Owned recipes only; fixture, contract and parent native plan remain in the containing preparation directory under their separate owner. No staging, evaluator, compiler or GUI was executed. Python AST and PowerShell parser checks passed. Copy these recipe files into a NEW final native root before staging; do not execute them from the preparation location. capture.js derives its root from its loaded module URL.

Admission and immutable preparation

Final source pin must be supplied through admission JSON only after successful identified gates. Parent reports candidate17f1f89fef4a6bf520f4b09a2116548b967d030e in final-03 gates; this preparation does not infer a pass. Earlier bfc259 final-01 failed test compilation. Candidate4fbdf6f final-02 recorded1,215passed/1failed/6ignored: the failed assertion incorrectly expected the prior app.layer although existing RevealInDiagram normalizes to diagram.layer. The test-only correction retains the eight-case matrix/full-Project checks and adds selected_node; no production change is attributed to these two gate repairs. Both failed attempts remain separate evidence. stage.py requires:

approved_for_staging=true, source_commit full40hex and repo clean at that exact HEAD.
gate_summary file record {path,bytes,sha256}; final summary must expose source_commit/passed/inputs_unchanged/outputs and six steps toolchain,cargo-version,desktop-tests,desktop-clippy,desktop-build,evaluator-build.
gate_receipts array of exact raw records: source_manifest, environment, relocation, each step result/orchestration log/output log/context/inputs-before/inputs-after/changes.patch, and original run.py bound by those results. Include env.ps1/config/environment dependencies needed for eventual portable evidence. Stage verifies fixed required argv in both summary and raw results, resolved result cwd equals the admitted repository, every context key equals its result value, current raw source matches tested inventory and every per-command inventory matches it; no dirty/untracked source admitted.
artifacts map with exactly arcadia-studio.exe, attachment_snapshot.exe and libunwind.dll records. Executables must match final summary outputs and come from preserved artifact paths outside target; runtime SHAaa282fa47bb2c4e210cea5e470cdbdca58568f0be0bc73e404d86ab9cd95ef6a.
baseline record of the finalized fixture JSON; placement_contract record of finalized placed-node.contract.json; native_plan record of finalized parent/fixture-owner README. Bind exact hashes after owner review, not this draft's mutable paths.

Invocation after authorization: python FINAL_ROOT/stage.py --admission FINAL_ADMISSION.json.

Stage copies all admitted raw records and artifact bytes without rewriting them, retains path/relocation mappings, maps exact raw tracked source to Git blob IDs, and invokes ONLY attachment_snapshot. It produces canonical full baseline B, inserts a validation-only reserved UUID into a clone with the declared node/target position, validates that whole Project, fixes the canonical node shape before launch, and freezes B plus P-template, catalog, contract, plan and recipes. Empty port_anchors omission is the only permitted template normalization; other node fields cannot be learned from native output. There is no geometry probe/build or observed-output oracle. Final plan plus this README select the fixed import/save workflow below.

Fixed initial Open and Save workflow

The desktop treats JSON as an imported Legacy model. A .arcadia path instead goes through source_files, and existing JSON destinations cannot be overwritten by Save. Renaming JSON to .arcadia is therefore invalid.

Stage creates immutable baseline/B.input.json and working/import.json. It preregisters working/traceability-trial.arcadia as absent; first launch refuses if that source path already exists. Root opens working/import.json through native UI, then uses Save As to create working/traceability-trial.arcadia BEFORE placement or checkpoint00. Checkpoint00 must parse that source and equal full B. Subsequent editing, Save, Undo/Redo and fresh reopen use that source path.

First launch receipt records the actual import file before the process. Normal-close receipt records the saved source; subsequent launches begin from that saved-source record and chain to prior bound close. If the first process never creates source, closure recording fails explicitly and must be investigated. capture helper records its working_source_path: saved source when it exists, otherwise the import JSON. This hash describes the known file, not independent proof of which model is open; observed native path and complete-Project checkpoints provide that evidence.

pwsh -File FINAL_ROOT/launch.ps1 -Run 1 uses child-only private profile and package/System32 runtime PATH, with no global environment changes. Fresh run directories are create-new. Default run observer records bound PID/start, before/after source hashes, recipe/manifest hashes, exit/logs and prior close. Initial fresh-node binding may be created during Run1; if one already exists before a later launch its bytes must remain unchanged through close. No normal-exit result alone proves close cause or UI acceptance.

