short choice | | `out_of_scope` | The request should not enter a resumable workflow | | `none` | No change can be resumed | Damaged configuration or workflow state makes the probe stop with a reason instead of scanning another directory and guessing. `ambient_resume: false` disables automatic probing for ordinary requests; an explicit `/comet` call still works. ## Dashboard responsibility Dashboard reads the Runtime projection to display phase, evidence freshness, continuation, structured findings, conflict summaries, and archive readiness. It neither re-derives facts nor offers write actions for progression, repair, or Archive. CLI and Runtime remain the only writers. For parallel requirements, see [Multiple changes and specification conflicts](/en/native/multi-change-and-conflicts). For interruptions, cross-device discovery, or transaction problems, see [Recovery and troubleshooting](/en/native/recovery-playbook). For individual commands and exit semantics, see [Native CLI](/en/cli/native).