# Saved-destination repair union — 2026-09-12

Source `33e30c1` on `codex/canvas-union-ytr83r-20260911` combines the a57 canvas and cb91525 grapheme corrections with a narrow saved-destination repair from peer `33c6d83e9ba9a5b1310b1b627d7c40affcbcf15c`. Independent review found no actionable correctness finding. Windows focused repair **5**, full desktop all-targets **761**, strict desktop all-targets Clippy and GUI build passed; the five are included in 761. Matching bounded native repair/history/recovery, Unicode selection/passive-save and packaged GUI/server acceptance now passed. Release publication is a separate subsequent step. [Artifact hashes and completed validation](release-canvas-repair-validation-20260912.md) links exact evidence. [STATE](STATE.md) scopes earlier evidence and platform limits; [issue 6](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/6) and [native/release issue 5](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/5) retain live coordination.

Opening an invalid second destination retained the previously accepted Document and its old saved baseline. Repairing that destination to the old accepted bytes could make Apply an identical-content no-op and falsely appear clean, bypassing the intended unsaved Close/New/Open protection even though the destination still contained invalid bytes. The correction binds saved authority to the actual destination's reachable disk bytes. An unknown baseline after successful recovery with failed reload remains dirty. Recovery of a former Save As target cannot replace the current destination's baseline. Current model, revision and Undo/Redo history remain intact; successful Save establishes the new exact baseline.

The integration changes only `app.rs`, `document.rs` and the new `app/repair_save_state_tests.rs`. It imports the saved-baseline behavior and five regression tests, without peer navigation changes. The passing tests distinguish identical-content repair, exact disk state and Close/Cancel; Undo/Redo and external-write conflict; equal content at separate destinations; real journal rollback; and current/former destination authority after missing-entry rollback or an explicitly injected reload failure. They do not establish native chooser/close-dialog behavior.

The frozen manifest `.local/repair-union-windows-20260911/inputs.json` has SHA256 **0F21B9A852CF44699BF29FCE0A35EC460744C85F5E26F0EA4920E8568211E312**, covering **530 files / 9,727,025 bytes**. Root verified all frozen bytes against source `33e30c1` HEAD. The manifest's earlier `0d39d58` baseline identifies capture provenance, not the final source commit. The [verbatim independent review](release-saved-destination-independent-review-20260912.md) likewise records the precommit dirty candidate; its three source hashes are the reviewed integration identity. Its byte-exact copy has SHA256 **96F56D781FEF4B0A1A5053D2FF889668DB32A8A3B9F01AAB967CE3C93676ACA6**.

The [closed Windows archive](experiments/repair-union-windows-33e30c1-20260912/README.md) contains complete logs, exit-zero status receipts, environment and exact-input verification before each gate and after the final build. All 530 frozen files remained unchanged; after the same-byte source commit, each boundary also verified HEAD. The unoptimized GUI is **113,049,088 bytes**, SHA256 **504862533CAAD919912E40C89BED4B1E43BA98138C42085480602A0A21FFF658**, preserved read-only with its required `libunwind.dll` and source/copy hash agreement. Exact commands, timings and local artifact provenance are in the [gate report](experiments/repair-union-windows-33e30c1-20260912/REPORT.md) and [binary manifest](experiments/repair-union-windows-33e30c1-20260912/binary-manifest.json). The archive contains no executable, DLL or source ZIP.

Matching native repair → Apply identical bytes → Close/Cancel → Save passed, including exact original/new destination comparisons and separately saved graphical Undo/Redo. A prepared real journal rollback retained the current model as unsaved and saved correctly on retry. Accent/ZWJ and wide Latin/CJK selection/passive-save checks, packaged example/help smoke and normal GUI exit0 passed; all559 package files remained unchanged. Long wide labels can remain clipped. Fresh extracted server25-request editing/persistence checks also passed. [Native evidence](experiments/canvas-repair-native-33e30c1-20260912/README.md), [producer/extraction](experiments/canvas-repair-package-33e30c1-20260912/README.md), [server evidence](experiments/canvas-repair-server-33e30c1-20260912/README.md). These completed bounded checks do not establish full-product acceptance or publication. Earlier cb91525 four focused tests, desktop 756 and Clippy are [closed evidence](experiments/grapheme-windows-cb91525-20260911/README.md); its planned GUI build was superseded. The four tests are included in 756, not additional coverage.

Earlier a57/69DB staged native checks passed 13 oracles across 45 screenshots at the default wide window: Cancel, three source/consumer creation workflows, saved Undo/Redo and actual reopen. [Exact archive](experiments/staged-source-native-a57c334-20260911/README.md), [independent review](release-staged-native-a57-independent-review-20260911.md). A separate fresh a57 session then covered OA 100%/125%/Fit, resizing to a reported 1100×700 client (1102×732 captured frame), minimum Fit66, OA leftward and SA upward pan with moved Create/Delete selection identities, and bounded card/capsule/viewport clipping without toolbar bleed. Passive Save preserved all identities, fields, reachable source and physical bytes: exactly two files / 20,214 bytes. The bound process exited normally with code 0 and empty stdout/stderr. [Camera evidence](experiments/canvas-camera-a57c334-20260912/README.md), [verbatim independent review](release-camera-a57-independent-review-20260912.md).

At 66% the labels are visibly small; the camera record does not establish general readability, accessibility, complete focus/keyboard behavior, every zoom or every clipping edge. Exact inputs and client geometry are root's account; the 18 images independently support final states. The [earlier picker failure and close](experiments/canvas-native-close-a57c334-20260911/README.md) remain separate historical evidence. These pre-grapheme a57/69DB results do not establish `33e30c1`/50486253 native or package acceptance. Linux remains paused by explicit user instruction, and the full user goal remains incomplete.