One-time parameter binding

Contract target=(500,350), fixed abs error<=1 per axis. Before the placement click, root must record a create-new calibration JSON with declared_utc, target={x:500,y:350}, maximum_absolute_error_per_axis_world_units=1, canvas_mapping (actual measured transform/evidence), physical_pixel_scale, chosen_integer_pixel={x:integer,y:integer}, predicted_error_bound_world={x:finite0..1,y:finite0..1}. This is a pre-input measurement record, not permission to widen the contract after output. Timestamp and fields alone cannot prove operator timing; native observation independently confirms it.

After baseline Save/check, run first placed checkpoint:

python FINAL_ROOT/check.py --expected P --calibration PRE_INPUT_CALIBRATION.json --output-prefix FINAL_ROOT/runs/run-01/checkpoints/01-place

The checker copies the saved .arcadia immutably, evaluates it, requires exactly one added Node key in the target view, canonical fresh UUIDv4 absent from all baseline UUID values/keys, matching Node.id, and finite x/y inside the fixed box. It substitutes ONLY those three values into the prelaunch complete P-template and compares the entire actual Project. All other fields/identities/diagrams/traces/semantic maps must match. No global ID normalization or field stripping.

Only after full equality and immutable rechecks pass does it write the checkpoint receipt then create-new fresh-node-binding.json with exact UUID/x/y, signed errors, position rule, calibration/catalog/manifest/evaluator/input hashes and the first receipt hash. A failed first check creates no binding. Later P checks require exact existing UUID/x/y without tolerance and validate that binding against the first accepted receipt. B checks require the exact complete baseline; they do not remove or reset the binding. Baseline/redo/reopen invocations use --expected B/P and a new output prefix. Default --actual is the saved source path; a deliberate supplement may pass another .arcadia source but must be predeclared separately.

Capture helper: set globalThis.traceabilityRunRoot to the current bound run and call captureTraceability(name,note,freshSkyState). It preserves all supplied JPEG/PNG bytes and metadata and refuses repeated names. It does not prove screenshot freshness/window ownership itself. Freeze capture/helper imports with the final native root; preparation imports are not evidence.

Remaining review and limits

Parent must supply final successful gate/admission hashes; fixture-owner plan must incorporate the approved Save As workflow and calibration rule; then stage B/P canonicalization must actually pass. Do not alter expected node fields after observing a mismatch. Preserve failed stages/checkpoints and use fresh directories for repairs. Review the generated P-template and contract before GUI launch. Native trace-line expectations derive from explicit fixture traces and existing projection behavior, not a newly invented geometry evaluator. Existing tests establish semantic Exchange-trace validity; the omission of relation-to-relation trace lines is source-derived in the prior audit, not directly asserted by those tests. Generic ordinary-exchange hide tests likewise do not alone establish a specifically hidden-trace case. Full Project equality proves persisted changes; UI task comprehension, trace visibility, normal reopening and held-input behavior need their separately bounded observations.

Admission assembly helper (prepared, not run): after final PASS, parent may invoke python .local/traceability-view-native-admission-20260923.py --source-commit 17f1f89fef4a6bf520f4b09a2116548b967d030e --gate .local/traceability-view-gates-20260923/final-03 --output .local/traceability-view-native-17f1f89-20260923-02. It performs read-only gate/command/context/source/config/artifact checks before creating the new root, then copies exactly six recipe files and writes admission.json. It never invokes stage.py or any executable. Failed attempt histories belong in the later evidence archive, not successful-stage admission. Parent still reviews admission then explicitly invokes stage.py after successful gates.

Save As preparation correction: the entry basename traceability-trial.arcadia is deliberately distinct from the included traceability.arcadia module. The first frozen native root .local/traceability-view-native-17f1f89-20260923 remains retained as a failed preparation workflow: its declared entry collided with that included filename. Use a new native root for the corrected recipe; do not edit the earlier manifest or receipts. See .local/traceability-view-save-as-refusal-20260923.md for observation limits.