Adapted from the State native evidence package. Python standard library only; neither preparation nor verification runs any GUI, checker, archived helper or binary.

From a checkout, validate explicit closed runs:

python -B prepare.py --root C:/ar-multiselect-9e8r6t --runs run-1 --check-only
python -B prepare.py --root C:/ar-multiselect-9e8r6t --runs run-1 run-2 --output FRESH_DIRECTORY
python -B FRESH_DIRECTORY/verify.py

The output directory must not exist. Run-2 is an example, usable only after its finished.json exists. Explicit names prevent accidental capture of a live run. No run is automatically accepted. Run-1 always retains reviewStatus: failed: Back exposed the outer reference's editable Properties while highlighting the qualified tile; reorder and history were not performed. Later runs are unreviewed by this tool even if independently accepted in the parent's report.

The archive retains every run file byte, exact prepared helpers (including common.py and README.md), the actual capture-executed.js separately, complete fixture/working/snapshot source, screenshots and accessibility JSON, logs, normal-exit/closure flags, and history-bytes.json when present. The executed capture function is preserved and package-pinned; the preparation receipt does not authenticate it as the same bytes as the prepared capture.js template.

Both GUI and checker build raw receipts, process/start metadata, logs, complete input maps and source ZIPs are archived. Source maps/ZIPs are deduplicated by exact hash. The historical checker source is also directly available. Helpers must match recorded pins; use repeated --helper PATH for unavailable historical versions. Never rewrite original capture helpers to make pins pass.

Verification checks safe unique ZIP paths and JSON keys, all member hashes, reference closure, lifecycle/time relationships, exact prepared helpers, source-map equality, every source-capsule byte, executable receipt identity, artifact membership in raw Cargo output, all snapshot reports, and literal history bytes if present. Nonzero native/checker exits are retained as data; missing closure or inconsistent receipts refuse packaging. A successful receipt consistency check is not a claim that native interactions succeeded.

The verifier does not authenticate authorship, independently replay the checker, interpret screenshot contents, verify pixel dimensions, infer click/drag/focus actions, prove one-step history, or establish usability/native acceptance. Input hashes establish recorded consistency, not a reproducible-build proof. Binaries are identified by build readback pins and native receipts, not included or run. Independent parent review remains necessary. Failed checker output is preserved verbatim and not required to be a positive JSON report.